From 2f4ce3867788f2c5fab646e9c9c2052aa44e0811 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sat, 3 Oct 2026 18:27:58 -0700
Subject: [PATCH 01/55] Reserve HTTP listeners throughout SSH publication
 fixtures

The SSH publication fixture selected a port by binding and immediately
closing it, then asynchronously initialized a server before binding again.
A competing listener at that real call site reproduces AddrInUse. Retain
the original bound listener and hand it to the existing supervised startup
API for initial startup and every restoration in this fixture family.

Assert that another binder cannot claim the fixture port before handoff.
All original refusal, disconnect and cold-preparation scenarios pass in
the 105-case multi-server rerun. No bind retries or deadline changes.
---
 .../tests/multi_server/ssh/publication.rs     | 28 +++++++++++++------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/crates/canopy-server/tests/multi_server/ssh/publication.rs b/crates/canopy-server/tests/multi_server/ssh/publication.rs
index 1910a6a2..aa9c8697 100644
--- a/crates/canopy-server/tests/multi_server/ssh/publication.rs
+++ b/crates/canopy-server/tests/multi_server/ssh/publication.rs
@@ -20,10 +20,16 @@ async fn fixture() -> Result<Fixture> {
         ssh_key::private::Ed25519Keypair::from_seed(&[12; 32]).into(),
         "test",
     )?;
-    let address = available_address().await?;
-    let server = CanopyServer::start(
+    let listener = TcpListener::bind("127.0.0.1:0").await?;
+    let address = listener.local_addr()?;
+    // Retain the advertised port across asynchronous startup; another test
+    // must not be able to claim it between address selection and serving.
+    let competition = TcpListener::bind(address).await.unwrap_err();
+    assert_eq!(competition.kind(), std::io::ErrorKind::AddrInUse);
+    let server = CanopyServer::start_with_listener(
         server_config(address, workspace.path().join("server"), &host)?,
         store.clone(),
+        listener,
     )
     .await?;
     create_repository(address, "publication").await?;
@@ -192,10 +198,12 @@ async fn late_ssh_push_refusals_report_both_refs_and_survive_restore() -> Result
         assert_eq!(generation(&client, address).await?, before);
         server.shutdown().await?;
 
-        let address = available_address().await?;
-        let restored = CanopyServer::start(
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let address = listener.local_addr()?;
+        let restored = CanopyServer::start_with_listener(
             server_config(address, workspace.path().join("restored"), &host)?,
             store,
+            listener,
         )
         .await?;
         let ssh_address = restored.ssh_addr().ok_or("SSH listener missing")?;
@@ -303,10 +311,12 @@ async fn disconnected_ssh_push_finishes_publication_before_shutdown_releases_cel
     store.proceed.notify_one();
     tokio::time::timeout(Duration::from_secs(20), draining).await???;
 
-    let address = available_address().await?;
-    let restored = CanopyServer::start(
+    let listener = TcpListener::bind("127.0.0.1:0").await?;
+    let address = listener.local_addr()?;
+    let restored = CanopyServer::start_with_listener(
         server_config(address, workspace.path().join("restored"), &host)?,
         store,
+        listener,
     )
     .await?;
     let ssh_address = restored.ssh_addr().ok_or("SSH listener missing")?;
@@ -341,10 +351,12 @@ async fn cold_ssh_push_preparation_failure_reports_rejection_before_any_refs_cha
     } = fixture().await?;
     git(Some(&source), &ssh, &["push", &url, "main"]).await?;
     server.shutdown().await?;
-    let address = available_address().await?;
-    let restored = CanopyServer::start(
+    let listener = TcpListener::bind("127.0.0.1:0").await?;
+    let address = listener.local_addr()?;
+    let restored = CanopyServer::start_with_listener(
         server_config(address, workspace.path().join("cold"), &host)?,
         store.clone(),
+        listener,
     )
     .await?;
     let ssh_address = restored.ssh_addr().ok_or("SSH listener missing")?;

From 2888af5589d97cf4068a3f1c4ec838549ea5f88d Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sat, 3 Oct 2026 18:29:08 -0700
Subject: [PATCH 02/55] Gate deployment and workspace access on packed storage
 format

Reuse the existing root purpose and ETag reservation in a bounded
canopy-pack-v1 envelope. Reject unversioned or unknown remote formats
before workspace reclamation, probes, identity writes or Cell activation.
Reuse the owner/worker fences with the new managed runtime directory;
reject and retain legacy local state. Include the boundary in release
source hashing and update affected fixtures and harness paths.

Local hard-cutover work only: the old production Git schema and command
registry still require conversion with every producer and reader before
this branch can be released. No legacy decoder or migration is added.

Validation: 661 unique workspace Rust cases, 8 isolated RustFS cases,
96 Python harness cases, warnings-denied all-target Clippy, formatting,
doctest completion, and server build. Original red format regressions
and the earlier SSH suite failure are retained separately.
---
 crates/canopy-server/src/deployment/mod.rs    |  8 ++
 crates/canopy-server/src/deployment/root.rs   | 75 ++++++++++++++----
 crates/canopy-server/src/deployment/tests.rs  | 78 +++++++++++++++++++
 crates/canopy-server/src/lib.rs               |  4 +
 crates/canopy-server/src/server/mod.rs        |  3 +-
 .../canopy-server/src/server/workspace/mod.rs | 14 +++-
 .../src/server/workspace/tests.rs             | 49 +++++++++++-
 .../multi_server/peers/cold_activation.rs     |  5 +-
 .../tests/multi_server/peers/mod.rs           |  2 +-
 .../multi_server/residency/faults/mod.rs      |  2 +-
 .../tests/multi_server/residency/mod.rs       |  2 +-
 .../tests/multi_server/retained_catalog.rs    |  2 +-
 .../canopy-server/tests/multi_server/size.rs  |  2 +-
 .../tests/multi_server/workspace.rs           | 49 +++++++++++-
 docs/contracts.md                             | 12 ++-
 docs/delivery-plan.md                         |  2 +-
 .../mandatory-publication-registration.md     |  2 +-
 docs/implementation.md                        |  2 +-
 docs/large-repository-implementation-plan.md  |  2 +-
 .../large-repository-implementation-status.md | 16 +++-
 scripts/benchmark_large_repository.py         |  4 +-
 scripts/smoke_s3_cache.py                     |  2 +-
 scripts/smoke_s3_process.py                   |  2 +-
 23 files changed, 296 insertions(+), 43 deletions(-)

diff --git a/crates/canopy-server/src/deployment/mod.rs b/crates/canopy-server/src/deployment/mod.rs
index 285962dd..ec5282a8 100644
--- a/crates/canopy-server/src/deployment/mod.rs
+++ b/crates/canopy-server/src/deployment/mod.rs
@@ -19,6 +19,14 @@ mod recovery;
 mod root;
 pub use recovery::WorkerConfig;
 
+/// Incompatible repository deployment and local cache format.
+pub const STORAGE_FORMAT: &str = "canopy-pack-v1";
+
+/// Read-only admission before local reclamation, probes or Cell activation.
+pub(crate) async fn validate_service_root(store: &Store, prefix: &Path) -> Result<()> {
+    root::validate_service(store, prefix).await
+}
+
 /// Application-wide admission shared by nodes and offline administration.
 #[derive(Clone)]
 pub struct Deployment {
diff --git a/crates/canopy-server/src/deployment/root.rs b/crates/canopy-server/src/deployment/root.rs
index a6497caf..28e01d9b 100644
--- a/crates/canopy-server/src/deployment/root.rs
+++ b/crates/canopy-server/src/deployment/root.rs
@@ -70,21 +70,74 @@ pub(super) struct RootClaim {
     token: ETag,
 }
 
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct RootEnvelope<P> {
+    format: String,
+    purpose: P,
+}
+
+fn encode(purpose: &RootPurpose) -> Result<Bytes> {
+    if matches!(purpose, RootPurpose::Backup { source, pin, .. } | RootPurpose::Restore { source, pin, .. }
+        if source.len() > 4096 || pin.len() > 4096)
+    {
+        return Err(Error::Backup("root reservation exceeds size limit"));
+    }
+    let body = Bytes::from(serde_json::to_vec(&RootEnvelope {
+        format: STORAGE_FORMAT.into(),
+        purpose,
+    })?);
+    if body.len() > 4096 {
+        return Err(Error::Backup("root reservation exceeds size limit"));
+    }
+    Ok(body)
+}
+
 fn path(root: &Path) -> Path {
     root.clone().join("canopy-root-v1.json")
 }
 
 pub(super) async fn load(store: &Store, root: &Path) -> Result<Option<RootClaim>> {
     match store.get_with_etag_bounded(&path(root), 4096).await {
-        Ok((bytes, token)) => Ok(Some(RootClaim {
-            purpose: serde_json::from_slice(&bytes)?,
-            token,
-        })),
+        Ok((bytes, token)) => {
+            let envelope: RootEnvelope<RootPurpose> = serde_json::from_slice(&bytes)?;
+            if envelope.format != STORAGE_FORMAT {
+                return Err(Error::Backup("unrecognized Canopy storage format"));
+            }
+            Ok(Some(RootClaim {
+                purpose: envelope.purpose,
+                token,
+            }))
+        }
         Err(StorageError::NotFound { .. }) => Ok(None),
         Err(error) => Err(error.into()),
     }
 }
 
+pub(super) async fn validate_service(store: &Store, root: &Path) -> Result<()> {
+    let mut claim = load(store, root).await?;
+    if claim.is_none()
+        && ApplicationIdentityStore::new(store.clone(), root.clone())
+            .load()
+            .await?
+            .is_some()
+    {
+        // A concurrent initializer reserves its marker before its identity.
+        claim = load(store, root).await?;
+        if claim.is_none() {
+            return Err(Error::Backup(
+                "destination already contains an application identity",
+            ));
+        }
+    }
+    if claim.is_some_and(|claim| !claim.purpose.permits_service()) {
+        return Err(Error::Backup(
+            "backup or unfinished restore prefix cannot serve",
+        ));
+    }
+    Ok(())
+}
+
 pub(super) async fn reserve(store: &Store, root: &Path, purpose: RootPurpose) -> Result<RootClaim> {
     if load(store, root).await?.is_none()
         && ApplicationIdentityStore::new(store.clone(), root.clone())
@@ -99,10 +152,7 @@ pub(super) async fn reserve(store: &Store, root: &Path, purpose: RootPurpose) ->
             "destination already contains an application identity",
         ));
     }
-    let body = Bytes::from(serde_json::to_vec(&purpose)?);
-    if body.len() > 4096 {
-        return Err(Error::Backup("root reservation exceeds size limit"));
-    }
+    let body = encode(&purpose)?;
     match store.create_strict_with_etag(&path(root), body).await {
         Ok(token) => Ok(RootClaim { purpose, token }),
         Err(error) => match load(store, root).await? {
@@ -131,14 +181,7 @@ impl RootClaim {
             }
             RootPurpose::Service => return Err(Error::Backup("service root cannot finish a copy")),
         }
-        match store
-            .update(
-                &path(root),
-                Bytes::from(serde_json::to_vec(&next)?),
-                self.token,
-            )
-            .await
-        {
+        match store.update(&path(root), encode(&next)?, self.token).await {
             Ok(_) => Ok(()),
             Err(error) => match load(store, root).await? {
                 Some(current) if current.purpose == next => Ok(()),
diff --git a/crates/canopy-server/src/deployment/tests.rs b/crates/canopy-server/src/deployment/tests.rs
index 26ba872c..17b60658 100644
--- a/crates/canopy-server/src/deployment/tests.rs
+++ b/crates/canopy-server/src/deployment/tests.rs
@@ -10,6 +10,84 @@ type TestResult = std::result::Result<(), Box<dyn std::error::Error>>;
 
 mod retained_maintenance;
 
+#[tokio::test]
+async fn root_reservation_limit_includes_the_format_envelope_before_any_write() -> TestResult {
+    let deployment = fixture()?;
+    let mut purpose = root::RootPurpose::Backup {
+        source: String::new(),
+        pin: uuid::Uuid::new_v4().to_string(),
+        complete: false,
+    };
+    let previous_overhead = serde_json::to_vec(&purpose)?.len();
+    if let root::RootPurpose::Backup { source, .. } = &mut purpose {
+        *source = "s".repeat(4096 - previous_overhead);
+    }
+    assert_eq!(serde_json::to_vec(&purpose)?.len(), 4096);
+    assert!(matches!(
+        root::reserve(deployment.layout.store(), &deployment.prefix, purpose).await,
+        Err(Error::Backup("root reservation exceeds size limit"))
+    ));
+    assert!(
+        root::load(deployment.layout.store(), &deployment.prefix)
+            .await?
+            .is_none()
+    );
+    assert!(deployment.identities.load().await?.is_none());
+    Ok(())
+}
+
+#[tokio::test]
+async fn old_or_unknown_root_format_cannot_initialize_identity_or_release() -> TestResult {
+    for bytes in [
+        br#"{"kind":"service"}"#.as_slice(),
+        br#"{"purpose":{"kind":"service"}}"#,
+        br#"{"format":"future-format","purpose":{"kind":"service"}}"#,
+        br#"{"format":"canopy-pack-v1","purpose":{"kind":"service"},"extra":true}"#,
+    ] {
+        let deployment = fixture()?;
+        let path = deployment.prefix.clone().join("canopy-root-v1.json");
+        let original = bytes::Bytes::copy_from_slice(bytes);
+        deployment
+            .layout
+            .store()
+            .create_strict(&path, original.clone())
+            .await?;
+        let before = deployment.layout.store().get_with_etag(&path).await?;
+        assert!(
+            root::load(deployment.layout.store(), &deployment.prefix)
+                .await
+                .is_err()
+        );
+        assert!(deployment.initialize().await.is_err());
+        assert!(deployment.identities.load().await?.is_none());
+        assert!(deployment.releases.load().await?.is_none());
+        assert_eq!(
+            deployment.layout.store().get_with_etag(&path).await?,
+            before
+        );
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn packed_root_envelope_reuses_purpose_and_is_rejected_by_old_decoder() -> TestResult {
+    let deployment = fixture()?;
+    deployment.initialize().await?;
+    let path = deployment.prefix.clone().join("canopy-root-v1.json");
+    let (bytes, _) = deployment.layout.store().get_with_etag(&path).await?;
+    assert_eq!(
+        serde_json::from_slice::<serde_json::Value>(&bytes)?,
+        serde_json::json!({
+            "format": "canopy-pack-v1", "purpose": { "kind": "service" }
+        })
+    );
+    // The old decoder is exactly the existing tagged RootPurpose type.
+    assert!(serde_json::from_slice::<root::RootPurpose>(&bytes).is_err());
+    deployment.initialize().await?;
+    deployment.require_ready().await?;
+    Ok(())
+}
+
 fn fixture() -> std::result::Result<Deployment, Box<dyn std::error::Error>> {
     let app = CanopyApplication::compile(build_descriptor(
         include_bytes!("../../../../Cargo.lock"),
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index cfa08361..c0021a5f 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -184,6 +184,10 @@ impl CellModule for RepositoryModule {
             source_digest: {
                 let mut source = blake3::Hasher::new();
                 source.update(include_bytes!("lib.rs"));
+                source.update(include_bytes!("deployment/mod.rs"));
+                source.update(include_bytes!("deployment/root.rs"));
+                source.update(include_bytes!("server/mod.rs"));
+                source.update(include_bytes!("server/workspace/mod.rs"));
                 source.update(include_bytes!("../../canopy-git-format/src/lib.rs"));
                 source.update(include_bytes!(
                     "../../canopy-git-format/src/pack_index/mod.rs"
diff --git a/crates/canopy-server/src/server/mod.rs b/crates/canopy-server/src/server/mod.rs
index a91c9c40..8fc0f45f 100644
--- a/crates/canopy-server/src/server/mod.rs
+++ b/crates/canopy-server/src/server/mod.rs
@@ -438,12 +438,13 @@ impl RunningServer {
             listeners.http = Some(reservation);
             socket
         });
+        let store = Store::new(Arc::clone(&raw_store));
+        crate::deployment::validate_service_root(&store, &config.store_prefix).await?;
         let data_dir = config.data_dir.clone();
         let local = Arc::new(
             tokio::task::spawn_blocking(move || workspace::Workspace::open(&data_dir)).await??,
         );
         listeners.workspace = Some(Arc::clone(&local));
-        let store = Store::new(Arc::clone(&raw_store));
         storage::probe(&store, &config.store_prefix.clone().join("canopy-probe")).await?;
         let application = Arc::new(CanopyApplication::compile(build_descriptor(
             include_bytes!("../../../../Cargo.lock"),
diff --git a/crates/canopy-server/src/server/workspace/mod.rs b/crates/canopy-server/src/server/workspace/mod.rs
index dafa4602..e7f1ab05 100644
--- a/crates/canopy-server/src/server/workspace/mod.rs
+++ b/crates/canopy-server/src/server/workspace/mod.rs
@@ -8,7 +8,7 @@ use std::{
 };
 
 const MARKER: &str = ".canopy-runtime";
-const FORMAT: &[u8] = b"canopy-runtime-v1\n";
+const FORMAT: &[u8] = crate::deployment::STORAGE_FORMAT.as_bytes();
 
 struct OwnerLock(File);
 
@@ -42,7 +42,17 @@ impl Workspace {
         fs::create_dir_all(directory)?;
         let directory = fs::canonicalize(directory)?;
         let owner = OwnerLock::acquire(&directory.join(".canopy-owner.lock"))?;
-        let root = directory.join("runtime-v1");
+        match fs::symlink_metadata(directory.join("runtime-v1")) {
+            Ok(_) => {
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    "legacy Canopy runtime requires a fresh packed-format data directory",
+                ));
+            }
+            Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+            Err(error) => return Err(error),
+        }
+        let root = directory.join(crate::deployment::STORAGE_FORMAT);
         #[cfg(unix)]
         let created = {
             use std::os::unix::fs::DirBuilderExt;
diff --git a/crates/canopy-server/src/server/workspace/tests.rs b/crates/canopy-server/src/server/workspace/tests.rs
index 6d23bc68..0235936d 100644
--- a/crates/canopy-server/src/server/workspace/tests.rs
+++ b/crates/canopy-server/src/server/workspace/tests.rs
@@ -2,6 +2,46 @@ use super::*;
 
 type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error>>;
 
+#[test]
+fn legacy_runtime_prevents_cutover_and_preserves_every_file() -> Result {
+    let directory = tempfile::TempDir::new()?;
+    let legacy = directory.path().join("runtime-v1");
+    fs::create_dir(&legacy)?;
+    fs::write(legacy.join(MARKER), b"canopy-runtime-v1\n")?;
+    fs::write(legacy.join("important"), b"retain old state")?;
+    assert!(
+        Workspace::open(directory.path())
+            .is_err_and(|error| error.kind() == io::ErrorKind::InvalidData)
+    );
+    assert_eq!(fs::read(legacy.join("important"))?, b"retain old state");
+    assert!(!directory.path().join("canopy-pack-v1").exists());
+    Ok(())
+}
+
+#[test]
+fn packed_workspace_checks_format_before_reclaiming_any_file() -> Result {
+    for marker in [
+        None,
+        Some(b"canopy-runtime-v1\n".as_slice()),
+        Some(b"unknown-format"),
+    ] {
+        let directory = tempfile::TempDir::new()?;
+        let root = directory.path().join("canopy-pack-v1");
+        fs::create_dir(&root)?;
+        fs::write(root.join("important"), b"retain unrecognized state")?;
+        if let Some(marker) = marker {
+            fs::write(root.join(MARKER), marker)?;
+        }
+        assert!(Workspace::open(directory.path()).is_err());
+        assert_eq!(
+            fs::read(root.join("important"))?,
+            b"retain unrecognized state"
+        );
+        assert!(!directory.path().join("runtime-v1").exists());
+    }
+    Ok(())
+}
+
 #[test]
 fn releasing_ownership_unlocks_descriptors_retained_by_an_unrelated_child() -> Result {
     let directory = tempfile::TempDir::new()?;
@@ -58,7 +98,7 @@ fn live_owner_blocks_cleanup_and_restart_reclaims_only_managed_state() -> Result
 #[test]
 fn unrecognized_runtime_is_never_reclaimed() -> Result {
     let directory = tempfile::TempDir::new()?;
-    let root = directory.path().join("runtime-v1");
+    let root = directory.path().join(crate::deployment::STORAGE_FORMAT);
     fs::create_dir(&root)?;
     fs::write(root.join("important"), b"retain")?;
     assert!(Workspace::open(directory.path()).is_err());
@@ -78,9 +118,12 @@ fn runtime_symlink_is_rejected_and_nested_symlinks_do_not_delete_targets() -> Re
     let directory = tempfile::TempDir::new()?;
     let outside = tempfile::TempDir::new()?;
     fs::write(outside.path().join("important"), b"retain")?;
-    symlink(outside.path(), directory.path().join("runtime-v1"))?;
+    symlink(
+        outside.path(),
+        directory.path().join(crate::deployment::STORAGE_FORMAT),
+    )?;
     assert!(Workspace::open(directory.path()).is_err());
-    fs::remove_file(directory.path().join("runtime-v1"))?;
+    fs::remove_file(directory.path().join(crate::deployment::STORAGE_FORMAT))?;
     let workspace = Workspace::open(directory.path())?;
     symlink(outside.path(), workspace.path().join("nested"))?;
     drop(workspace);
diff --git a/crates/canopy-server/tests/multi_server/peers/cold_activation.rs b/crates/canopy-server/tests/multi_server/peers/cold_activation.rs
index b6f66344..7350e360 100644
--- a/crates/canopy-server/tests/multi_server/peers/cold_activation.rs
+++ b/crates/canopy-server/tests/multi_server/peers/cold_activation.rs
@@ -236,7 +236,10 @@ async fn qualify_competing_cold_gateways(delay_claim_reply: bool) -> Result {
         .load(target.cell_id())
         .await?
         .ok_or("missing control")?;
-    let local_path = format!("runtime-v1/{}/repository.sqlite", repository_id.simple());
+    let local_path = format!(
+        "canopy-pack-v1/{}/repository.sqlite",
+        repository_id.simple()
+    );
     let local_owners = ["first", "second"]
         .into_iter()
         .filter(|name| files.path().join(name).join(&local_path).exists())
diff --git a/crates/canopy-server/tests/multi_server/peers/mod.rs b/crates/canopy-server/tests/multi_server/peers/mod.rs
index 479860fb..b6041dfc 100644
--- a/crates/canopy-server/tests/multi_server/peers/mod.rs
+++ b/crates/canopy-server/tests/multi_server/peers/mod.rs
@@ -173,7 +173,7 @@ async fn two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_direct
         let node = if name == "left" { "first" } else { "second" };
         let other = if node == "first" { "second" } else { "first" };
         let path = format!(
-            "runtime-v1/{}/repository.sqlite",
+            "canopy-pack-v1/{}/repository.sqlite",
             hex::encode(id.as_bytes())
         );
         assert!(files.path().join(node).join(&path).exists());
diff --git a/crates/canopy-server/tests/multi_server/residency/faults/mod.rs b/crates/canopy-server/tests/multi_server/residency/faults/mod.rs
index 0b2db138..58ae4ba4 100644
--- a/crates/canopy-server/tests/multi_server/residency/faults/mod.rs
+++ b/crates/canopy-server/tests/multi_server/residency/faults/mod.rs
@@ -210,7 +210,7 @@ impl Fixture {
         let oid = run_git(Some(&source), &["rev-parse", "HEAD"]).await?;
         create(&client, address, "second").await?;
         create(&client, address, "third").await?;
-        let local = workspace.path().join("server/runtime-v1");
+        let local = workspace.path().join("server/canopy-pack-v1");
         Ok(Self {
             workspace,
             store,
diff --git a/crates/canopy-server/tests/multi_server/residency/mod.rs b/crates/canopy-server/tests/multi_server/residency/mod.rs
index 43862bb4..58068f1b 100644
--- a/crates/canopy-server/tests/multi_server/residency/mod.rs
+++ b/crates/canopy-server/tests/multi_server/residency/mod.rs
@@ -30,7 +30,7 @@ async fn repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_n
     );
     let authority = CellAuthority::new(layout);
     let server = CanopyServer::start(settings, store).await?;
-    let local_root = workspace.path().join("server/runtime-v1");
+    let local_root = workspace.path().join("server/canopy-pack-v1");
     let local = workspace.path().join("source");
     run_git(None, &["init", "-b", "main", path_str(&local)?]).await?;
     run_git(Some(&local), &["config", "user.name", "Canopy Test"]).await?;
diff --git a/crates/canopy-server/tests/multi_server/retained_catalog.rs b/crates/canopy-server/tests/multi_server/retained_catalog.rs
index 88ab6ae3..c0e554b3 100644
--- a/crates/canopy-server/tests/multi_server/retained_catalog.rs
+++ b/crates/canopy-server/tests/multi_server/retained_catalog.rs
@@ -58,7 +58,7 @@ async fn retained_fixture() -> Result<RetainedFixture> {
                 .store_prefix
                 .clone()
                 .join("canopy-root-v1.json"),
-            Bytes::from_static(br#"{"kind":"service"}"#),
+            Bytes::from_static(br#"{"format":"canopy-pack-v1","purpose":{"kind":"service"}}"#),
         )
         .await?;
     ApplicationIdentityStore::new(storage.clone(), configuration.store_prefix.clone())
diff --git a/crates/canopy-server/tests/multi_server/size.rs b/crates/canopy-server/tests/multi_server/size.rs
index a3b9548b..0b01c4bd 100644
--- a/crates/canopy-server/tests/multi_server/size.rs
+++ b/crates/canopy-server/tests/multi_server/size.rs
@@ -99,7 +99,7 @@ async fn push_and_database_exceed_512_mib_and_lfs_exceeds_5_gib_after_restore()
     run_git(Some(&source), &["-c", AUTH, "push", &url, "main"]).await?;
     let expected = run_git(Some(&source), &["rev-parse", "HEAD"]).await?;
     tokio::fs::remove_dir_all(&source).await?;
-    let database_root = workspace.path().join("first/runtime-v1");
+    let database_root = workspace.path().join("first/canopy-pack-v1");
     let database_bytes = tokio::task::spawn_blocking(
         move || -> std::result::Result<u64, Box<dyn std::error::Error + Send + Sync>> {
             for entry in std::fs::read_dir(database_root)? {
diff --git a/crates/canopy-server/tests/multi_server/workspace.rs b/crates/canopy-server/tests/multi_server/workspace.rs
index ea203625..b3457529 100644
--- a/crates/canopy-server/tests/multi_server/workspace.rs
+++ b/crates/canopy-server/tests/multi_server/workspace.rs
@@ -1,5 +1,52 @@
 use super::*;
 
+#[tokio::test(flavor = "multi_thread")]
+async fn old_deployment_format_is_rejected_before_workspace_or_identity_writes()
+-> Result<(), Box<dyn std::error::Error>> {
+    for bytes in [
+        br#"{"kind":"service"}"#.as_slice(),
+        br#"{"purpose":{"kind":"service"}}"#,
+        br#"{"format":"future-format","purpose":{"kind":"service"}}"#,
+        br#"{"format":"canopy-pack-v1","purpose":{"kind":"backup","source":"source","pin":"11111111-1111-4111-8111-111111111111","complete":true}}"#,
+        br#"{"format":"canopy-pack-v1","purpose":{"kind":"restore","source":"source","pin":"11111111-1111-4111-8111-111111111111","complete":false}}"#,
+    ] {
+        let files = tempfile::TempDir::new()?;
+        let data = files.path().join("node");
+        let packed = data.join("canopy-pack-v1");
+        std::fs::create_dir_all(&packed)?;
+        std::fs::write(packed.join(".canopy-runtime"), b"canopy-pack-v1")?;
+        std::fs::write(packed.join("important"), b"retain existing cache")?;
+        let configuration = config(available_address().await?, data.clone());
+        let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+        let storage = cellule_store::Store::new(Arc::clone(&store));
+        let root = configuration
+            .store_prefix
+            .clone()
+            .join("canopy-root-v1.json");
+        storage
+            .create_strict(&root, bytes::Bytes::copy_from_slice(bytes))
+            .await?;
+        let original = storage.get_with_etag(&root).await?;
+        let identities = cellule_runtime::cell::application::ApplicationIdentityStore::new(
+            storage.clone(),
+            configuration.store_prefix.clone(),
+        );
+        if let Ok(server) = CanopyServer::start(configuration, store).await {
+            server.shutdown().await?;
+            return Err("unversioned deployment was admitted".into());
+        }
+        assert!(identities.load().await?.is_none());
+        assert_eq!(storage.get_with_etag(&root).await?, original);
+        assert_eq!(
+            std::fs::read(packed.join("important"))?,
+            b"retain existing cache"
+        );
+        assert!(!data.join(".canopy-owner.lock").exists());
+        assert!(!data.join("runtime-v1").exists());
+    }
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn active_node_blocks_workspace_reuse_and_shutdown_allows_durable_restore()
 -> Result<(), Box<dyn std::error::Error>> {
@@ -27,7 +74,7 @@ async fn active_node_blocks_workspace_reuse_and_shutdown_allows_durable_restore(
         matches!(occupied, Err(canopy_server::server::ServerError::Io(error)) if error.kind() == std::io::ErrorKind::WouldBlock)
     );
     server.shutdown().await?;
-    let sentinel = data.join("runtime-v1/abandoned");
+    let sentinel = data.join("canopy-pack-v1/abandoned");
     std::fs::write(&sentinel, b"reclaim before restoring")?;
     let address = available_address().await?;
     let server = CanopyServer::start(config(address, data), store).await?;
diff --git a/docs/contracts.md b/docs/contracts.md
index 1e20e1b2..6f0ca384 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -1134,7 +1134,7 @@ complete OOM/CPU/process/crash fault matrix require separate qualification.
 
 `data_dir/.canopy-owner.lock` prevents concurrent nodes from using one local
 directory. The server and repository manager retain the lock throughout their
-lifetime, including detached request work. `data_dir/runtime-v1/` is private to
+lifetime, including detached request work. `data_dir/canopy-pack-v1/` is private to
 the node (created with mode 0700 on Unix) and identified by a version marker.
 Startup validates that marker and reclaims local SQLite files, Git caches and
 spools before opening Cells or advertising the node. These are disposable copies;
@@ -2647,8 +2647,14 @@ with the release still Ready provide a quiet capture window. A successful source
 pin UUID identifies one immutable cut; repeating create reuses it.
 
 `<prefix>/canopy-root-v1.json` is a bounded, conditional-write reservation with
-Service, Backup or Restore purpose. Backup/Restore bind the source prefix and
-pin UUID. Service initialization competes on this same key. Every reservation,
+the exact `{"format":"canopy-pack-v1","purpose":...}` envelope containing
+the existing Service, Backup or Restore purpose. Missing/unknown formats and
+unversioned purpose records are rejected, and the previous top-level-purpose
+decoder rejects the new envelope. Backup/Restore bind the source prefix and
+pin UUID. Startup checks format and serving eligibility before local workspace
+reclamation, storage probes, identity/release writes and Cell activation.
+Legacy `runtime-v1` directories and missing/unknown current workspace markers
+are retained and rejected; operators select a fresh data directory. Service initialization competes on this same key. Every reservation,
 including Service, rejects an existing application identity without a root marker.
 Current initialization writes the marker first; admission rechecks it after
 reading an identity to allow a concurrent current-format creator. Copies also
diff --git a/docs/delivery-plan.md b/docs/delivery-plan.md
index bac79695..33549ee9 100644
--- a/docs/delivery-plan.md
+++ b/docs/delivery-plan.md
@@ -1822,7 +1822,7 @@ qualification remain open.
 ### Managed local runtime recovery qualification
 
 On 2026-09-26, `src/server/workspace.rs` replaced anonymous node directories with
-one marked `runtime-v1/` directory beneath a locked `data_dir`. The manager retains
+one marked `canopy-pack-v1/` directory beneath a locked `data_dir`. The manager retains
 that owner with detached request work. Git caches use a recognizable prefix and
 per-cache worker locks. On Unix, native Git and its descendants inherit the lock
 descriptor across exec. Startup acquires every abandoned worker fence before
diff --git a/docs/design/mandatory-publication-registration.md b/docs/design/mandatory-publication-registration.md
index 6fd2a7c2..d366fea2 100644
--- a/docs/design/mandatory-publication-registration.md
+++ b/docs/design/mandatory-publication-registration.md
@@ -63,4 +63,4 @@ The converted late-cursor test requires the actual SQL fault message, SDK absenc
 
 Final frozen-source macOS ARM64 qualification passes **655 unique Rust tests**: 531 library tests (6 Git-format / 14 object-storage / 511 server), 104 multi-server tests and 20 CLI/contract/recovery/Smart HTTP tests. The server library finishes in 235.55 seconds and multi-server in 376.05 seconds. Subprocess summaries and focused reruns are excluded from the count. All eight isolated RustFS compatibility cases pass, including SHA-256, signed pushes, SSH, the 4,096-ref mirror, filtered clones and LFS. The separate large-transfer case still requires a dedicated disk with at least 40 GiB free. All 96 Python qualification tests pass in 40.924 seconds. Workspace/all-target Clippy passes with warnings denied in 24.00 seconds. The server binary builds successfully in 80 seconds. Formatting, diff checks, all 409 frozen Rust-source hashes, the protected checkout index, archived document and exact Cellule pin checks pass. Temporary probes are removed. No stack, lifetime, deadline, resource or capacity thresholds were widened. Exact-head Linux/provider CI and full-scale qualification are separate gates.
 
-The published listener fix is independent: PR #32 was merged on 2026-10-03 at `e0957301fa388a69f669cffb31b2126cd982f34d`. Both complete Verify runs passed on its published head `370408f8184c2d0fccb273b6fe6b60ed896123d1`. The fetched `origin/main` and that head have the identical complete tree `45e96c20abad39df2d40c7554c5de2b720ab0dae`; the squash merge therefore includes every published change. The isolated working branch is aligned with that main revision, preserving the local registration increment. There is no open PR #32 conflict to resolve. Those CI checks qualify the published listener tree, not these local registration changes. This increment is prepared on `codex/mandatory-publication-registration` for a new PR to main. The full implementation and capacity goal remains open.
+The published listener fix is independent: PR #32 was merged on 2026-10-03 at `e0957301fa388a69f669cffb31b2126cd982f34d`. Both complete Verify runs passed on its published head `370408f8184c2d0fccb273b6fe6b60ed896123d1`. The fetched `origin/main` and that head have the identical complete tree `45e96c20abad39df2d40c7554c5de2b720ab0dae`; the squash merge therefore includes every published change. The isolated working branch is aligned with that main revision, preserving the local registration increment. There is no open PR #32 conflict to resolve. Those CI checks qualify the published listener tree, not these local registration changes. PR #33 merged at `9438bb865959fb975d5349ba8b9908b461653821`. Both complete exact-head Linux [push](https://github.com/crabbuild/canopy/actions/runs/37164049029) and [PR](https://github.com/crabbuild/canopy/actions/runs/37164077931) Verify runs pass at `32f5559216432c0437ac3e864d71c454ee779e1e`, including 659 unique workspace tests, eight RustFS cases and build. Main and that published head have the identical tree `aacb41ee48e953cf106c75f8319667fa83639b96`. The local production cutover starts from that merged main; its changes require their own qualification. The full implementation and capacity goal remains open.
diff --git a/docs/implementation.md b/docs/implementation.md
index 20edc7c9..c84097c2 100644
--- a/docs/implementation.md
+++ b/docs/implementation.md
@@ -89,7 +89,7 @@ See [native pack policy](contracts.md#native-pack-resource-policy) and
 
 ### Local workspace and shutdown
 
-The node locks its `data_dir` and owns `runtime-v1/` beneath it. On Unix,
+The node locks its `data_dir` and owns `canopy-pack-v1/` beneath it. On Unix,
 restart removes abandoned local state before restoring Cells from object storage;
 live Git descendants prevent cleanup. Unknown runtime markers and cleanup errors
 stop startup. Keep the lock files in place; files outside the managed runtime
diff --git a/docs/large-repository-implementation-plan.md b/docs/large-repository-implementation-plan.md
index 0608711f..9e738856 100644
--- a/docs/large-repository-implementation-plan.md
+++ b/docs/large-repository-implementation-plan.md
@@ -293,7 +293,7 @@ The [immutable ref state](design/immutable-ref-state.md) supplies conditional ve
 
 1. The shared streaming rewrite now coalesces existing-base batches by affected subtree and preserves untouched roots. Qualify sustained ordinary and bulk preparation separately, including long-name byte splits, retained tombstones, provider budgets and hot-root fairness.
 2. The fresh immutable catalog generation now carries the ref snapshot through the same query-derived base and retention floor. The private preparation factory loads and rewrites that exact root; compaction carries it forward and the inline publisher refuses selected roots. Fresh empty initialization now authenticates a private empty preparation and atomically installs joint roots with one durable outcome; wire it into repository creation at cutover. Bind membership/ancestry and exact policy/check facts to the privately issued transition certificate, and qualify their current-state CAS/fairness semantics.
-3. Direct-push [paged policy guards](design/paged-ref-policy-guards.md) now bind rare configuration epochs and indexed exact check dependencies, with bounded transactional registration/cleanup and private conditional root signing. The private [immutable completion factory](design/immutable-push-outcomes.md) binds registered native custody and freezes success/refusal descriptors in an 8 KiB input. Command 36 atomically publishes those exact catalog/ref/response descriptors with live guard/epoch, current authorization, owner/lease/pin and generation CAS checks; it transports no plan and writes no per-ref rows. Query 37 and the streaming replay adapter derive the selected result from current authorized durable identity. The service-owned exact command factory, foreground dispatch and bound lifecycle now retain/recover this command with a 16 KiB wire reservation and current-authorized streaming ticket responses. Immutable outcome-only command 38 reuses the session certificate, native checkpoint, same RootPush dispatch and current-authorized streaming reader without catalog/refs writes. Paged-policy commands now retain their original intent/evidence and exact SDK identity in the same foreground dispatcher; the bound lifecycle resumes after a known page and blocks final handoff during uncertainty. Armed pages now retain a pre-frozen refusal-only command under one 528 KiB admission and recover the original SDK evidence for the active local phase. Successful pages share one refusal Arc; that exact command can also complete a negative outcome after later policy/write changes. Its final transaction cannot select native success or expose roots. Complete durable process-loss reconstruction, production HTTP/SSH refusal-pipeline conversion and reviewed-merge bindings, and include every page/command cost in hot-repository capacity qualification.
+3. Direct-push [paged policy guards](design/paged-ref-policy-guards.md) now bind rare configuration epochs and indexed exact check dependencies, with bounded transactional registration/cleanup and private conditional root signing. The private [immutable completion factory](design/immutable-push-outcomes.md) binds registered native custody and freezes success/refusal descriptors in an 8 KiB input. Command 36 atomically publishes those exact catalog/ref/response descriptors with live guard/epoch, current authorization, owner/lease/pin and generation CAS checks; it transports no plan and writes no per-ref rows. Query 37 and the streaming replay adapter derive the selected result from current authorized durable identity. The service-owned exact command factory, foreground dispatch and bound lifecycle now retain/recover this command with a 32 KiB registered wire reservation and current-authorized streaming ticket responses. Immutable outcome-only command 38 reuses the session certificate, native checkpoint, same RootPush dispatch and current-authorized streaming reader without catalog/refs writes. Paged-policy commands now retain their original intent/evidence and exact SDK identity in the same foreground dispatcher; the bound lifecycle resumes after a known page and blocks final handoff during uncertainty. Armed pages now retain a pre-frozen refusal-only command under one 544 KiB registered admission and recover the original SDK evidence for the active local phase. Successful pages share one refusal Arc; that exact command can also complete a negative outcome after later policy/write changes. Its final transaction cannot select native success or expose roots. Complete durable process-loss reconstruction, production HTTP/SSH refusal-pipeline conversion and reviewed-merge bindings, and include every page/command cost in hot-repository capacity qualification.
 4. Convert every producer, reader, default-branch, policy/check, review and recovery path together. Delete the old ref/body schema and adapters for the fresh-data cutover.
 5. Include snapshots and their transitive immutable nodes in complete retention, collection and isolated restore, including the immutable initialization outcome's retained empty catalog/ref roots. Qualify hot-root fairness and full-history mixed workloads against the mandatory large-team gates.
 
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 7bc536be..3b7dc845 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -2,9 +2,19 @@
 
 Updated during implementation on 2026-10-03. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
-Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The audit verifies each directly merged PR's exact merge tree and main ancestry; the entire main tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
+Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
-All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. Production startup/HTTP/SSH/generated producer and reader conversion, mandatory registration and the fresh-schema hard cutover remain open.
+All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. Production startup/HTTP/SSH/generated producer and reader conversion, production registration and the fresh-schema hard cutover remain open.
+
+## Production hard cutover started locally
+
+The isolated `codex/packed-production-cutover` branch is aligned with merged PR #33 at `9438bb865959fb975d5349ba8b9908b461653821`. Its first production change wraps the existing `RootPurpose` at the unchanged `canopy-root-v1.json` key in the required `canopy-pack-v1` envelope. There is no legacy decoder. The root remains bounded to 4 KiB, including envelope overhead. Encoding borrows the original purpose and bounds source/pin strings before serialization. Reservations and completion still use the original conditional create/ETag CAS.
+
+Startup performs a read-only root/serving-purpose check before opening or reclaiming local state, storage probes, identity/release writes or Cell activation. It preserves the concurrent-initializer recheck when identity appears after the first marker read. Local workspaces use `canopy-pack-v1/` and the same format marker. An existing `runtime-v1` directory is rejected and retained; missing/unknown markers in the new directory are rejected before cleanup. Existing owner/worker exclusion and descendant fencing are preserved. Source/release hashing now includes the deployment format and workspace/startup code. All fixture and benchmark paths follow the new directory.
+
+Four new unit regressions fail against the original code. A real startup regression also fails because an unversioned deployment was admitted. After the change, all 16 deployment and nine workspace tests pass. The real startup and durable restart pair pass, including old/missing/unknown formats, completed backup and unfinished restore rejection before any workspace or identity writes. The final envelope-boundary regression passes in the full library audit: all 516 server library tests pass. All 96 Python qualification tests pass in 41.507 seconds. The first broad multi-server audit records 104 passed and one macOS `AddrInUse` failure in the late SSH publication-refusal family. The original error remains retained. That family passes alone; holding a competing listener in its released HTTP-port gap deterministically reproduces the same error. Retaining and handing off the bound listener refuses the competing bind and passes all three original refusal scenarios. The shared fixture and all three restore starts in that family now retain their listeners. Temporary diagnostics are removed. The uninstrumented broader integration rerun passes all 105 multi-server cases with four test threads in 419.98 seconds, including the original cancelled-startup and late SSH refusal cases. Owner restart, Repository Cell and Smart HTTP pass. Combined with the preceding unchanged-source library/CLI/contract runs, all 661 unique current workspace Rust cases pass; child-process summaries and focused reruns are excluded. Workspace/all-target Clippy passes with warnings denied in 45.68 seconds. All eight isolated RustFS compatibility cases pass on this same source, including the 4,096-ref mirror, SHA-256 native candidates, signed HTTP/SSH, filtered clones and SSH LFS. Workspace doctests finish successfully with no cases; the server binary builds in 26.91 seconds. The separate large-transfer gate still needs at least 40 GiB free on both scratch and provider volumes; complete histories and 10,000-developer capacity remain unqualified. Formatting/diff checks, all 409 frozen Rust-source hashes, three changed scripts’ syntax and 116 local documentation links pass.
+
+**This is local, unpublished work and is not a releasable packed deployment.** The production RepositoryModule still selects the old Git schema and commands. The fresh schema, production registration, HTTP/SSH/generated producers, authoritative catalog/ref/object readers and obsolete body/ref/inline adapters must cut over together before this branch is published as a release. Actual typed collection/backup/isolated restore, initial/Claim/Renew/denied/pre-admission recovery, retained-input adoption/repreparation, OS containment, accelerated reads/rewrites, continuous fair maintenance and complete repository/team qualification remain required. Format checks and compatibility fixtures do not prove that wider completion.
 
 ## Mandatory publication registration qualified locally
 
@@ -14,7 +24,7 @@ The ten standalone fixtures now use actual native packs in admitted namespaces,
 
 The final frozen-source macOS ARM64 workspace passes **655 unique Rust tests**: 531 library tests (6 Git-format / 14 object-storage / 511 server), 104 multi-server tests and 20 CLI/contract/recovery/Smart HTTP tests. The server library completes in 235.55 seconds and multi-server in 376.05 seconds. Eight isolated RustFS compatibility cases pass; the large-transfer case remains a dedicated-volume gate. All 96 Python qualification tests pass in 40.924 seconds, and workspace/all-target Clippy passes with warnings denied in 24.00 seconds. The server binary builds in 80 seconds. Formatting, diff, 409 frozen Rust-source hashes, exact dependency and protected-checkout checks pass. Earlier stack overflows are avoided through owned qualification and synchronous future construction, reducing the common ARM64 debug native poll frame from roughly 951 KiB to 707 KiB with standard stacks. A retirement expiry assertion failed once; its isolated control passed four milliseconds after expiry with unchanged identity. The fixture now verifies actual wall-clock expiry before resolution; the original timing cause remains unproven. Probes are removed, and no stacks, SDK lifetimes, production deadlines, resource limits or capacity thresholds were widened.
 
-The increment is prepared for a new PR to main after merged #32. Exact-head Linux/provider CI is required for publication qualification. Production registration, startup/HTTP/SSH/generated producers and readers, and fresh-schema hard cutover remain the highest-priority next work. Initial/Claim/Renew/denied/pre-admission recovery, retained-input adoption/repreparation, typed collection/backup/isolated restore, resource containment, accelerated reads/physical rewriting, fair continuous maintenance and full repository/team qualification also remain open. The full objective remains open.
+PR #33 is merged at `9438bb865959fb975d5349ba8b9908b461653821`. Both exact-head Linux [push Verify](https://github.com/crabbuild/canopy/actions/runs/37164049029) and [PR Verify](https://github.com/crabbuild/canopy/actions/runs/37164077931) pass at `32f5559216432c0437ac3e864d71c454ee779e1e`, each with 659 unique workspace tests, all eight RustFS compatibility cases, harness, formatting, all-target Clippy and server build. The original cancellation and all four controlled-fork cases pass. Main and the published head have the identical full tree `aacb41ee48e953cf106c75f8319667fa83639b96`, proving every published registration change is included. These results qualify that tree, not the current local format changes. Production registration, startup/HTTP/SSH/generated producers and readers, and fresh-schema hard cutover remain the highest-priority next work. Initial/Claim/Renew/denied/pre-admission recovery, retained-input adoption/repreparation, typed collection/backup/isolated restore, resource containment, accelerated reads/physical rewriting, fair continuous maintenance and full repository/team qualification also remain open. The full objective remains open.
 
 ## Linux listener ownership qualified at PR #32
 
diff --git a/scripts/benchmark_large_repository.py b/scripts/benchmark_large_repository.py
index bab54e42..8ffe8966 100644
--- a/scripts/benchmark_large_repository.py
+++ b/scripts/benchmark_large_repository.py
@@ -114,7 +114,7 @@ def sample():
                                                  "process_tree_rss_bytes": rss}) + "\n")
                         # MAX(sequence) uses the integer primary key. Avoid
                         # table scans or long transactions on the live Cell.
-                        for database in (args.state_dir / "node" / "runtime-v1").glob("*/repository.sqlite"):
+                        for database in (args.state_dir / "node" / "canopy-pack-v1").glob("*/repository.sqlite"):
                             try:
                                 connection = sqlite3.connect(database.as_uri() + "?mode=ro", uri=True, timeout=0.2)
                                 try:
@@ -258,7 +258,7 @@ def api(path, payload=None, method=None):
         git("prepare-pull-client", "clone", "--shared", "--single-branch", "--branch",
             default_ref.removeprefix("refs/heads/"), str(args.work_dir / "warm-v2.git"), str(pull_work))
         git("configure-pull-client", "-C", str(pull_work), "remote", "set-url", "origin", url)
-        # The binary's startup contract removes runtime-v1 before recovering
+        # The binary's startup contract removes canopy-pack-v1 before recovering
         # authoritative Cells from the provider; no manual deletion is needed.
         commit_env = {**git_env, "GIT_AUTHOR_NAME": "Canopy Evaluation",
             "GIT_AUTHOR_EMAIL": "evaluation@example.invalid",
diff --git a/scripts/smoke_s3_cache.py b/scripts/smoke_s3_cache.py
index 05f5add2..f69bbb17 100644
--- a/scripts/smoke_s3_cache.py
+++ b/scripts/smoke_s3_cache.py
@@ -113,7 +113,7 @@ def clone(name, protocol):
 
 def cached_objects(data):
     objects = {}
-    for cache in (data / "runtime-v1").glob("canopy-git-*/repo.git"):
+    for cache in (data / "canopy-pack-v1").glob("canopy-git-*/repo.git"):
         if (cache / "objects/info/alternates").exists():
             continue
         for path in (cache / "objects").glob("*/*"):
diff --git a/scripts/smoke_s3_process.py b/scripts/smoke_s3_process.py
index c388fb07..4eb932a9 100644
--- a/scripts/smoke_s3_process.py
+++ b/scripts/smoke_s3_process.py
@@ -755,7 +755,7 @@ def main():
             clone_and_verify(f"{base_url}/canopy/other.git", directory / "clean-other", other_oid, other_readme)
             second.kill()
             second.wait(timeout=10)
-            abandoned = directory / "second" / "runtime-v1"
+            abandoned = directory / "second" / "canopy-pack-v1"
             stale_caches = list(abandoned.glob("canopy-git-*"))
             assert stale_caches, "expected a retained fetch cache at owner death"
             sentinel = abandoned / "abandoned-upload"

From 38ec7eb36e28349eaab4103b6dad24906979fad9 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sat, 3 Oct 2026 19:06:04 -0700
Subject: [PATCH 03/55] Select packed production registry and certify
 repository creation

Reuse the bounded typed publication contract for actual Repository Cell migrations, activation and maintenance. Initialize private empty catalog/ref roots before Ready and authenticate retained initialization on cold load without new allocation.

Production Git producer/reader conversion remains an unreleasable local cutover. Qualification reads published Cell roots through the sparse VFS, uses scoped provider keys for corruption injection and releases connection guards before awaits.
---
 .../canopy-server/src/deployment/recovery.rs  |   2 +-
 crates/canopy-server/src/lib.rs               |  32 +--
 crates/canopy-server/src/object_batch/mod.rs  |   1 +
 .../src/packs/publication/mod.rs              |  14 +-
 .../src/packs/publication/registry.rs         | 136 ++++++++++
 .../src/packs/publication/tests.rs            |  80 +-----
 .../src/server/catalog_initialization.rs      | 249 ++++++++++++++++++
 crates/canopy-server/src/server/mod.rs        |   3 +
 .../canopy-server/src/server/residency/mod.rs |  26 +-
 .../tests/multi_server/workspace.rs           | 239 +++++++++++++++++
 docs/large-repository-implementation-plan.md  |   4 +-
 .../large-repository-implementation-status.md |  10 +-
 12 files changed, 685 insertions(+), 111 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/registry.rs
 create mode 100644 crates/canopy-server/src/server/catalog_initialization.rs

diff --git a/crates/canopy-server/src/deployment/recovery.rs b/crates/canopy-server/src/deployment/recovery.rs
index 355e0e26..8300b9c9 100644
--- a/crates/canopy-server/src/deployment/recovery.rs
+++ b/crates/canopy-server/src/deployment/recovery.rs
@@ -168,7 +168,7 @@ impl Deployment {
                         let (module, schema) = if entry.namespace() == directory::DIRECTORY {
                             (DirectoryModule::NAME, directory::SCHEMA)
                         } else if entry.namespace() == REPOSITORIES {
-                            (RepositoryModule::NAME, include_str!("../schema.sql"))
+                            (RepositoryModule::NAME, crate::REPOSITORY_SCHEMA)
                         } else {
                             return Err(Error::Release("unknown maintenance Cell namespace").into());
                         };
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index c0021a5f..0a987506 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -84,22 +84,10 @@ pub(crate) fn replica_limits(database: u64, capture: u64) -> cellule_ltx::Limits
     }
 }
 
-const SCHEMA: &str = include_str!("schema.sql");
-const COMMANDS: [OperationDescriptor; 9] = [
-    operation(1),
-    operation_with_codec(3, 4),
-    operation_with_codec(4, 6),
-    OperationDescriptor {
-        input_limit: object_batch::INPUT_LIMIT,
-        ..operation_with_codec(5, 5)
-    },
-    operation_with_codec(6, 3),
-    operation_with_codec(7, 2),
-    operation_with_codec(8, 2),
-    operation_with_codec(9, 4),
-    operation_with_codec(10, 2),
-];
-const QUERIES: [OperationDescriptor; 1] = [operation(2)];
+/// Fresh packed schema shared by release migrations and actual Cell activation.
+pub const REPOSITORY_SCHEMA: &str = packs::publication::SCHEMA;
+const SCHEMA: &str = REPOSITORY_SCHEMA;
+use packs::publication::registry::{COMMANDS, QUERIES};
 
 const fn operation(id: u32) -> OperationDescriptor {
     operation_with_codec(id, 1)
@@ -287,6 +275,9 @@ impl CellModule for RepositoryModule {
                 ));
                 source.update(include_bytes!("packs/publication/exact.rs"));
                 source.update(include_bytes!("packs/publication/mod.rs"));
+                source.update(include_bytes!("packs/publication/registry.rs"));
+                source.update(include_bytes!("server/catalog_initialization.rs"));
+                source.update(include_bytes!("server/residency/mod.rs"));
                 source.update(include_bytes!("packs/publication/codec.rs"));
                 source.update(include_bytes!("packs/publication/sql.rs"));
                 source.update(include_bytes!("packs/publication/schema.sql"));
@@ -352,14 +343,7 @@ impl CellModule for RepositoryModule {
 
     fn register(self, registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
         register_sql::<Self>(registry)?;
-        registry.bind_command::<FinalizePush>()?;
-        registry.bind_command::<push::CompletePush>()?;
-        registry.bind_command::<object_batch::PutObjects>()?;
-        registry.bind_command::<graph::CertifyObjects>()?;
-        registry.bind_command::<ancestry::CertifyAncestry>()?;
-        registry.bind_command::<branch_rules::command::SetBranchRule>()?;
-        registry.bind_command::<pulls::merge::command::MergePull>()?;
-        registry.bind_command::<pulls::candidates::command::PrepareCandidate>()
+        packs::publication::register(registry)
     }
 }
 
diff --git a/crates/canopy-server/src/object_batch/mod.rs b/crates/canopy-server/src/object_batch/mod.rs
index de6f4d22..f698ad30 100644
--- a/crates/canopy-server/src/object_batch/mod.rs
+++ b/crates/canopy-server/src/object_batch/mod.rs
@@ -18,6 +18,7 @@ pub(crate) const MAX_OBJECTS: usize = 128;
 // Publication amortizes durable commits independently of bounded read pages.
 pub(crate) const MAX_BATCH_OBJECTS: usize = 2048;
 pub(crate) const VERIFY_BATCH_BYTES: u64 = 64 * 1024 * 1024;
+#[cfg(test)]
 pub(crate) const INPUT_LIMIT: u32 = 4 * 1024 * 1024;
 // Leave room for record metadata inside Cellule's bounded command wire format.
 const INLINE_BATCH_BYTES: usize = 3 * 1024 * 1024;
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index f85a9a3e..6cd0af84 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -1,6 +1,6 @@
 //! Fenced preparation and retained generation facts in the Repository Cell.
-//! The fresh schema is selected with the final producer/reader hard cutover;
-//! these commands are not registered on the legacy repository serving path.
+//! Production and qualification share the same bounded packed operation registry.
+//! The remaining producer/reader conversion is an unreleasable local cutover.
 use super::{catalog::StoredCatalog, ref_state::RefStateSnapshotRoot};
 use crate::{
     ObjectFormat, RepositoryModule,
@@ -14,6 +14,7 @@ use cellule_runtime::{
     primitives::sql::{SqlBatch, SqlResultSet, SqlStatement, SqlValue},
     registry::{CommandContext, CommandResult, OwnerFence, QueryContext},
 };
+pub(crate) mod registry;
 mod session;
 pub use session::PreparationSession;
 mod base;
@@ -214,10 +215,8 @@ pub struct MaintenanceRequest {
     pub owner: OwnerFence,
 }
 
-/// Register on the fresh RepositoryModule only, with bounded descriptors for
-/// command IDs 11..14/16..19/22/24..26/28..29/31/33/35 and query IDs
-/// 15/20..21/23/27/30/32/34, plus the existing trusted SQL query. No separate
-/// Cell or compatibility API.
+/// Bind the packed production contract. Inline publication/completion adapters
+/// are deliberately excluded; qualification binds its historical fixtures itself.
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_command::<BeginStaging>()?;
     registry.bind_command::<RenewStaging>()?;
@@ -237,8 +236,6 @@ pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_command::<RegisterRefPolicyPage>()?;
     registry.bind_query::<CheckRefPolicyGuard>()?;
     registry.bind_command::<ReapRefPolicyGuard>()?;
-    registry.bind_command::<PublishCatalogRefs>()?;
-    registry.bind_command::<CompleteCatalogPush>()?;
     registry.bind_command::<CompleteRootPush>()?;
     registry.bind_command::<CompleteRootOutcome>()?;
     registry.bind_command::<RegisterRootRecovery>()?;
@@ -246,7 +243,6 @@ pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_query::<CheckCompletedRootPush>()?;
     registry.bind_command::<PublishCatalogCompaction>()?;
     registry.bind_query::<CheckCompletedCompaction>()?;
-    registry.bind_query::<CheckCompletedPush>()?;
     registry.bind_query::<CheckPreparationFrontier>()?;
     registry.bind_query::<CheckPreparation>()
 }
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
new file mode 100644
index 00000000..c51060a1
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -0,0 +1,136 @@
+//! One bounded operation contract shared by production and qualification.
+use super::*;
+use cellule_runtime::registry::OperationDescriptor;
+
+const fn command<C: Command>(input_limit: u32, output_limit: u32) -> OperationDescriptor {
+    OperationDescriptor {
+        id: C::ID,
+        codec_version: C::CODEC_VERSION,
+        schema_min: 1,
+        schema_max: 1,
+        input_limit,
+        output_limit,
+    }
+}
+const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescriptor {
+    OperationDescriptor {
+        id: Q::ID,
+        codec_version: Q::CODEC_VERSION,
+        schema_min: 1,
+        schema_max: 1,
+        input_limit,
+        output_limit,
+    }
+}
+
+pub(crate) const COMMANDS: [OperationDescriptor; 20] = [
+    crate::operation(1),
+    command::<BeginPreparation>(4096, 4096),
+    command::<ClaimPreparation>(4096, 4096),
+    command::<RenewPreparation>(4096, 4096),
+    command::<AbortPreparation>(4096, 4096),
+    command::<ReapPreparation>(4096, 4096),
+    command::<RegisterCatalogAttestation>(4096, 4096),
+    command::<PublishCatalogCompaction>(4096, 4096),
+    command::<BeginStaging>(4096, 4096),
+    command::<RenewStaging>(4096, 4096),
+    command::<BindStaging>(4096, 4096),
+    command::<ClaimStaging>(4096, 4096),
+    command::<RegisterStagedInputs>(4096, 4096),
+    command::<InitializeCatalogRefs>(INITIALIZATION_BYTES, 512),
+    command::<RegisterRefPolicyPage>(REF_POLICY_PAGE_BYTES, 128),
+    command::<ReapRefPolicyGuard>(4096, 128),
+    command::<CompleteRootPush>(ROOT_COMPLETION_BYTES, 512),
+    command::<CompleteRootOutcome>(ROOT_COMPLETION_BYTES, 512),
+    command::<RegisterRootRecovery>(4096, 4096),
+    command::<ReleaseTerminalRecovery>(4096, 128),
+];
+pub(crate) const QUERIES: [OperationDescriptor; 9] = [
+    crate::operation(2),
+    query::<CheckPreparation>(4096, 4096),
+    query::<CheckPreparationFrontier>(4096, 4096),
+    query::<CheckCompletedCompaction>(4096, 4096),
+    query::<CheckStaging>(4096, 4096),
+    query::<CheckStagedInputs>(4096, 4096),
+    query::<CheckInitializedCatalog>(4096, 512),
+    query::<CheckRefPolicyGuard>(4096, 128),
+    query::<CheckCompletedRootPush>(4096, 512),
+];
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{CanopyApplication, RepositoryModule, build_descriptor};
+    use cellule_app::CellApplication;
+    use cellule_runtime::CellModule;
+
+    #[test]
+    fn production_registers_only_the_packed_command_contract() -> cellule_runtime::Result<()> {
+        let application = CanopyApplication::compile(build_descriptor(
+            include_bytes!("../../../../../Cargo.lock"),
+            env!("CARGO_PKG_VERSION"),
+        ))?;
+        assert!(
+            application
+                .registry()
+                .module_code(RepositoryModule::NAME)
+                .is_some()
+        );
+        let descriptor = RepositoryModule.descriptor();
+        let ids: Vec<_> = descriptor
+            .commands
+            .iter()
+            .map(|operation| operation.id)
+            .collect();
+        assert_eq!(
+            ids,
+            vec![
+                1, 11, 12, 13, 14, 16, 17, 22, 24, 25, 26, 28, 29, 31, 33, 35, 36, 38, 39, 40
+            ]
+        );
+        assert_eq!(
+            descriptor
+                .queries
+                .iter()
+                .map(|operation| operation.id)
+                .collect::<Vec<_>>(),
+            vec![2, 15, 21, 23, 27, 30, 32, 34, 37]
+        );
+        for (id, codec, input, output) in [
+            (
+                33,
+                RegisterRefPolicyPage::CODEC_VERSION,
+                REF_POLICY_PAGE_BYTES,
+                128,
+            ),
+            (
+                36,
+                CompleteRootPush::CODEC_VERSION,
+                ROOT_COMPLETION_BYTES,
+                512,
+            ),
+            (
+                38,
+                CompleteRootOutcome::CODEC_VERSION,
+                ROOT_COMPLETION_BYTES,
+                512,
+            ),
+            (39, RegisterRootRecovery::CODEC_VERSION, 4096, 4096),
+        ] {
+            let operation = descriptor
+                .commands
+                .iter()
+                .find(|value| value.id == id)
+                .unwrap();
+            assert_eq!(
+                (
+                    operation.codec_version,
+                    operation.input_limit,
+                    operation.output_limit
+                ),
+                (codec, input, output)
+            );
+        }
+        Ok(())
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 723f347c..29fa26c1 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -67,37 +67,10 @@ impl CellModule for Module {
             publish_descriptor.input_limit = 4 << 20;
             let mut complete_descriptor = descriptor(19);
             complete_descriptor.input_limit = 4 << 20;
-            let mut initial_descriptor = descriptor(31);
-            initial_descriptor.input_limit = INITIALIZATION_BYTES;
-            initial_descriptor.output_limit = 512;
-            let mut initial_query = descriptor(32);
-            initial_query.output_limit = 512;
-            let mut policy_page = descriptor(33);
-            policy_page.codec_version = RegisterRefPolicyPage::CODEC_VERSION;
-            policy_page.input_limit = REF_POLICY_PAGE_BYTES;
-            policy_page.output_limit = 128;
-            let mut policy_query = descriptor(34);
-            policy_query.output_limit = 128;
-            let mut policy_reap = descriptor(35);
-            policy_reap.output_limit = 128;
-            let mut root_completion = descriptor(36);
-            root_completion.codec_version = CompleteRootPush::CODEC_VERSION;
-            root_completion.input_limit = ROOT_COMPLETION_BYTES;
-            root_completion.output_limit = 512;
-            let mut root_outcome = descriptor(38);
-            root_outcome.codec_version = CompleteRootOutcome::CODEC_VERSION;
-            root_outcome.input_limit = ROOT_COMPLETION_BYTES;
-            root_outcome.output_limit = 512;
-            let mut root_lookup = descriptor(37);
-            root_lookup.output_limit = 512;
-            let mut recovery = descriptor(39);
-            recovery.codec_version = RegisterRootRecovery::CODEC_VERSION;
-            // Match the existing production SQL transport contract exactly.
-            // The generic 4 KiB fixture limit cannot encode even one valid
-            // 65 KiB ref name; policy construction has its own smaller bound.
-            let sql_query = crate::operation(2);
-            let mut release = descriptor(40);
-            release.output_limit = 128;
+            let mut commands = super::registry::COMMANDS.to_vec();
+            commands.extend([publish_descriptor, complete_descriptor, ref_descriptor]);
+            let mut queries = super::registry::QUERIES.to_vec();
+            queries.push(descriptor(20));
             ModuleDescriptor {
                 name: Self::NAME,
                 source_digest: Digest::from_bytes([11; 32]),
@@ -109,42 +82,8 @@ impl CellModule for Module {
                     sql: SCHEMA,
                     digest: Digest::from_bytes(*blake3::hash(SCHEMA.as_bytes()).as_bytes()),
                 }])),
-                commands: Box::leak(Box::new([
-                    descriptor(11),
-                    descriptor(12),
-                    descriptor(13),
-                    descriptor(14),
-                    descriptor(16),
-                    descriptor(17),
-                    publish_descriptor,
-                    complete_descriptor,
-                    descriptor(22),
-                    descriptor(24),
-                    descriptor(25),
-                    descriptor(26),
-                    descriptor(28),
-                    descriptor(29),
-                    initial_descriptor,
-                    policy_page,
-                    policy_reap,
-                    root_completion,
-                    root_outcome,
-                    recovery,
-                    release,
-                    ref_descriptor,
-                ])),
-                queries: Box::leak(Box::new([
-                    sql_query,
-                    descriptor(15),
-                    descriptor(20),
-                    descriptor(21),
-                    descriptor(23),
-                    descriptor(27),
-                    descriptor(30),
-                    initial_query,
-                    policy_query,
-                    root_lookup,
-                ])),
+                commands: Box::leak(commands.into_boxed_slice()),
+                queries: Box::leak(queries.into_boxed_slice()),
                 workflow_definitions: &[],
                 activity_types: &[],
                 namespaces: Box::leak(Box::new([NamespaceDescriptor {
@@ -159,9 +98,12 @@ impl CellModule for Module {
         })
     }
     fn register(self, registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
+        cellule_runtime::primitives::sql::register_sql::<RepositoryModule>(registry)?;
         super::register(registry)?;
-        registry.bind_command::<refs::FixtureRefs>()?;
-        registry.bind_query::<cellule_runtime::primitives::sql::SqlBatchQuery<RepositoryModule>>()
+        registry.bind_command::<PublishCatalogRefs>()?;
+        registry.bind_command::<CompleteCatalogPush>()?;
+        registry.bind_query::<CheckCompletedPush>()?;
+        registry.bind_command::<refs::FixtureRefs>()
     }
 }
 struct Fixture {
diff --git a/crates/canopy-server/src/server/catalog_initialization.rs b/crates/canopy-server/src/server/catalog_initialization.rs
new file mode 100644
index 00000000..76400b5e
--- /dev/null
+++ b/crates/canopy-server/src/server/catalog_initialization.rs
@@ -0,0 +1,249 @@
+//! Certified empty-catalog initialization before exposing a repository route.
+use crate::{
+    ObjectFormat, RepositoryCell, RepositoryModule,
+    packs::{
+        catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes, CatalogSnapshot},
+        directory::snapshot::DirectorySnapshot,
+        metadata::MetadataLimits,
+        publication::{
+            BeginPreparation, BeginRequest, CatalogPreparation, CheckInitializedCatalog,
+            ClaimPreparation, DEFAULT_LEASE_MS, GenerationFact, InitializationReply,
+            InitializeCatalogRefs, LeaseCheck, LeaseRequest, PreparationBaseResolver,
+            PreparationDenial, PreparationReply, PreparationToken,
+        },
+    },
+};
+use canopy_object_storage::artifact::ArtifactStore;
+use cellule_ltx::DiskBudget;
+use cellule_runtime::{
+    CellClient, Error, InvocationError, Receipt,
+    identity::IncarnationId,
+    primitives::sql::{SqlBatch, SqlCell, SqlStatement, SqlValue},
+    registry::OwnerFence,
+};
+use object_store::ObjectStore;
+use std::{path::Path, sync::Arc};
+
+type Failure = Box<dyn std::error::Error + Send + Sync>;
+
+fn request(repository: &RepositoryCell, owner: &str) -> BeginRequest {
+    let mut hash = blake3::Hasher::new();
+    hash.update(b"canopy.repository.initialization.v1\0");
+    for field in [
+        repository.target.tenant().as_bytes().as_slice(),
+        repository.target.application().as_bytes().as_slice(),
+        repository.id.as_slice(),
+        repository.object_format.as_str().as_bytes(),
+        owner.as_bytes(),
+    ] {
+        hash.update(&(field.len() as u64).to_be_bytes());
+        hash.update(field);
+    }
+    let request_digest = *hash.finalize().as_bytes();
+    let mut operation = [0; 16];
+    operation.copy_from_slice(&request_digest[..16]);
+    operation[0] |= 1;
+    BeginRequest {
+        repository: repository.id,
+        operation,
+        request_digest,
+        actor: owner.into(),
+        lease_ms: DEFAULT_LEASE_MS,
+    }
+}
+
+async fn verify(
+    fact: GenerationFact,
+    store: &ArtifactStore,
+    format: ObjectFormat,
+) -> Result<(), Failure> {
+    if fact.generation != 1 || fact.certificate.is_none() {
+        return Err(Error::Command("invalid repository initialization fact").into());
+    }
+    let stored = fact
+        .catalog
+        .ok_or(Error::Command("initial catalog absent"))?;
+    if stored.repository != store.repository() || stored.format != format {
+        return Err(Error::Command("initial catalog context differs").into());
+    }
+    let catalog = CatalogSnapshot::download(store, stored).await?;
+    let directory = DirectorySnapshot::download(store, catalog.directory).await?;
+    let refs = fact
+        .refs
+        .ok_or(Error::Command("initial refs absent"))?
+        .read(store)
+        .await?;
+    if catalog.sources.is_some()
+        || !directory.level_zero.is_empty()
+        || directory.levels.iter().any(Option::is_some)
+        || refs.repository != store.repository()
+        || refs.format != format
+        || refs.generation != 0
+        || refs.root.is_some()
+        || refs.default_branch != "refs/heads/main"
+    {
+        return Err(Error::Command("initial catalog is not the certified empty state").into());
+    }
+    Ok(())
+}
+
+/// The caller's tracked cold-transition task owns this work through cancellation.
+/// Ready repositories only observe their immutable initialization; they cannot
+/// reconstruct missing ownership or publish a new empty catalog during restore.
+pub(super) async fn ensure(
+    repository: &RepositoryCell,
+    client: CellClient,
+    owner: &str,
+    provider: Arc<dyn ObjectStore>,
+    workspace: &Path,
+    budget: DiskBudget,
+    pending: bool,
+) -> Result<(), Failure> {
+    let input = request(repository, owner);
+    let target = &repository.target;
+    let store = Arc::new(ArtifactStore::new(provider, repository.id));
+    if let Some(fact) = client
+        .query::<CheckInitializedCatalog>(target, None, input.clone())
+        .await?
+        .output
+    {
+        return verify(fact, &store, repository.object_format).await;
+    }
+    if !pending {
+        return Err(Error::Command("ready repository has no certified initialization").into());
+    }
+    let started_at = std::time::Instant::now();
+    let started = match client
+        .command::<BeginPreparation>(target, super::mutation_identity()?, input.clone())
+        .await
+    {
+        Ok(started) => started,
+        Err(InvocationError::Rejected(rejected))
+            if matches!(
+                rejected.output,
+                PreparationReply::Denied(PreparationDenial::Stale | PreparationDenial::Expired)
+            ) =>
+        {
+            // Claim only after a known domain refusal. Read the exact old
+            // binding; the Claim receiver verifies its pin and actual owner.
+            let check = prior_attempt(&client, repository, &input, rejected.receipt).await?;
+            client
+                .command::<ClaimPreparation>(
+                    target,
+                    super::mutation_identity()?,
+                    LeaseRequest {
+                        check,
+                        lease_ms: DEFAULT_LEASE_MS,
+                    },
+                )
+                .await?
+        }
+        Err(error) => {
+            // A logical initialization can win between the first query and
+            // Begin. Only a known conflict may use that exact retained result;
+            // uncertain command evidence stays an error, never fresh admission.
+            if matches!(&error, InvocationError::Rejected(value)
+                if value.output == PreparationReply::Denied(PreparationDenial::Conflict))
+                && let Some(fact) = client
+                    .query::<CheckInitializedCatalog>(target, None, input)
+                    .await?
+                    .output
+            {
+                return verify(fact, &store, repository.object_format).await;
+            }
+            return Err(error.into());
+        }
+    };
+    let PreparationReply::Granted(lease) = started.output else {
+        return Err(Error::Command("repository initialization admission denied").into());
+    };
+    let check = LeaseCheck {
+        token: lease.token,
+        actor: owner.into(),
+    };
+    let indexes = Arc::new(CatalogIndexes::new(
+        Arc::clone(&store),
+        repository.object_format,
+    ));
+    let files = Arc::new(CatalogFiles::new(
+        workspace,
+        budget.clone(),
+        Arc::clone(&store),
+        repository.object_format,
+        CatalogFileLimits::default(),
+    )?);
+    let base = Arc::new(
+        PreparationBaseResolver::open(
+            client.clone(),
+            target.clone(),
+            check,
+            indexes,
+            files,
+            Some(started.receipt),
+        )
+        .await?,
+    );
+    let prepared = CatalogPreparation::new(workspace, budget, base, MetadataLimits::default())
+        .await?
+        .finish()
+        .await?;
+    let proof = prepared.empty_ref_initialization().await?;
+    let committed = client
+        .command::<InitializeCatalogRefs>(target, super::mutation_identity()?, proof)
+        .await?;
+    let InitializationReply::Initialized(fact) = committed.output else {
+        return Err(Error::Command("repository initialization publication denied").into());
+    };
+    verify(*fact, &store, repository.object_format).await?;
+    tracing::debug!(repository = %hex::encode(repository.id), elapsed_seconds = started_at.elapsed().as_secs_f64(), "certified repository catalog initialized");
+    Ok(())
+}
+
+fn fixed<const N: usize>(value: &SqlValue) -> Result<[u8; N], Error> {
+    match value {
+        SqlValue::Blob(bytes) => bytes
+            .as_slice()
+            .try_into()
+            .map_err(|_| Error::Command("invalid prior initialization binding")),
+        _ => Err(Error::Command("invalid prior initialization binding")),
+    }
+}
+async fn prior_attempt(
+    client: &CellClient,
+    repository: &RepositoryCell,
+    input: &BeginRequest,
+    minimum: Receipt,
+) -> Result<LeaseCheck, Failure> {
+    let sql = SqlCell::<RepositoryModule>::new(client.clone(), repository.target.clone())?;
+    let observed = sql.query(Some(minimum), SqlBatch { statements: vec![SqlStatement {
+        sql: "SELECT o.incarnation,o.owner_epoch,o.admission_sequence,o.artifact_operation FROM catalog_operations o JOIN repository_identity r ON r.singleton=1 WHERE o.id=?1 AND o.actor=?2 AND o.request_digest=?3 AND o.generation=0 AND r.owner=?2 AND r.repository_id=?4 AND r.object_format=?5".into(),
+        parameters: vec![SqlValue::Blob(input.operation.to_vec()), SqlValue::Text(input.actor.clone()), SqlValue::Blob(input.request_digest.to_vec()), SqlValue::Blob(repository.id.to_vec()), SqlValue::Text(repository.object_format.as_str().into())],
+    }] }).await?;
+    let Some([incarnation, epoch, SqlValue::Integer(sequence), operation]) = observed
+        .output
+        .first()
+        .and_then(|set| set.rows.first())
+        .map(Vec::as_slice)
+    else {
+        return Err(Error::Command("prior initialization attempt absent").into());
+    };
+    let attempt = u64::try_from(*sequence)
+        .map_err(|_| Error::Command("invalid prior initialization sequence"))?;
+    if attempt == 0 {
+        return Err(Error::Command("invalid prior initialization sequence").into());
+    }
+    Ok(LeaseCheck {
+        actor: input.actor.clone(),
+        token: PreparationToken {
+            repository: repository.id,
+            operation: input.operation,
+            request_digest: input.request_digest,
+            owner: OwnerFence {
+                incarnation: IncarnationId::from_bytes(fixed(incarnation)?),
+                epoch: u64::from_be_bytes(fixed(epoch)?),
+            },
+            attempt,
+            artifact_operation: fixed(operation)?,
+        },
+    })
+}
diff --git a/crates/canopy-server/src/server/mod.rs b/crates/canopy-server/src/server/mod.rs
index 8fc0f45f..c1a175ef 100644
--- a/crates/canopy-server/src/server/mod.rs
+++ b/crates/canopy-server/src/server/mod.rs
@@ -47,6 +47,7 @@ use crate::{
 };
 
 mod catalog_admission;
+mod catalog_initialization;
 mod discovery;
 mod lifecycle;
 mod listeners;
@@ -67,6 +68,8 @@ pub(crate) const RENEW_INTERVAL: Duration = Duration::from_secs(3);
 
 #[derive(Debug, thiserror::Error)]
 pub enum ServerError {
+    #[error("packed repository initialization failed")]
+    CatalogInitialization(#[source] Box<dyn std::error::Error + Send + Sync>),
     #[error("invalid SSH host key")]
     SshKey(#[source] Box<directory::SshKeyError>),
     #[error("Cellule runtime failed")]
diff --git a/crates/canopy-server/src/server/residency/mod.rs b/crates/canopy-server/src/server/residency/mod.rs
index 7f57850b..a84ff6f7 100644
--- a/crates/canopy-server/src/server/residency/mod.rs
+++ b/crates/canopy-server/src/server/residency/mod.rs
@@ -31,6 +31,7 @@ use crate::{
 
 pub(super) struct LoadedRepository {
     repository: Arc<RepositoryCell>,
+    client: CellClient,
     gateway: Arc<GitGateway>,
     name: String,
     router: Router,
@@ -266,7 +267,7 @@ impl RepositoryManager {
                     SqlCellSpec {
                         target: &target,
                         module: RepositoryModule::NAME,
-                        schema: include_str!("../../schema.sql"),
+                        schema: crate::REPOSITORY_SCHEMA,
                         destination: directory.join("repository.sqlite"),
                     },
                     self.session,
@@ -302,8 +303,13 @@ impl RepositoryManager {
             .await
             .get(&entry.repository_id)
             .filter(|repository| !repository.initialized)
-            .map(|repository| Arc::clone(&repository.repository));
-        if let Some(repository) = initialize {
+            .map(|repository| {
+                (
+                    Arc::clone(&repository.repository),
+                    repository.client.clone(),
+                )
+            });
+        if let Some((repository, client)) = initialize {
             // Keep the acquired Cell through an uncertain initialization result.
             // A later request retries setup before any fast-path route is exposed.
             if entry.state == RepositoryState::Pending {
@@ -321,6 +327,17 @@ impl RepositoryManager {
                     "repository owner differs from directory",
                 ));
             }
+            super::catalog_initialization::ensure(
+                &repository,
+                client,
+                &entry.owner,
+                Arc::clone(&self.external_store),
+                self.local.path(),
+                self.disk_budget.clone(),
+                entry.state == RepositoryState::Pending,
+            )
+            .await
+            .map_err(ServerError::CatalogInitialization)?;
         }
         let mut loaded = self.loaded.lock().await;
         let existing = loaded
@@ -516,7 +533,7 @@ impl RepositoryManager {
         slot: Arc<OwnedSemaphorePermit>,
     ) -> Result<LoadedRepository, ServerError> {
         let application = self.node.application_handle::<CanopyApplication>(
-            client,
+            client.clone(),
             self.tenant,
             self.application,
         )?;
@@ -561,6 +578,7 @@ impl RepositoryManager {
         });
         Ok(LoadedRepository {
             repository,
+            client,
             gateway,
             name: entry.name.clone(),
             router,
diff --git a/crates/canopy-server/tests/multi_server/workspace.rs b/crates/canopy-server/tests/multi_server/workspace.rs
index b3457529..ea8334b1 100644
--- a/crates/canopy-server/tests/multi_server/workspace.rs
+++ b/crates/canopy-server/tests/multi_server/workspace.rs
@@ -91,3 +91,242 @@ async fn active_node_blocks_workspace_reuse_and_shutdown_allows_durable_restore(
     server.shutdown().await?;
     Ok(())
 }
+
+#[tokio::test(flavor = "multi_thread")]
+async fn new_repositories_bootstrap_the_production_packed_catalog_before_becoming_ready()
+-> Result<(), Box<dyn std::error::Error>> {
+    use canopy_server::packs::{
+        catalog::{CatalogSnapshot, StoredCatalog},
+        ref_state::RefStateSnapshotRoot,
+    };
+    use cellule_runtime::codec::{BoundedDecoder, WireValue};
+    use object_store::ObjectStoreExt;
+    for format in ["sha1", "sha256"] {
+        let files = tempfile::TempDir::new()?;
+        let data = files.path().join("node");
+        let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let address = listener.local_addr()?;
+        let cfg = config(address, data.clone());
+        let prefix = cfg.store_prefix.clone();
+        let tenant = cfg.tenant;
+        let application = cfg.application;
+        let layout = cellule_runtime::ltx::CellStorageLayout::new(
+            cellule_store::Store::new(Arc::clone(&store)),
+            prefix.clone(),
+            *application.as_bytes(),
+        );
+        let server = CanopyServer::start_with_listener(cfg, Arc::clone(&store), listener).await?;
+        let client = reqwest::Client::new();
+        let response: serde_json::Value = client
+            .post(format!("http://{address}/api/repositories"))
+            .bearer_auth("local-test-token")
+            .json(&serde_json::json!({"name":"packed","object_format":format}))
+            .send()
+            .await?
+            .error_for_status()?
+            .json()
+            .await?;
+        let repository = uuid::Uuid::parse_str(
+            response["repository_id"]
+                .as_str()
+                .ok_or("repository UUID absent")?,
+        )?;
+        let target = canopy_server::repository_target(tenant, application, *repository.as_bytes())?;
+        server.shutdown().await?;
+        let root = repository_root(&layout, &target, &files.path().join("original.sqlite")).await?;
+        let (catalog, refs, allocation) = {
+            let connection = root.connection()?;
+            for table in [
+                "objects",
+                "object_uploads",
+                "object_chunks",
+                "object_edges",
+                "object_closure",
+                "git_packs",
+                "commit_parents",
+                "commit_ancestry",
+            ] {
+                assert!(
+                    !connection.query_row(
+                        "SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name=?1)",
+                        [table],
+                        |row| row.get::<_, bool>(0)
+                    )?,
+                    "legacy table {table} is still selected"
+                );
+            }
+            let (generation,catalog,refs,certificate): (i64,Vec<u8>,Vec<u8>,Vec<u8>)=connection.query_row(
+            "SELECT g.generation,g.catalog,g.refs,g.certificate FROM catalog_state s JOIN catalog_generations g ON g.generation=s.generation WHERE s.singleton=1",[],|row| Ok((row.get(0)?,row.get(1)?,row.get(2)?,row.get(3)?)))?;
+            assert_eq!(generation, 1);
+            assert_eq!(certificate.len(), 32);
+            assert_eq!(
+                connection
+                    .query_row("SELECT count(*) FROM catalog_initialization", [], |row| row
+                        .get::<_, i64>(0))?,
+                1
+            );
+            assert_eq!(
+                connection
+                    .query_row("SELECT count(*) FROM catalog_operations", [], |row| row
+                        .get::<_, i64>(0))?,
+                0
+            );
+            let allocation = connection.query_row(
+                "SELECT artifact_sequence FROM repository_identity WHERE singleton=1",
+                [],
+                |row| row.get::<_, i64>(0),
+            )?;
+            assert_eq!(allocation, 1);
+            (catalog, refs, allocation)
+        };
+        drop(root);
+        let mut decoder = BoundedDecoder::new(&catalog, 256)?;
+        let catalog = StoredCatalog::decode(&mut decoder)?;
+        decoder.finish()?;
+        let mut decoder = BoundedDecoder::new(&refs, 128)?;
+        let refs = RefStateSnapshotRoot::decode(&mut decoder)?;
+        decoder.finish()?;
+        let provider: Arc<dyn ObjectStore> = Arc::new(object_store::prefix::PrefixStore::new(
+            Arc::clone(&store),
+            prefix.clone(),
+        ));
+        let artifacts = canopy_object_storage::artifact::ArtifactStore::new(
+            Arc::clone(&provider),
+            *repository.as_bytes(),
+        );
+        let snapshot = CatalogSnapshot::download(&artifacts, catalog).await?;
+        assert!(snapshot.sources.is_none());
+        let snapshot = refs.read(&artifacts).await?;
+        assert_eq!(snapshot.generation, 0);
+        assert_eq!(snapshot.default_branch, "refs/heads/main");
+        assert!(snapshot.root.is_none());
+        let restored_data = files.path().join("restored");
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let restored_address = listener.local_addr()?;
+        let restored = CanopyServer::start_with_listener(
+            config(restored_address, restored_data.clone()),
+            Arc::clone(&store),
+            listener,
+        )
+        .await?;
+        let restored_response: serde_json::Value = client
+            .get(format!("http://{restored_address}/api/repositories/packed"))
+            .bearer_auth("local-test-token")
+            .send()
+            .await?
+            .error_for_status()?
+            .json()
+            .await?;
+        assert_eq!(
+            restored_response["repository_id"],
+            response["repository_id"]
+        );
+        restored.shutdown().await?;
+        let root = repository_root(&layout, &target, &files.path().join("restored.sqlite")).await?;
+        {
+            let connection = root.connection()?;
+            assert_eq!(
+                connection.query_row(
+                    "SELECT artifact_sequence FROM repository_identity WHERE singleton=1",
+                    [],
+                    |row| row.get::<_, i64>(0)
+                )?,
+                allocation
+            );
+            assert_eq!(
+                connection.query_row(
+                    "SELECT catalog FROM catalog_generations WHERE generation=1",
+                    [],
+                    |row| row.get::<_, Vec<u8>>(0)
+                )?,
+                {
+                    let mut encoded = cellule_runtime::codec::BoundedEncoder::new(256)?;
+                    catalog.encode(&mut encoded)?;
+                    encoded.finish()
+                }
+            );
+        }
+        drop(root);
+
+        // A Ready repository must fail closed when retained initialization
+        // metadata is missing, rather than silently publishing another empty
+        // catalog. The immutable Cell outcome still exists in this fixture.
+        let catalog_path = artifacts.path(
+            canopy_object_storage::artifact::ArtifactKey {
+                operation: catalog.operation,
+                binding_digest: catalog.artifact.digest,
+                kind: canopy_object_storage::artifact::ArtifactKind::CatalogNode,
+            },
+            catalog.artifact.digest,
+        )?;
+        provider.head(&catalog_path).await?;
+        provider.delete(&catalog_path).await?;
+        assert!(matches!(
+            provider.head(&catalog_path).await,
+            Err(object_store::Error::NotFound { .. })
+        ));
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let broken_address = listener.local_addr()?;
+        let broken = CanopyServer::start_with_listener(
+            config(broken_address, files.path().join("missing-initial-catalog")),
+            Arc::clone(&store),
+            listener,
+        )
+        .await?;
+        let refused = client
+            .get(format!("http://{broken_address}/api/repositories/packed"))
+            .bearer_auth("local-test-token")
+            .send()
+            .await?;
+        assert_eq!(refused.status(), reqwest::StatusCode::SERVICE_UNAVAILABLE);
+        assert_eq!(refused.text().await?, "Repository is unavailable");
+        broken.shutdown().await?;
+        let root = repository_root(&layout, &target, &files.path().join("refused.sqlite")).await?;
+        {
+            let connection = root.connection()?;
+            assert_eq!(
+                connection.query_row(
+                    "SELECT artifact_sequence FROM repository_identity WHERE singleton=1",
+                    [],
+                    |row| row.get::<_, i64>(0)
+                )?,
+                allocation
+            );
+            assert_eq!(
+                connection.query_row(
+                    "SELECT generation FROM catalog_state WHERE singleton=1",
+                    [],
+                    |row| row.get::<_, i64>(0)
+                )?,
+                1
+            );
+        }
+        drop(root);
+    }
+    Ok(())
+}
+
+// Restored workers use sparse placeholders. Ordinary SQLite cannot fetch their
+// missing pages; inspect the authenticated published root through Cellule's VFS.
+async fn repository_root(
+    layout: &cellule_runtime::ltx::CellStorageLayout,
+    target: &cellule_runtime::CellTarget,
+    destination: &Path,
+) -> Result<cellule_ltx::ReadOnlyRoot, Box<dyn std::error::Error>> {
+    let control = cellule_runtime::control::authority::CellAuthority::new(layout.clone())
+        .load(target.cell_id())
+        .await?
+        .ok_or("repository control absent")?;
+    let root = control.value().ltx_root().ok_or("repository root absent")?;
+    let replica = cellule_ltx::CellReplica::new(
+        layout.clone(),
+        *target.cell_id().as_bytes(),
+        *control.value().incarnation.as_bytes(),
+        cellule_ltx::Limits::default(),
+    )?;
+    Ok(replica
+        .open_root(&root)
+        .await?
+        .open_read_only(destination)?)
+}
diff --git a/docs/large-repository-implementation-plan.md b/docs/large-repository-implementation-plan.md
index 9e738856..fe3295ca 100644
--- a/docs/large-repository-implementation-plan.md
+++ b/docs/large-repository-implementation-plan.md
@@ -91,7 +91,7 @@ Populate it from the admitted actor authority. Audit replay and retry execution
 
 **Files:** `crates/canopy-server/src/schema.sql`, `crates/canopy-server/src/lib.rs`, `crates/canopy-server/src/packs/{metadata,directory,sources,catalog,verification,closure}/`, new operation/publication commands, existing ref/push/product commands and repository Cell tests. **Dependency:** B's actual admitted owner fence; C's authenticated artifacts; E's complete isolated physical verification.
 
-The earlier [SQL fixture](design/packed-repository-schema.sql) is not the release definition. Deliver fresh release DDL together with the new deployment marker. Preserve product tables unless a demonstrated requirement changes them; keep push response/certificate chunks. Remove historical Git bodies, mutable per-object placement and graph rows from the Cell. Store current catalog descriptor/generation, root certification, fenced operation attempts/outcomes and retention/reader-pin facts. Immutable metadata segments and directory/source indexes hold canonical object/edge inventories. Do not implement the superseded `PutObjects`, `CertifyObjects` or `SwitchPackLocations` Cell commands as a compatibility stage.
+The earlier [SQL fixture](design/packed-repository-schema.sql) is not the release definition. Deliver fresh release DDL together with the new deployment marker. Preserve product tables unless a demonstrated requirement changes them; reuse the existing immutable response, signed-certificate and native-result roots instead of inline SQL body/chunk adapters. Remove historical Git bodies, mutable per-object placement and graph rows from the Cell. Store current catalog descriptor/generation, root certification, fenced operation attempts/outcomes and retention/reader-pin facts. Immutable metadata segments and directory/source indexes hold canonical object/edge inventories. Do not implement the superseded `PutObjects`, `CertifyObjects` or `SwitchPackLocations` Cell commands as a compatibility stage.
 
 1. Reuse the implemented immutable artifacts, canonical `ObjectHeader`/typed edges, native index ordinal partitions and bounded catalog codecs. Operation records bind repository, format, identity, admitted owner fence/attempt, input catalog/generation, artifact descriptors and exact durable response. Register large input/output sets through a bounded immutable root; never serialize every historical descriptor into Begin or Complete.
 2. Implement a trusted base resolver from the retained, certified input catalog and authoritative root facts. Keep a valid generation lease throughout preparation. Reuse `CatalogFiles` for admitted, authenticated SQLite files and `CatalogReader::headers` for grouped file reads. Resolve only requested OIDs in ordered batches of at most 512; presence in a native index or raw catalog is insufficient for closure certification. Compare the complete incoming canonical header against every matching base header, including body and graph digests.
@@ -292,7 +292,7 @@ Each cell below is a test family, with SHA-1/SHA-256 coverage on a representativ
 The [immutable ref state](design/immutable-ref-state.md) supplies conditional versioned roots and streaming initial construction. Complete the final publication change in this order:
 
 1. The shared streaming rewrite now coalesces existing-base batches by affected subtree and preserves untouched roots. Qualify sustained ordinary and bulk preparation separately, including long-name byte splits, retained tombstones, provider budgets and hot-root fairness.
-2. The fresh immutable catalog generation now carries the ref snapshot through the same query-derived base and retention floor. The private preparation factory loads and rewrites that exact root; compaction carries it forward and the inline publisher refuses selected roots. Fresh empty initialization now authenticates a private empty preparation and atomically installs joint roots with one durable outcome; wire it into repository creation at cutover. Bind membership/ancestry and exact policy/check facts to the privately issued transition certificate, and qualify their current-state CAS/fairness semantics.
+2. The fresh immutable catalog generation now carries the ref snapshot through the same query-derived base and retention floor. The private preparation factory loads and rewrites that exact root; compaction carries it forward and the inline publisher refuses selected roots. Fresh empty initialization authenticates a private empty preparation and atomically installs joint roots with one durable outcome. The local production cutover now invokes that path before repository Ready and verifies the retained immutable initialization during fresh-disk restore; complete original-command persistence/reconstruction and all pending/Claim/denied/pre-admission recovery before release. See the [current qualification and unreleasable boundaries](large-repository-implementation-status.md#production-hard-cutover-started-locally). Bind membership/ancestry and exact policy/check facts to the privately issued transition certificate, and qualify their current-state CAS/fairness semantics.
 3. Direct-push [paged policy guards](design/paged-ref-policy-guards.md) now bind rare configuration epochs and indexed exact check dependencies, with bounded transactional registration/cleanup and private conditional root signing. The private [immutable completion factory](design/immutable-push-outcomes.md) binds registered native custody and freezes success/refusal descriptors in an 8 KiB input. Command 36 atomically publishes those exact catalog/ref/response descriptors with live guard/epoch, current authorization, owner/lease/pin and generation CAS checks; it transports no plan and writes no per-ref rows. Query 37 and the streaming replay adapter derive the selected result from current authorized durable identity. The service-owned exact command factory, foreground dispatch and bound lifecycle now retain/recover this command with a 32 KiB registered wire reservation and current-authorized streaming ticket responses. Immutable outcome-only command 38 reuses the session certificate, native checkpoint, same RootPush dispatch and current-authorized streaming reader without catalog/refs writes. Paged-policy commands now retain their original intent/evidence and exact SDK identity in the same foreground dispatcher; the bound lifecycle resumes after a known page and blocks final handoff during uncertainty. Armed pages now retain a pre-frozen refusal-only command under one 544 KiB registered admission and recover the original SDK evidence for the active local phase. Successful pages share one refusal Arc; that exact command can also complete a negative outcome after later policy/write changes. Its final transaction cannot select native success or expose roots. Complete durable process-loss reconstruction, production HTTP/SSH refusal-pipeline conversion and reviewed-merge bindings, and include every page/command cost in hot-repository capacity qualification.
 4. Convert every producer, reader, default-branch, policy/check, review and recovery path together. Delete the old ref/body schema and adapters for the fresh-data cutover.
 5. Include snapshots and their transitive immutable nodes in complete retention, collection and isolated restore, including the immutable initialization outcome's retained empty catalog/ref roots. Qualify hot-root fairness and full-history mixed workloads against the mandatory large-team gates.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 3b7dc845..2845e8df 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -4,7 +4,7 @@ Updated during implementation on 2026-10-03. **The full implementation and capac
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
-All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. Production startup/HTTP/SSH/generated producer and reader conversion, production registration and the fresh-schema hard cutover remain open.
+All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
 ## Production hard cutover started locally
 
@@ -14,7 +14,13 @@ Startup performs a read-only root/serving-purpose check before opening or reclai
 
 Four new unit regressions fail against the original code. A real startup regression also fails because an unversioned deployment was admitted. After the change, all 16 deployment and nine workspace tests pass. The real startup and durable restart pair pass, including old/missing/unknown formats, completed backup and unfinished restore rejection before any workspace or identity writes. The final envelope-boundary regression passes in the full library audit: all 516 server library tests pass. All 96 Python qualification tests pass in 41.507 seconds. The first broad multi-server audit records 104 passed and one macOS `AddrInUse` failure in the late SSH publication-refusal family. The original error remains retained. That family passes alone; holding a competing listener in its released HTTP-port gap deterministically reproduces the same error. Retaining and handing off the bound listener refuses the competing bind and passes all three original refusal scenarios. The shared fixture and all three restore starts in that family now retain their listeners. Temporary diagnostics are removed. The uninstrumented broader integration rerun passes all 105 multi-server cases with four test threads in 419.98 seconds, including the original cancelled-startup and late SSH refusal cases. Owner restart, Repository Cell and Smart HTTP pass. Combined with the preceding unchanged-source library/CLI/contract runs, all 661 unique current workspace Rust cases pass; child-process summaries and focused reruns are excluded. Workspace/all-target Clippy passes with warnings denied in 45.68 seconds. All eight isolated RustFS compatibility cases pass on this same source, including the 4,096-ref mirror, SHA-256 native candidates, signed HTTP/SSH, filtered clones and SSH LFS. Workspace doctests finish successfully with no cases; the server binary builds in 26.91 seconds. The separate large-transfer gate still needs at least 40 GiB free on both scratch and provider volumes; complete histories and 10,000-developer capacity remain unqualified. Formatting/diff checks, all 409 frozen Rust-source hashes, three changed scripts’ syntax and 116 local documentation links pass.
 
-**This is local, unpublished work and is not a releasable packed deployment.** The production RepositoryModule still selects the old Git schema and commands. The fresh schema, production registration, HTTP/SSH/generated producers, authoritative catalog/ref/object readers and obsolete body/ref/inline adapters must cut over together before this branch is published as a release. Actual typed collection/backup/isolated restore, initial/Claim/Renew/denied/pre-admission recovery, retained-input adoption/repreparation, OS containment, accelerated reads/rewrites, continuous fair maintenance and complete repository/team qualification remain required. Format checks and compatibility fixtures do not prove that wider completion.
+The next local increment selects `packs::publication::SCHEMA` through one `REPOSITORY_SCHEMA` constant for production RepositoryModule migrations, actual repository acquisition and maintenance recovery. Production and publication qualification share the same 20 command and nine query descriptors, deriving actual codec versions and bounded envelopes from the typed operations. Legacy Git commands 3–10 and inline publication/completion 18/19/query20 are excluded from production binding; the latter remain explicit qualification-only bindings until their callers and DDL are removed. Production creation now obtains an actual preparation lease, constructs the private empty-catalog proof and atomically publishes catalog/ref roots through command 31 before exposing the repository as Ready. Ready restoration verifies the exact retained initialization and authenticated immutable metadata without another Begin or artifact allocation. Only a known Stale/Expired Begin refusal allows an explicit Claim of the observed original attempt. Uncertain errors remain errors; they cannot select a fresh admission within that invocation. Initialization work remains owned by the existing tracked repository-transition task through HTTP cancellation and shutdown.
+
+The new real HTTP creation regression initially fails because production still selects the old `objects` table. Its bootstrap portion then passes for SHA-1/SHA-256. Extending it to fresh-disk restoration exposes a test read error: ordinary SQLite bypasses Cellule's authenticated sparse VFS and reads an incomplete placeholder. The restored HTTP load itself succeeds. The fixture now inspects the exact published immutable Cell root with Cellule's supported read-only reader. The missing-catalog fixture initially joins a nested key as one escaped path component, so it deletes a different key; using the same scoped provider and proving HEAD absence corrects that injection. Final missing-initial-catalog cold loads return exactly HTTP 503 without advancing catalog generation or artifact allocation. The lint audit also catches a synchronous read-only connection guard spanning awaits; lexical query scopes release it before artifact I/O. No production workaround or lint suppression is added.
+
+All 254 publication tests pass in 154.86 seconds, including the shared production-registry contract, using four threads and standard stacks. The final three workspace integration tests pass in 2.45 seconds, including both formats, fresh-disk restoration, missing retained metadata and the deployment/workspace exclusions. Workspace/all-target Clippy passes with warnings denied in 7.85 seconds. These are focused local checks. The broad full-workspace, provider and capacity results above remain attributed to their earlier source; unconverted production Git paths cannot be qualified by this increment.
+
+**This is local, unpublished work and is not a releasable packed deployment.** Production Git pushes, cache/object/ref readers and generated producers still call legacy storage APIs, whose tables and bindings are absent from the selected production contract. Their conversion, product graph/policy/check/review consumers, and deletion of temporary SQL refs and inline response/certificate/plan adapters must complete together before release. Complete original SDK-command persistence/reconstruction for initialization and all initial/Claim/Renew/denied/pre-admission phases is still required; the new bootstrap is not proof of that recovery protocol. Actual typed collection/backup/isolated restore, retained-input adoption/repreparation, OS containment, accelerated reads/rewrites, continuous fair maintenance and complete repository/team qualification remain required. Format checks, startup fixtures and primitive publication tests do not prove that wider completion.
 
 ## Mandatory publication registration qualified locally
 

From 699810d08405e0e61965bb860093c109b4a09f98 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sat, 3 Oct 2026 19:57:16 -0700
Subject: [PATCH 04/55] Register and recover exact catalog initialization
 commands

---
 crates/canopy-server/src/lib.rs               |   6 +
 .../src/packs/publication/coordinator.rs      |   2 +
 .../publication/coordinator/initialization.rs |  97 +++++
 .../src/packs/publication/coordinator/work.rs |   5 +
 .../src/packs/publication/initialization.rs   |   2 +
 .../publication/initialization/publish.rs     | 243 ++++++------
 .../src/packs/publication/mod.rs              |   4 +-
 .../src/packs/publication/recovery/archive.rs |   5 +
 .../src/packs/publication/recovery/codec.rs   |   4 +
 .../publication/recovery/initialization.rs    |  84 ++++
 .../src/packs/publication/recovery/mod.rs     |  75 ++--
 .../src/packs/publication/recovery/phase.rs   |  14 +-
 .../src/packs/publication/recovery/ready.rs   |   4 +
 .../publication/recovery/registration.rs      |   2 +-
 .../src/packs/publication/tests.rs            |   1 +
 .../packs/publication/tests/durable_policy.rs |   7 +-
 .../publication/tests/durable_recovery.rs     |  25 +-
 .../packs/publication/tests/initialization.rs | 374 +++++++++++++-----
 .../tests/initialization_recovery.rs          | 298 ++++++++++++++
 .../tests/inputs/requests/results.rs          |  17 +-
 .../packs/publication/tests/native_capture.rs |  16 +-
 .../src/packs/publication/tests/ref_policy.rs |   7 +-
 .../publication/tests/terminal_retention.rs   |  28 +-
 .../src/server/catalog_initialization.rs      | 136 ++++---
 .../tests/multi_server/workspace.rs           |   1 +
 .../mandatory-publication-registration.md     |  23 +-
 docs/large-repository-implementation-plan.md  |   2 +-
 .../large-repository-implementation-status.md |  16 +-
 28 files changed, 1162 insertions(+), 336 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/coordinator/initialization.rs
 create mode 100644 crates/canopy-server/src/packs/publication/recovery/initialization.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 0a987506..1bcbe1cc 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -245,6 +245,12 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/ref_proof.rs"));
                 source.update(include_bytes!("packs/publication/ref_snapshot.rs"));
                 source.update(include_bytes!("packs/publication/initialization.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/coordinator/initialization.rs"
+                ));
+                source.update(include_bytes!(
+                    "packs/publication/recovery/initialization.rs"
+                ));
                 source.update(include_bytes!("packs/publication/ref_policy/mod.rs"));
                 source.update(include_bytes!("packs/publication/ref_policy/codec.rs"));
                 source.update(include_bytes!("packs/publication/ref_policy/commands.rs"));
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index 2ef53e49..bb2bc2de 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -22,7 +22,9 @@ use tokio::{
 /// Scratch/native work remains independently charged to its DiskBudget.
 const COMMAND_RESERVATION: u64 = 8 << 20;
 const INLINE_BYTES: u32 = 4 << 20;
+mod initialization;
 mod inputs;
+pub use initialization::ReadyInitialization;
 pub use inputs::{NativeInputReadyError, ReadyNativeInputs, RegisteredNativeInputs};
 mod policy;
 pub use policy::{ReadyRefPolicyPage, RefPolicyReadyError, RefPolicyRefusalFailure};
diff --git a/crates/canopy-server/src/packs/publication/coordinator/initialization.rs b/crates/canopy-server/src/packs/publication/coordinator/initialization.rs
new file mode 100644
index 00000000..a49816d2
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/coordinator/initialization.rs
@@ -0,0 +1,97 @@
+//! Initialization reuses exact registered recovery and original live custody.
+use super::*;
+use canopy_object_storage::artifact::ArtifactStore;
+
+/// Private empty-catalog proof and exact original SDK command. Registration
+/// precedes every dispatch; unknown registration cannot authorize execution.
+#[must_use]
+pub struct ReadyInitialization {
+    owner: Arc<PreparedCatalog>,
+    command: PreparedCommand<InitializeCatalogRefs>,
+}
+impl PreparedCatalog {
+    pub async fn ready_initialization(
+        self: &Arc<Self>,
+        identity: MutationIdentity,
+    ) -> Result<ReadyInitialization, InitializationPreparationError> {
+        let proof = self.empty_ref_initialization().await?;
+        let (client, target, _) = self.base.capability();
+        self.ensure_live()?;
+        let command = client
+            .prepare_command::<InitializeCatalogRefs>(target, identity, proof)
+            .await
+            .map_err(|error| InitializationPreparationError::Command(Box::new(error)))?;
+        self.ensure_live()?;
+        Ok(ReadyInitialization {
+            owner: Arc::clone(self),
+            command,
+        })
+    }
+}
+impl ReadyInitialization {
+    pub async fn persist_recovery(
+        &self,
+        store: &ArtifactStore,
+        identity: MutationIdentity,
+    ) -> Result<RegisteredRootRecovery, RootRecoveryError> {
+        super::super::recovery::persist(
+            &self.owner.base.session,
+            &self.command,
+            super::super::recovery::Kind::Initialization,
+            store,
+            identity,
+            0,
+        )
+        .await
+    }
+    /// Reuses the account-fair publication queue and its exact live-session
+    /// binding. A decoded recovery record cannot substitute for this owner.
+    pub fn bind_recovery(
+        self,
+        registered: RegisteredRootRecovery,
+        store: &ArtifactStore,
+    ) -> Result<ReadyBoundRecovery, Box<RecoveryBindingFailure<Self>>> {
+        if !self.matches(&registered, store) {
+            return Err(Box::new(RecoveryBindingFailure {
+                original: self,
+                registered,
+            }));
+        }
+        Ok(ReadyBoundRecovery::new(
+            PushPreparation::Catalog(self.owner),
+            None,
+            false,
+            registered,
+            store,
+        ))
+    }
+    fn matches(&self, registered: &RegisteredRootRecovery, store: &ArtifactStore) -> bool {
+        registered.matches_original(
+            super::super::recovery::Kind::Initialization,
+            self.command.evidence(),
+            None,
+            &self.owner.base.session,
+            store,
+        )
+    }
+    /// Repository startup already owns its bounded transition admission. Keep
+    /// this exact original session through its registered command and all I/O.
+    pub(crate) async fn complete(
+        self,
+        registered: &RegisteredRootRecovery,
+        store: &ArtifactStore,
+    ) -> Result<Committed<InitializationReply>, PublicationError> {
+        if !self.matches(registered, store) {
+            return Err(PublicationError::Recovery {
+                evidence: Box::new(self.command.evidence().clone()),
+                source: Box::new(RootRecoveryError::Context),
+            });
+        }
+        let client = self.owner.base.capability().0;
+        let result = registered
+            .dispatch_initialization(client, store, Some(&self.owner.base.session))
+            .await;
+        drop(self.owner);
+        result
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index 5db60bfe..9e2c42d7 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -254,6 +254,7 @@ impl ReadyPublication {
 
 #[derive(Clone, Debug)]
 pub enum PublicationOutcome {
+    Initialization(Committed<InitializationReply>),
     Push(Committed<CatalogCompletionReply>),
     RootPush(Committed<RootCompletionReply>),
     /// Original page result/receipt only; fresh guard checks remain mandatory.
@@ -265,6 +266,8 @@ pub enum PublicationOutcome {
 }
 #[derive(Debug, thiserror::Error)]
 pub enum PublicationError {
+    #[error("repository initialization publication: {0}")]
+    Initialization(#[source] InvocationError<InitializationReply>),
     #[error("terminal recovery release: {0}")]
     TerminalRelease(#[source] InvocationError<TerminalReleaseReply>),
     #[error("durable publication phase could not be observed: {source}")]
@@ -298,6 +301,7 @@ impl PublicationError {
         }
         match self {
             Self::Recovery { .. } => "pending",
+            Self::Initialization(error) => kind(error),
             Self::Push(error) => kind(error),
             Self::RootPush(error) => kind(error),
             Self::PolicyPage(error) => kind(error),
@@ -316,6 +320,7 @@ impl PublicationError {
         }
         match self {
             Self::Recovery { .. } => true,
+            Self::Initialization(error) => unknown(error),
             Self::Push(error) => unknown(error),
             Self::RootPush(error) => unknown(error),
             Self::PolicyPage(error) => unknown(error),
diff --git a/crates/canopy-server/src/packs/publication/initialization.rs b/crates/canopy-server/src/packs/publication/initialization.rs
index 528758f2..6770991d 100644
--- a/crates/canopy-server/src/packs/publication/initialization.rs
+++ b/crates/canopy-server/src/packs/publication/initialization.rs
@@ -12,6 +12,8 @@ const INITIAL_HEAD: &str = "refs/heads/main";
 
 #[derive(Debug, thiserror::Error)]
 pub enum InitializationPreparationError {
+    #[error("initialization command preparation failed")]
+    Command(#[source] Box<InvocationError<InitializationReply>>),
     #[error("initialization preparation is inactive")]
     Base(#[from] PreparationBaseError),
     #[error("initialization snapshot failed")]
diff --git a/crates/canopy-server/src/packs/publication/initialization/publish.rs b/crates/canopy-server/src/packs/publication/initialization/publish.rs
index 9bd47778..02c2d4ea 100644
--- a/crates/canopy-server/src/packs/publication/initialization/publish.rs
+++ b/crates/canopy-server/src/packs/publication/initialization/publish.rs
@@ -53,132 +53,149 @@ pub struct InitializeCatalogRefs;
 impl Command for InitializeCatalogRefs {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 31;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = InitialRefProof;
     type Output = InitializationReply;
     fn execute(
         context: &mut CommandContext<'_, '_>,
         input: Self::Input,
     ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
-        input.shape()?;
-        let Some((data, key)) = authenticate(
-            context,
-            &input.certificate,
-            Some(binding(input.refs)?),
-            None,
-        )?
-        else {
-            return Ok(denied(PreparationDenial::Unauthorized));
+        let data = input.certificate.data()?;
+        let check = LeaseCheck {
+            token: data.token,
+            actor: data.actor,
         };
-        let logical = context.sql(&statement("SELECT actor,request_digest,verification_digest,result FROM catalog_initialization WHERE id=?1", vec![blob(data.token.operation)]))?;
-        if let Some(row) = rows(&logical)?.first() {
-            let [
-                SqlValue::Text(actor),
-                request,
-                digest,
-                SqlValue::Blob(bytes),
-            ] = row.as_slice()
-            else {
-                return Err(Error::Command("invalid initialization outcome"));
-            };
-            if *actor != data.actor
-                || fixed::<32>(request)? != data.token.request_digest
-                || fixed::<32>(digest)? != verification(data.catalog, input.refs)?
-            {
-                return Ok(denied(PreparationDenial::Conflict));
-            }
-            return Ok(CommandResult::Success(InitializationReply::Initialized(
-                Box::new(saved(
-                    bytes,
-                    data.token.repository,
-                    data.catalog.format,
-                    fixed(digest)?,
-                )?),
-            )));
-        }
-        // Exact recorded replay above grants no write. New initialization must
-        // satisfy the current actual fence, admin role, pin and pristine state.
-        if data.token.owner != context.owner_fence() {
-            return Ok(denied(PreparationDenial::Stale));
-        }
-        let Some(format) = authorized(
-            context,
-            data.token.repository,
-            &data.actor,
-            TokenScope::Admin,
-        )?
+        recovery::execute(context, &check, recovery::Kind::Initialization, |context| {
+            initialize(context, input)
+        })
+    }
+}
+
+fn initialize(
+    context: &mut CommandContext<'_, '_>,
+    input: InitialRefProof,
+) -> cellule_runtime::Result<CommandResult<InitializationReply>> {
+    input.shape()?;
+    let Some((data, key)) = authenticate(
+        context,
+        &input.certificate,
+        Some(binding(input.refs)?),
+        None,
+    )?
+    else {
+        return Ok(denied(PreparationDenial::Unauthorized));
+    };
+    let logical = context.sql(&statement("SELECT actor,request_digest,verification_digest,result FROM catalog_initialization WHERE id=?1", vec![blob(data.token.operation)]))?;
+    if let Some(row) = rows(&logical)?.first() {
+        let [
+            SqlValue::Text(actor),
+            request,
+            digest,
+            SqlValue::Blob(bytes),
+        ] = row.as_slice()
         else {
-            return Ok(denied(PreparationDenial::Unauthorized));
+            return Err(Error::Command("invalid initialization outcome"));
         };
-        let Some(row) = load(context, data.token)? else {
-            return Ok(denied(PreparationDenial::Missing));
-        };
-        if !matched(
-            &row,
-            &LeaseCheck {
-                token: data.token,
-                actor: data.actor.clone(),
-            },
-        ) {
-            return Ok(denied(PreparationDenial::Stale));
-        }
-        if row.expires <= now(context.now_ms())? {
-            return Ok(denied(PreparationDenial::Expired));
-        }
-        check_pin(context, &row)?;
-        if format != data.catalog.format
-            || !retention_matches(context, &data, row.generation, format)?
-            || fact(context, data.token.repository, format, None)? != data.base
+        if *actor != data.actor
+            || fixed::<32>(request)? != data.token.request_digest
+            || fixed::<32>(digest)? != verification(data.catalog, input.refs)?
         {
             return Ok(denied(PreparationDenial::Conflict));
         }
-        let pristine = context.sql(&statement("SELECT generation=0 AND default_branch=?1 AND NOT EXISTS(SELECT 1 FROM refs) AND NOT EXISTS(SELECT 1 FROM pushes WHERE initial_staging IS NULL OR response_id IS NOT NULL OR publication IS NOT NULL) AND NOT EXISTS(SELECT 1 FROM catalog_compactions) AND NOT EXISTS(SELECT 1 FROM catalog_initialization) AND NOT EXISTS(SELECT 1 FROM catalog_generations WHERE generation>0) FROM ref_generation WHERE singleton=1", vec![SqlValue::Text(INITIAL_HEAD.into())]))?;
-        match rows(&pristine)?.first().map(Vec::as_slice) {
-            Some([SqlValue::Integer(1)]) => {}
-            Some([SqlValue::Integer(0)]) => return Ok(denied(PreparationDenial::Conflict)),
-            _ => return Err(Error::Command("missing initialization state")),
-        }
-        let Some(missing) = checkpoint(context, &data, &key)? else {
-            return Ok(denied(PreparationDenial::Conflict));
-        };
-        let verified_roots = verification(data.catalog, input.refs)?;
-        let bytes = input.certificate.bytes()?;
-        let digest = *blake3::hash(&bytes).as_bytes();
-        let result = GenerationFact {
-            generation: 1,
-            catalog: Some(data.catalog),
-            refs: Some(input.refs),
-            certificate: Some(digest),
-        };
-        let mut encoded = BoundedEncoder::new(512)?;
-        result.encode(&mut encoded)?;
-        let mut catalog = BoundedEncoder::new(256)?;
-        data.catalog.encode(&mut catalog)?;
-        let mut refs = BoundedEncoder::new(128)?;
-        input.refs.encode(&mut refs)?;
-        if row.expires <= now(context.now_ms())? {
-            return Ok(denied(PreparationDenial::Expired));
-        }
-        // No rejection after the first write: later failures abort all roots,
-        // the durable outcome and checkpoint together at the Cell ACK gate.
-        if missing {
-            changed(context.sql(&statement("UPDATE catalog_operations SET attestation=?1,attestation_digest=?2 WHERE id=?3 AND attestation IS NULL", vec![blob(&bytes),blob(digest),blob(data.token.operation)]))?)?;
-            changed(context.sql(&statement("UPDATE catalog_leases SET attestation=?1,attestation_digest=?2 WHERE incarnation=?3 AND admission_sequence=?4 AND attestation IS NULL", vec![blob(&bytes),blob(digest),blob(data.token.owner.incarnation.as_bytes()),number(data.token.attempt)?]))?)?;
-        }
-        changed(context.sql(&statement("INSERT INTO catalog_generations(generation,catalog,certificate,refs) VALUES(1,?1,?2,?3)", vec![blob(catalog.finish()),blob(digest),blob(refs.finish())]))?)?;
-        changed(context.sql(&statement(
-            "UPDATE catalog_state SET generation=1 WHERE singleton=1 AND generation=0",
-            vec![],
-        ))?)?;
-        changed(context.sql(&statement("INSERT INTO catalog_initialization(singleton,id,actor,request_digest,verification_digest,result) VALUES(1,?1,?2,?3,?4,?5)", vec![blob(data.token.operation),SqlValue::Text(data.actor),blob(data.token.request_digest),blob(verified_roots),blob(encoded.finish())]))?)?;
-        changed(context.sql(&statement(
-            "DELETE FROM catalog_operations WHERE id=?1",
-            vec![blob(data.token.operation)],
-        ))?)?;
-        Ok(CommandResult::Success(InitializationReply::Initialized(
-            Box::new(result),
-        )))
+        return Ok(CommandResult::Success(InitializationReply::Initialized(
+            Box::new(saved(
+                bytes,
+                data.token.repository,
+                data.catalog.format,
+                fixed(digest)?,
+            )?),
+        )));
+    }
+    // Exact recorded replay above grants no write. New initialization must
+    // satisfy the current actual fence, admin role, pin and pristine state.
+    if data.token.owner != context.owner_fence() {
+        return Ok(denied(PreparationDenial::Stale));
+    }
+    let Some(format) = authorized(
+        context,
+        data.token.repository,
+        &data.actor,
+        TokenScope::Admin,
+    )?
+    else {
+        return Ok(denied(PreparationDenial::Unauthorized));
+    };
+    let Some(row) = load(context, data.token)? else {
+        return Ok(denied(PreparationDenial::Missing));
+    };
+    if !matched(
+        &row,
+        &LeaseCheck {
+            token: data.token,
+            actor: data.actor.clone(),
+        },
+    ) {
+        return Ok(denied(PreparationDenial::Stale));
+    }
+    if row.expires <= now(context.now_ms())? {
+        return Ok(denied(PreparationDenial::Expired));
+    }
+    check_pin(context, &row)?;
+    if format != data.catalog.format
+        || !retention_matches(context, &data, row.generation, format)?
+        || fact(context, data.token.repository, format, None)? != data.base
+    {
+        return Ok(denied(PreparationDenial::Conflict));
+    }
+    let pristine = context.sql(&statement("SELECT generation=0 AND default_branch=?1 AND NOT EXISTS(SELECT 1 FROM refs) AND NOT EXISTS(SELECT 1 FROM pushes WHERE initial_staging IS NULL OR response_id IS NOT NULL OR publication IS NOT NULL) AND NOT EXISTS(SELECT 1 FROM catalog_compactions) AND NOT EXISTS(SELECT 1 FROM catalog_initialization) AND NOT EXISTS(SELECT 1 FROM catalog_generations WHERE generation>0) FROM ref_generation WHERE singleton=1", vec![SqlValue::Text(INITIAL_HEAD.into())]))?;
+    match rows(&pristine)?.first().map(Vec::as_slice) {
+        Some([SqlValue::Integer(1)]) => {}
+        Some([SqlValue::Integer(0)]) => return Ok(denied(PreparationDenial::Conflict)),
+        _ => return Err(Error::Command("missing initialization state")),
+    }
+    let Some(missing) = checkpoint(context, &data, &key)? else {
+        return Ok(denied(PreparationDenial::Conflict));
+    };
+    let verified_roots = verification(data.catalog, input.refs)?;
+    let bytes = input.certificate.bytes()?;
+    let digest = *blake3::hash(&bytes).as_bytes();
+    let result = GenerationFact {
+        generation: 1,
+        catalog: Some(data.catalog),
+        refs: Some(input.refs),
+        certificate: Some(digest),
+    };
+    let mut encoded = BoundedEncoder::new(512)?;
+    result.encode(&mut encoded)?;
+    let mut catalog = BoundedEncoder::new(256)?;
+    data.catalog.encode(&mut catalog)?;
+    let mut refs = BoundedEncoder::new(128)?;
+    input.refs.encode(&mut refs)?;
+    if row.expires <= now(context.now_ms())? {
+        return Ok(denied(PreparationDenial::Expired));
+    }
+    // No rejection after the first write: later failures abort all roots,
+    // the durable outcome and checkpoint together at the Cell ACK gate.
+    if missing {
+        changed(context.sql(&statement("UPDATE catalog_operations SET attestation=?1,attestation_digest=?2 WHERE id=?3 AND attestation IS NULL", vec![blob(&bytes),blob(digest),blob(data.token.operation)]))?)?;
+        changed(context.sql(&statement("UPDATE catalog_leases SET attestation=?1,attestation_digest=?2 WHERE incarnation=?3 AND admission_sequence=?4 AND attestation IS NULL", vec![blob(&bytes),blob(digest),blob(data.token.owner.incarnation.as_bytes()),number(data.token.attempt)?]))?)?;
     }
+    changed(context.sql(&statement(
+        "INSERT INTO catalog_generations(generation,catalog,certificate,refs) VALUES(1,?1,?2,?3)",
+        vec![blob(catalog.finish()), blob(digest), blob(refs.finish())],
+    ))?)?;
+    changed(context.sql(&statement(
+        "UPDATE catalog_state SET generation=1 WHERE singleton=1 AND generation=0",
+        vec![],
+    ))?)?;
+    changed(context.sql(&statement("INSERT INTO catalog_initialization(singleton,id,actor,request_digest,verification_digest,result) VALUES(1,?1,?2,?3,?4,?5)", vec![blob(data.token.operation),SqlValue::Text(data.actor),blob(data.token.request_digest),blob(verified_roots),blob(encoded.finish())]))?)?;
+    changed(context.sql(&statement(
+        "DELETE FROM catalog_operations WHERE id=?1",
+        vec![blob(data.token.operation)],
+    ))?)?;
+    Ok(CommandResult::Success(InitializationReply::Initialized(
+        Box::new(result),
+    )))
 }
 
 /// Fresh read authorization and exact logical identity; no namespace allocation
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 6cd0af84..a51f6384 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -61,8 +61,8 @@ pub use coordinator::{
     PreparationReadyError, PublicationAdmissionFailure, PublicationClass, PublicationCoordinator,
     PublicationError, PublicationLimits, PublicationOutcome, PublicationScheduleError,
     PublicationState, PublicationStats, PublicationTicket, ReadyBoundRecovery,
-    ReadyCatalogCompaction, ReadyCatalogPush, ReadyNativeInputs, ReadyPreparation,
-    ReadyPublication, ReadyRefPolicyPage, ReadyRootPush, RecoveryBindingFailure,
+    ReadyCatalogCompaction, ReadyCatalogPush, ReadyInitialization, ReadyNativeInputs,
+    ReadyPreparation, ReadyPublication, ReadyRefPolicyPage, ReadyRootPush, RecoveryBindingFailure,
     RefPolicyReadyError, RefPolicyRefusalFailure, RegisteredNativeInputs, RootPushReadyError,
 };
 mod commands;
diff --git a/crates/canopy-server/src/packs/publication/recovery/archive.rs b/crates/canopy-server/src/packs/publication/recovery/archive.rs
index d28abb61..e1b0c9f4 100644
--- a/crates/canopy-server/src/packs/publication/recovery/archive.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/archive.rs
@@ -126,6 +126,11 @@ impl phase::Journal {
     ) -> Result<Option<CompletedRootPush>, CodecError> {
         // Validation is required even when only a primary result is selected.
         self.may_advance(record)?;
+        if record.kind == Kind::Initialization {
+            // Initial catalog roots have no native push response/audit graph.
+            // Keep their recovery pin until typed initialization retirement.
+            return Ok(None);
+        }
         let result = if record.kind == Kind::Policy {
             if !self.refused(record)? {
                 return Ok(None);
diff --git a/crates/canopy-server/src/packs/publication/recovery/codec.rs b/crates/canopy-server/src/packs/publication/recovery/codec.rs
index 4f0afd00..e0e15658 100644
--- a/crates/canopy-server/src/packs/publication/recovery/codec.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/codec.rs
@@ -27,6 +27,7 @@ impl WireValue for Record {
             Kind::Publish => 0,
             Kind::Outcome => 1,
             Kind::Policy => 2,
+            Kind::Initialization => 3,
         })?;
         self.primary.encode(e)?;
         e.write_bool(self.refusal.is_some())?;
@@ -52,6 +53,7 @@ impl WireValue for Record {
                 0 => Kind::Publish,
                 1 => Kind::Outcome,
                 2 => Kind::Policy,
+                3 => Kind::Initialization,
                 _ => return Err(CodecError::Invalid("root recovery command")),
             },
             primary: Stamp::decode(d)?,
@@ -86,6 +88,7 @@ impl WireValue for Bundle {
             Kind::Publish => 0,
             Kind::Outcome => 1,
             Kind::Policy => 2,
+            Kind::Initialization => 3,
         })?;
         self.primary.encode(e)?;
         e.write_bool(self.refusal.is_some())?;
@@ -103,6 +106,7 @@ impl WireValue for Bundle {
                 0 => Kind::Publish,
                 1 => Kind::Outcome,
                 2 => Kind::Policy,
+                3 => Kind::Initialization,
                 _ => return Err(CodecError::Invalid("unknown recovery kind")),
             },
             primary: SavedCommand::decode(d)?,
diff --git a/crates/canopy-server/src/packs/publication/recovery/initialization.rs b/crates/canopy-server/src/packs/publication/recovery/initialization.rs
new file mode 100644
index 00000000..df126aee
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/recovery/initialization.rs
@@ -0,0 +1,84 @@
+//! Exact initialization discovery, receipts and command restoration.
+use super::*;
+
+impl RegisteredRootRecovery {
+    /// Discover only the current initialization attempt, using the indexed
+    /// operation/lease binding. Historical metadata grants knowledge, not Write.
+    pub async fn load_initialization(
+        client: &CellClient,
+        target: &CellTarget,
+        store: &ArtifactStore,
+        input: &BeginRequest,
+    ) -> Result<Option<Self>, RootRecoveryError> {
+        if crate::repository_target(target.tenant(), target.application(), input.repository)?
+            != *target
+            || store.repository() != input.repository
+        {
+            return Err(RootRecoveryError::Context);
+        }
+        let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
+        let observed = sql.query(None, statement(
+            "SELECT o.incarnation,o.admission_sequence FROM catalog_operations o JOIN catalog_leases l ON l.incarnation=o.incarnation AND l.admission_sequence=o.admission_sequence WHERE o.id=?1 AND o.actor=?2 AND o.request_digest=?3 AND o.generation=0 AND l.recovery IS NOT NULL",
+            vec![blob(input.operation),SqlValue::Text(input.actor.clone()),blob(input.request_digest)]
+        )).await.map_err(|error| RootRecoveryError::Query(Box::new(error)))?;
+        let Some([incarnation, sequence]) = rows(&observed.output)?.first().map(Vec::as_slice)
+        else {
+            if rows(&observed.output)?.is_empty() {
+                return Ok(None);
+            }
+            return Err(RootRecoveryError::Context);
+        };
+        let loaded = Self::load_pin(
+            client,
+            target,
+            store,
+            IncarnationId::from_bytes(fixed(incarnation)?),
+            unsigned(sequence)?,
+            None,
+        )
+        .await?
+        .ok_or(RootRecoveryError::Context)?;
+        if loaded.record.kind != Kind::Initialization
+            || loaded.record.check.actor != input.actor
+            || loaded.token().operation != input.operation
+            || loaded.token().request_digest != input.request_digest
+        {
+            return Err(RootRecoveryError::Context);
+        }
+        Ok(Some(loaded))
+    }
+    /// Original durable phase knowledge wins before body reads and fresh
+    /// custody. Only authoritative SDK absence can execute the saved bytes.
+    pub async fn recover_initialization(
+        &self,
+        client: &CellClient,
+        store: &ArtifactStore,
+    ) -> Result<Committed<InitializationReply>, PublicationError> {
+        self.dispatch_initialization(client, store, None).await
+    }
+    pub(in crate::packs::publication) async fn dispatch_initialization(
+        &self,
+        client: &CellClient,
+        store: &ArtifactStore,
+        original: Option<&PreparationSession>,
+    ) -> Result<Committed<InitializationReply>, PublicationError> {
+        if self.record.kind != Kind::Initialization {
+            return Err(PublicationError::Recovery {
+                evidence: Box::new(self.evidence().clone()),
+                source: Box::new(RootRecoveryError::Context),
+            });
+        }
+        let result = self
+            .dispatch_command::<InitializeCatalogRefs>(client, store, false, original)
+            .await
+            .map_err(|error| {
+                error.publication(self.evidence(), PublicationError::Initialization)
+            })?;
+        if matches!(result.output, InitializationReply::Denied(_)) {
+            return Err(PublicationError::Initialization(InvocationError::Rejected(
+                Box::new(result),
+            )));
+        }
+        Ok(result)
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index 7a3c077a..e7b843b2 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -16,6 +16,7 @@ use cellule_runtime::{
 };
 pub(in crate::packs::publication) mod archive;
 mod codec;
+mod initialization;
 mod ready;
 mod supervisor;
 pub use archive::{
@@ -34,7 +35,7 @@ pub(in crate::packs::publication) use phase::execute;
 pub(in crate::packs::publication) use phase::normalize_root;
 
 const ROOT_BYTES: u32 = 8192;
-const DOMAIN: &[u8] = b"canopy.publication-command-recovery.v3\0";
+const DOMAIN: &[u8] = b"canopy.publication-command-recovery.v4\0";
 
 #[derive(Debug, thiserror::Error)]
 pub enum RootRecoveryError {
@@ -74,10 +75,13 @@ pub(super) enum Kind {
     Publish,
     Outcome,
     Policy,
+    Initialization,
 }
 impl Kind {
     fn body_limit(self) -> u32 {
-        if self == Self::Policy {
+        if self == Self::Initialization {
+            INITIALIZATION_BYTES
+        } else if self == Self::Policy {
             REF_POLICY_PAGE_BYTES
         } else {
             ROOT_COMPLETION_BYTES
@@ -323,9 +327,11 @@ impl RegisteredRootRecovery {
                 self.dispatch_command::<CompleteRootOutcome>(client, store, false, original)
                     .await
             }
-            Kind::Policy => Err(AttemptError::Invocation(InvocationError::NotStarted(
-                Error::Command("policy recovery requires phase dispatch"),
-            ))),
+            Kind::Policy | Kind::Initialization => {
+                Err(AttemptError::Invocation(InvocationError::NotStarted(
+                    Error::Command("recovery kind requires typed phase dispatch"),
+                )))
+            }
         };
         match result {
             Ok(value) => phase::normalize_root(Ok(value)).map_err(PublicationError::RootPush),
@@ -356,6 +362,12 @@ impl RegisteredRootRecovery {
         original: Option<&PreparationSession>,
         #[cfg(test)] refusal_fault: Option<&std::sync::atomic::AtomicU8>,
     ) -> Result<PublicationOutcome, PublicationError> {
+        if self.record.kind == Kind::Initialization {
+            return self
+                .dispatch_initialization(client, store, original)
+                .await
+                .map(PublicationOutcome::Initialization);
+        }
         if self.record.kind != Kind::Policy {
             let result = match original {
                 Some(original) => self.dispatch_root(client, store, Some(original)).await,
@@ -517,31 +529,38 @@ impl RegisteredRootRecovery {
         // would change both fencing semantics and refusal behavior: the final
         // transaction must still be able to select rejection after ACL loss.
         // Standalone recovery reacquires custody for positive work.
-        let session = if refusal_only || original.is_some() {
-            None
-        } else {
-            match PreparationSession::open(
-                client.clone(),
-                self.evidence().target().clone(),
-                self.record.check.clone(),
-                None,
-            )
-            .await
-            {
-                Ok(session) => Some(session),
-                Err(error) => {
-                    if let Some(known) = self.known::<C>(client, store, refusal).await? {
-                        return Ok(known);
+        // Initialization performs no new preparation or native work. Its
+        // frozen receiver checks Admin, the actual owner, live pin, checkpoint
+        // and pristine roots in the committing transaction. Requiring a fresh
+        // Write query here would hide an expired/revoked attempt before that
+        // original command could record its definitive denial. Bound live
+        // initialization still retains and checks its original local guard.
+        let session =
+            if refusal_only || self.record.kind == Kind::Initialization || original.is_some() {
+                None
+            } else {
+                match PreparationSession::open(
+                    client.clone(),
+                    self.evidence().target().clone(),
+                    self.record.check.clone(),
+                    None,
+                )
+                .await
+                {
+                    Ok(session) => Some(session),
+                    Err(error) => {
+                        if let Some(known) = self.known::<C>(client, store, refusal).await? {
+                            return Ok(known);
+                        }
+                        return Err(AttemptError::Invocation(InvocationError::NotStarted(
+                            Error::Facility {
+                                name: "publication recovery custody",
+                                source: Box::new(error),
+                            },
+                        )));
                     }
-                    return Err(AttemptError::Invocation(InvocationError::NotStarted(
-                        Error::Facility {
-                            name: "publication recovery custody",
-                            source: Box::new(error),
-                        },
-                    )));
                 }
-            }
-        };
+            };
         // A command can settle while body I/O or custody acquisition is in flight.
         if let Some(known) = self.known::<C>(client, store, refusal).await? {
             return Ok(known);
diff --git a/crates/canopy-server/src/packs/publication/recovery/phase.rs b/crates/canopy-server/src/packs/publication/recovery/phase.rs
index 2e897b68..cb011547 100644
--- a/crates/canopy-server/src/packs/publication/recovery/phase.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/phase.rs
@@ -84,7 +84,12 @@ pub(super) struct Journal {
 impl Journal {
     fn validate(&self, record: &Record) -> Result<(), CodecError> {
         if let Some(primary) = &self.primary {
-            let denied = if record.kind == Kind::Policy {
+            let denied = if record.kind == Kind::Initialization {
+                matches!(
+                    primary.decode_reply::<InitializationReply>()?,
+                    InitializationReply::Denied(_)
+                )
+            } else if record.kind == Kind::Policy {
                 matches!(
                     primary.decode_reply::<RefPolicyReply>()?,
                     RefPolicyReply::Denied(_)
@@ -140,7 +145,12 @@ impl Journal {
         let Some(primary) = &self.primary else {
             return Ok(false);
         };
-        Ok(if record.kind == Kind::Policy {
+        Ok(if record.kind == Kind::Initialization {
+            matches!(
+                primary.decode_reply::<InitializationReply>()?,
+                InitializationReply::Denied(_)
+            )
+        } else if record.kind == Kind::Policy {
             matches!(primary.decode_reply::<RefPolicyReply>()?, RefPolicyReply::Registered(value) if value.valid)
         } else {
             matches!(
diff --git a/crates/canopy-server/src/packs/publication/recovery/ready.rs b/crates/canopy-server/src/packs/publication/recovery/ready.rs
index c98e9759..faf00b61 100644
--- a/crates/canopy-server/src/packs/publication/recovery/ready.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/ready.rs
@@ -92,6 +92,10 @@ impl ReadyRootRecovery {
             PublicationError::RootPush(InvocationError::Pending(Box::new(
                 saved.snapshot.evidence().clone(),
             )))
+        } else if self.recovery.record.kind == Kind::Initialization {
+            PublicationError::Initialization(InvocationError::Pending(Box::new(
+                self.recovery.evidence().clone(),
+            )))
         } else if self.recovery.record.kind == Kind::Policy {
             PublicationError::PolicyPage(InvocationError::Pending(Box::new(
                 self.recovery.evidence().clone(),
diff --git a/crates/canopy-server/src/packs/publication/recovery/registration.rs b/crates/canopy-server/src/packs/publication/recovery/registration.rs
index 3920ff85..37a38a10 100644
--- a/crates/canopy-server/src/packs/publication/recovery/registration.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/registration.rs
@@ -5,7 +5,7 @@ pub struct RegisterRootRecovery;
 impl Command for RegisterRootRecovery {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 39;
-    const CODEC_VERSION: u32 = 3;
+    const CODEC_VERSION: u32 = 4;
     type Input = RootRecoveryCertificate;
     type Output = RootRecoveryReply;
     fn execute(
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 29fa26c1..77ffe90c 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -7,6 +7,7 @@ mod durable_policy;
 mod durable_recovery;
 mod frontier;
 mod initialization;
+mod initialization_recovery;
 mod inputs;
 mod mandatory_registration;
 mod namespaces;
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
index 0628d856..2db9aec7 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
@@ -73,8 +73,9 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
             f.client().resolve(&first_evidence).await?,
             Resolution::Absent
         ));
+        let token = check.token;
         f.handle
-            .query(0, 128, |db| {
+            .query(0, 128, move |db| {
                 assert_eq!(
                     db.query_row("SELECT count(*) FROM ref_policy_guards", [], |row| row
                         .get::<_, u64>(0))?,
@@ -82,8 +83,8 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
                 );
                 assert_eq!(
                     db.query_row(
-                        "SELECT count(*) FROM catalog_leases WHERE recovery_phase IS NOT NULL",
-                        [],
+                        "SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 AND recovery_phase IS NOT NULL",
+                        rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt],
                         |row| row.get::<_, u64>(0)
                     )?,
                     0
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
index 59040b44..abf0a58c 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
@@ -154,12 +154,13 @@ async fn qualify_ready(
             .evidence(),
         &original
     );
+    let token = check.token;
     let persisted = f
         .handle
-        .query(0, 1024, |db| {
+        .query(0, 1024, move |db| {
             Ok(db.query_row(
-                "SELECT recovery FROM catalog_leases WHERE recovery IS NOT NULL",
-                [],
+                "SELECT recovery FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 AND recovery IS NOT NULL",
+                rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt],
                 |row| row.get::<_, Vec<u8>>(0),
             )?)
         })
@@ -289,7 +290,7 @@ async fn qualify_ready(
                         .output
                         .is_none()
                 );
-                assert_pin_retained(&handle).await?;
+                assert_pin_retained(&handle, check.token).await?;
                 runtime.shutdown().await?;
                 return Ok(());
             }
@@ -309,7 +310,7 @@ async fn qualify_ready(
                 .is_none()
         );
     }
-    assert_pin_retained(&handle).await?;
+    assert_pin_retained(&handle, check.token).await?;
     runtime.shutdown().await?;
     Ok(())
 }
@@ -326,26 +327,26 @@ pub(super) async fn read_response(
         body,
     })
 }
-async fn assert_pin_retained(handle: &CellHandle) -> Result {
+async fn assert_pin_retained(handle: &CellHandle, token: PreparationToken) -> Result {
     handle
-        .query(0, 32, |db| {
+        .query(0, 32, move |db| {
             assert_eq!(
                 db.query_row(
-                    "SELECT count(*) FROM catalog_leases WHERE recovery IS NOT NULL",
-                    [],
+                    "SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 AND recovery IS NOT NULL",
+                    rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt],
                     |row| row.get::<_, u64>(0)
                 )?,
                 1
             );
             assert!(
                 db.execute(
-                    "UPDATE catalog_leases SET recovery=NULL WHERE recovery IS NOT NULL",
-                    []
+                    "UPDATE catalog_leases SET recovery=NULL WHERE incarnation=?1 AND admission_sequence=?2 AND recovery IS NOT NULL",
+                    rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt]
                 )
                 .is_err()
             );
             assert!(
-                db.execute("DELETE FROM catalog_leases WHERE recovery IS NOT NULL", [])
+                db.execute("DELETE FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 AND recovery IS NOT NULL", rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt])
                     .is_err()
             );
             Ok(Vec::new())
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization.rs b/crates/canopy-server/src/packs/publication/tests/initialization.rs
index 8fff8765..c5e01f7e 100644
--- a/crates/canopy-server/src/packs/publication/tests/initialization.rs
+++ b/crates/canopy-server/src/packs/publication/tests/initialization.rs
@@ -10,7 +10,7 @@ use crate::packs::{
 use canopy_object_storage::artifact::ArtifactStore;
 use cellule_ltx::DiskBudget;
 
-async fn empty(
+pub(super) async fn empty(
     fixture: &Fixture,
     operation: [u8; 16],
     store: Arc<ArtifactStore>,
@@ -30,17 +30,133 @@ fn initialized(reply: InitializationReply) -> Result<GenerationFact> {
         InitializationReply::Denied(why) => Err(format!("initialization denied {why:?}").into()),
     }
 }
-async fn reject(fixture: &Fixture, input: InitialRefProof, reason: PreparationDenial) -> Result {
-    let before = state(&fixture.handle).await?;
-    let result = fixture
+pub(super) async fn registered(
+    fixture: &Fixture,
+    prepared: &PreparedCatalog,
+    input: InitialRefProof,
+    mutation: MutationIdentity,
+) -> Result<(
+    cellule_runtime::PreparedCommand<InitializeCatalogRefs>,
+    RegisteredRootRecovery,
+)> {
+    let command = fixture
         .client()
-        .command::<InitializeCatalogRefs>(&fixture.target, identity()?, input)
+        .prepare_command::<InitializeCatalogRefs>(&fixture.target, mutation, input)
+        .await?;
+    let record = super::super::recovery::persist(
+        &prepared.base.session,
+        &command,
+        super::super::recovery::Kind::Initialization,
+        &prepared.base.indexes().store(),
+        identity()?,
+        0,
+    )
+    .await?;
+    Ok((command, record))
+}
+async fn reject(
+    fixture: &Fixture,
+    command: cellule_runtime::PreparedCommand<InitializeCatalogRefs>,
+    registered: &RegisteredRootRecovery,
+    store: &ArtifactStore,
+    reason: PreparationDenial,
+) -> Result {
+    let before = state(&fixture.handle).await?;
+    let evidence = command.evidence().clone();
+    let result = command.execute().await?;
+    assert_eq!(result.output, InitializationReply::Denied(reason));
+    assert_eq!(state(&fixture.handle).await?, before);
+    assert!(matches!(
+        fixture.client().resolve(&evidence).await?,
+        cellule_runtime::Resolution::Committed(
+            cellule_runtime::cell::executor::StoredOutcome::Success { .. }
+        )
+    ));
+    let recovered = registered
+        .recover_initialization(&fixture.client(), store)
         .await;
     assert!(
-        matches!(result,Err(InvocationError::Rejected(ref value)) if value.output==InitializationReply::Denied(reason)),
+        matches!(recovered,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==result.receipt && value.output==result.output)
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn unregistered_initialization_keeps_sdk_and_catalog_absent() -> Result {
+    let fixture = Fixture::new(ObjectFormat::Sha1).await?;
+    let store = Arc::new(ArtifactStore::new(
+        Arc::new(InMemory::new()),
+        fixture.repository,
+    ));
+    let (prepared, root, budget) = empty(&fixture, [229; 16], store).await?;
+    let command = fixture
+        .client()
+        .prepare_command::<InitializeCatalogRefs>(
+            &fixture.target,
+            identity()?,
+            prepared.empty_ref_initialization().await?,
+        )
+        .await?;
+    let evidence = command.evidence().clone();
+    let before = state(&fixture.handle).await?;
+    let result = command.execute().await;
+    assert!(
+        matches!(result, Err(InvocationError::NotStarted(_))),
         "{result:?}"
     );
     assert_eq!(state(&fixture.handle).await?, before);
+    assert!(matches!(
+        fixture.client().resolve(&evidence).await?,
+        cellule_runtime::Resolution::Absent
+    ));
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    fixture.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_initialization_records_original_expiry_and_revocation_denials() -> Result {
+    for (sql, reason) in [
+        (
+            "UPDATE catalog_leases SET expires_at_ms=0; UPDATE catalog_operations SET expires_at_ms=0",
+            PreparationDenial::Expired,
+        ),
+        (
+            "UPDATE repository_identity SET owner='replacement'",
+            PreparationDenial::Unauthorized,
+        ),
+    ] {
+        let fixture = Fixture::new(ObjectFormat::Sha256).await?;
+        let store = Arc::new(ArtifactStore::new(
+            Arc::new(InMemory::new()),
+            fixture.repository,
+        ));
+        let (prepared, root, budget) = empty(&fixture, [231; 16], store.clone()).await?;
+        let proof = prepared.empty_ref_initialization().await?;
+        let (command, registered) = registered(&fixture, &prepared, proof, identity()?).await?;
+        let evidence = command.evidence().clone();
+        drop(command);
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        edit(&fixture, sql).await?;
+        let before = state(&fixture.handle).await?;
+        let result = registered
+            .recover_initialization(&fixture.client(), &store)
+            .await;
+        assert!(
+            matches!(result,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.output==InitializationReply::Denied(reason)),
+            "{result:?}"
+        );
+        assert_eq!(state(&fixture.handle).await?, before);
+        assert!(matches!(
+            fixture.client().resolve(&evidence).await?,
+            cellule_runtime::Resolution::Committed(
+                cellule_runtime::cell::executor::StoredOutcome::Success { .. }
+            )
+        ));
+        fixture.runtime.shutdown().await?;
+    }
     Ok(())
 }
 
@@ -78,10 +194,9 @@ async fn fresh_initialization_commits_joint_empty_roots_and_enables_first_ref_pr
                 .is_none()
         );
         let mutation = identity()?;
-        let committed = fixture
-            .client()
-            .command::<InitializeCatalogRefs>(&fixture.target, mutation, proof.clone())
-            .await?;
+        let (command, registered) =
+            registered(&fixture, &prepared, proof.clone(), mutation).await?;
+        let committed = command.clone().execute().await?;
         let fact = initialized(committed.output.clone())?;
         let mut e = BoundedEncoder::new(512)?;
         committed.output.encode(&mut e)?;
@@ -130,13 +245,19 @@ async fn fresh_initialization_commits_joint_empty_roots_and_enables_first_ref_pr
                 .receipt,
             committed.receipt
         );
-        assert_eq!(
+        assert!(matches!(
             fixture
                 .client()
                 .command::<InitializeCatalogRefs>(&fixture.target, identity()?, proof.clone())
-                .await?
-                .output,
-            committed.output
+                .await,
+            Err(InvocationError::NotStarted(_))
+        ));
+        let recovered = registered
+            .recover_initialization(&fixture.client(), &store)
+            .await?;
+        assert_eq!(
+            (recovered.output, recovered.receipt),
+            (committed.output.clone(), committed.receipt)
         );
         assert_eq!(
             fixture
@@ -230,53 +351,76 @@ async fn initialization_refuses_history_head_changes_revocation_expiry_and_forge
             Arc::new(InMemory::new()),
             fixture.repository,
         ));
-        let (prepared, root, budget) = empty(&fixture, [223; 16], store).await?;
+        let (prepared, root, budget) = empty(&fixture, [223; 16], store.clone()).await?;
         let proof = prepared.empty_ref_initialization().await?;
+        let (command, registered) = registered(&fixture, &prepared, proof, identity()?).await?;
         edit(&fixture, sql).await?;
-        reject(&fixture, proof, reason).await?;
+        reject(&fixture, command, &registered, &store, reason).await?;
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        fixture.runtime.shutdown().await?;
+    }
+    for mode in 0..3 {
+        let fixture = Fixture::new(ObjectFormat::Sha256).await?;
+        let store = Arc::new(ArtifactStore::new(
+            Arc::new(InMemory::new()),
+            fixture.repository,
+        ));
+        let (prepared, root, budget) = empty(&fixture, [224; 16], store.clone()).await?;
+        let proof = prepared.empty_ref_initialization().await?;
+        let mut forged = proof.clone();
+        let mut data = proof.certificate.data()?;
+        if mode == 0 {
+            data.token.owner.epoch += 1;
+        }
+        if mode == 2 {
+            data.tenant = [96; 16];
+        }
+        forged.certificate =
+            CatalogCertificate::seal(&data, &if mode == 1 { [17; 32] } else { [16; 32] })?;
+        let (command, registered) = registered(&fixture, &prepared, forged, identity()?).await?;
+        if mode == 0 {
+            let before = state(&fixture.handle).await?;
+            let evidence = command.evidence().clone();
+            assert!(matches!(
+                command.execute().await,
+                Err(InvocationError::NotStarted(_))
+            ));
+            assert_eq!(state(&fixture.handle).await?, before);
+            assert!(matches!(
+                fixture.client().resolve(&evidence).await?,
+                cellule_runtime::Resolution::Absent
+            ));
+        } else {
+            reject(
+                &fixture,
+                command,
+                &registered,
+                &store,
+                PreparationDenial::Unauthorized,
+            )
+            .await?;
+        }
+        let mut e = BoundedEncoder::new(128)?;
+        proof.refs.encode(&mut e)?;
+        let mut bytes = e.finish();
+        let end = bytes.len() - 1;
+        bytes[end] ^= 1;
+        let mut d = BoundedDecoder::new(&bytes, 128)?;
+        let refs = RefStateSnapshotRoot::decode(&mut d)?;
+        d.finish()?;
+        let raw = InitialRefProof {
+            refs,
+            certificate: proof.certificate,
+        };
+        assert!(
+            raw.encode(&mut BoundedEncoder::new(INITIALIZATION_BYTES)?)
+                .is_err()
+        );
         drop(prepared);
         cleaned(root.path(), &budget).await?;
         fixture.runtime.shutdown().await?;
     }
-    let fixture = Fixture::new(ObjectFormat::Sha256).await?;
-    let store = Arc::new(ArtifactStore::new(
-        Arc::new(InMemory::new()),
-        fixture.repository,
-    ));
-    let (prepared, root, budget) = empty(&fixture, [224; 16], store).await?;
-    let proof = prepared.empty_ref_initialization().await?;
-    let mut stale = proof.clone();
-    let mut data = stale.certificate.data()?;
-    data.token.owner.epoch += 1;
-    stale.certificate = CatalogCertificate::seal(&data, &[16; 32])?;
-    reject(&fixture, stale, PreparationDenial::Stale).await?;
-    let mut forged = proof.clone();
-    forged.certificate = CatalogCertificate::seal(&proof.certificate.data()?, &[17; 32])?;
-    reject(&fixture, forged, PreparationDenial::Unauthorized).await?;
-    let mut wrong = proof.clone();
-    let mut data = wrong.certificate.data()?;
-    data.tenant = [96; 16];
-    wrong.certificate = CatalogCertificate::seal(&data, &[16; 32])?;
-    reject(&fixture, wrong, PreparationDenial::Unauthorized).await?;
-    let mut e = BoundedEncoder::new(128)?;
-    proof.refs.encode(&mut e)?;
-    let mut bytes = e.finish();
-    let end = bytes.len() - 1;
-    bytes[end] ^= 1;
-    let mut d = BoundedDecoder::new(&bytes, 128)?;
-    let refs = RefStateSnapshotRoot::decode(&mut d)?;
-    d.finish()?;
-    let raw = InitialRefProof {
-        refs,
-        certificate: proof.certificate,
-    };
-    assert!(
-        raw.encode(&mut BoundedEncoder::new(INITIALIZATION_BYTES)?)
-            .is_err()
-    );
-    drop(prepared);
-    cleaned(root.path(), &budget).await?;
-    fixture.runtime.shutdown().await?;
     Ok(())
 }
 
@@ -292,16 +436,34 @@ async fn initialization_late_failure_rolls_back_roots_checkpoint_and_outcome_and
     let (second, root_b, budget_b) = empty(&fixture, [226; 16], store).await?;
     let a = first.empty_ref_initialization().await?;
     let b = second.empty_ref_initialization().await?;
+    let (command_a, registered_a) = registered(&fixture, &first, a, identity()?).await?;
+    let (command_b, registered_b) = registered(&fixture, &second, b, identity()?).await?;
     edit(&fixture,"CREATE TRIGGER fail_initialization BEFORE INSERT ON catalog_initialization BEGIN SELECT RAISE(ABORT,'late initialization fault'); END;").await?;
     let before = state(&fixture.handle).await?;
+    let failed = command_a.clone().execute().await;
     assert!(
-        fixture
-            .client()
-            .command::<InitializeCatalogRefs>(&fixture.target, identity()?, a.clone())
-            .await
-            .is_err()
+        matches!(failed,Err(InvocationError::NotStarted(Error::Sqlite(rusqlite::Error::SqliteFailure(_,Some(ref message))))) if message == "late initialization fault"),
+        "{failed:?}"
     );
     assert_eq!(state(&fixture.handle).await?, before);
+    fixture
+        .handle
+        .query(0, 128, |db| {
+            assert_eq!(
+                db.query_row(
+                    "SELECT count(*) FROM catalog_leases WHERE recovery_phase IS NOT NULL",
+                    [],
+                    |row| row.get::<_, u64>(0)
+                )?,
+                0
+            );
+            Ok(Vec::new())
+        })
+        .await?;
+    assert!(matches!(
+        fixture.client().resolve(command_a.evidence()).await?,
+        cellule_runtime::Resolution::Absent
+    ));
     assert!(
         fixture
             .client()
@@ -312,29 +474,25 @@ async fn initialization_late_failure_rolls_back_roots_checkpoint_and_outcome_and
     );
     edit(&fixture, "DROP TRIGGER fail_initialization").await?;
     let client = fixture.client();
-    let (result_a, result_b) = tokio::join!(
-        client.command::<InitializeCatalogRefs>(&fixture.target, identity()?, a.clone()),
-        client.command::<InitializeCatalogRefs>(&fixture.target, identity()?, b.clone()),
-    );
-    let (committed, losing, winner, loser) = match (result_a, result_b) {
-        (Ok(committed), Err(InvocationError::Rejected(rejected))) => {
-            assert_eq!(
-                rejected.output,
-                InitializationReply::Denied(PreparationDenial::Conflict)
-            );
-            (committed, b, [225; 16], [226; 16])
-        }
-        (Err(InvocationError::Rejected(rejected)), Ok(committed)) => {
-            assert_eq!(
-                rejected.output,
-                InitializationReply::Denied(PreparationDenial::Conflict)
-            );
-            (committed, a, [226; 16], [225; 16])
-        }
-        other => {
-            return Err(format!("initialization must have exactly one winner: {other:?}").into());
-        }
-    };
+    let (result_a, result_b) = tokio::join!(command_a.execute(), command_b.execute());
+    let result_a = result_a?;
+    let result_b = result_b?;
+    let (committed, losing, winner, loser, registered_loser) =
+        match (&result_a.output, &result_b.output) {
+            (
+                InitializationReply::Initialized(_),
+                InitializationReply::Denied(PreparationDenial::Conflict),
+            ) => (result_a, result_b, [225; 16], [226; 16], registered_b),
+            (
+                InitializationReply::Denied(PreparationDenial::Conflict),
+                InitializationReply::Initialized(_),
+            ) => (result_b, result_a, [226; 16], [225; 16], registered_a),
+            other => {
+                return Err(
+                    format!("initialization must have exactly one winner: {other:?}").into(),
+                );
+            }
+        };
     let fact = initialized(committed.output)?;
     assert_eq!(fact.generation, 1);
     assert_eq!(
@@ -351,7 +509,12 @@ async fn initialization_late_failure_rolls_back_roots_checkpoint_and_outcome_and
             .output
             .is_none()
     );
-    reject(&fixture, losing, PreparationDenial::Conflict).await?;
+    let recovered = registered_loser
+        .recover_initialization(&client, &first.base.indexes().store())
+        .await;
+    assert!(
+        matches!(recovered,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==losing.receipt && value.output==losing.output)
+    );
     drop(first);
     drop(second);
     cleaned(root_a.path(), &budget_a).await?;
@@ -373,10 +536,11 @@ async fn initialization_exact_outcome_survives_owner_restore_and_pending_old_att
     let a = first.empty_ref_initialization().await?;
     let b = second.empty_ref_initialization().await?;
     let mutation = identity()?;
-    let committed = fixture
-        .client()
-        .command::<InitializeCatalogRefs>(&fixture.target, mutation, a.clone())
-        .await?;
+    let (command_a, registered_a) = registered(&fixture, &first, a.clone(), mutation).await?;
+    let (command_b, registered_b) = registered(&fixture, &second, b.clone(), identity()?).await?;
+    let snapshot_b = command_b.snapshot();
+    let body_b = command_b.input_bytes().to_vec();
+    let committed = command_a.execute().await?;
     fixture.handle.drain().await?;
     fixture.runtime.shutdown().await?;
     let session = SessionId::from_bytes([229; 16]);
@@ -412,21 +576,41 @@ async fn initialization_exact_outcome_survives_owner_restore_and_pending_old_att
         (exact.output, exact.receipt),
         (committed.output.clone(), committed.receipt)
     );
-    assert_eq!(
+    assert!(matches!(
         client
             .command::<InitializeCatalogRefs>(&fixture.target, identity()?, a)
-            .await?
-            .output,
-        committed.output
+            .await,
+        Err(InvocationError::NotStarted(_))
+    ));
+    let recovered = registered_a
+        .recover_initialization(&client, &first.base.indexes().store())
+        .await?;
+    assert_eq!(
+        (recovered.output, recovered.receipt),
+        (committed.output.clone(), committed.receipt)
     );
     let before = state(&handle).await?;
-    let stale = client
-        .command::<InitializeCatalogRefs>(&fixture.target, identity()?, b)
+    // Cold recovery must settle the absent original under the new owner. It
+    // cannot depend on opening the old owner's now-invalid live capability.
+    let denied = registered_b
+        .recover_initialization(&client, &second.base.indexes().store())
         .await;
     assert!(
-        matches!(stale,Err(InvocationError::Rejected(ref value)) if value.output==InitializationReply::Denied(PreparationDenial::Stale))
+        matches!(denied,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.output==InitializationReply::Denied(PreparationDenial::Stale)),
+        "{denied:?}"
+    );
+    let stale = client
+        .restore_command::<InitializeCatalogRefs>(snapshot_b, body_b)?
+        .execute()
+        .await?;
+    assert_eq!(
+        stale.output,
+        InitializationReply::Denied(PreparationDenial::Stale)
     );
     assert_eq!(state(&handle).await?, before);
+    assert!(
+        matches!(denied,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==stale.receipt && value.output==stale.output)
+    );
     assert_eq!(
         client
             .query::<CheckInitializedCatalog>(&fixture.target, None, fixture.begin([227; 16]))
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs b/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
new file mode 100644
index 00000000..e230f2c0
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
@@ -0,0 +1,298 @@
+//! Original initialization identity survives real restore and SDK expiry.
+use super::*;
+use super::{
+    initialization::empty,
+    prepare::cleaned,
+    publishing::{edit, state},
+};
+use crate::packs::{
+    catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes},
+    metadata::tests::limits,
+};
+use canopy_object_storage::artifact::ArtifactStore;
+use cellule_ltx::DiskBudget;
+use cellule_runtime::Resolution;
+use object_store::{ObjectStore, ObjectStoreExt};
+use tokio::time::{Duration, timeout};
+
+#[tokio::test]
+async fn lost_initialization_registration_is_discovered_after_fresh_disk_owner_restore() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    let operation = [233; 16];
+    let (prepared, root, budget) = empty(&f, operation, store.clone()).await?;
+    let command = f
+        .client()
+        .prepare_command::<InitializeCatalogRefs>(
+            &f.target,
+            identity()?,
+            prepared.empty_ref_initialization().await?,
+        )
+        .await?;
+    let original = command.evidence().clone();
+    let check = check(prepared.token());
+    let lost = super::super::recovery::persist(
+        &prepared.base.session,
+        &command,
+        super::super::recovery::Kind::Initialization,
+        &store,
+        identity()?,
+        2,
+    )
+    .await;
+    assert!(
+        matches!(lost, Err(RootRecoveryError::Registration(ref error)) if matches!(&**error, InvocationError::Pending(_)))
+    );
+    assert!(matches!(
+        f.client().resolve(&original).await?,
+        Resolution::Absent
+    ));
+    let saved = RegisteredRootRecovery::load_initialization(
+        &f.client(),
+        &f.target,
+        &store,
+        &f.begin(operation),
+    )
+    .await?
+    .ok_or("winning initialization registration absent")?;
+    assert_eq!(saved.evidence(), &original);
+    let rival = f
+        .client()
+        .prepare_command::<InitializeCatalogRefs>(
+            &f.target,
+            identity()?,
+            prepared.empty_ref_initialization().await?,
+        )
+        .await?;
+    super::mandatory_registration::not_started(&f, &rival).await?;
+    let rival_registration = super::super::recovery::persist(
+        &prepared.base.session,
+        &rival,
+        super::super::recovery::Kind::Initialization,
+        &store,
+        identity()?,
+        0,
+    )
+    .await;
+    assert!(
+        matches!(rival_registration, Err(RootRecoveryError::Registration(ref error)) if matches!(&**error, InvocationError::Rejected(value) if value.output==RootRecoveryReply::Denied(PreparationDenial::Conflict)))
+    );
+    let mut wrong = f.begin(operation);
+    wrong.request_digest[0] ^= 1;
+    assert!(
+        RegisteredRootRecovery::load_initialization(&f.client(), &f.target, &store, &wrong)
+            .await?
+            .is_none()
+    );
+    drop(rival);
+    drop(command);
+    drop(saved);
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    let (runtime, handle, client) = super::durable_recovery::restore_owner(&f, &check).await?;
+    assert!(!f.root.path().join("a.sqlite").exists());
+    let saved = RegisteredRootRecovery::load_initialization(
+        &client,
+        &f.target,
+        &store,
+        &f.begin(operation),
+    )
+    .await?
+    .ok_or("restored registration absent")?;
+    assert_eq!(saved.evidence(), &original);
+    assert!(matches!(
+        client.resolve(&original).await?,
+        Resolution::Absent
+    ));
+    let before = state(&handle).await?;
+    let denied = match saved.recover_initialization(&client, &store).await {
+        Err(PublicationError::Initialization(InvocationError::Rejected(value))) => value,
+        other => {
+            return Err(format!("cold original must settle its stale owner: {other:?}").into());
+        }
+    };
+    assert_eq!(
+        denied.output,
+        InitializationReply::Denied(PreparationDenial::Stale)
+    );
+    assert_eq!(state(&handle).await?, before);
+    assert!(
+        matches!(saved.recover_initialization(&client, &store).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==denied.receipt)
+    );
+    // Only a definitive original denial permits a new owner to claim. It gets
+    // its own namespace; the original pin and result remain unchanged.
+    let started = client
+        .command::<ClaimPreparation>(
+            &f.target,
+            identity()?,
+            LeaseRequest {
+                check: check.clone(),
+                lease_ms: DEFAULT_LEASE_MS,
+            },
+        )
+        .await?;
+    let current = lease(started.output)?;
+    assert_eq!(current.token.owner, handle.owner_fence());
+    assert_ne!(
+        current.token.artifact_operation,
+        check.token.artifact_operation
+    );
+    assert_eq!(current.base.generation, 0);
+    let scratch = tempfile::TempDir::new()?;
+    let disk = DiskBudget::new(64 << 20);
+    let indexes = Arc::new(CatalogIndexes::new(store.clone(), f.format));
+    let files = Arc::new(CatalogFiles::new(
+        scratch.path(),
+        disk.clone(),
+        store.clone(),
+        f.format,
+        CatalogFileLimits::default(),
+    )?);
+    let base = Arc::new(
+        PreparationBaseResolver::open(
+            client.clone(),
+            f.target.clone(),
+            super::check(current.token),
+            indexes,
+            files,
+            Some(started.receipt),
+        )
+        .await?,
+    );
+    let prepared = Arc::new(
+        CatalogPreparation::new(scratch.path(), disk.clone(), base, limits())
+            .await?
+            .finish()
+            .await?,
+    );
+    let ready = prepared.ready_initialization(identity()?).await?;
+    let registered = ready.persist_recovery(&store, identity()?).await?;
+    let result = ready.complete(&registered, &store).await?;
+    assert!(
+        matches!(result.output, InitializationReply::Initialized(ref fact) if fact.generation==1)
+    );
+    assert!(
+        matches!(saved.recover_initialization(&client, &store).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==denied.receipt)
+    );
+    handle
+        .query(0, 128, |db| {
+            assert_eq!(
+                db.query_row(
+                    "SELECT artifact_sequence FROM repository_identity",
+                    [],
+                    |r| r.get::<_, u64>(0)
+                )?,
+                2
+            );
+            assert_eq!(
+                db.query_row("SELECT count(*) FROM catalog_initialization", [], |r| r
+                    .get::<_, u64>(0))?,
+                1
+            );
+            assert_eq!(
+                db.query_row(
+                    "SELECT count(*) FROM catalog_leases WHERE recovery_phase IS NOT NULL",
+                    [],
+                    |r| r.get::<_, u64>(0)
+                )?,
+                2
+            );
+            Ok(Vec::new())
+        })
+        .await?;
+    drop(prepared);
+    cleaned(scratch.path(), &disk).await?;
+    runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn original_initialization_receipt_survives_lost_ack_expiry_body_loss_and_owner_restore()
+-> Result {
+    let f = Fixture::new(ObjectFormat::Sha1).await?;
+    let provider: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+    let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+    let (prepared, root, budget) = empty(&f, [234; 16], store.clone()).await?;
+    let prepared = Arc::new(prepared);
+    let mut mutation = identity()?;
+    mutation.expires_at_ms = mutation.issued_at_ms + 8_000;
+    let ready = prepared.ready_initialization(mutation).await?;
+    let registered = ready.persist_recovery(&store, identity()?).await?;
+    let original = registered.evidence().clone();
+    let check = check(registered.token());
+    let bound = ready.bind_recovery(registered.clone(), &store)?;
+    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    queue.fault_for_test(2);
+    let observer = queue
+        .submit(bound)
+        .await
+        .map_err(|failure| format!("initialization admission: {:?}", failure.reason))?;
+    assert!(
+        matches!(timeout(Duration::from_secs(10), observer.wait()).await?, PublicationState::Uncertain(ref error) if matches!(&**error, PublicationError::Initialization(InvocationError::Pending(evidence)) if **evidence==original))
+    );
+    assert_eq!(queue.stats().await.command_bytes, 20 << 10);
+    assert_eq!(queue.close_and_drain().await.len(), 1);
+    observer.recover().await?;
+    let expected = match timeout(Duration::from_secs(10), observer.wait()).await? {
+        PublicationState::Finished(Ok(PublicationOutcome::Initialization(value))) => value,
+        other => return Err(format!("original initialization recovery: {other:?}").into()),
+    };
+    assert!(matches!(
+        expected.output,
+        InitializationReply::Initialized(_)
+    ));
+    assert_eq!(queue.stats().await.command_bytes, 0);
+    assert_eq!(queue.stats().await.admitted, 0);
+    assert!(queue.close_and_drain().await.is_empty());
+    drop(observer);
+    drop(queue);
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    // Delete the exact saved body manifest and revoke current rights. Original
+    // phase knowledge must win before both body I/O and fresh permission checks.
+    for (key, descriptor) in registered.command_bodies_for_test() {
+        let path = store.path(key, descriptor.digest)?;
+        provider.head(&path).await?;
+        provider.delete(&path).await?;
+        assert!(matches!(
+            provider.head(&path).await,
+            Err(object_store::Error::NotFound { .. })
+        ));
+    }
+    edit(&f, "UPDATE repository_identity SET owner='replacement'").await?;
+    drop(registered);
+    let (runtime, handle, client) = super::durable_recovery::restore_owner(&f, &check).await?;
+    let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
+    if now <= mutation.expires_at_ms {
+        tokio::time::sleep(Duration::from_millis(u64::try_from(
+            mutation.expires_at_ms - now + 1,
+        )?))
+        .await;
+    }
+    assert!(matches!(
+        client.resolve(&original).await?,
+        Resolution::Expired
+    ));
+    let loaded = RegisteredRootRecovery::load(&client, &f.target, &store, &check)
+        .await?
+        .ok_or("original initialization pin absent")?;
+    assert_eq!(loaded.evidence(), &original);
+    let before = state(&handle).await?;
+    let result = loaded.recover_initialization(&client, &store).await?;
+    assert_eq!(
+        (result.output, result.receipt),
+        (expected.output.clone(), expected.receipt)
+    );
+    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let observer = queue
+        .submit(loaded.ready(client, (*store).clone())?)
+        .await
+        .map_err(|failure| format!("cold initialization admission: {:?}", failure.reason))?;
+    assert!(
+        matches!(timeout(Duration::from_secs(10), observer.wait()).await?, PublicationState::Finished(Ok(PublicationOutcome::Initialization(ref value))) if value.receipt==expected.receipt && value.output==expected.output)
+    );
+    assert!(queue.close_and_drain().await.is_empty());
+    assert_eq!(state(&handle).await?, before);
+    runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs b/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
index a4fbf2cd..880a71b6 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
@@ -324,15 +324,14 @@ async fn root_outcome_preserves_plain_http_errors_without_verifying_or_publishin
         .await?
         .finish()
         .await?;
-        request
-            .fixture
-            .client()
-            .command::<InitializeCatalogRefs>(
-                &request.fixture.target,
-                identity()?,
-                initial.empty_ref_initialization().await?,
-            )
-            .await?;
+        let (command, _) = super::super::super::initialization::registered(
+            &request.fixture,
+            &initial,
+            initial.empty_ref_initialization().await?,
+            identity()?,
+        )
+        .await?;
+        command.execute().await?;
         drop(initial);
         super::super::super::prepare::cleaned(initial_root.path(), &initial_budget).await?;
         let before = super::super::super::publishing::state(&request.fixture.handle).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/native_capture.rs b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
index 53964261..bcc54f34 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_capture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
@@ -456,14 +456,14 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
             .await?
             .finish()
             .await?;
-        fixture
-            .client()
-            .command::<InitializeCatalogRefs>(
-                &fixture.target,
-                identity()?,
-                empty.empty_ref_initialization().await?,
-            )
-            .await?;
+        let (command, _) = super::initialization::registered(
+            &fixture,
+            &empty,
+            empty.empty_ref_initialization().await?,
+            identity()?,
+        )
+        .await?;
+        command.execute().await?;
         drop(empty);
         cleaned(root.path(), &budget).await?;
     }
diff --git a/crates/canopy-server/src/packs/publication/tests/ref_policy.rs b/crates/canopy-server/src/packs/publication/tests/ref_policy.rs
index f85d9580..8229bb78 100644
--- a/crates/canopy-server/src/packs/publication/tests/ref_policy.rs
+++ b/crates/canopy-server/src/packs/publication/tests/ref_policy.rs
@@ -41,10 +41,9 @@ async fn rooted(format: ObjectFormat) -> Result<(Fixture, Graph)> {
         .finish()
         .await?;
     let proof = empty.empty_ref_initialization().await?;
-    fixture
-        .client()
-        .command::<InitializeCatalogRefs>(&fixture.target, identity()?, proof)
-        .await?;
+    let (command, _) =
+        super::initialization::registered(&fixture, &empty, proof, identity()?).await?;
+    command.execute().await?;
     drop(empty);
     cleaned(root.path(), &budget).await?;
     let graph = fixture::attempt(&fixture, provider, store).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
index 55accde2..54bb9b77 100644
--- a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
+++ b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
@@ -5,6 +5,16 @@ use canopy_object_storage::artifact::ArtifactStore;
 use cellule_runtime::{CellClient, Committed, Resolution};
 use tokio::time::{Duration, timeout};
 
+async fn unrelated_recovery_pins(handle: &CellHandle, token: PreparationToken) -> Result<Vec<u8>> {
+    Ok(handle.query(0, 64 << 10, move |db| {
+        let mut statement = db.prepare("SELECT incarnation,admission_sequence,recovery,recovery_phase,recovery_phase_revision FROM catalog_leases WHERE recovery IS NOT NULL AND NOT(incarnation=?1 AND admission_sequence=?2) ORDER BY incarnation,admission_sequence")?;
+        let pins = statement.query_map(rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt], |row| Ok((
+            row.get::<_, Vec<u8>>(0)?, row.get::<_, u64>(1)?, row.get::<_, Vec<u8>>(2)?, row.get::<_, Option<Vec<u8>>>(3)?, row.get::<_, u64>(4)?
+        )))?.collect::<rusqlite::Result<Vec<_>>>()?;
+        serde_json::to_vec(&pins).map_err(|_| Error::Command("fixture unrelated recovery pins"))
+    }).await?)
+}
+
 pub(super) async fn maintenance(
     handle: &CellHandle,
     repository: [u8; 16],
@@ -318,6 +328,8 @@ pub(super) async fn archive(
     expected: &Committed<RootCompletionReply>,
     fault: u8,
 ) -> Result<ReadyTerminalRelease> {
+    let token = head.token();
+    let unrelated = unrelated_recovery_pins(handle, token).await?;
     let admin = maintenance(handle, f.repository).await?;
     // The certificate binds the original actor, but release needs CURRENT
     // repository administration and actual admitted owner custody separately.
@@ -349,7 +361,7 @@ pub(super) async fn archive(
         Resolution::Absent
     ));
     handle
-        .query(0, 128, |db| {
+        .query(0, 128, move |db| {
             assert_eq!(
                 db.query_row(
                     "SELECT count(*) FROM pushes WHERE recovery IS NOT NULL",
@@ -360,8 +372,8 @@ pub(super) async fn archive(
             );
             assert_eq!(
                 db.query_row(
-                    "SELECT count(*) FROM catalog_leases WHERE recovery IS NOT NULL",
-                    [],
+                    "SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 AND recovery IS NOT NULL",
+                    rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt],
                     |r| r.get::<_, u64>(0)
                 )?,
                 1
@@ -449,7 +461,10 @@ pub(super) async fn archive(
         assert!(stats.release_recovered > 0);
         assert_eq!(stats.failures, 0);
         if fault != 1 {
-            assert_eq!(stats.scanned, 0);
+            // A retired push has no pin. Any independent initialization pin
+            // remains settled and must not admit another publication/release.
+            assert_eq!(stats.scanned, stats.settled);
+            assert_eq!(stats.submitted, 0);
         }
     }
     let PublicationState::Finished(Ok(PublicationOutcome::TerminalRelease(released))) =
@@ -469,14 +484,15 @@ pub(super) async fn archive(
         (&recovered.output, recovered.receipt),
         (&released.output, released.receipt)
     );
-    handle.query(0, 128, |db| {
-        assert_eq!(db.query_row("SELECT count(*) FROM catalog_leases WHERE recovery IS NOT NULL", [], |r| r.get::<_, u64>(0))?, 0);
+    handle.query(0, 128, move |db| {
+        assert_eq!(db.query_row("SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 AND recovery IS NOT NULL", rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt], |r| r.get::<_, u64>(0))?, 0);
         assert_eq!(db.query_row("SELECT count(*) FROM pushes WHERE recovery IS NOT NULL AND recovery_phase IS NOT NULL AND recovery_release IS NOT NULL", [], |r| r.get::<_, u64>(0))?, 1);
         for sql in ["UPDATE pushes SET recovery=NULL,recovery_phase=NULL,recovery_release=NULL WHERE recovery IS NOT NULL", "UPDATE pushes SET recovery_phase=x'01' WHERE recovery IS NOT NULL", "UPDATE pushes SET recovery_release=x'01' WHERE recovery IS NOT NULL", "DELETE FROM pushes WHERE recovery IS NOT NULL"] {
             assert!(db.execute(sql, []).is_err(), "{sql}");
         }
         Ok(Vec::new())
     }).await?;
+    assert_eq!(unrelated_recovery_pins(handle, token).await?, unrelated);
     let loaded = RegisteredRootRecovery::load(
         client,
         &f.target,
diff --git a/crates/canopy-server/src/server/catalog_initialization.rs b/crates/canopy-server/src/server/catalog_initialization.rs
index 76400b5e..de012c90 100644
--- a/crates/canopy-server/src/server/catalog_initialization.rs
+++ b/crates/canopy-server/src/server/catalog_initialization.rs
@@ -7,9 +7,9 @@ use crate::{
         metadata::MetadataLimits,
         publication::{
             BeginPreparation, BeginRequest, CatalogPreparation, CheckInitializedCatalog,
-            ClaimPreparation, DEFAULT_LEASE_MS, GenerationFact, InitializationReply,
-            InitializeCatalogRefs, LeaseCheck, LeaseRequest, PreparationBaseResolver,
-            PreparationDenial, PreparationReply, PreparationToken,
+            ClaimPreparation, DEFAULT_LEASE_MS, GenerationFact, InitializationReply, LeaseCheck,
+            LeaseRequest, PreparationBaseResolver, PreparationDenial, PreparationReply,
+            PreparationToken, PublicationError, RegisteredRootRecovery,
         },
     },
 };
@@ -113,45 +113,86 @@ pub(super) async fn ensure(
         return Err(Error::Command("ready repository has no certified initialization").into());
     }
     let started_at = std::time::Instant::now();
-    let started = match client
-        .command::<BeginPreparation>(target, super::mutation_identity()?, input.clone())
-        .await
-    {
-        Ok(started) => started,
-        Err(InvocationError::Rejected(rejected))
-            if matches!(
-                rejected.output,
-                PreparationReply::Denied(PreparationDenial::Stale | PreparationDenial::Expired)
-            ) =>
-        {
-            // Claim only after a known domain refusal. Read the exact old
-            // binding; the Claim receiver verifies its pin and actual owner.
-            let check = prior_attempt(&client, repository, &input, rejected.receipt).await?;
-            client
-                .command::<ClaimPreparation>(
-                    target,
-                    super::mutation_identity()?,
-                    LeaseRequest {
-                        check,
-                        lease_ms: DEFAULT_LEASE_MS,
-                    },
-                )
-                .await?
+    let recovered =
+        RegisteredRootRecovery::load_initialization(&client, target, &store, &input).await?;
+    let claim = if let Some(recovered) = recovered {
+        match recovered.recover_initialization(&client, &store).await {
+            Ok(committed) => {
+                let InitializationReply::Initialized(fact) = committed.output else {
+                    return Err(Error::Command("invalid recovered initialization reply").into());
+                };
+                return verify(*fact, &store, repository.object_format).await;
+            }
+            Err(PublicationError::Initialization(InvocationError::Rejected(ref value)))
+                if matches!(
+                    value.output,
+                    InitializationReply::Denied(
+                        PreparationDenial::Stale | PreparationDenial::Expired
+                    )
+                ) =>
+            {
+                Some(LeaseCheck {
+                    token: recovered.token(),
+                    actor: owner.into(),
+                })
+            }
+            Err(error) => return Err(error.into()),
         }
-        Err(error) => {
-            // A logical initialization can win between the first query and
-            // Begin. Only a known conflict may use that exact retained result;
-            // uncertain command evidence stays an error, never fresh admission.
-            if matches!(&error, InvocationError::Rejected(value)
-                if value.output == PreparationReply::Denied(PreparationDenial::Conflict))
-                && let Some(fact) = client
-                    .query::<CheckInitializedCatalog>(target, None, input)
-                    .await?
-                    .output
+    } else {
+        None
+    };
+    let started = if let Some(check) = claim {
+        client
+            .command::<ClaimPreparation>(
+                target,
+                super::mutation_identity()?,
+                LeaseRequest {
+                    check,
+                    lease_ms: DEFAULT_LEASE_MS,
+                },
+            )
+            .await?
+    } else {
+        match client
+            .command::<BeginPreparation>(target, super::mutation_identity()?, input.clone())
+            .await
+        {
+            Ok(started) => started,
+            Err(InvocationError::Rejected(rejected))
+                if matches!(
+                    rejected.output,
+                    PreparationReply::Denied(PreparationDenial::Stale | PreparationDenial::Expired)
+                ) =>
             {
-                return verify(fact, &store, repository.object_format).await;
+                // Claim only after a known domain refusal. Read the exact old
+                // binding; the Claim receiver verifies its pin and actual owner.
+                let check = prior_attempt(&client, repository, &input, rejected.receipt).await?;
+                client
+                    .command::<ClaimPreparation>(
+                        target,
+                        super::mutation_identity()?,
+                        LeaseRequest {
+                            check,
+                            lease_ms: DEFAULT_LEASE_MS,
+                        },
+                    )
+                    .await?
+            }
+            Err(error) => {
+                // A logical initialization can win between the first query and
+                // Begin. Only a known conflict may use that exact retained result;
+                // uncertain command evidence stays an error, never fresh admission.
+                if matches!(&error, InvocationError::Rejected(value)
+                if value.output == PreparationReply::Denied(PreparationDenial::Conflict))
+                    && let Some(fact) = client
+                        .query::<CheckInitializedCatalog>(target, None, input)
+                        .await?
+                        .output
+                {
+                    return verify(fact, &store, repository.object_format).await;
+                }
+                return Err(error.into());
             }
-            return Err(error.into());
         }
     };
     let PreparationReply::Granted(lease) = started.output else {
@@ -183,14 +224,19 @@ pub(super) async fn ensure(
         )
         .await?,
     );
-    let prepared = CatalogPreparation::new(workspace, budget, base, MetadataLimits::default())
-        .await?
-        .finish()
+    let prepared = Arc::new(
+        CatalogPreparation::new(workspace, budget, base, MetadataLimits::default())
+            .await?
+            .finish()
+            .await?,
+    );
+    let ready = prepared
+        .ready_initialization(super::mutation_identity()?)
         .await?;
-    let proof = prepared.empty_ref_initialization().await?;
-    let committed = client
-        .command::<InitializeCatalogRefs>(target, super::mutation_identity()?, proof)
+    let registered = ready
+        .persist_recovery(&store, super::mutation_identity()?)
         .await?;
+    let committed = ready.complete(&registered, &store).await?;
     let InitializationReply::Initialized(fact) = committed.output else {
         return Err(Error::Command("repository initialization publication denied").into());
     };
diff --git a/crates/canopy-server/tests/multi_server/workspace.rs b/crates/canopy-server/tests/multi_server/workspace.rs
index ea8334b1..8eac070b 100644
--- a/crates/canopy-server/tests/multi_server/workspace.rs
+++ b/crates/canopy-server/tests/multi_server/workspace.rs
@@ -172,6 +172,7 @@ async fn new_repositories_bootstrap_the_production_packed_catalog_before_becomin
                         .get::<_, i64>(0))?,
                 0
             );
+            assert_eq!(connection.query_row("SELECT count(*) FROM catalog_leases WHERE generation=0 AND recovery IS NOT NULL AND recovery_phase IS NOT NULL AND recovery_phase_revision=1", [], |row| row.get::<_, i64>(0))?, 1);
             let allocation = connection.query_row(
                 "SELECT artifact_sequence FROM repository_identity WHERE singleton=1",
                 [],
diff --git a/docs/design/mandatory-publication-registration.md b/docs/design/mandatory-publication-registration.md
index d366fea2..f728e7d7 100644
--- a/docs/design/mandatory-publication-registration.md
+++ b/docs/design/mandatory-publication-registration.md
@@ -1,33 +1,44 @@
 # Mandatory publication registration
 
-Status: receiver and registered-admission increment qualified locally on 2026-10-03. All existing publication callers in the qualification fixtures now use exact registration. This contract defines the required hard cutover; production startup, producers, readers and fresh-schema conversion remain incomplete.
+Status: policy/root registration is published through PR #33. The unpublished production cutover extends this same protocol to final catalog initialization. Production producers, readers, complete startup recovery and final schema conversion remain incomplete.
 
 ## Receiver contract
 
-Commands 33, 36 and 38 must find an authenticated recovery record on their exact preparation pin before executing their domain action. The record must match the actual SDK mutation stamp, repository check, tenant, application and incarnation. A missing registration, a competing SDK identity, or a premature frozen refusal returns `NotStarted`, leaves SDK resolution `Absent`, and changes neither domain state nor the registration journal. Retrying the same original command after registration is allowed.
+Commands 31, 33, 36 and 38 must find an authenticated recovery record on their exact preparation pin before executing their domain action. The record must match the actual SDK mutation stamp, repository check, tenant, application and incarnation. A missing registration, a competing SDK identity, or a premature frozen refusal returns `NotStarted`, leaves SDK resolution `Absent`, and changes neither domain state nor the registration journal. Retrying the same original command after registration is allowed.
 
 Register the exact command body and SDK snapshot before submission. Reuse `Record`, `Bundle`, `SavedCommand`, `Journal`, `Frame`, immutable input roots and `catalog_leases.recovery`; no new durable queue or per-object table is needed. Each policy bundle contains its original page command and one pre-frozen refusal command. Successful pages share that refusal. Advancing the pin requires the authenticated settled predecessor, with strictly increasing steps and a known successful page. A refused policy page cannot advance into positive publication.
 
 Domain effects, the original result and sequence, and the phase revision commit in the same SDK transaction. A trusted domain denial is durable knowledge; normalize its typed root reply without inventing another receipt. A later SQL or encoding failure rolls back every effect and SDK acceptance. Retry the original prepared command after repair.
 
-Recovery resolves the authenticated journal and original SDK evidence before reopening bodies or checking fresh custody. Only authoritative absence can execute restored original bytes. Positive cold recovery requires valid custody; a frozen refusal retains its refusal-only role and still checks its actual owner, operation, pin, floor and checkpoint. Original known outcomes remain recoverable after SDK expiry or owner loss. Product response streaming separately requires current Read authorization.
+Recovery resolves the authenticated journal and original SDK evidence before reopening bodies or checking fresh custody. Only authoritative absence can execute restored original bytes. Positive root/policy cold recovery requires valid custody; a frozen refusal retains its refusal-only role and still checks its actual owner, operation, pin, floor and checkpoint. Original known outcomes remain recoverable after SDK expiry or owner loss. Product response streaming separately requires current Read authorization.
 
 An exact registration retry can refer to a predecessor that has already become historical. `settled_frame` must supply artifact storage to `current_journal` so the existing authenticated history reader can recover that predecessor's original journal. Current-head equality alone is insufficient. The reader checks MACs, matching checks and strictly decreasing steps one bounded frame at a time.
 
 ## Protocol and admission
 
-Use recovery purpose `canopy.publication-command-recovery.v3\0` and these command codecs:
+Use recovery purpose `canopy.publication-command-recovery.v4\0` and these command codecs in the unpublished hard cutover:
 
 | Command | ID | Codec |
 | --- | --- | --- |
+| InitializeCatalogRefs | 31 | 2 |
 | RegisterRefPolicyPage | 33 | 2 |
 | CompleteRootPush | 36 | 2 |
 | CompleteRootOutcome | 38 | 3 |
-| RegisterRootRecovery | 39 | 3 |
+| RegisterRootRecovery | 39 | 4 |
 
 Keep the existing record and artifact structures. Do not add a compatibility decoder or an unregistered execution fallback.
 
-Live factories persist their exact bundle, then bind it into `ReadyBoundRecovery`, preserving the original session, shared clock, lifecycle fence and policy intent. Cold registered work uses `ReadyRootRecovery`. Both use the existing fair publication queue. Raw `ReadyRootPush` and `ReadyRefPolicyPage` values have no admission variant or `From` conversion; persist and bind before submitting. Their private factory values remain available for exact registration and refusal composition. The obsolete direct dispatch code and unused per-page refusal-state allocation are removed. The current reservation formula charges two copies of the body, recovery header and optional refusal: 32 KiB for a final root command and 544 KiB for an armed policy page. Uncertain work stays charged through cancellation and service closure.
+Live factories persist their exact bundle, then bind it into `ReadyBoundRecovery`, preserving the original session, shared clock, lifecycle fence and policy intent. Cold registered work uses `ReadyRootRecovery`. Both use the existing fair publication queue. Raw `ReadyRootPush` and `ReadyRefPolicyPage` values have no admission variant or `From` conversion; persist and bind before submitting. Their private factory values remain available for exact registration and refusal composition. The obsolete direct dispatch code and unused per-page refusal-state allocation are removed. The current reservation formula charges two copies of the body, recovery header and optional refusal: 20 KiB for initialization, 32 KiB for a final root command and 544 KiB for an armed policy page. Uncertain work stays charged through cancellation and service closure.
+
+## Catalog initialization recovery
+
+`ReadyInitialization` derives the private empty proof from its retained `PreparedCatalog`, freezes command 31 and persists the same exact SDK snapshot/body/header before dispatch. Registration command 39 pins `Kind::Initialization` in the existing attempt namespace. Matching original capabilities can bind into the existing fair publication queue. Production repository startup instead retains this same owner through its already admitted, tracked repository transition. Unknown registration never authorizes final execution.
+
+Pending startup queries the current indexed operation/pin binding before issuing Begin. A recovered positive verifies the original empty catalog/directory/ref roots. Only a known original Stale/Expired final denial permits Claim of that observed attempt; other uncertainty propagates. Ready restoration observes the retained initialization fact without creating a new attempt.
+
+Cold initialization performs no new preparation or native work. After authoritative SDK absence it restores the exact original bytes and lets the final receiver atomically check actual owner, Admin, live pin, certificate/checkpoint and pristine roots. Requiring a fresh Write-dependent session first would prevent an expired or revoked original from recording its definitive denial. Live bound dispatch still checks its original shared clock/fence. Known journal outcomes retain their original sequence and receipt even after SDK expiry, owner loss, permission revocation and body loss; they grant no current write or read capability.
+
+This closes final-command registration and reconstruction only. Exact initial Begin/Claim/Renew and failure before final registration still need durable integration. Initialization has no native push response/audit graph, so push terminal retirement cannot release its pin. Its generation-zero recovery pin remains retained until typed initialization retirement is implemented; that floor prevents generation collection and is a release blocker. Include the immutable initialization roots, command metadata and receipts in typed collection, backup and isolated restore.
 
 ## Remaining implementation sequence
 
diff --git a/docs/large-repository-implementation-plan.md b/docs/large-repository-implementation-plan.md
index fe3295ca..28a12a60 100644
--- a/docs/large-repository-implementation-plan.md
+++ b/docs/large-repository-implementation-plan.md
@@ -292,7 +292,7 @@ Each cell below is a test family, with SHA-1/SHA-256 coverage on a representativ
 The [immutable ref state](design/immutable-ref-state.md) supplies conditional versioned roots and streaming initial construction. Complete the final publication change in this order:
 
 1. The shared streaming rewrite now coalesces existing-base batches by affected subtree and preserves untouched roots. Qualify sustained ordinary and bulk preparation separately, including long-name byte splits, retained tombstones, provider budgets and hot-root fairness.
-2. The fresh immutable catalog generation now carries the ref snapshot through the same query-derived base and retention floor. The private preparation factory loads and rewrites that exact root; compaction carries it forward and the inline publisher refuses selected roots. Fresh empty initialization authenticates a private empty preparation and atomically installs joint roots with one durable outcome. The local production cutover now invokes that path before repository Ready and verifies the retained immutable initialization during fresh-disk restore; complete original-command persistence/reconstruction and all pending/Claim/denied/pre-admission recovery before release. See the [current qualification and unreleasable boundaries](large-repository-implementation-status.md#production-hard-cutover-started-locally). Bind membership/ancestry and exact policy/check facts to the privately issued transition certificate, and qualify their current-state CAS/fairness semantics.
+2. The fresh immutable catalog generation now carries the ref snapshot through the same query-derived base and retention floor. The private preparation factory loads and rewrites that exact root; compaction carries it forward and the inline publisher refuses selected roots. Fresh empty initialization authenticates a private empty preparation and atomically installs joint roots with one durable outcome. The local production cutover now invokes that path before repository Ready and verifies the retained immutable initialization during fresh-disk restore. Final initialization now uses the existing exact registered snapshot/body/journal protocol, including cold original denial recovery. Complete initial Begin/Claim/Renew, pre-registration process-loss recovery and typed terminal retirement of its generation-zero pin before release. See the [current qualification and unreleasable boundaries](large-repository-implementation-status.md#production-hard-cutover-started-locally). Bind membership/ancestry and exact policy/check facts to the privately issued transition certificate, and qualify their current-state CAS/fairness semantics.
 3. Direct-push [paged policy guards](design/paged-ref-policy-guards.md) now bind rare configuration epochs and indexed exact check dependencies, with bounded transactional registration/cleanup and private conditional root signing. The private [immutable completion factory](design/immutable-push-outcomes.md) binds registered native custody and freezes success/refusal descriptors in an 8 KiB input. Command 36 atomically publishes those exact catalog/ref/response descriptors with live guard/epoch, current authorization, owner/lease/pin and generation CAS checks; it transports no plan and writes no per-ref rows. Query 37 and the streaming replay adapter derive the selected result from current authorized durable identity. The service-owned exact command factory, foreground dispatch and bound lifecycle now retain/recover this command with a 32 KiB registered wire reservation and current-authorized streaming ticket responses. Immutable outcome-only command 38 reuses the session certificate, native checkpoint, same RootPush dispatch and current-authorized streaming reader without catalog/refs writes. Paged-policy commands now retain their original intent/evidence and exact SDK identity in the same foreground dispatcher; the bound lifecycle resumes after a known page and blocks final handoff during uncertainty. Armed pages now retain a pre-frozen refusal-only command under one 544 KiB registered admission and recover the original SDK evidence for the active local phase. Successful pages share one refusal Arc; that exact command can also complete a negative outcome after later policy/write changes. Its final transaction cannot select native success or expose roots. Complete durable process-loss reconstruction, production HTTP/SSH refusal-pipeline conversion and reviewed-merge bindings, and include every page/command cost in hot-repository capacity qualification.
 4. Convert every producer, reader, default-branch, policy/check, review and recovery path together. Delete the old ref/body schema and adapters for the fresh-data cutover.
 5. Include snapshots and their transitive immutable nodes in complete retention, collection and isolated restore, including the immutable initialization outcome's retained empty catalog/ref roots. Qualify hot-root fairness and full-history mixed workloads against the mandatory large-team gates.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 2845e8df..02befafa 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -20,7 +20,21 @@ The new real HTTP creation regression initially fails because production still s
 
 All 254 publication tests pass in 154.86 seconds, including the shared production-registry contract, using four threads and standard stacks. The final three workspace integration tests pass in 2.45 seconds, including both formats, fresh-disk restoration, missing retained metadata and the deployment/workspace exclusions. Workspace/all-target Clippy passes with warnings denied in 7.85 seconds. These are focused local checks. The broad full-workspace, provider and capacity results above remain attributed to their earlier source; unconverted production Git paths cannot be qualified by this increment.
 
-**This is local, unpublished work and is not a releasable packed deployment.** Production Git pushes, cache/object/ref readers and generated producers still call legacy storage APIs, whose tables and bindings are absent from the selected production contract. Their conversion, product graph/policy/check/review consumers, and deletion of temporary SQL refs and inline response/certificate/plan adapters must complete together before release. Complete original SDK-command persistence/reconstruction for initialization and all initial/Claim/Renew/denied/pre-admission phases is still required; the new bootstrap is not proof of that recovery protocol. Actual typed collection/backup/isolated restore, retained-input adoption/repreparation, OS containment, accelerated reads/rewrites, continuous fair maintenance and complete repository/team qualification remain required. Format checks, startup fixtures and primitive publication tests do not prove that wider completion.
+**This is local, unpublished work and is not a releasable packed deployment.** Production Git pushes, cache/object/ref readers and generated producers still call legacy storage APIs, whose tables and bindings are absent from the selected production contract. Their conversion, product graph/policy/check/review consumers, and deletion of temporary SQL refs and inline response/certificate/plan adapters must complete together before release. Final initialization now uses the same exact registered recovery protocol as policy/root publication; initial Begin/Claim/Renew and failure before registration remain incomplete. Typed initialization terminal retirement must release its retained generation-zero pin without losing original receipts. The new bootstrap is not proof of the complete recovery or retention protocol. Actual typed collection/backup/isolated restore, retained-input adoption/repreparation, OS containment, accelerated reads/rewrites, continuous fair maintenance and complete repository/team qualification remain required. Format checks, startup fixtures and primitive publication tests do not prove that wider completion.
+
+## Exact final initialization recovery in the local cutover
+
+Command 31 now requires authenticated exact registration before its domain action. The existing `Record`, `Bundle`, `SavedCommand`, `Journal`, `Frame`, immutable body/header roots and independent preparation pin carry `Kind::Initialization`; there is no separate durable queue or metadata authority. The unpublished protocol purpose advances to v4, initialization codec to 2 and recovery-registration codec to 4, with no compatibility decoder. Other published final-command codecs remain unchanged.
+
+`PreparedCatalog::ready_initialization` freezes the private proof and original SDK command while retaining its owner. After durable registration it binds into the existing account-fair dispatcher, charging 20 KiB through uncertainty. Actual startup uses its already bounded tracked transition admission and retains the same original session through exact registered completion. Pending startup discovers the current operation's registered original before Begin; only a known original Stale/Expired denial permits a new Claim. Ready startup continues to verify the retained initialization without another admission.
+
+Original phase results and sequences commit atomically with catalog/ref initialization or a definitive typed denial. Unregistered/competing identities leave SDK and domain/phase state absent. Late SQL failure rolls back every effect. Cold final initialization restores only after authoritative SDK absence and delegates current owner/Admin/expiry/pin/checkpoint/pristine checks to that exact receiver. It performs no new preparation/native work and does not require a fresh Write query that could hide a definitive expiry/revocation denial. Live bound work still checks its original shared clock and lifecycle fence. Known journal knowledge wins before body/custody reads and retains the original receipt after SDK expiry or owner loss.
+
+The unregistered-command regression first publishes generation one against the old code, then passes with SDK/domain absence after the receiver gate. A cold expiry regression first stops at an inactive custody query, then passes with the definitive original denial after the recovery change. Eight initialization families cover both formats, late rollback, competing identity, lost registration acknowledgement, lost final acknowledgement, removal of local SQLite before real owner restoration, and original receipt recovery after SDK expiry, current permission revocation and saved-body loss. The original live/fair admission retains its 20 KiB reservation through uncertainty and closed-service recovery.
+
+The broader audit exposes one shared policy initializer that still submits command 31 without registration, plus queries that assume only one recovery pin exists. The initializer now registers first. Native recovery/retirement fixtures select the exact original attempt and verify unrelated recovery headers/phases remain unchanged. The final complete publication run passes **258 tests in 173.96 seconds** with four threads and standard stacks. Three actual workspace/startup tests pass in 2.57 seconds, including real registered initialization, SHA-1/SHA-256 creation, fresh-disk restoration and missing-root refusal: **261 unique focused Rust cases**. Focused reruns are excluded. Workspace/all-target Clippy passes with warnings denied in 31.97 seconds; the server builds in 33.76 seconds. Production and integration sources are unchanged after those integration/build checks; subsequent edits affect four qualification fixture files only. Formatting, diff checks, all 414 frozen Rust-source hashes, local documentation links, the protected checkout/archive and exact Cellule pin checks pass. No stack, SDK lifetime, deadline, resource or capacity threshold is widened.
+
+Initial Begin/Claim/Renew, pre-registration process loss and initial terminal retirement remain release blockers. Retaining the initialization pin indefinitely would prevent later catalog generation collection. The full production cutover, provider and repository/team capacity gates remain open. This checkpoint is local and unpublished.
 
 ## Mandatory publication registration qualified locally
 

From 6490293801e39233b739cab156fad48252c03b3b Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sat, 3 Oct 2026 20:51:32 -0700
Subject: [PATCH 05/55] fix: retire initialization recovery pins with shared
 receipts

---
 crates/canopy-server/src/lib.rs               |   1 +
 .../src/packs/publication/initialization.rs   |  59 +-
 .../publication/initialization/publish.rs     |  46 +-
 .../src/packs/publication/mod.rs              |   3 +-
 .../src/packs/publication/recovery/archive.rs | 186 +++++--
 .../publication/recovery/initialization.rs    |   9 +-
 .../src/packs/publication/recovery/mod.rs     |   2 +
 .../src/packs/publication/recovery/phase.rs   |   2 +-
 .../packs/publication/recovery/supervisor.rs  |   4 +
 .../src/packs/publication/registry.rs         |   1 +
 .../src/packs/publication/schema.sql          |  41 +-
 .../src/packs/publication/tests.rs            |  13 +
 .../tests/initialization_retirement.rs        | 511 ++++++++++++++++++
 .../packs/publication/tests/native_capture.rs |  13 +-
 .../publication/tests/policy_dispatch.rs      |   6 +-
 .../packs/publication/tests/policy_refusal.rs |   8 +-
 .../src/packs/publication/tests/ref_policy.rs |  14 +-
 .../publication/tests/root_completion.rs      |   7 +-
 .../packs/publication/tests/root_dispatch.rs  |   7 +-
 .../publication/tests/terminal_retention.rs   |  12 +-
 .../src/server/catalog_initialization.rs      | 103 ++--
 crates/canopy-server/src/server/peer.rs       |  26 +-
 .../canopy-server/src/server/residency/mod.rs |   6 +-
 .../tests/multi_server/workspace.rs           |  10 +-
 .../mandatory-publication-registration.md     |   3 +-
 docs/design/terminal-publication-retention.md |  23 +-
 docs/large-repository-implementation-plan.md  |   4 +-
 .../large-repository-implementation-status.md |  16 +-
 28 files changed, 987 insertions(+), 149 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 1bcbe1cc..9472507c 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -284,6 +284,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/registry.rs"));
                 source.update(include_bytes!("server/catalog_initialization.rs"));
                 source.update(include_bytes!("server/residency/mod.rs"));
+                source.update(include_bytes!("server/peer.rs"));
                 source.update(include_bytes!("packs/publication/codec.rs"));
                 source.update(include_bytes!("packs/publication/sql.rs"));
                 source.update(include_bytes!("packs/publication/schema.sql"));
diff --git a/crates/canopy-server/src/packs/publication/initialization.rs b/crates/canopy-server/src/packs/publication/initialization.rs
index 6770991d..97c76e1f 100644
--- a/crates/canopy-server/src/packs/publication/initialization.rs
+++ b/crates/canopy-server/src/packs/publication/initialization.rs
@@ -1,15 +1,70 @@
 //! Fresh empty catalog/ref publication. No SQL-ref conversion or decoded-root
 //! signing adapter exists: only a privately assembled empty catalog can mint it.
 use super::*;
-use crate::packs::ref_state::{RefSnapshotError, RefStateSnapshot};
+use crate::packs::{
+    catalog::CatalogSnapshot,
+    directory::snapshot::DirectorySnapshot,
+    ref_state::{RefSnapshotError, RefStateSnapshot},
+};
 use cellule_runtime::{InvocationError, primitives::sql::SqlCell};
 use tokio::time::timeout_at;
 
-mod publish;
+pub(in crate::packs::publication) mod publish;
 pub use publish::{CheckInitializedCatalog, InitializeCatalogRefs};
 pub const INITIALIZATION_BYTES: u32 = 2048;
 const INITIAL_HEAD: &str = "refs/heads/main";
 
+#[derive(Debug, thiserror::Error)]
+pub enum InitializationVerificationError {
+    #[error("initialization fact encoding failed")]
+    Codec(#[from] CodecError),
+    #[error("initialization catalog metadata failed")]
+    Catalog(#[from] crate::packs::directory::index::IndexError),
+    #[error("initialization ref metadata failed")]
+    Refs(#[from] RefSnapshotError),
+    #[error("initialization is not the certified empty state")]
+    Context,
+}
+
+/// Verify the complete constant-size initial graph, including its typed empty
+/// leaves. Both route activation and retirement use the same checks.
+pub(crate) async fn verify_empty(
+    fact: GenerationFact,
+    store: &canopy_object_storage::artifact::ArtifactStore,
+    format: ObjectFormat,
+) -> Result<
+    (
+        StoredCatalog,
+        crate::packs::directory::snapshot::StoredSnapshot,
+        RefStateSnapshotRoot,
+    ),
+    InitializationVerificationError,
+> {
+    initial_fact(&fact)?;
+    let catalog = fact
+        .catalog
+        .ok_or(InitializationVerificationError::Context)?;
+    let refs = fact.refs.ok_or(InitializationVerificationError::Context)?;
+    if catalog.repository != store.repository() || catalog.format != format {
+        return Err(InitializationVerificationError::Context);
+    }
+    let snapshot = CatalogSnapshot::download(store, catalog).await?;
+    let directory = DirectorySnapshot::download(store, snapshot.directory).await?;
+    let state = refs.read(store).await?;
+    if snapshot.sources.is_some()
+        || !directory.level_zero.is_empty()
+        || directory.levels.iter().any(Option::is_some)
+        || state.repository != store.repository()
+        || state.format != format
+        || state.generation != 0
+        || state.root.is_some()
+        || state.default_branch != INITIAL_HEAD
+    {
+        return Err(InitializationVerificationError::Context);
+    }
+    Ok((catalog, snapshot.directory, refs))
+}
+
 #[derive(Debug, thiserror::Error)]
 pub enum InitializationPreparationError {
     #[error("initialization command preparation failed")]
diff --git a/crates/canopy-server/src/packs/publication/initialization/publish.rs b/crates/canopy-server/src/packs/publication/initialization/publish.rs
index 02c2d4ea..d908b224 100644
--- a/crates/canopy-server/src/packs/publication/initialization/publish.rs
+++ b/crates/canopy-server/src/packs/publication/initialization/publish.rs
@@ -20,20 +20,50 @@ fn verification(
     hash.update(&e.finish());
     Ok(*hash.finalize().as_bytes())
 }
+pub(in crate::packs::publication) const SAVED: &str = "SELECT actor,request_digest,verification_digest,result FROM catalog_initialization WHERE id=?1";
+
+pub(in crate::packs::publication) fn selected(
+    outcome: &[SqlResultSet],
+    check: &LeaseCheck,
+) -> Result<Option<GenerationFact>, Error> {
+    let Some(
+        [
+            SqlValue::Text(actor),
+            request,
+            digest,
+            SqlValue::Blob(bytes),
+        ],
+    ) = rows(outcome)?.first().map(Vec::as_slice)
+    else {
+        if rows(outcome)?.is_empty() {
+            return Ok(None);
+        }
+        return Err(Error::Command("invalid initialization lookup"));
+    };
+    if *actor != check.actor || fixed::<32>(request)? != check.token.request_digest {
+        return Ok(None);
+    }
+    Ok(Some(saved(
+        bytes,
+        check.token.repository,
+        None,
+        fixed(digest)?,
+    )?))
+}
+
 fn saved(
     bytes: &[u8],
     repository: [u8; 16],
-    format: ObjectFormat,
+    format: Option<ObjectFormat>,
     digest: [u8; 32],
 ) -> Result<GenerationFact, CodecError> {
     let mut d = BoundedDecoder::new(bytes, 512)?;
     let fact = GenerationFact::decode(&mut d)?;
     d.finish()?;
     initial_fact(&fact)?;
-    if fact
-        .catalog
-        .is_none_or(|root| root.repository != repository || root.format != format)
-    {
+    if fact.catalog.is_none_or(|root| {
+        root.repository != repository || format.is_some_and(|format| root.format != format)
+    }) {
         return Err(CodecError::Invalid("invalid initialization result"));
     }
     if verification(
@@ -106,7 +136,7 @@ fn initialize(
             Box::new(saved(
                 bytes,
                 data.token.repository,
-                data.catalog.format,
+                Some(data.catalog.format),
                 fixed(digest)?,
             )?),
         )));
@@ -188,7 +218,7 @@ fn initialize(
         "UPDATE catalog_state SET generation=1 WHERE singleton=1 AND generation=0",
         vec![],
     ))?)?;
-    changed(context.sql(&statement("INSERT INTO catalog_initialization(singleton,id,actor,request_digest,verification_digest,result) VALUES(1,?1,?2,?3,?4,?5)", vec![blob(data.token.operation),SqlValue::Text(data.actor),blob(data.token.request_digest),blob(verified_roots),blob(encoded.finish())]))?)?;
+    changed(context.sql(&statement("INSERT INTO catalog_initialization(singleton,id,actor,request_digest,verification_digest,result,incarnation,admission_sequence) VALUES(1,?1,?2,?3,?4,?5,?6,?7)", vec![blob(data.token.operation),SqlValue::Text(data.actor),blob(data.token.request_digest),blob(verified_roots),blob(encoded.finish()),blob(data.token.owner.incarnation.as_bytes()),number(data.token.attempt)?]))?)?;
     changed(context.sql(&statement(
         "DELETE FROM catalog_operations WHERE id=?1",
         vec![blob(data.token.operation)],
@@ -249,7 +279,7 @@ impl Query for CheckInitializedCatalog {
         Ok(Some(saved(
             bytes,
             input.repository,
-            format,
+            Some(format),
             fixed(digest)?,
         )?))
     }
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index a51f6384..55989b11 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -31,9 +31,10 @@ pub use prepare::{CatalogPreparation, CatalogPreparationError, PreparedCatalog};
 pub(in crate::packs) mod ref_proof;
 pub use ref_proof::{RefProofError, RefPublicationProof};
 mod initialization;
+pub(crate) use initialization::verify_empty as verify_initial_catalog;
 pub use initialization::{
     CheckInitializedCatalog, INITIALIZATION_BYTES, InitialRefProof, InitializationPreparationError,
-    InitializationReply, InitializeCatalogRefs,
+    InitializationReply, InitializationVerificationError, InitializeCatalogRefs,
 };
 mod ref_snapshot;
 pub use ref_snapshot::{PreparedRefSnapshot, RefSnapshotPreparationError};
diff --git a/crates/canopy-server/src/packs/publication/recovery/archive.rs b/crates/canopy-server/src/packs/publication/recovery/archive.rs
index e1b0c9f4..6178eb3d 100644
--- a/crates/canopy-server/src/packs/publication/recovery/archive.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/archive.rs
@@ -1,8 +1,8 @@
 //! A closed attempt transfers the same recovery certificate/journal into its
-//! immutable selected-push row before releasing its independent preparation pin.
+//! immutable shared receipt row before releasing its independent preparation pin.
 use super::*;
 
-const DOMAIN: &[u8] = b"canopy.terminal-recovery-release.v1\0";
+const DOMAIN: &[u8] = b"canopy.terminal-recovery-release.v2\0";
 const RELEASE_BYTES: u32 = 4096;
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct TerminalReleaseCertificate(CertificateEnvelope);
@@ -40,6 +40,7 @@ pub(in crate::packs::publication) fn descriptor(
     e.write_text(match kind {
         ArtifactKind::InputRoot => "input-root",
         ArtifactKind::InputBody => "input-body",
+        ArtifactKind::CatalogNode => "catalog-node",
         _ => return Err(RootRecoveryError::Context),
     })?;
     artifact(&mut e, value)?;
@@ -119,17 +120,91 @@ impl WireValue for TerminalReleaseReply {
     }
 }
 
-impl phase::Journal {
-    pub(super) fn terminal(
+pub(super) enum Terminal {
+    Push(Box<CompletedRootPush>),
+    Initialization(InitializationReply),
+}
+impl Terminal {
+    fn selected_statement(&self, operation: [u8; 16]) -> SqlStatement {
+        SqlStatement {
+            sql: match self {
+                Self::Push(_) => super::super::root_completion::read::SAVED,
+                Self::Initialization(_) => super::super::initialization::publish::SAVED,
+            }
+            .into(),
+            parameters: vec![blob(operation)],
+        }
+    }
+    fn matches_selected(&self, result: &[SqlResultSet], check: &LeaseCheck) -> Result<bool, Error> {
+        Ok(match self {
+            Self::Push(terminal) => {
+                super::super::root_completion::read::saved(
+                    result,
+                    &check.actor,
+                    check.token.request_digest,
+                )? == Some(**terminal)
+            }
+            Self::Initialization(InitializationReply::Initialized(fact)) => {
+                super::super::initialization::publish::selected(result, check)? == Some(**fact)
+            }
+            // A known negative is the original phase knowledge. A later attempt
+            // may initialize this logical operation, without rewriting that denial.
+            Self::Initialization(InitializationReply::Denied(_)) => true,
+        })
+    }
+    async fn closed_graph(
         &self,
-        record: &Record,
-    ) -> Result<Option<CompletedRootPush>, CodecError> {
+        store: &ArtifactStore,
+        hash: &mut blake3::Hasher,
+    ) -> Result<(), RootRecoveryError> {
+        match self {
+            Self::Push(terminal) => {
+                super::super::root_completion::closed_graph(store, terminal.root, hash).await?
+            }
+            Self::Initialization(reply) => {
+                hash.update(&encoded(reply, 512)?);
+                if let InitializationReply::Initialized(fact) = reply {
+                    let format = fact.catalog.ok_or(RootRecoveryError::Context)?.format;
+                    let (catalog, directory, refs) =
+                        super::super::initialization::verify_empty(**fact, store, format).await?;
+                    descriptor(
+                        hash,
+                        catalog.operation,
+                        ArtifactKind::CatalogNode,
+                        catalog.artifact,
+                    )?;
+                    descriptor(
+                        hash,
+                        directory.operation,
+                        ArtifactKind::CatalogNode,
+                        directory.artifact,
+                    )?;
+                    descriptor(
+                        hash,
+                        refs.operation(),
+                        ArtifactKind::InputRoot,
+                        refs.artifact(),
+                    )?;
+                }
+            }
+        }
+        Ok(())
+    }
+}
+impl phase::Journal {
+    pub(super) fn terminal(&self, record: &Record) -> Result<Option<Terminal>, CodecError> {
         // Validation is required even when only a primary result is selected.
         self.may_advance(record)?;
         if record.kind == Kind::Initialization {
-            // Initial catalog roots have no native push response/audit graph.
-            // Keep their recovery pin until typed initialization retirement.
-            return Ok(None);
+            return self
+                .primary
+                .as_ref()
+                .map(|value| {
+                    value
+                        .decode_reply::<InitializationReply>()
+                        .map(Terminal::Initialization)
+                })
+                .transpose();
         }
         let result = if record.kind == Kind::Policy {
             if !self.refused(record)? {
@@ -143,12 +218,24 @@ impl phase::Journal {
             .map(|value| value.decode_reply::<RootCompletionReply>())
             .transpose()?
         {
-            Some(RootCompletionReply::Completed(value)) => Ok(Some(*value)),
+            Some(RootCompletionReply::Completed(value)) => Ok(Some(Terminal::Push(value))),
             _ => Ok(None),
         }
     }
 }
 impl RegisteredRootRecovery {
+    pub(super) async fn attempt_closed(
+        &self,
+        client: &CellClient,
+    ) -> Result<bool, RootRecoveryError> {
+        let sql =
+            SqlCell::<RepositoryModule>::new(client.clone(), self.evidence().target().clone())?;
+        let result = sql.query(None, statement(
+            "SELECT 1 FROM catalog_operations WHERE incarnation=?1 AND admission_sequence=?2 LIMIT 1",
+            vec![blob(self.token().owner.incarnation.as_bytes()), number(self.token().attempt)?],
+        )).await.map_err(|error| RootRecoveryError::Query(Box::new(error)))?;
+        Ok(rows(&result.output)?.is_empty())
+    }
     /// Complete typed header/history and selected audit verification precedes
     /// minting the release proof. A historical/intermediate/unknown capability
     /// cannot release a pin. This proof authorizes no provider deletion.
@@ -167,6 +254,9 @@ impl RegisteredRootRecovery {
         let terminal = journal
             .terminal(&self.record)?
             .ok_or(RootRecoveryError::Context)?;
+        if !self.attempt_closed(&client).await? {
+            return Err(RootRecoveryError::Context);
+        }
         let sql =
             SqlCell::<RepositoryModule>::new(client.clone(), self.evidence().target().clone())?;
         let row = sql
@@ -174,10 +264,7 @@ impl RegisteredRootRecovery {
                 None,
                 SqlBatch {
                     statements: vec![
-                        SqlStatement {
-                            sql: super::super::root_completion::read::SAVED.into(),
-                            parameters: vec![blob(self.token().operation)],
-                        },
+                        terminal.selected_statement(self.token().operation),
                         SqlStatement {
                             sql: "SELECT push_cert_seed FROM repository_identity WHERE singleton=1"
                                 .into(),
@@ -192,12 +279,7 @@ impl RegisteredRootRecovery {
             )
             .await
             .map_err(|error| RootRecoveryError::Query(Box::new(error)))?;
-        if super::super::root_completion::read::saved(
-            &row.output,
-            &self.record.check.actor,
-            self.token().request_digest,
-        )? != Some(terminal)
-        {
+        if !terminal.matches_selected(&row.output, &self.record.check)? {
             return Err(RootRecoveryError::Context);
         }
         let seed = super::super::attestation::seed(
@@ -250,7 +332,7 @@ impl RegisteredRootRecovery {
             )?;
             record = next;
         }
-        super::super::root_completion::closed_graph(store, terminal.root, &mut hash).await?;
+        terminal.closed_graph(store, &mut hash).await?;
         let proof = Proof {
             recovery: self.certificate.clone(),
             phase: *blake3::hash(&encoded(&journal, 2048)?).as_bytes(),
@@ -349,7 +431,7 @@ pub struct ReleaseTerminalRecovery;
 impl Command for ReleaseTerminalRecovery {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 40;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = TerminalReleaseInput;
     type Output = TerminalReleaseReply;
     fn execute(
@@ -402,21 +484,18 @@ impl Command for ReleaseTerminalRecovery {
         let Some(terminal) = terminal else {
             return deny(PreparationDenial::Conflict);
         };
-        let selected = context.sql(&statement(
-            super::super::root_completion::read::SAVED,
-            vec![blob(record.check.token.operation)],
-        ))?;
-        if super::super::root_completion::read::saved(
-            &selected,
-            &record.check.actor,
-            record.check.token.request_digest,
-        )? != Some(terminal)
-        {
+        let selected = context.sql(&SqlBatch {
+            statements: vec![terminal.selected_statement(record.check.token.operation)],
+        })?;
+        if !terminal.matches_selected(&selected, &record.check)? {
             return deny(PreparationDenial::Conflict);
         }
+        // Closing an older denied initialization must not delete the currently
+        // claimed attempt of the same logical operation. The exact pin is the
+        // authority boundary; a successor's independent namespace remains live.
         let active = context.sql(&statement(
-            "SELECT 1 FROM catalog_operations WHERE id=?1 LIMIT 1",
-            vec![blob(record.check.token.operation)],
+            "SELECT 1 FROM catalog_operations WHERE incarnation=?1 AND admission_sequence=?2 LIMIT 1",
+            vec![blob(record.check.token.owner.incarnation.as_bytes()), number(record.check.token.attempt)?],
         ))?;
         if !rows(&active)?.is_empty() {
             return deny(PreparationDenial::Conflict);
@@ -430,7 +509,7 @@ impl Command for ReleaseTerminalRecovery {
             stamp: Stamp::of(&evidence),
             result: phase::Recorded::new(context.sequence(), false, encoded(&reply, 128)?)?,
         };
-        let changed=context.sql(&statement("UPDATE pushes SET recovery=?1,recovery_phase=?2,recovery_release=?3 WHERE id=?4 AND recovery IS NULL AND response_root IS NOT NULL",vec![blob(certificate),blob(saved),blob(encoded(&released,1024)?),blob(record.check.token.operation)]))?;
+        let changed=context.sql(&statement("INSERT INTO catalog_recovery_receipts(incarnation,admission_sequence,operation,recovery,recovery_phase,recovery_release) VALUES(?1,?2,?3,?4,?5,?6)",vec![blob(record.check.token.owner.incarnation.as_bytes()),number(record.check.token.attempt)?,blob(record.check.token.operation),blob(certificate),blob(saved),blob(encoded(&released,1024)?)]))?;
         if changed.first().is_none_or(|set| set.rows_affected != 1) {
             return Err(Error::Command("terminal archive CAS failed"));
         }
@@ -451,9 +530,8 @@ impl RegisteredRootRecovery {
     ) -> Result<Option<Self>, RootRecoveryError> {
         let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
         let result=sql.query(None,SqlBatch{statements:vec![
-            SqlStatement{sql:"SELECT recovery,recovery_phase FROM pushes WHERE id=?1 AND recovery IS NOT NULL".into(),parameters:vec![blob(check.token.operation)]},
+            SqlStatement{sql:"SELECT recovery,recovery_phase FROM catalog_recovery_receipts WHERE incarnation=?1 AND admission_sequence=?2 AND operation=?3".into(),parameters:vec![blob(check.token.owner.incarnation.as_bytes()),number(check.token.attempt)?,blob(check.token.operation)]},
             SqlStatement{sql:"SELECT push_cert_seed FROM repository_identity WHERE singleton=1 AND repository_id=?1".into(),parameters:vec![blob(check.token.repository)]},
-            SqlStatement{sql:super::super::root_completion::read::SAVED.into(),parameters:vec![blob(check.token.operation)]},
         ]}).await.map_err(|error|RootRecoveryError::Query(Box::new(error)))?;
         let Some([SqlValue::Blob(bytes), saved]) = rows(&result.output)?.first().map(Vec::as_slice)
         else {
@@ -476,12 +554,16 @@ impl RegisteredRootRecovery {
         let terminal = phase::journal(saved, &record)?
             .terminal(&record)?
             .ok_or(RootRecoveryError::Context)?;
-        if super::super::root_completion::read::saved(
-            result.output.get(2..).ok_or(RootRecoveryError::Context)?,
-            &check.actor,
-            check.token.request_digest,
-        )? != Some(terminal)
-        {
+        let selected = sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![terminal.selected_statement(check.token.operation)],
+                },
+            )
+            .await
+            .map_err(|error| RootRecoveryError::Query(Box::new(error)))?;
+        if !terminal.matches_selected(&selected.output, check)? {
             return Err(RootRecoveryError::Context);
         }
         let bundle = record.root.read::<Bundle>(store, ROOT_BYTES).await?;
@@ -494,6 +576,20 @@ impl RegisteredRootRecovery {
     }
 }
 impl ReadyTerminalRelease {
+    /// The repository's tracked cold-transition task retains this command
+    /// through cancellation, just as it retains the initial publication.
+    pub(crate) async fn complete(
+        self,
+    ) -> Result<Committed<TerminalReleaseReply>, PublicationError> {
+        let evidence = Box::new(self.command.evidence().clone());
+        let PublicationOutcome::TerminalRelease(result) = self.dispatch(false, 0).await? else {
+            return Err(PublicationError::Recovery {
+                evidence,
+                source: Box::new(RootRecoveryError::Context),
+            });
+        };
+        Ok(result)
+    }
     #[cfg(test)]
     pub(in crate::packs::publication) fn with_client_for_test(
         mut self,
@@ -525,8 +621,8 @@ impl ReadyTerminalRelease {
             .query(
                 None,
                 statement(
-                    "SELECT recovery_release FROM pushes WHERE id=?1",
-                    vec![blob(self.check.token.operation)],
+                    "SELECT recovery_release FROM catalog_recovery_receipts WHERE incarnation=?1 AND admission_sequence=?2 AND operation=?3",
+                    vec![blob(self.check.token.owner.incarnation.as_bytes()), number(self.check.token.attempt)?, blob(self.check.token.operation)],
                 ),
             )
             .await
diff --git a/crates/canopy-server/src/packs/publication/recovery/initialization.rs b/crates/canopy-server/src/packs/publication/recovery/initialization.rs
index df126aee..98468de1 100644
--- a/crates/canopy-server/src/packs/publication/recovery/initialization.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/initialization.rs
@@ -2,8 +2,8 @@
 use super::*;
 
 impl RegisteredRootRecovery {
-    /// Discover only the current initialization attempt, using the indexed
-    /// operation/lease binding. Historical metadata grants knowledge, not Write.
+    /// Discover the current or successfully closed initialization pin, using
+    /// exact indexed operation/lease and immutable outcome bindings. Historical metadata grants knowledge, not Write.
     pub async fn load_initialization(
         client: &CellClient,
         target: &CellTarget,
@@ -18,9 +18,12 @@ impl RegisteredRootRecovery {
         }
         let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
         let observed = sql.query(None, statement(
-            "SELECT o.incarnation,o.admission_sequence FROM catalog_operations o JOIN catalog_leases l ON l.incarnation=o.incarnation AND l.admission_sequence=o.admission_sequence WHERE o.id=?1 AND o.actor=?2 AND o.request_digest=?3 AND o.generation=0 AND l.recovery IS NOT NULL",
+            "SELECT o.incarnation,o.admission_sequence FROM catalog_operations o JOIN catalog_leases l ON l.incarnation=o.incarnation AND l.admission_sequence=o.admission_sequence WHERE o.id=?1 AND o.actor=?2 AND o.request_digest=?3 AND o.generation=0 AND l.recovery IS NOT NULL UNION ALL SELECT l.incarnation,l.admission_sequence FROM catalog_initialization i JOIN catalog_leases l ON l.incarnation=i.incarnation AND l.admission_sequence=i.admission_sequence WHERE i.id=?1 AND i.actor=?2 AND i.request_digest=?3 AND l.generation=0 AND l.recovery IS NOT NULL",
             vec![blob(input.operation),SqlValue::Text(input.actor.clone()),blob(input.request_digest)]
         )).await.map_err(|error| RootRecoveryError::Query(Box::new(error)))?;
+        if rows(&observed.output)?.len() > 1 {
+            return Err(RootRecoveryError::Context);
+        }
         let Some([incarnation, sequence]) = rows(&observed.output)?.first().map(Vec::as_slice)
         else {
             if rows(&observed.output)?.is_empty() {
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index e7b843b2..7502f6f5 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -39,6 +39,8 @@ const DOMAIN: &[u8] = b"canopy.publication-command-recovery.v4\0";
 
 #[derive(Debug, thiserror::Error)]
 pub enum RootRecoveryError {
+    #[error("closed initialization graph failed")]
+    Initialization(#[from] super::initialization::InitializationVerificationError),
     #[error("closed native audit graph failed")]
     Audit(#[from] NativeResultError),
     #[error("terminal release command preparation failed")]
diff --git a/crates/canopy-server/src/packs/publication/recovery/phase.rs b/crates/canopy-server/src/packs/publication/recovery/phase.rs
index cb011547..90219713 100644
--- a/crates/canopy-server/src/packs/publication/recovery/phase.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/phase.rs
@@ -350,7 +350,7 @@ impl RegisteredRootRecovery {
         let sql =
             SqlCell::<RepositoryModule>::new(client.clone(), self.evidence().target().clone())?;
         let result = sql.query(None, SqlBatch { statements: vec![
-            SqlStatement { sql: "SELECT recovery,recovery_phase FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 UNION ALL SELECT recovery,recovery_phase FROM pushes WHERE id=?3 AND recovery IS NOT NULL AND NOT EXISTS(SELECT 1 FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2)".into(), parameters: vec![blob(self.token().owner.incarnation.as_bytes()), number(self.token().attempt)?, blob(self.token().operation)] },
+            SqlStatement { sql: "SELECT recovery,recovery_phase FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 UNION ALL SELECT recovery,recovery_phase FROM catalog_recovery_receipts WHERE incarnation=?1 AND admission_sequence=?2 AND operation=?3 AND NOT EXISTS(SELECT 1 FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2)".into(), parameters: vec![blob(self.token().owner.incarnation.as_bytes()), number(self.token().attempt)?, blob(self.token().operation)] },
             SqlStatement { sql: "SELECT push_cert_seed FROM repository_identity WHERE singleton=1".into(), parameters: vec![] },
         ] }).await.map_err(|error| RootRecoveryError::Query(Box::new(error)))?;
         let Some([SqlValue::Blob(bytes), saved]) = rows(&result.output)?.first().map(Vec::as_slice)
diff --git a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
index 2b9656ac..47e230ea 100644
--- a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
@@ -260,6 +260,10 @@ impl Scan {
             if journal.terminal(&registered.record)?.is_some()
                 && let Some(maintenance) = &self.maintenance
             {
+                if !registered.attempt_closed(&self.client).await? {
+                    stats.deferred = stats.deferred.saturating_add(1);
+                    return Ok(());
+                }
                 let identity =
                     crate::server::mutation_identity().map_err(|source| Error::Facility {
                         name: "terminal retirement identity",
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index c51060a1..450c6e6c 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -116,6 +116,7 @@ mod tests {
                 512,
             ),
             (39, RegisterRootRecovery::CODEC_VERSION, 4096, 4096),
+            (40, ReleaseTerminalRecovery::CODEC_VERSION, 4096, 128),
         ] {
             let operation = descriptor
                 .commands
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index 603f714a..04a615aa 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -68,11 +68,6 @@ CREATE TABLE pushes (
     options TEXT NOT NULL DEFAULT '[]' CHECK(length(CAST(options AS BLOB)) <= 65536),
     response_id BLOB CHECK(response_id IS NULL OR length(response_id) = 16),
     completion_digest BLOB CHECK(completion_digest IS NULL OR length(completion_digest) = 32),
-    -- Closed attempts keep their original recovery headers and phase here,
-    -- independently of a preparation floor or creating-input lease.
-    recovery BLOB CHECK(recovery IS NULL OR (typeof(recovery)='blob' AND length(recovery) BETWEEN 1 AND 1024)),
-    recovery_phase BLOB CHECK(recovery_phase IS NULL OR (typeof(recovery_phase)='blob' AND length(recovery_phase) BETWEEN 1 AND 2048)),
-    recovery_release BLOB CHECK(recovery_release IS NULL OR (typeof(recovery_release)='blob' AND length(recovery_release) BETWEEN 1 AND 1024)),
     response_root BLOB CHECK(response_root IS NULL OR (typeof(response_root)='blob' AND length(response_root) BETWEEN 1 AND 128)),
     rejected INTEGER CHECK(rejected IN (0, 1)),
     rejection_reason TEXT,
@@ -84,9 +79,6 @@ CREATE TABLE pushes (
     CHECK((response_id IS NULL) = (rejected IS NULL)),
     CHECK((response_id IS NULL) = (completion_digest IS NULL)),
     CHECK(response_root IS NULL OR response_id IS NOT NULL),
-    CHECK((recovery IS NULL) = (recovery_phase IS NULL)),
-    CHECK((recovery IS NULL) = (recovery_release IS NULL)),
-    CHECK(recovery IS NULL OR response_root IS NOT NULL),
     CHECK(rejected IS NOT 1 OR publication IS NULL)
 ) WITHOUT ROWID;
 CREATE TRIGGER push_publication_immutable BEFORE UPDATE OF publication,publication_plan_digest ON pushes
@@ -110,10 +102,6 @@ CREATE TRIGGER push_root_completion_retained BEFORE DELETE ON pushes
 WHEN OLD.response_root IS NOT NULL
 BEGIN SELECT RAISE(ABORT, 'root completion must be retained'); END;
 
-CREATE TRIGGER push_recovery_archive_immutable BEFORE UPDATE OF recovery,recovery_phase,recovery_release ON pushes
-WHEN OLD.recovery IS NOT NULL AND (NEW.recovery IS NOT OLD.recovery OR NEW.recovery_phase IS NOT OLD.recovery_phase OR NEW.recovery_release IS NOT OLD.recovery_release)
-BEGIN SELECT RAISE(ABORT, 'closed recovery is immutable'); END;
-
 CREATE TRIGGER push_initial_staging_immutable BEFORE UPDATE OF initial_staging ON pushes
 WHEN OLD.initial_staging IS NOT NULL AND NEW.initial_staging IS NOT OLD.initial_staging
 BEGIN SELECT RAISE(ABORT, 'initial staging receipt is immutable'); END;
@@ -365,6 +353,8 @@ INSERT INTO catalog_state VALUES(1, 0);
 -- fact retains the small empty catalog/ref metadata for exact logical recovery.
 CREATE TABLE catalog_initialization (
     singleton INTEGER PRIMARY KEY CHECK(singleton=1),
+    incarnation BLOB NOT NULL CHECK(typeof(incarnation)='blob' AND length(incarnation)=16),
+    admission_sequence INTEGER NOT NULL CHECK(typeof(admission_sequence)='integer' AND admission_sequence>0),
     id BLOB NOT NULL UNIQUE CHECK(length(id)=16),
     actor TEXT NOT NULL,
     request_digest BLOB NOT NULL CHECK(length(request_digest)=32),
@@ -394,6 +384,27 @@ CREATE TRIGGER catalog_compactions_not_replaced BEFORE INSERT ON catalog_compact
 WHEN EXISTS(SELECT 1 FROM catalog_compactions WHERE id=NEW.id)
 BEGIN SELECT RAISE(ABORT, 'compaction outcomes cannot be replaced'); END;
 
+-- Closed attempts retain the same bounded authenticated header, phase and
+-- original release receipt, independent of generation floors and pin quota.
+-- Multiple attempts of one logical initialization have independent identities.
+CREATE TABLE catalog_recovery_receipts (
+    incarnation BLOB NOT NULL CHECK(typeof(incarnation)='blob' AND length(incarnation)=16),
+    admission_sequence INTEGER NOT NULL CHECK(typeof(admission_sequence)='integer' AND admission_sequence>0),
+    operation BLOB NOT NULL CHECK(typeof(operation)='blob' AND length(operation)=16),
+    recovery BLOB NOT NULL CHECK(typeof(recovery)='blob' AND length(recovery) BETWEEN 1 AND 1024),
+    recovery_phase BLOB NOT NULL CHECK(typeof(recovery_phase)='blob' AND length(recovery_phase) BETWEEN 1 AND 2048),
+    recovery_release BLOB NOT NULL CHECK(typeof(recovery_release)='blob' AND length(recovery_release) BETWEEN 1 AND 1024),
+    PRIMARY KEY(incarnation,admission_sequence)
+) WITHOUT ROWID;
+CREATE INDEX catalog_recovery_receipts_by_operation ON catalog_recovery_receipts(operation,incarnation,admission_sequence);
+CREATE TRIGGER catalog_recovery_receipt_immutable BEFORE UPDATE ON catalog_recovery_receipts
+BEGIN SELECT RAISE(ABORT, 'closed recovery is immutable'); END;
+CREATE TRIGGER catalog_recovery_receipt_not_replaced BEFORE INSERT ON catalog_recovery_receipts
+WHEN EXISTS(SELECT 1 FROM catalog_recovery_receipts WHERE incarnation=NEW.incarnation AND admission_sequence=NEW.admission_sequence)
+BEGIN SELECT RAISE(ABORT, 'closed recovery cannot be replaced'); END;
+CREATE TRIGGER catalog_recovery_receipt_retained BEFORE DELETE ON catalog_recovery_receipts
+BEGIN SELECT RAISE(ABORT, 'closed recovery must be retained'); END;
+
 -- Staging attempts retain their creating namespace with a NULL generation.
 -- A one-way late bind pins a generation floor and every later generation. This permits
 -- read-only frontier refresh without a new durable pin/Claim per publication.
@@ -471,9 +482,9 @@ BEGIN SELECT RAISE(ABORT, 'publication recovery requires exact phase append'); E
 -- Typed recovery/backup traversal must authorize releasing these pins.
 CREATE TRIGGER catalog_lease_recovery_retained BEFORE DELETE ON catalog_leases
 WHEN OLD.recovery IS NOT NULL AND NOT EXISTS(
-    SELECT 1 FROM pushes p WHERE p.id=OLD.operation AND p.response_root IS NOT NULL
-        AND p.recovery IS OLD.recovery AND p.recovery_phase IS OLD.recovery_phase
-        AND p.recovery_release IS NOT NULL)
+    SELECT 1 FROM catalog_recovery_receipts p WHERE p.incarnation=OLD.incarnation
+        AND p.admission_sequence=OLD.admission_sequence AND p.operation=OLD.operation
+        AND p.recovery IS OLD.recovery AND p.recovery_phase IS OLD.recovery_phase)
 BEGIN SELECT RAISE(ABORT, 'root recovery command is retained'); END;
 
 CREATE TABLE catalog_operations (
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 77ffe90c..b16bb990 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -8,6 +8,7 @@ mod durable_recovery;
 mod frontier;
 mod initialization;
 mod initialization_recovery;
+mod initialization_retirement;
 mod inputs;
 mod mandatory_registration;
 mod namespaces;
@@ -199,6 +200,18 @@ impl Fixture {
     async fn counts(&self) -> Result<(u64, u64)> {
         counts(&self.handle).await
     }
+    async fn counts_for(&self, token: PreparationToken) -> Result<(u64, u64)> {
+        let bytes = self.handle.query(0, 16, move |connection| {
+            let parameters = rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt];
+            let operations: u64 = connection.query_row("SELECT count(*) FROM catalog_operations WHERE incarnation=?1 AND admission_sequence=?2", parameters, |row| row.get(0))?;
+            let leases: u64 = connection.query_row("SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2", parameters, |row| row.get(0))?;
+            Ok([operations.to_be_bytes(), leases.to_be_bytes()].concat())
+        }).await?;
+        Ok((
+            u64::from_be_bytes(bytes[..8].try_into()?),
+            u64::from_be_bytes(bytes[8..].try_into()?),
+        ))
+    }
     // Trusted fixture injection only. Production generation facts require the
     // complete catalog verifier and fenced publisher; a digest is not a proof.
     async fn install_catalog(&self, generation: u64, catalog: StoredCatalog) -> Result<()> {
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs b/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
new file mode 100644
index 00000000..fc05d9d3
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
@@ -0,0 +1,511 @@
+//! Release the initial floor without losing the exact original command result.
+use super::*;
+use super::{
+    initialization::empty,
+    prepare::cleaned,
+    publishing::{edit, edit_handle},
+    terminal_retention::maintenance,
+};
+use crate::packs::catalog::CatalogSnapshot;
+use canopy_object_storage::artifact::{ArtifactKey, ArtifactKind, ArtifactStore};
+use cellule_runtime::Resolution;
+use object_store::{ObjectStore, ObjectStoreExt};
+use tokio::time::{Duration, timeout};
+
+#[tokio::test]
+async fn initialized_repository_releases_zero_floor_and_recovers_original_receipt() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let (prepared, root, budget) = empty(&f, [235; 16], store.clone()).await?;
+        let prepared = Arc::new(prepared);
+        let ready = prepared.ready_initialization(identity()?).await?;
+        let registered = ready.persist_recovery(&store, identity()?).await?;
+        let admin = maintenance(&f.handle, f.repository).await?;
+        assert!(
+            registered
+                .ready_terminal_release(f.client(), &store, admin.clone(), identity()?)
+                .await
+                .is_err()
+        );
+        let original = ready.complete(&registered, &store).await?;
+        let discovered = RegisteredRootRecovery::load_initialization(
+            &f.client(),
+            &f.target,
+            &store,
+            &f.begin([235; 16]),
+        )
+        .await?
+        .ok_or("closed initial pin not discovered")?;
+        assert_eq!(discovered.evidence(), registered.evidence());
+        let result = registered
+            .ready_terminal_release(f.client(), &store, admin, identity()?)
+            .await?
+            .complete()
+            .await?;
+        assert_eq!(result.output, TerminalReleaseReply::Released);
+        f.handle.query(0, 128, |db| {
+            assert_eq!(db.query_row("SELECT count(*) FROM catalog_leases", [], |r| r.get::<_,u64>(0))?, 0);
+            assert_eq!(db.query_row("SELECT count(*) FROM catalog_initialization", [], |r| r.get::<_,u64>(0))?, 1);
+            assert_eq!(db.query_row("SELECT count(*) FROM catalog_recovery_receipts", [], |r| r.get::<_,u64>(0))?, 1);
+            for sql in [
+                "UPDATE catalog_recovery_receipts SET operation=zeroblob(16)",
+                "UPDATE catalog_recovery_receipts SET recovery_phase=x'01'",
+                "UPDATE catalog_recovery_receipts SET recovery_release=x'01'",
+                "INSERT OR REPLACE INTO catalog_recovery_receipts SELECT * FROM catalog_recovery_receipts",
+                "DELETE FROM catalog_recovery_receipts",
+            ] {
+                assert!(db.execute(sql, []).is_err(), "{sql}");
+            }
+            Ok(Vec::new())
+        }).await?;
+        let check = check(registered.token());
+        drop(discovered);
+        drop(registered);
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        let loaded = RegisteredRootRecovery::load(&f.client(), &f.target, &store, &check)
+            .await?
+            .ok_or("initial receipt archive missing")?;
+        let recovered = loaded.recover_initialization(&f.client(), &store).await?;
+        assert_eq!(
+            (recovered.output, recovered.receipt),
+            (original.output, original.receipt)
+        );
+        let mut wrong = check;
+        wrong.token.attempt += 1;
+        assert!(
+            RegisteredRootRecovery::load(&f.client(), &f.target, &store, &wrong)
+                .await?
+                .is_none()
+        );
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initialization_retirement_checks_actual_authority_and_rolls_back_the_last_write() -> Result
+{
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    let (prepared, root, budget) = empty(&f, [236; 16], store.clone()).await?;
+    let prepared = Arc::new(prepared);
+    let ready = prepared.ready_initialization(identity()?).await?;
+    let saved = ready.persist_recovery(&store, identity()?).await?;
+    ready.complete(&saved, &store).await?;
+    let admin = maintenance(&f.handle, f.repository).await?;
+    for wrong_owner in [true, false] {
+        let mut wrong = admin.clone();
+        if wrong_owner {
+            wrong.owner.epoch += 1;
+        } else {
+            wrong.actor = "outsider".into();
+        }
+        let release = saved
+            .ready_terminal_release(f.client(), &store, wrong, identity()?)
+            .await?;
+        assert!(
+            matches!(release.complete().await, Err(PublicationError::TerminalRelease(InvocationError::Rejected(ref value))) if value.output == TerminalReleaseReply::Denied(PreparationDenial::Unauthorized))
+        );
+    }
+    let release = saved
+        .ready_terminal_release(f.client(), &store, admin, identity()?)
+        .await?;
+    edit_handle(&f.handle, "CREATE TRIGGER initialization_release_late_fault BEFORE DELETE ON catalog_leases WHEN OLD.recovery IS NOT NULL BEGIN SELECT RAISE(ABORT,'late initialization release fault'); END").await?;
+    let failed = release.clone().complete().await;
+    assert!(
+        matches!(failed, Err(PublicationError::TerminalRelease(InvocationError::NotStarted(Error::Sqlite(rusqlite::Error::SqliteFailure(_,Some(ref message)))))) if message == "late initialization release fault"),
+        "{failed:?}"
+    );
+    assert!(matches!(
+        f.client().resolve(&release.evidence_for_test()).await?,
+        Resolution::Absent
+    ));
+    f.handle.query(0,128,|db| {
+        assert_eq!(db.query_row("SELECT count(*) FROM catalog_recovery_receipts",[],|r| r.get::<_,u64>(0))?,0);
+        assert_eq!(db.query_row("SELECT count(*) FROM catalog_leases WHERE recovery IS NOT NULL AND recovery_phase IS NOT NULL",[],|r| r.get::<_,u64>(0))?,1);
+        Ok(Vec::new())
+    }).await?;
+    edit_handle(&f.handle, "DROP TRIGGER initialization_release_late_fault").await?;
+    assert_eq!(
+        release.complete().await?.output,
+        TerminalReleaseReply::Released
+    );
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn missing_typed_initial_metadata_cannot_authorize_retirement() -> Result {
+    for missing in 0..3 {
+        let f = Fixture::new(ObjectFormat::Sha256).await?;
+        let provider = Arc::new(InMemory::new());
+        let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+        let (prepared, root, budget) = empty(&f, [237; 16], store.clone()).await?;
+        let prepared = Arc::new(prepared);
+        let ready = prepared.ready_initialization(identity()?).await?;
+        let saved = ready.persist_recovery(&store, identity()?).await?;
+        let original = ready.complete(&saved, &store).await?;
+        let InitializationReply::Initialized(fact) = &original.output else {
+            return Err("initialization reply".into());
+        };
+        let catalog = fact.catalog.ok_or("catalog absent")?;
+        let directory = CatalogSnapshot::download(&store, catalog).await?.directory;
+        let refs = fact.refs.ok_or("refs absent")?;
+        let (operation, kind, artifact) = match missing {
+            0 => (
+                catalog.operation,
+                ArtifactKind::CatalogNode,
+                catalog.artifact,
+            ),
+            1 => (
+                directory.operation,
+                ArtifactKind::CatalogNode,
+                directory.artifact,
+            ),
+            _ => (refs.operation(), ArtifactKind::InputRoot, refs.artifact()),
+        };
+        let path = store.path(
+            ArtifactKey {
+                operation,
+                binding_digest: artifact.digest,
+                kind,
+            },
+            artifact.digest,
+        )?;
+        provider.head(&path).await?;
+        provider.delete(&path).await?;
+        assert!(
+            saved
+                .ready_terminal_release(
+                    f.client(),
+                    &store,
+                    maintenance(&f.handle, f.repository).await?,
+                    identity()?
+                )
+                .await
+                .is_err()
+        );
+        assert_eq!(
+            saved
+                .recover_initialization(&f.client(), &store)
+                .await?
+                .receipt,
+            original.receipt
+        );
+        f.handle
+            .query(0, 128, |db| {
+                assert_eq!(
+                    db.query_row(
+                        "SELECT count(*) FROM catalog_leases WHERE recovery IS NOT NULL",
+                        [],
+                        |r| r.get::<_, u64>(0)
+                    )?,
+                    1
+                );
+                assert_eq!(
+                    db.query_row("SELECT count(*) FROM catalog_recovery_receipts", [], |r| {
+                        r.get::<_, u64>(0)
+                    })?,
+                    0
+                );
+                Ok(Vec::new())
+            })
+            .await?;
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn denied_initial_attempt_retires_only_after_claim_and_keeps_its_receipt_after_success()
+-> Result {
+    let f = Fixture::new(ObjectFormat::Sha1).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    let operation = [238; 16];
+    let (prepared, root, budget) = empty(&f, operation, store.clone()).await?;
+    let prepared = Arc::new(prepared);
+    let ready = prepared.ready_initialization(identity()?).await?;
+    let saved = ready.persist_recovery(&store, identity()?).await?;
+    let old = check(saved.token());
+    edit(
+        &f,
+        "UPDATE catalog_operations SET expires_at_ms=0; UPDATE catalog_leases SET expires_at_ms=0",
+    )
+    .await?;
+    let denied = match saved.recover_initialization(&f.client(), &store).await {
+        Err(PublicationError::Initialization(InvocationError::Rejected(value))) => value,
+        other => return Err(format!("expected original expiry: {other:?}").into()),
+    };
+    assert_eq!(
+        denied.output,
+        InitializationReply::Denied(PreparationDenial::Expired)
+    );
+    let admin = maintenance(&f.handle, f.repository).await?;
+    assert!(
+        saved
+            .ready_terminal_release(f.client(), &store, admin.clone(), identity()?)
+            .await
+            .is_err()
+    );
+    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let supervisor = RecoverySupervisor::start_retiring(
+        f.client(),
+        f.target.clone(),
+        (*store).clone(),
+        queue.clone(),
+        RecoveryScanLimits {
+            page: 1,
+            interval: Duration::from_secs(1),
+        },
+        admin.clone(),
+    )?;
+    timeout(Duration::from_secs(10), async {
+        while supervisor.stats().scanned == 0 {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
+    let scan = supervisor.shutdown().await?;
+    assert_eq!(scan.release_submitted, 0);
+    assert!(scan.deferred > 0);
+    assert_eq!(queue.stats().await.admitted, 0);
+    f.client()
+        .command::<ClaimPreparation>(
+            &f.target,
+            identity()?,
+            LeaseRequest {
+                check: old.clone(),
+                lease_ms: DEFAULT_LEASE_MS,
+            },
+        )
+        .await?;
+    let release = saved
+        .ready_terminal_release(f.client(), &store, admin.clone(), identity()?)
+        .await?;
+    release.complete().await?;
+    drop(ready);
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    let (prepared, root, budget) = empty(&f, operation, store.clone()).await?;
+    let prepared = Arc::new(prepared);
+    let ready = prepared.ready_initialization(identity()?).await?;
+    let current = ready.persist_recovery(&store, identity()?).await?;
+    assert_ne!(
+        current.token().artifact_operation,
+        saved.token().artifact_operation
+    );
+    assert_eq!(
+        RegisteredRootRecovery::load_initialization(
+            &f.client(),
+            &f.target,
+            &store,
+            &f.begin(operation)
+        )
+        .await?
+        .ok_or("new attempt absent")?
+        .evidence(),
+        current.evidence()
+    );
+    ready.complete(&current, &store).await?;
+    current
+        .ready_terminal_release(f.client(), &store, admin, identity()?)
+        .await?
+        .complete()
+        .await?;
+    let old = RegisteredRootRecovery::load(&f.client(), &f.target, &store, &old)
+        .await?
+        .ok_or("old denied archive absent")?;
+    assert!(
+        matches!(old.recover_initialization(&f.client(), &store).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.output == denied.output && value.receipt == denied.receipt)
+    );
+    f.handle
+        .query(0, 128, |db| {
+            assert_eq!(
+                db.query_row("SELECT count(*) FROM catalog_recovery_receipts", [], |r| {
+                    r.get::<_, u64>(0)
+                })?,
+                2
+            );
+            assert_eq!(
+                db.query_row("SELECT count(*) FROM catalog_leases", [], |r| r
+                    .get::<_, u64>(0))?,
+                0
+            );
+            Ok(Vec::new())
+        })
+        .await?;
+    assert!(queue.close_and_drain().await.is_empty());
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn lost_initial_retirement_ack_keeps_original_receipts_after_expiry_body_loss_and_restore()
+-> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let provider: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+    let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+    let (prepared, root, budget) = empty(&f, [239; 16], store.clone()).await?;
+    let prepared = Arc::new(prepared);
+    let mut mutation = identity()?;
+    mutation.expires_at_ms = mutation.issued_at_ms + 8_000;
+    let ready = prepared.ready_initialization(mutation).await?;
+    let saved = ready.persist_recovery(&store, identity()?).await?;
+    let original = ready.complete(&saved, &store).await?;
+    let check = check(saved.token());
+    let mut release_identity = identity()?;
+    release_identity.expires_at_ms = release_identity.issued_at_ms + 8_000;
+    let release = saved
+        .ready_terminal_release(
+            f.client(),
+            &store,
+            maintenance(&f.handle, f.repository).await?,
+            release_identity,
+        )
+        .await?;
+    let rival = saved
+        .ready_terminal_release(
+            f.client(),
+            &store,
+            maintenance(&f.handle, f.repository).await?,
+            identity()?,
+        )
+        .await?;
+    let evidence = release.evidence_for_test();
+    assert!(matches!(
+        release.clone().dispatch(false, 2).await,
+        Err(PublicationError::TerminalRelease(InvocationError::Pending(
+            _
+        )))
+    ));
+    let released = release.clone().complete().await?;
+    assert!(
+        matches!(rival.complete().await, Err(PublicationError::TerminalRelease(InvocationError::Rejected(ref value))) if value.output == TerminalReleaseReply::Denied(PreparationDenial::Missing))
+    );
+    for (key, descriptor) in saved.command_bodies_for_test() {
+        let path = store.path(key, descriptor.digest)?;
+        provider.head(&path).await?;
+        provider.delete(&path).await?;
+    }
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    edit(&f, "UPDATE repository_identity SET owner='replacement'").await?;
+    let (runtime, handle, client) = super::durable_recovery::restore_owner(&f, &check).await?;
+    assert_ne!(handle.owner_fence(), check.token.owner);
+    loop {
+        let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
+        if now > release_identity.expires_at_ms.max(mutation.expires_at_ms) {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(u64::try_from(
+            release_identity.expires_at_ms.max(mutation.expires_at_ms) - now + 1,
+        )?))
+        .await;
+    }
+    assert!(matches!(
+        client.resolve(&evidence).await?,
+        Resolution::Expired
+    ));
+    let restored = RegisteredRootRecovery::load(&client, &f.target, &store, &check)
+        .await?
+        .ok_or("restored archive absent")?;
+    let result = restored.recover_initialization(&client, &store).await?;
+    assert_eq!(
+        (result.output, result.receipt),
+        (original.output, original.receipt)
+    );
+    let result = release.with_client_for_test(client).complete().await?;
+    assert_eq!(
+        (result.output, result.receipt),
+        (released.output, released.receipt)
+    );
+    runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn automatic_initialization_retirement_recovers_uncertainty_after_pin_disappears() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    let (prepared, root, budget) = empty(&f, [240; 16], store.clone()).await?;
+    let prepared = Arc::new(prepared);
+    let ready = prepared.ready_initialization(identity()?).await?;
+    let saved = ready.persist_recovery(&store, identity()?).await?;
+    ready.complete(&saved, &store).await?;
+    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    queue.fault_for_test(2);
+    let scanner = RecoverySupervisor::start_retiring(
+        f.client(),
+        f.target.clone(),
+        (*store).clone(),
+        queue.clone(),
+        RecoveryScanLimits {
+            page: 1,
+            interval: Duration::from_secs(1),
+        },
+        maintenance(&f.handle, f.repository).await?,
+    )?;
+    let observer = timeout(Duration::from_secs(10), async {
+        loop {
+            if let Some(observer) = queue.pending(saved.token().operation).await {
+                break observer;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
+    assert!(matches!(
+        timeout(Duration::from_secs(10), observer.wait()).await?,
+        PublicationState::Uncertain(_)
+    ));
+    let scan = scanner.shutdown().await?;
+    assert_eq!(scan.release_submitted, 1);
+    assert_eq!(queue.stats().await.admitted, 1);
+    f.handle
+        .query(0, 128, |db| {
+            assert_eq!(
+                db.query_row("SELECT count(*) FROM catalog_leases", [], |r| r
+                    .get::<_, u64>(0))?,
+                0
+            );
+            Ok(Vec::new())
+        })
+        .await?;
+    assert_eq!(queue.close_and_drain().await.len(), 1);
+    let scanner = RecoverySupervisor::start_retiring(
+        f.client(),
+        f.target.clone(),
+        (*store).clone(),
+        queue.clone(),
+        RecoveryScanLimits {
+            page: 1,
+            interval: Duration::from_secs(1),
+        },
+        maintenance(&f.handle, f.repository).await?,
+    )?;
+    timeout(Duration::from_secs(10), async {
+        while scanner.stats().release_recovered == 0 {
+            tokio::time::sleep(Duration::from_millis(5)).await;
+        }
+    })
+    .await?;
+    assert!(
+        matches!(timeout(Duration::from_secs(10), observer.wait()).await?, PublicationState::Finished(Ok(PublicationOutcome::TerminalRelease(ref value))) if value.output==TerminalReleaseReply::Released)
+    );
+    let scan = scanner.shutdown().await?;
+    assert_eq!(scan.release_submitted, 0);
+    assert_eq!(queue.stats().await.admitted, 0);
+    assert!(queue.close_and_drain().await.is_empty());
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/native_capture.rs b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
index bcc54f34..bfead167 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_capture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
@@ -456,7 +456,7 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
             .await?
             .finish()
             .await?;
-        let (command, _) = super::initialization::registered(
+        let (command, registered) = super::initialization::registered(
             &fixture,
             &empty,
             empty.empty_ref_initialization().await?,
@@ -464,6 +464,17 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
         )
         .await?;
         command.execute().await?;
+        // Match actual startup before building later native policy work.
+        registered
+            .ready_terminal_release(
+                fixture.client(),
+                &store,
+                super::terminal_retention::maintenance(&fixture.handle, fixture.repository).await?,
+                identity()?,
+            )
+            .await?
+            .complete()
+            .await?;
         drop(empty);
         cleaned(root.path(), &budget).await?;
     }
diff --git a/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs b/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
index f8940f57..dcfbf5fa 100644
--- a/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
@@ -329,7 +329,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
                     assert_eq!(body, rejected.body);
                     assert_eq!(body.windows(3).filter(|part| *part == b"ng ").count(), 257);
                     assert!(!body.windows(3).any(|part| part == b"ok "));
-                    assert_eq!(f.counts().await?, (0, 2));
+                    assert_eq!(f.counts_for(prepared.token()).await?, (0, 1));
                     roots_unchanged(&before, &state(&f.handle).await?)?;
                 }
                 PublicationState::Finished(Err(error)) => {
@@ -344,7 +344,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
                     ));
                     assert_denied_page(f, &evidence, loss).await?;
                     assert!(observer.root_response(store).await.is_err());
-                    assert_eq!(f.counts().await?, (1, 2));
+                    assert_eq!(f.counts_for(prepared.token()).await?, (1, 1));
                     roots_unchanged(&before, &state(&f.handle).await?)?;
                 }
                 other => return Err(format!("unexpected policy result {other:?}").into()),
@@ -477,7 +477,7 @@ async fn complete(
     }
     assert_eq!(body, expected.body);
     // Initialization and the native attempt each retain an independent pin.
-    assert_eq!(f.counts().await?, (0, 2));
+    assert_eq!(f.counts_for(prepared.token()).await?, (0, 1));
     f.handle
         .query(0, 1024, |db| {
             assert_eq!(
diff --git a/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs b/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
index 315fd4ce..e40741ff 100644
--- a/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
+++ b/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
@@ -45,6 +45,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
     let expected =
         crate::push::report::rejected_report(&request.response, crate::push::report::REJECTED)?;
     let session = Arc::new(ticket.bound_session()?);
+    let attempt_token = session.check.token;
     let operation = session.check.token.operation;
     assert!(
         session
@@ -218,7 +219,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
         assert!(matches!(outcome, PublicationState::Finished(Err(error))
             if matches!(&*error, PublicationError::RootPush(InvocationError::Rejected(value)) if value.output==RootCompletionReply::Denied(PreparationDenial::Expired))));
         assert!(observer.root_response(store).await.is_err());
-        assert_eq!(f.counts().await?, (1, 2));
+        assert_eq!(f.counts_for(attempt_token).await?, (1, 1));
     } else {
         let PublicationState::Finished(Ok(PublicationOutcome::RootPush(committed))) = outcome
         else {
@@ -256,7 +257,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
         assert_eq!(body, expected.body);
         assert_eq!(body.windows(3).filter(|p| *p == b"ng ").count(), 257);
         assert!(!body.windows(3).any(|p| p == b"ok "));
-        assert_eq!(f.counts().await?, (0, 2));
+        assert_eq!(f.counts_for(attempt_token).await?, (0, 1));
     }
     let Resolution::Committed(page) = f.client().resolve(&page_evidence).await? else {
         return Err("original registered page receipt missing".into());
@@ -340,6 +341,7 @@ async fn qualify_live(context: Context<'_>, loss: Loss) -> Result {
             .await?,
     );
     let session = Arc::new(ticket.bound_session()?);
+    let attempt_token = session.check.token;
     let refusal = Arc::new(
         session
             .ready_root_refusal(identity()?, store, root, budget.clone(), None)
@@ -471,7 +473,7 @@ async fn qualify_live(context: Context<'_>, loss: Loss) -> Result {
         let after: Vec<serde_json::Value> = serde_json::from_slice(&state(&f.handle).await?)?;
         assert_eq!(before[..6], after[..6]);
     }
-    assert_eq!(f.counts().await?, (0, 2));
+    assert_eq!(f.counts_for(attempt_token).await?, (0, 1));
     assert!(staging.close_and_drain().await.is_empty());
     assert!(p.close_and_drain().await.is_empty());
     assert_eq!(p.reservations_for_test().await, (0, 0, 0));
diff --git a/crates/canopy-server/src/packs/publication/tests/ref_policy.rs b/crates/canopy-server/src/packs/publication/tests/ref_policy.rs
index 8229bb78..39d053d5 100644
--- a/crates/canopy-server/src/packs/publication/tests/ref_policy.rs
+++ b/crates/canopy-server/src/packs/publication/tests/ref_policy.rs
@@ -41,9 +41,21 @@ async fn rooted(format: ObjectFormat) -> Result<(Fixture, Graph)> {
         .finish()
         .await?;
     let proof = empty.empty_ref_initialization().await?;
-    let (command, _) =
+    let (command, registered) =
         super::initialization::registered(&fixture, &empty, proof, identity()?).await?;
     command.execute().await?;
+    // Match production startup: the completed initial fact keeps its metadata
+    // and original receipt, while its generation-zero pin is retired.
+    registered
+        .ready_terminal_release(
+            fixture.client(),
+            &store,
+            super::terminal_retention::maintenance(&fixture.handle, fixture.repository).await?,
+            identity()?,
+        )
+        .await?
+        .complete()
+        .await?;
     drop(empty);
     cleaned(root.path(), &budget).await?;
     let graph = fixture::attempt(&fixture, provider, store).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/root_completion.rs b/crates/canopy-server/src/packs/publication/tests/root_completion.rs
index 628facb4..a2ae610b 100644
--- a/crates/canopy-server/src/packs/publication/tests/root_completion.rs
+++ b/crates/canopy-server/src/packs/publication/tests/root_completion.rs
@@ -501,13 +501,14 @@ pub(super) async fn qualify(
         },
         expected
     );
-    let facts = fixture.handle.query(0, 128, |db| {
-        let counts: (i64,i64,i64,i64,i64) = db.query_row("SELECT (SELECT count(*) FROM refs),(SELECT count(*) FROM push_responses),(SELECT count(*) FROM push_response_chunks),(SELECT count(*) FROM catalog_operations),(SELECT count(*) FROM catalog_leases)",[],|row|Ok((row.get(0)?,row.get(1)?,row.get(2)?,row.get(3)?,row.get(4)?)))?;
+    let token = prepared.token();
+    let facts = fixture.handle.query(0, 128, move |db| {
+        let counts: (i64,i64,i64,i64,i64) = db.query_row("SELECT (SELECT count(*) FROM refs),(SELECT count(*) FROM push_responses),(SELECT count(*) FROM push_response_chunks),(SELECT count(*) FROM catalog_operations),(SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2)",rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt],|row|Ok((row.get(0)?,row.get(1)?,row.get(2)?,row.get(3)?,row.get(4)?)))?;
         Ok(serde_json::to_vec(&counts).unwrap())
     }).await?;
     assert_eq!(
         serde_json::from_slice::<(i64, i64, i64, i64, i64)>(&facts)?,
-        (0, 0, 0, 0, 2)
+        (0, 0, 0, 0, 1)
     );
     if mode == CompletionMode::WriteRevoked {
         edit(
diff --git a/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs b/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
index dee0b4d1..de57dcc4 100644
--- a/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
@@ -91,7 +91,8 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
             .is_err(),
         "publishing native intent must not become a ref-free outcome"
     );
-    let operation = prepared.token().operation;
+    let token = prepared.token();
+    let operation = token.operation;
     let lookup = BeginRequest {
         repository: f.repository,
         operation,
@@ -322,7 +323,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
                 response(observer.root_response(store).await?).await?,
                 expected
             );
-            assert_eq!(f.counts().await?, (0, 2));
+            assert_eq!(f.counts_for(token).await?, (0, 1));
             let saved = f
                 .client()
                 .query::<CheckCompletedRootPush>(&f.target, Some(committed.receipt), lookup.clone())
@@ -336,7 +337,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
                 PublicationError::RootPush(InvocationError::NotStarted(_))
             ));
             assert!(observer.root_response(store).await.is_err());
-            assert_eq!(f.counts().await?, (1, 2));
+            assert_eq!(f.counts_for(token).await?, (1, 1));
             assert!(
                 f.client()
                     .query::<CheckCompletedRootPush>(&f.target, None, lookup.clone())
diff --git a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
index 54bb9b77..80246f67 100644
--- a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
+++ b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
@@ -364,8 +364,8 @@ pub(super) async fn archive(
         .query(0, 128, move |db| {
             assert_eq!(
                 db.query_row(
-                    "SELECT count(*) FROM pushes WHERE recovery IS NOT NULL",
-                    [],
+                    "SELECT count(*) FROM catalog_recovery_receipts WHERE incarnation=?1 AND admission_sequence=?2",
+                    rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt],
                     |r| r.get::<_, u64>(0)
                 )?,
                 0
@@ -461,8 +461,8 @@ pub(super) async fn archive(
         assert!(stats.release_recovered > 0);
         assert_eq!(stats.failures, 0);
         if fault != 1 {
-            // A retired push has no pin. Any independent initialization pin
-            // remains settled and must not admit another publication/release.
+            // A retired push has no pin. Other settled intermediate heads
+            // must not admit another publication or release.
             assert_eq!(stats.scanned, stats.settled);
             assert_eq!(stats.submitted, 0);
         }
@@ -486,8 +486,8 @@ pub(super) async fn archive(
     );
     handle.query(0, 128, move |db| {
         assert_eq!(db.query_row("SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 AND recovery IS NOT NULL", rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt], |r| r.get::<_, u64>(0))?, 0);
-        assert_eq!(db.query_row("SELECT count(*) FROM pushes WHERE recovery IS NOT NULL AND recovery_phase IS NOT NULL AND recovery_release IS NOT NULL", [], |r| r.get::<_, u64>(0))?, 1);
-        for sql in ["UPDATE pushes SET recovery=NULL,recovery_phase=NULL,recovery_release=NULL WHERE recovery IS NOT NULL", "UPDATE pushes SET recovery_phase=x'01' WHERE recovery IS NOT NULL", "UPDATE pushes SET recovery_release=x'01' WHERE recovery IS NOT NULL", "DELETE FROM pushes WHERE recovery IS NOT NULL"] {
+        assert_eq!(db.query_row("SELECT count(*) FROM catalog_recovery_receipts WHERE incarnation=?1 AND admission_sequence=?2", rusqlite::params![token.owner.incarnation.as_bytes().as_slice(), token.attempt], |r| r.get::<_, u64>(0))?, 1);
+        for sql in ["UPDATE catalog_recovery_receipts SET recovery=NULL,recovery_phase=NULL,recovery_release=NULL WHERE recovery IS NOT NULL", "UPDATE catalog_recovery_receipts SET recovery_phase=x'01' WHERE recovery IS NOT NULL", "UPDATE catalog_recovery_receipts SET recovery_release=x'01' WHERE recovery IS NOT NULL", "DELETE FROM catalog_recovery_receipts WHERE recovery IS NOT NULL"] {
             assert!(db.execute(sql, []).is_err(), "{sql}");
         }
         Ok(Vec::new())
diff --git a/crates/canopy-server/src/server/catalog_initialization.rs b/crates/canopy-server/src/server/catalog_initialization.rs
index de012c90..e58ceeed 100644
--- a/crates/canopy-server/src/server/catalog_initialization.rs
+++ b/crates/canopy-server/src/server/catalog_initialization.rs
@@ -2,14 +2,14 @@
 use crate::{
     ObjectFormat, RepositoryCell, RepositoryModule,
     packs::{
-        catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes, CatalogSnapshot},
-        directory::snapshot::DirectorySnapshot,
+        catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes},
         metadata::MetadataLimits,
         publication::{
             BeginPreparation, BeginRequest, CatalogPreparation, CheckInitializedCatalog,
             ClaimPreparation, DEFAULT_LEASE_MS, GenerationFact, InitializationReply, LeaseCheck,
-            LeaseRequest, PreparationBaseResolver, PreparationDenial, PreparationReply,
-            PreparationToken, PublicationError, RegisteredRootRecovery,
+            LeaseRequest, MaintenanceRequest, PreparationBaseResolver, PreparationDenial,
+            PreparationReply, PreparationToken, PublicationError, RegisteredRootRecovery,
+            TerminalReleaseReply,
         },
     },
 };
@@ -57,33 +57,7 @@ async fn verify(
     store: &ArtifactStore,
     format: ObjectFormat,
 ) -> Result<(), Failure> {
-    if fact.generation != 1 || fact.certificate.is_none() {
-        return Err(Error::Command("invalid repository initialization fact").into());
-    }
-    let stored = fact
-        .catalog
-        .ok_or(Error::Command("initial catalog absent"))?;
-    if stored.repository != store.repository() || stored.format != format {
-        return Err(Error::Command("initial catalog context differs").into());
-    }
-    let catalog = CatalogSnapshot::download(store, stored).await?;
-    let directory = DirectorySnapshot::download(store, catalog.directory).await?;
-    let refs = fact
-        .refs
-        .ok_or(Error::Command("initial refs absent"))?
-        .read(store)
-        .await?;
-    if catalog.sources.is_some()
-        || !directory.level_zero.is_empty()
-        || directory.levels.iter().any(Option::is_some)
-        || refs.repository != store.repository()
-        || refs.format != format
-        || refs.generation != 0
-        || refs.root.is_some()
-        || refs.default_branch != "refs/heads/main"
-    {
-        return Err(Error::Command("initial catalog is not the certified empty state").into());
-    }
+    crate::packs::publication::verify_initial_catalog(fact, store, format).await?;
     Ok(())
 }
 
@@ -93,12 +67,13 @@ async fn verify(
 pub(super) async fn ensure(
     repository: &RepositoryCell,
     client: CellClient,
-    owner: &str,
+    maintenance: MaintenanceRequest,
     provider: Arc<dyn ObjectStore>,
     workspace: &Path,
     budget: DiskBudget,
     pending: bool,
 ) -> Result<(), Failure> {
+    let owner = maintenance.actor.as_str();
     let input = request(repository, owner);
     let target = &repository.target;
     let store = Arc::new(ArtifactStore::new(provider, repository.id));
@@ -107,7 +82,7 @@ pub(super) async fn ensure(
         .await?
         .output
     {
-        return verify(fact, &store, repository.object_format).await;
+        return verify_and_retire(repository, &client, &store, &input, fact, &maintenance).await;
     }
     if !pending {
         return Err(Error::Command("ready repository has no certified initialization").into());
@@ -115,13 +90,15 @@ pub(super) async fn ensure(
     let started_at = std::time::Instant::now();
     let recovered =
         RegisteredRootRecovery::load_initialization(&client, target, &store, &input).await?;
-    let claim = if let Some(recovered) = recovered {
+    let claim = if let Some(ref recovered) = recovered {
         match recovered.recover_initialization(&client, &store).await {
             Ok(committed) => {
                 let InitializationReply::Initialized(fact) = committed.output else {
                     return Err(Error::Command("invalid recovered initialization reply").into());
                 };
-                return verify(*fact, &store, repository.object_format).await;
+                verify(*fact, &store, repository.object_format).await?;
+                retire(recovered, client, &store, &maintenance).await?;
+                return Ok(());
             }
             Err(PublicationError::Initialization(InvocationError::Rejected(ref value)))
                 if matches!(
@@ -185,16 +162,27 @@ pub(super) async fn ensure(
                 if matches!(&error, InvocationError::Rejected(value)
                 if value.output == PreparationReply::Denied(PreparationDenial::Conflict))
                     && let Some(fact) = client
-                        .query::<CheckInitializedCatalog>(target, None, input)
+                        .query::<CheckInitializedCatalog>(target, None, input.clone())
                         .await?
                         .output
                 {
-                    return verify(fact, &store, repository.object_format).await;
+                    return verify_and_retire(
+                        repository,
+                        &client,
+                        &store,
+                        &input,
+                        fact,
+                        &maintenance,
+                    )
+                    .await;
                 }
                 return Err(error.into());
             }
         }
     };
+    if let Some(recovered) = recovered {
+        retire(&recovered, client.clone(), &store, &maintenance).await?;
+    }
     let PreparationReply::Granted(lease) = started.output else {
         return Err(Error::Command("repository initialization admission denied").into());
     };
@@ -241,10 +229,51 @@ pub(super) async fn ensure(
         return Err(Error::Command("repository initialization publication denied").into());
     };
     verify(*fact, &store, repository.object_format).await?;
+    retire(&registered, client, &store, &maintenance).await?;
     tracing::debug!(repository = %hex::encode(repository.id), elapsed_seconds = started_at.elapsed().as_secs_f64(), "certified repository catalog initialized");
     Ok(())
 }
 
+async fn verify_and_retire(
+    repository: &RepositoryCell,
+    client: &CellClient,
+    store: &ArtifactStore,
+    input: &BeginRequest,
+    fact: GenerationFact,
+    maintenance: &MaintenanceRequest,
+) -> Result<(), Failure> {
+    verify(fact, store, repository.object_format).await?;
+    if let Some(recovered) =
+        RegisteredRootRecovery::load_initialization(client, &repository.target, store, input)
+            .await?
+    {
+        retire(&recovered, client.clone(), store, maintenance).await?;
+    }
+    Ok(())
+}
+
+async fn retire(
+    registered: &RegisteredRootRecovery,
+    client: CellClient,
+    store: &ArtifactStore,
+    maintenance: &MaintenanceRequest,
+) -> Result<(), Failure> {
+    let result = registered
+        .ready_terminal_release(
+            client,
+            store,
+            maintenance.clone(),
+            super::mutation_identity()?,
+        )
+        .await?
+        .complete()
+        .await?;
+    if result.output != TerminalReleaseReply::Released {
+        return Err(Error::Command("initialization retirement denied").into());
+    }
+    Ok(())
+}
+
 fn fixed<const N: usize>(value: &SqlValue) -> Result<[u8; N], Error> {
     match value {
         SqlValue::Blob(bytes) => bytes
diff --git a/crates/canopy-server/src/server/peer.rs b/crates/canopy-server/src/server/peer.rs
index 72bda0d8..acdf31c2 100644
--- a/crates/canopy-server/src/server/peer.rs
+++ b/crates/canopy-server/src/server/peer.rs
@@ -118,10 +118,31 @@ impl NodePeer {
             .is_some_and(|owner| owner.session() != self.0.session))
     }
 
+    pub(super) async fn current_owner_fence(
+        &self,
+        target: &CellTarget,
+    ) -> Result<cellule_runtime::registry::OwnerFence, ServerError> {
+        self.live_binding(target)
+            .await?
+            .map(|(_, fence)| fence)
+            .ok_or(Error::Fenced.into())
+    }
+
     async fn live_owner(
         &self,
         target: &CellTarget,
     ) -> Result<Option<NodeAdvertisement>, ServerError> {
+        Ok(self
+            .live_binding(target)
+            .await?
+            .map(|(advertisement, _)| advertisement))
+    }
+
+    async fn live_binding(
+        &self,
+        target: &CellTarget,
+    ) -> Result<Option<(NodeAdvertisement, cellule_runtime::registry::OwnerFence)>, ServerError>
+    {
         let authority = CellAuthority::new(self.0.layout.clone());
         let Some(control) = authority.load(target.cell_id()).await? else {
             return Ok(None);
@@ -136,7 +157,10 @@ impl NodePeer {
         if live.advertisement().endpoint() != owner.endpoint {
             return Err(Error::Fenced.into());
         }
-        Ok(Some(live.advertisement().clone()))
+        Ok(Some((
+            live.advertisement().clone(),
+            control.value().owner_fence(),
+        )))
     }
 
     pub(super) async fn ensure_directory(&self) -> Result<(), ServerError> {
diff --git a/crates/canopy-server/src/server/residency/mod.rs b/crates/canopy-server/src/server/residency/mod.rs
index a84ff6f7..7cfd5cb5 100644
--- a/crates/canopy-server/src/server/residency/mod.rs
+++ b/crates/canopy-server/src/server/residency/mod.rs
@@ -330,7 +330,11 @@ impl RepositoryManager {
             super::catalog_initialization::ensure(
                 &repository,
                 client,
-                &entry.owner,
+                crate::packs::publication::MaintenanceRequest {
+                    repository: entry.repository_id,
+                    actor: entry.owner.clone(),
+                    owner: self.peer.current_owner_fence(&repository.target).await?,
+                },
                 Arc::clone(&self.external_store),
                 self.local.path(),
                 self.disk_budget.clone(),
diff --git a/crates/canopy-server/tests/multi_server/workspace.rs b/crates/canopy-server/tests/multi_server/workspace.rs
index 8eac070b..f11a3ca9 100644
--- a/crates/canopy-server/tests/multi_server/workspace.rs
+++ b/crates/canopy-server/tests/multi_server/workspace.rs
@@ -172,7 +172,15 @@ async fn new_repositories_bootstrap_the_production_packed_catalog_before_becomin
                         .get::<_, i64>(0))?,
                 0
             );
-            assert_eq!(connection.query_row("SELECT count(*) FROM catalog_leases WHERE generation=0 AND recovery IS NOT NULL AND recovery_phase IS NOT NULL AND recovery_phase_revision=1", [], |row| row.get::<_, i64>(0))?, 1);
+            assert_eq!(connection.query_row("SELECT count(*) FROM catalog_leases WHERE generation=0 AND recovery IS NOT NULL", [], |row| row.get::<_, i64>(0))?, 0);
+            assert_eq!(
+                connection.query_row(
+                    "SELECT count(*) FROM catalog_recovery_receipts",
+                    [],
+                    |row| row.get::<_, i64>(0)
+                )?,
+                1
+            );
             let allocation = connection.query_row(
                 "SELECT artifact_sequence FROM repository_identity WHERE singleton=1",
                 [],
diff --git a/docs/design/mandatory-publication-registration.md b/docs/design/mandatory-publication-registration.md
index f728e7d7..32c95ebc 100644
--- a/docs/design/mandatory-publication-registration.md
+++ b/docs/design/mandatory-publication-registration.md
@@ -25,6 +25,7 @@ Use recovery purpose `canopy.publication-command-recovery.v4\0` and these comman
 | CompleteRootPush | 36 | 2 |
 | CompleteRootOutcome | 38 | 3 |
 | RegisterRootRecovery | 39 | 4 |
+| ReleaseTerminalRecovery | 40 | 2 |
 
 Keep the existing record and artifact structures. Do not add a compatibility decoder or an unregistered execution fallback.
 
@@ -38,7 +39,7 @@ Pending startup queries the current indexed operation/pin binding before issuing
 
 Cold initialization performs no new preparation or native work. After authoritative SDK absence it restores the exact original bytes and lets the final receiver atomically check actual owner, Admin, live pin, certificate/checkpoint and pristine roots. Requiring a fresh Write-dependent session first would prevent an expired or revoked original from recording its definitive denial. Live bound dispatch still checks its original shared clock/fence. Known journal outcomes retain their original sequence and receipt even after SDK expiry, owner loss, permission revocation and body loss; they grant no current write or read capability.
 
-This closes final-command registration and reconstruction only. Exact initial Begin/Claim/Renew and failure before final registration still need durable integration. Initialization has no native push response/audit graph, so push terminal retirement cannot release its pin. Its generation-zero recovery pin remains retained until typed initialization retirement is implemented; that floor prevents generation collection and is a release blocker. Include the immutable initialization roots, command metadata and receipts in typed collection, backup and isolated restore.
+This closes final-command registration and reconstruction only. Exact initial Begin/Claim/Renew and failure before final registration still need durable integration. The local typed [terminal retirement protocol](terminal-publication-retention.md) now verifies its complete empty catalog/directory/ref graph and moves the same original certificate/journal/release receipt into the shared immutable archive before deleting the exact pin. Positive startup discovers the original closed attempt through the immutable initialization fact’s exact pin identity and retires it before serving. A denied initialization retires only after its active binding closes; a successor keeps its independent pin. Unknown attempts remain protected. Background-service reconstruction of older orphan attempts remains part of complete startup integration. Include the immutable initialization roots, command metadata and receipts in typed collection, backup and isolated restore.
 
 ## Remaining implementation sequence
 
diff --git a/docs/design/terminal-publication-retention.md b/docs/design/terminal-publication-retention.md
index 5b8ed9fe..6fe01b40 100644
--- a/docs/design/terminal-publication-retention.md
+++ b/docs/design/terminal-publication-retention.md
@@ -1,22 +1,22 @@
 # Terminal publication recovery retention
 
-Completed pushes must release their independent preparation pins without losing original command receipts. Leaving successful pins forever eventually exhausts the 4,096-pin admission cap and retains unnecessary catalog floors. This protocol transfers the same authenticated recovery certificate and phase journal into the existing immutable `pushes` row, then deletes the matching pin in one transaction. It uses the fresh publication schema and existing artifact structures; it adds no durable queue or per-object rows.
+Completed pushes and closed initialization attempts must release their independent preparation pins without losing original command receipts. Leaving successful pins forever eventually exhausts the 4,096-pin admission cap and retains unnecessary catalog floors. This protocol transfers the same authenticated recovery certificate and phase journal into the immutable shared `catalog_recovery_receipts` table, then deletes the matching pin in one transaction. It uses the fresh publication schema and existing certificate, journal, SDK receipt and artifact structures; it adds no durable queue or per-object rows. The archive is keyed by original incarnation/admission sequence, with an operation index for typed enumeration. Different attempts of the same logical initialization retain independent original receipts.
 
 The protocol releases a preparation pin. It does not authorize provider deletion. Complete retained-root enumeration, reader and worker drain, backup, isolated restore, and repository-scoped collection remain required before any production artifact deletion.
 
 ## Release eligibility and authority
 
-`RegisteredRootRecovery::ready_terminal_release` accepts only the current canonical recovery head with a recorded completed root outcome. A policy head is terminal only when its original refusal is recorded and its pre-frozen fallback root command has completed. Unknown acceptance, passed intermediate pages, denied root commands, historical heads, and a refused page without completed fallback cannot produce a release proof.
+`RegisteredRootRecovery::ready_terminal_release` accepts only the current canonical recovery head with a recorded completed root outcome. A policy head is terminal only when its original refusal is recorded and its pre-frozen fallback root command has completed. A known initialization result is terminal after its exact attempt is closed. A positive must match the immutable selected initialization fact; a known denial may retire only after Claim or bounded operation reaping has removed that exact active binding. A successor of the same logical operation keeps its own pin. Unknown acceptance, passed intermediate pages, denied push root commands, historical heads, and a refused page without completed fallback cannot produce a release proof.
 
-The private factory checks the saved actor and request selection against that exact completed outcome. It authenticates the current bundle and each predecessor frame, verifying repository MACs, tenant/application, lease identity, original SDK stamps, and strictly decreasing phase steps. Each header is bounded by 8 KiB. It then authenticates the selected outcome/native metadata and streams the selected response and native audit bodies to verified EOF. Missing or corrupt required bytes prevent proof creation.
+The private factory checks the saved actor and request selection against that exact completed outcome. It authenticates the current bundle and each predecessor frame, verifying repository MACs, tenant/application, lease identity, original SDK stamps, and strictly decreasing phase steps. Each header is bounded by 8 KiB. It then authenticates the selected outcome/native metadata and streams the selected response and native audit bodies to verified EOF. Missing or corrupt required bytes prevent proof creation. For positive initialization, the same verifier used by route activation downloads the catalog, directory and ref snapshot and checks their complete typed empty graph. The graph transcript includes the original fact and all three authenticated descriptors. A known negative has no positive graph edges; its original typed denial remains bound by the phase digest.
 
-The purpose-specific MAC proof binds the original recovery certificate, phase-journal digest, and verified closed-graph digest. `ReleaseTerminalRecovery` is command 40, codec version 1, with input limited to 4 KiB and output to 128 bytes. The actual command receiver separately requires current repository Admin authorization and its admitted owner fence. A proof prepared under an old owner or by a subsequently unauthorized administrator cannot bypass those checks.
+The purpose-specific MAC proof binds the original recovery certificate, phase-journal digest, and verified closed-graph digest. `ReleaseTerminalRecovery` is command 40, codec version 2, using purpose `canopy.terminal-recovery-release.v2\0`, with input limited to 4 KiB and output to 128 bytes. The actual command receiver separately requires current repository Admin authorization and its admitted owner fence. A proof prepared under an old owner or by a subsequently unauthorized administrator cannot bypass those checks.
 
 ## Atomic transfer and original receipts
 
-Before its first write, the receiver verifies the proof and embedded original certificate, exact current pin identity/head/phase, terminal selection, immutable saved push outcome, and absence of an active logical operation. All semantic refusals precede writes.
+Before its first write, the receiver verifies the proof and embedded original certificate, exact current pin identity/head/phase, terminal selection, the immutable selected push or positive initialization outcome, and absence of an active binding for that exact incarnation/admission sequence. All semantic refusals precede writes.
 
-The receiver obtains its release command's actual SDK mutation evidence and sequence from `CommandContext`. It writes three bounded values to the existing push row: the original recovery certificate, original phase journal, and release identity/result/sequence. An exact CAS then deletes the matching preparation pin. Any later SQL failure rolls back both writes and SDK acceptance. SQL guards prohibit archive replacement, mutation or deletion; the lease deletion guard requires the same certificate and phase in the completed push row.
+The receiver obtains its release command's actual SDK mutation evidence and sequence from `CommandContext`. It inserts one shared archive row containing the original pin key and logical operation, and three bounded values: the original recovery certificate, original phase journal, and release identity/result/sequence. An exact CAS then deletes the matching preparation pin. Any later SQL failure rolls back both writes and SDK acceptance. SQL guards prohibit archive replacement, mutation or deletion; the lease deletion guard requires the same certificate and phase in the exact shared archive row.
 
 Archived recovery reuses `RegisteredRootRecovery` and the existing predecessor-frame walk. The original root/page receipt survives SDK identity expiry, removal of original command bodies, local SQL destruction and fresh-owner restoration. A completed release also resolves its original archived receipt before SDK resolution or current custody checks. A competing, separately prepared release identity cannot inherit that receipt; once another release wins, its receiver refuses Missing.
 
@@ -26,17 +26,18 @@ An owner SQL query is not an arbitrary local SQLite read. The pinned Cellule exe
 
 | Root or edge | Retention after this attempt closes |
 | --- | --- |
-| Recovery certificate and phase journal | Stored unchanged in the selected push row |
+| Recovery certificate and phase journal | Stored unchanged in the shared immutable receipt archive |
 | Original head bundle and predecessor frames/bundles | Required to resolve exact historical command identities and receipts |
 | Selected outcome root and native result root | Required immutable metadata for replay and audit |
 | Selected response body | Required; its creating namespace can belong to a prior admitted attempt |
 | Native plan and signed certificate bodies | Required native audit edges, when present |
 | Original wire request, original command bodies, unselected responses and unpublished candidate artifacts | No permanent edge from this closed audit role; other retained snapshots, unknown attempts, readers or backups can still require them |
+| Initial empty catalog, directory and ref snapshot | Retained through the immutable initialization fact; its original pin identity also names receipt recovery |
 | Published catalog, refs, packs and indexes | Retained through their own certified catalog/generation and reader/backup roots |
 
 `root_completion::closed_graph` verifies the closed audit edges using the existing `StoredInputRoot`, `ArtifactDescriptor` and native-result representations. It retains no whole body in memory; authenticated parts are streamed one at a time. This verifier is not an exhaustive retained-root inventory or a collector. A future collector must select typed edges by root role rather than treating every descriptor inside a closed bundle as perpetual execution input.
 
-Only the selected successful closed attempt transfers into this push row. An older independent unknown attempt still retains its pin. Expiry alone never authorizes its deletion, a fresh command identity, or takeover.
+Only eligible closed attempts transfer into the shared archive. An older denied initialization can retire independently of its successor after its active binding closes. An older independent unknown attempt still retains its pin. Expiry alone never authorizes its deletion, a fresh command identity, or takeover.
 
 ## Automatic service retirement
 
@@ -44,10 +45,14 @@ Only the selected successful closed attempt transfers into this push row. An old
 
 Before each bounded keyset scan, the supervisor also recovers uncertain factory-owned terminal-release jobs from that same coordinator. This is necessary after a committed release removes its pin but loses its acknowledgement: a pin-only scan would no longer discover the still-charged command. Recovery retains the original SDK command, identity and receipt, including after coordinator close or scanner stop/restart. It does not retry compaction or replace a live producer's uncertain command.
 
+An active denied initialization is deferred before release preparation or SDK admission. Successful repository startup retires its initial pin before exposing the route, and recovered positive startup discovers the original pin by the immutable initialization outcome’s exact incarnation/admission sequence. Pending startup retires an original known denial only after a successful Claim. Current maintenance fencing comes from the validated durable Cell Control and its live node advertisement; the receiver still independently checks its actual admitted fence and current Admin role. The existing tracked transition owns this constant-size work through cancellation.
+
 Stopping the scanner requests stop between scans and joins its current work. It does not cancel an admitted release. Close and drain the publication coordinator separately. On owner succession, restart the service with current maintenance authority; original receipt lookup remains independent of that fresh authority. Production routing must use the SDK's ownership-aware transport rather than keeping a stopped owner's fixed local handle.
 
 ## Qualification and remaining work
 
 Native SHA-1/SHA-256 tests exercise quota release at the existing 4,096-pin cap, missing selected artifacts, current Admin and owner refusals, rollback at the final delete, original-command recovery after absence/lost acknowledgement/post-execution panic, scanner restart, automatic admission, uncertainty after pin disappearance, real SDK expiry, fresh-owner restore, immutable archives, removed original command bodies and current Read revocation. Existing multi-page policy tests retain their original page receipts after terminal archival. A separately prepared losing release is refused without replacing the winner's receipt.
 
-These fixtures prove the covered transaction, receipt and lifecycle invariants. They do not establish throughput for 10,000 developers. Proof preparation is currently serialized by the repository scanner; node-wide fair verification admission, provider I/O budgets and full-history measurements remain mandatory. Production registration/startup/producer/reader conversion, initial staging uncertainty, retained-input Claim/adoption/repreparation, complete typed collection and isolated restore, file-backed intents/reports, OS containment, accelerated reads, physical rewriting and continuous hot-root maintenance remain open under the [implementation plan](../large-repository-implementation-plan.md) and [large-team requirements](../large-team-scalability.md).
+Six typed initialization families additionally qualify both formats, immutable shared archives, denied-old/successful-new receipt separation, missing typed empty metadata, actual Admin/owner checks, last-write rollback, automatic release recovery after pin disappearance, SDK expiry, saved-body loss and fresh-owner restoration. The complete frozen-source publication suite passes 264 tests in 175.94 seconds with four threads and standard stacks.
+
+These fixtures prove the covered transaction, receipt and lifecycle invariants. They do not establish throughput for 10,000 developers. Proof preparation is currently serialized by the repository scanner; node-wide fair verification admission, provider I/O budgets and full-history measurements remain mandatory. Complete production producer/reader and background-service wiring, initial Begin/Claim/Renew/pre-registration uncertainty, retained-input Claim/adoption/repreparation, complete typed collection and isolated restore, file-backed intents/reports, OS containment, accelerated reads, physical rewriting and continuous hot-root maintenance remain open under the [implementation plan](../large-repository-implementation-plan.md) and [large-team requirements](../large-team-scalability.md).
diff --git a/docs/large-repository-implementation-plan.md b/docs/large-repository-implementation-plan.md
index 28a12a60..1e557a80 100644
--- a/docs/large-repository-implementation-plan.md
+++ b/docs/large-repository-implementation-plan.md
@@ -192,7 +192,7 @@ The earlier [SQL fixture](design/packed-repository-schema.sql) is not the releas
 1. Add a read-only retained-root enumeration API to Cellule. Reuse existing root/pin types. Return paginated roots with retention reason, control/pin revision bindings and a completion indicator. A caller may treat it as exhaustive only while its existing maintenance barrier prevents root/pin changes; detect revisions changing during enumeration and fail/restart.
 2. Audit every recovery selector, pin and unfinished backup/restore path. Test that each possible selected root appears in the enumeration. If any cannot be enumerated, return an explicit incomplete result; the collector must refuse deletion.
 3. Canopy walks each retained SQL snapshot's current catalog, immutable generation facts, independent preparation pins/checkpoint certificates, unfinished/uncertain operation outcomes and LFS facts. Resolve each retained catalog's complete authenticated directory/source dependencies, including immutable index nodes and all required metadata/pack/index artifacts. Preserve private attempt namespaces and unregistered output ownership until their writers are proven drained; never infer their deletion eligibility solely from catalog membership. The fresh schema has no `objects.pack_id` inventory. Retired catalog tombstones and completed operations alone do not retain bytes. Include all certified canonical objects, not only currently referenced tips. Restore preserves logical IDs, descriptors and the artifact allocation watermark; an isolated rollback restore uses a new provider namespace so delayed old deletes cannot target its bytes.
-The [terminal recovery protocol](design/terminal-publication-retention.md) now transfers the selected completed attempt's original certificate/journal and release receipt into the existing immutable push row and frees its independent pin atomically. Its typed closed audit verifier retains header/history, selected response and native plan/signed audit edges. This supplies selected-attempt retirement, not complete root enumeration or artifact deletion. Include these archived rows and exact historical receipts in retained-root traversal and isolated backup/restore. Older unknown attempts keep their own pins until the required recovery/retention protocol proves their disposition.
+The [terminal recovery protocol](design/terminal-publication-retention.md) now transfers the selected completed attempt's original certificate/journal and release receipt into the shared immutable receipt archive keyed by original incarnation/admission sequence and frees its independent pin atomically. Its typed closed audit verifier retains header/history, selected response and native plan/signed audit edges. This supplies selected-attempt retirement, not complete root enumeration or artifact deletion. Include these archived rows and exact historical receipts in retained-root traversal and isolated backup/restore. Older unknown attempts keep their own pins until the required recovery/retention protocol proves their disposition.
 
 4. Copy and verify all required artifacts before setting backup complete. Preserve/restore product tables and push replay state as in existing backup behavior; no old-format migration is added.
 
@@ -292,7 +292,7 @@ Each cell below is a test family, with SHA-1/SHA-256 coverage on a representativ
 The [immutable ref state](design/immutable-ref-state.md) supplies conditional versioned roots and streaming initial construction. Complete the final publication change in this order:
 
 1. The shared streaming rewrite now coalesces existing-base batches by affected subtree and preserves untouched roots. Qualify sustained ordinary and bulk preparation separately, including long-name byte splits, retained tombstones, provider budgets and hot-root fairness.
-2. The fresh immutable catalog generation now carries the ref snapshot through the same query-derived base and retention floor. The private preparation factory loads and rewrites that exact root; compaction carries it forward and the inline publisher refuses selected roots. Fresh empty initialization authenticates a private empty preparation and atomically installs joint roots with one durable outcome. The local production cutover now invokes that path before repository Ready and verifies the retained immutable initialization during fresh-disk restore. Final initialization now uses the existing exact registered snapshot/body/journal protocol, including cold original denial recovery. Complete initial Begin/Claim/Renew, pre-registration process-loss recovery and typed terminal retirement of its generation-zero pin before release. See the [current qualification and unreleasable boundaries](large-repository-implementation-status.md#production-hard-cutover-started-locally). Bind membership/ancestry and exact policy/check facts to the privately issued transition certificate, and qualify their current-state CAS/fairness semantics.
+2. The fresh immutable catalog generation now carries the ref snapshot through the same query-derived base and retention floor. The private preparation factory loads and rewrites that exact root; compaction carries it forward and the inline publisher refuses selected roots. Fresh empty initialization authenticates a private empty preparation and atomically installs joint roots with one durable outcome. The local production cutover now invokes that path before repository Ready and verifies the retained immutable initialization during fresh-disk restore. Final initialization now uses the existing exact registered snapshot/body/journal protocol, including cold original denial recovery. Typed initialization retirement now reuses that shared archive and releases the selected initial pin during actual startup, while preserving original positive/negative receipts. Complete initial Begin/Claim/Renew, pre-registration process-loss recovery and background recovery of older orphan attempts before release. See the [current qualification and unreleasable boundaries](large-repository-implementation-status.md#production-hard-cutover-started-locally). Bind membership/ancestry and exact policy/check facts to the privately issued transition certificate, and qualify their current-state CAS/fairness semantics.
 3. Direct-push [paged policy guards](design/paged-ref-policy-guards.md) now bind rare configuration epochs and indexed exact check dependencies, with bounded transactional registration/cleanup and private conditional root signing. The private [immutable completion factory](design/immutable-push-outcomes.md) binds registered native custody and freezes success/refusal descriptors in an 8 KiB input. Command 36 atomically publishes those exact catalog/ref/response descriptors with live guard/epoch, current authorization, owner/lease/pin and generation CAS checks; it transports no plan and writes no per-ref rows. Query 37 and the streaming replay adapter derive the selected result from current authorized durable identity. The service-owned exact command factory, foreground dispatch and bound lifecycle now retain/recover this command with a 32 KiB registered wire reservation and current-authorized streaming ticket responses. Immutable outcome-only command 38 reuses the session certificate, native checkpoint, same RootPush dispatch and current-authorized streaming reader without catalog/refs writes. Paged-policy commands now retain their original intent/evidence and exact SDK identity in the same foreground dispatcher; the bound lifecycle resumes after a known page and blocks final handoff during uncertainty. Armed pages now retain a pre-frozen refusal-only command under one 544 KiB registered admission and recover the original SDK evidence for the active local phase. Successful pages share one refusal Arc; that exact command can also complete a negative outcome after later policy/write changes. Its final transaction cannot select native success or expose roots. Complete durable process-loss reconstruction, production HTTP/SSH refusal-pipeline conversion and reviewed-merge bindings, and include every page/command cost in hot-repository capacity qualification.
 4. Convert every producer, reader, default-branch, policy/check, review and recovery path together. Delete the old ref/body schema and adapters for the fresh-data cutover.
 5. Include snapshots and their transitive immutable nodes in complete retention, collection and isolated restore, including the immutable initialization outcome's retained empty catalog/ref roots. Qualify hot-root fairness and full-history mixed workloads against the mandatory large-team gates.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 02befafa..376a8f50 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -20,7 +20,19 @@ The new real HTTP creation regression initially fails because production still s
 
 All 254 publication tests pass in 154.86 seconds, including the shared production-registry contract, using four threads and standard stacks. The final three workspace integration tests pass in 2.45 seconds, including both formats, fresh-disk restoration, missing retained metadata and the deployment/workspace exclusions. Workspace/all-target Clippy passes with warnings denied in 7.85 seconds. These are focused local checks. The broad full-workspace, provider and capacity results above remain attributed to their earlier source; unconverted production Git paths cannot be qualified by this increment.
 
-**This is local, unpublished work and is not a releasable packed deployment.** Production Git pushes, cache/object/ref readers and generated producers still call legacy storage APIs, whose tables and bindings are absent from the selected production contract. Their conversion, product graph/policy/check/review consumers, and deletion of temporary SQL refs and inline response/certificate/plan adapters must complete together before release. Final initialization now uses the same exact registered recovery protocol as policy/root publication; initial Begin/Claim/Renew and failure before registration remain incomplete. Typed initialization terminal retirement must release its retained generation-zero pin without losing original receipts. The new bootstrap is not proof of the complete recovery or retention protocol. Actual typed collection/backup/isolated restore, retained-input adoption/repreparation, OS containment, accelerated reads/rewrites, continuous fair maintenance and complete repository/team qualification remain required. Format checks, startup fixtures and primitive publication tests do not prove that wider completion.
+**This is local, unpublished work and is not a releasable packed deployment.** Production Git pushes, cache/object/ref readers and generated producers still call legacy storage APIs, whose tables and bindings are absent from the selected production contract. Their conversion, product graph/policy/check/review consumers, and deletion of temporary SQL refs and inline response/certificate/plan adapters must complete together before release. Final initialization now uses the same exact registered recovery protocol as policy/root publication; initial Begin/Claim/Renew and failure before registration remain incomplete. Typed initialization terminal retirement now releases eligible closed pins through the shared immutable receipt archive, preserving exact original receipts. Reconstruction of older orphan attempts still needs complete production background-service wiring. The new bootstrap is not proof of the complete recovery or retention protocol. Actual typed collection/backup/isolated restore, retained-input adoption/repreparation, OS containment, accelerated reads/rewrites, continuous fair maintenance and complete repository/team qualification remain required. Format checks, startup fixtures and primitive publication tests do not prove that wider completion.
+
+## Typed initialization retirement in the local cutover
+
+The terminal archive now reuses one immutable `catalog_recovery_receipts` row per original incarnation/admission sequence for both selected push completion and closed initialization. The original authenticated `Record`, `Bundle`, journal, predecessor frames and release receipt are unchanged in role; no durable queue or per-object ledger is added. Command 40 advances to codec 2 and purpose v2 without a compatibility decoder. SQL guards prohibit archive mutation, replacement and deletion, and require the exact archived certificate/phase before pin deletion.
+
+Positive retirement checks the immutable selected initialization, verifies its complete typed empty catalog/directory/ref graph, then inserts the archive and deletes only the exact original pin in the same SDK transaction. The immutable initialization fact stores its original pin key for indexed closed-attempt discovery. A known negative can retire only after its exact active binding closes; a successor of the same logical operation retains a separate namespace and original receipt. Unknown attempts remain pinned. The existing retiring scanner defers active negative initialization without allocating another SDK command and recovers uncertain release jobs even after their pin disappears.
+
+Actual repository startup retires the successful initial pin before serving, including recovered closed positive publication and a known denied original after successful Claim. Its existing tracked transition retains this bounded work through cancellation. Maintenance fencing is read from validated durable Cell Control with a live node advertisement, and the release receiver independently requires its actual admitted fence and current Admin. Both startup and retirement use the same typed empty-graph verifier. Fresh Ready restoration allocates neither a new preparation nor another artifact namespace.
+
+The original red regression fails with `Context` against the preceding code because completed initialization cannot retire. Six new families cover SHA-1/SHA-256, immutable archives, distinct old/new pin identity, actual Admin/fence rejection, rollback at the last delete, missing catalog/directory/ref metadata, known expiry after Claim and later positive publication, losing release identity, lost acknowledgement, saved-body loss, SDK expiry, real fresh-disk owner restore, and automatic recovery after pin disappearance. The first broad audit passes 261 and fails three existing live-owner scanner assertions: their unrelated completed initialization now legitimately retires. Their shared rooted setup now performs the same initialization retirement as production startup; push-retirement archive counts select the exact original pin rather than all archived operations. Original failure logs are retained. The first corrected setup covered only standalone policy fixtures; a second native setup required the same retirement. That audit then exposed 17 shared native assertions expecting a permanent second pin. An unchanged-source isolated reproduction confirms completed publication followed by a total-pin assertion failure (one actual pin versus two expected). Four native assertion helpers now select the original push incarnation/admission sequence and still require its active-operation and pin counts. Their custody checks retain only a copied token after dropping the original session; no ownership lifetime is extended.
+
+The complete frozen-source publication suite passes **264 tests in 175.94 seconds** with four threads and standard stacks, including all six new families and the original native uncertainty/retirement/policy-history cases. The last-write fixture requires the exact injected SQLite failure plus original SDK absence, so a prior gate refusal cannot satisfy the rollback assertion. Three actual production workspace/startup tests pass in 2.93 seconds, covering both formats, archived initialization with no generation-zero pin, fresh-disk restoration without another namespace, missing retained metadata refusal and deployment/workspace exclusions: **267 unique focused Rust cases**. Focused and child-process reruns are excluded. Workspace/all-target Clippy passes with warnings denied in 23.77 seconds; the server binary builds in 40.93 seconds. Formatting/diff checks, all 415 frozen Rust-source hashes, local documentation links, the protected checkout/archive and exact Cellule pins pass. No stack, SDK lifetime, deadline, resource or capacity threshold is widened. Complete initial Begin/Claim/Renew and pre-registration process loss, background service reconstruction for older orphan attempts, production producers/readers/final DDL, typed collection/backup/isolated restore and full-history/team capacity remain open. This is a local unreleasable checkpoint.
 
 ## Exact final initialization recovery in the local cutover
 
@@ -34,7 +46,7 @@ The unregistered-command regression first publishes generation one against the o
 
 The broader audit exposes one shared policy initializer that still submits command 31 without registration, plus queries that assume only one recovery pin exists. The initializer now registers first. Native recovery/retirement fixtures select the exact original attempt and verify unrelated recovery headers/phases remain unchanged. The final complete publication run passes **258 tests in 173.96 seconds** with four threads and standard stacks. Three actual workspace/startup tests pass in 2.57 seconds, including real registered initialization, SHA-1/SHA-256 creation, fresh-disk restoration and missing-root refusal: **261 unique focused Rust cases**. Focused reruns are excluded. Workspace/all-target Clippy passes with warnings denied in 31.97 seconds; the server builds in 33.76 seconds. Production and integration sources are unchanged after those integration/build checks; subsequent edits affect four qualification fixture files only. Formatting, diff checks, all 414 frozen Rust-source hashes, local documentation links, the protected checkout/archive and exact Cellule pin checks pass. No stack, SDK lifetime, deadline, resource or capacity threshold is widened.
 
-Initial Begin/Claim/Renew, pre-registration process loss and initial terminal retirement remain release blockers. Retaining the initialization pin indefinitely would prevent later catalog generation collection. The full production cutover, provider and repository/team capacity gates remain open. This checkpoint is local and unpublished.
+At this earlier registration checkpoint, initial Begin/Claim/Renew, pre-registration process loss and initial terminal retirement remain release blockers. Retaining the initialization pin indefinitely would prevent later catalog generation collection; the following local retirement increment removes the selected closed initial pin. The full production cutover, provider and repository/team capacity gates remain open. This checkpoint is local and unpublished.
 
 ## Mandatory publication registration qualified locally
 

From 50b9a2b5aec407175bfc9165f3e228bf611e2aea Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sat, 3 Oct 2026 22:01:06 -0700
Subject: [PATCH 06/55] Preserve first preparation admission across cold
 restart

Retain the actual accepted Begin receipt in the existing logical request row,
sharing the bounded authenticated record and lookup with staging. Startup
recovers it before another Begin and checks current fence/custody separately.
Explicit Claim can recover the authenticated original after operation reaping
without restoring old custody or displacing a successor.

Update initialization/compaction admission checks, command codecs and source
hashing. Qualify both object formats, SDK expiry, fresh-owner restore, rollback,
immutability and purpose separation. Preserve initial receipts in fixture
state hashes and target fault injection at the actual publication update.

Validation: 271 publication + 3 actual startup tests; all-target workspace
Clippy with warnings denied; canopy binary build; fmt/diff and frozen sources.
Local checkpoint only: remaining producer/reader cutover and full durable
custody-command recovery are required before release.
---
 crates/canopy-server/src/lib.rs               |   2 +
 .../packs/publication/admission_receipt.rs    | 295 ++++++++++
 .../src/packs/publication/commands.rs         |  51 +-
 .../packs/publication/compaction/publish.rs   |   4 +-
 .../publication/initialization/publish.rs     |   4 +-
 .../src/packs/publication/mod.rs              |   3 +
 .../packs/publication/preparation_receipt.rs  | 108 ++++
 .../src/packs/publication/schema.sql          |   8 +
 .../src/packs/publication/staging_receipt.rs  | 248 ++------
 .../src/packs/publication/tests.rs            |   1 +
 .../src/packs/publication/tests/completion.rs |   8 +-
 .../publication/tests/policy_dispatch.rs      |  11 +-
 .../publication/tests/preparation_receipt.rs  | 531 ++++++++++++++++++
 .../src/packs/publication/tests/publishing.rs |  30 +-
 .../src/server/catalog_initialization.rs      |  57 +-
 .../tests/multi_server/workspace.rs           |  15 +-
 docs/design/bound-preparation-dispatch.md     |   2 +-
 docs/design/initial-preparation-receipts.md   |  29 +
 docs/design/initial-staging-receipts.md       |   2 +
 .../mandatory-publication-registration.md     |   4 +-
 .../large-repository-implementation-status.md |  12 +
 21 files changed, 1179 insertions(+), 246 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/admission_receipt.rs
 create mode 100644 crates/canopy-server/src/packs/publication/preparation_receipt.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
 create mode 100644 docs/design/initial-preparation-receipts.md

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 9472507c..b2261469 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -261,6 +261,8 @@ impl CellModule for RepositoryModule {
                 ));
                 source.update(include_bytes!("packs/publication/staging_service.rs"));
                 source.update(include_bytes!("packs/publication/staging_receipt.rs"));
+                source.update(include_bytes!("packs/publication/admission_receipt.rs"));
+                source.update(include_bytes!("packs/publication/preparation_receipt.rs"));
                 source.update(include_bytes!("packs/publication/coordinator.rs"));
                 source.update(include_bytes!("packs/publication/coordinator/policy.rs"));
                 source.update(include_bytes!("packs/publication/coordinator/roots.rs"));
diff --git a/crates/canopy-server/src/packs/publication/admission_receipt.rs b/crates/canopy-server/src/packs/publication/admission_receipt.rs
new file mode 100644
index 00000000..04b86c8f
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/admission_receipt.rs
@@ -0,0 +1,295 @@
+//! Bounded first-admission knowledge shared by staging and preparation.
+//! These authenticated records grant no current custody or product access.
+use super::{
+    certificate::CertificateEnvelope,
+    recovery::{Stamp, phase::Recorded},
+    sql::*,
+    *,
+};
+use cellule_runtime::{
+    CellClient, CellTarget, Committed, InvocationError, PendingMutation, Receipt,
+    primitives::sql::SqlCell,
+};
+use std::marker::PhantomData;
+
+#[derive(Debug, thiserror::Error)]
+pub enum AdmissionReceiptError {
+    #[error("initial admission receipt binding differs")]
+    Context,
+    #[error("initial admission receipt encoding failed")]
+    Codec(#[from] CodecError),
+    #[error("initial admission receipt capability failed")]
+    Capability(#[from] Error),
+    #[error("initial admission receipt query failed")]
+    Query(#[source] Box<InvocationError<Vec<SqlResultSet>>>),
+}
+
+/// Implemented only by the two private admission kinds. A column or purpose
+/// cannot be chosen by an external caller.
+pub(super) trait Admission: Clone + Send + 'static {
+    const DOMAIN: &'static [u8];
+    const COLUMN: &'static str;
+    type Lease: Clone;
+    type Reply: WireValue;
+    fn grant(lease: Self::Lease) -> Self::Reply;
+    fn lease(result: &Recorded, request: &BeginRequest) -> Result<Self::Lease, CodecError>;
+    fn token(lease: &Self::Lease) -> PreparationToken;
+}
+
+#[derive(Clone)]
+struct Record<A: Admission> {
+    tenant: [u8; 16],
+    application: [u8; 16],
+    request: BeginRequest,
+    stamp: Stamp,
+    result: Recorded,
+    kind: PhantomData<A>,
+}
+impl<A: Admission> WireValue for Record<A> {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        A::lease(&self.result, &self.request)?;
+        e.write_bytes(A::DOMAIN)?;
+        e.write_bytes(&self.tenant)?;
+        e.write_bytes(&self.application)?;
+        self.request.encode(e)?;
+        self.stamp.encode(e)?;
+        self.result.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != A::DOMAIN {
+            return Err(CodecError::Invalid("initial admission receipt purpose"));
+        }
+        let value = Self {
+            tenant: crate::packs::directory::index::codec::fixed(d)?,
+            application: crate::packs::directory::index::codec::fixed(d)?,
+            request: BeginRequest::decode(d)?,
+            stamp: Stamp::decode(d)?,
+            result: Recorded::decode(d)?,
+            kind: PhantomData,
+        };
+        A::lease(&value.result, &value.request)?;
+        Ok(value)
+    }
+}
+
+fn decode<A: Admission>(bytes: &[u8], seed: &[u8; 32]) -> Result<Record<A>, AdmissionReceiptError> {
+    let mut d = BoundedDecoder::new(bytes, CERTIFICATE_BYTES)?;
+    let envelope = CertificateEnvelope::decode(&mut d)?;
+    d.finish()?;
+    if !envelope.authenticated(seed) {
+        return Err(AdmissionReceiptError::Context);
+    }
+    Ok(envelope.data()?)
+}
+
+#[derive(Clone)]
+pub(super) struct InitialAdmission<A: Admission> {
+    target: CellTarget,
+    record: Record<A>,
+}
+impl<A: Admission> InitialAdmission<A> {
+    pub(super) async fn load(
+        client: &CellClient,
+        target: &CellTarget,
+        operation: [u8; 16],
+    ) -> Result<Option<Self>, AdmissionReceiptError> {
+        let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
+        let result = sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![
+                        SqlStatement {
+                            sql: format!(
+                                "SELECT actor,request_digest,{} FROM pushes WHERE id=?1",
+                                A::COLUMN
+                            ),
+                            parameters: vec![blob(operation)],
+                        },
+                        SqlStatement {
+                            sql: "SELECT push_cert_seed FROM repository_identity WHERE singleton=1"
+                                .into(),
+                            parameters: vec![],
+                        },
+                    ],
+                },
+            )
+            .await
+            .map_err(|e| AdmissionReceiptError::Query(Box::new(e)))?;
+        let row = rows(&result.output)?.first().map(Vec::as_slice);
+        let Some([SqlValue::Text(actor), digest, value]) = row else {
+            return if row.is_none() {
+                Ok(None)
+            } else {
+                Err(AdmissionReceiptError::Context)
+            };
+        };
+        let bytes = match value {
+            SqlValue::Null => return Ok(None),
+            SqlValue::Blob(bytes) => bytes,
+            _ => return Err(AdmissionReceiptError::Context),
+        };
+        let seed = attestation::seed(
+            result
+                .output
+                .get(1..)
+                .ok_or(AdmissionReceiptError::Context)?,
+        )?;
+        let record: Record<A> = decode(bytes, &seed)?;
+        if record.request.actor != *actor
+            || record.request.request_digest != fixed::<32>(digest)?
+            || record.request.operation != operation
+            || record.tenant != *target.tenant().as_bytes()
+            || record.application != *target.application().as_bytes()
+            || crate::repository_target(
+                target.tenant(),
+                target.application(),
+                record.request.repository,
+            )? != *target
+        {
+            return Err(AdmissionReceiptError::Context);
+        }
+        Ok(Some(Self {
+            target: target.clone(),
+            record,
+        }))
+    }
+    pub(super) fn request(&self) -> &BeginRequest {
+        &self.record.request
+    }
+    pub(super) fn target(&self) -> &CellTarget {
+        &self.target
+    }
+    pub(super) fn lease(&self) -> A::Lease {
+        A::lease(&self.record.result, &self.record.request)
+            .expect("authenticated initial admission")
+    }
+    pub(super) fn receipt(&self) -> Receipt {
+        Receipt {
+            cell: self.target.cell_id(),
+            incarnation: A::token(&self.lease()).owner.incarnation,
+            // A Begin observing an already-bound attempt has its own receipt.
+            // The attempt sequence is not necessarily this command's sequence.
+            commit_sequence: self.record.result.sequence(),
+        }
+    }
+    pub(super) fn original(
+        &self,
+        evidence: &PendingMutation,
+    ) -> Result<Option<Committed<A::Reply>>, AdmissionReceiptError> {
+        if self.record.stamp != Stamp::of(evidence) {
+            return Ok(None);
+        }
+        if evidence.target() != &self.target || evidence.incarnation() != self.receipt().incarnation
+        {
+            return Err(AdmissionReceiptError::Context);
+        }
+        Ok(Some(self.record.result.committed(evidence)?))
+    }
+}
+
+/// The receipt is written after domain admission in the same SDK transaction.
+/// Failure rolls back namespace allocation, custody and SDK knowledge together.
+pub(super) fn save<A: Admission>(
+    context: &CommandContext<'_, '_>,
+    request: &BeginRequest,
+    lease: A::Lease,
+) -> cellule_runtime::Result<()> {
+    let evidence = context
+        .mutation_evidence()
+        .ok_or(Error::Command("initial admission evidence missing"))?;
+    if A::token(&lease).owner.incarnation != evidence.incarnation() {
+        return Err(Error::Command("initial admission incarnation differs"));
+    }
+    let mut output = BoundedEncoder::new(512)?;
+    A::grant(lease).encode(&mut output)?;
+    let record = Record::<A> {
+        tenant: *evidence.target().tenant().as_bytes(),
+        application: *evidence.target().application().as_bytes(),
+        request: request.clone(),
+        stamp: Stamp::of(&evidence),
+        result: Recorded::new(context.sequence(), false, output.finish())?,
+        kind: PhantomData,
+    };
+    let seed = attestation::seed(&context.sql(&statement(
+        "SELECT push_cert_seed FROM repository_identity WHERE singleton=1",
+        vec![],
+    ))?)?;
+    let envelope = CertificateEnvelope::seal(&record, &seed)?;
+    let mut encoded = BoundedEncoder::new(CERTIFICATE_BYTES)?;
+    envelope.encode(&mut encoded)?;
+    let existing = context.sql(&statement(
+        &format!(
+            "SELECT actor,request_digest,{} FROM pushes WHERE id=?1",
+            A::COLUMN
+        ),
+        vec![blob(request.operation)],
+    ))?;
+    let saved = if let Some(row) = rows(&existing)?.first() {
+        let [SqlValue::Text(actor), digest, original] = row.as_slice() else {
+            return Err(Error::Command("invalid initial admission request row"));
+        };
+        if *actor != request.actor || fixed::<32>(digest)? != request.request_digest {
+            return Err(Error::Command("initial admission request identity differs"));
+        }
+        if *original != SqlValue::Null {
+            return Ok(());
+        }
+        statement(
+            &format!(
+                "UPDATE pushes SET {0}=?1 WHERE id=?2 AND {0} IS NULL AND response_id IS NULL",
+                A::COLUMN
+            ),
+            vec![blob(encoded.finish()), blob(request.operation)],
+        )
+    } else {
+        statement(
+            &format!(
+                "INSERT INTO pushes(id,actor,request_digest,{}) VALUES(?1,?2,?3,?4)",
+                A::COLUMN
+            ),
+            vec![
+                blob(request.operation),
+                SqlValue::Text(request.actor.clone()),
+                blob(request.request_digest),
+                blob(encoded.finish()),
+            ],
+        )
+    };
+    publish::changed(context.sql(&saved)?)?;
+    Ok(())
+}
+
+pub(super) fn restart_matches<A: Admission>(
+    context: &CommandContext<'_, '_>,
+    check: &LeaseCheck,
+) -> cellule_runtime::Result<bool> {
+    let sets = context.sql(&statement(
+        &format!(
+            "SELECT actor,request_digest,{} FROM pushes WHERE id=?1",
+            A::COLUMN
+        ),
+        vec![blob(check.token.operation)],
+    ))?;
+    let Some([SqlValue::Text(actor), digest, SqlValue::Blob(bytes)]) =
+        rows(&sets)?.first().map(Vec::as_slice)
+    else {
+        return Ok(false);
+    };
+    if *actor != check.actor || fixed::<32>(digest)? != check.token.request_digest {
+        return Ok(false);
+    }
+    let seed = attestation::seed(&context.sql(&statement(
+        "SELECT push_cert_seed FROM repository_identity WHERE singleton=1",
+        vec![],
+    ))?)?;
+    let record: Record<A> = decode(bytes, &seed)
+        .map_err(|_| Error::Command("initial admission receipt authentication failed"))?;
+    let evidence = context
+        .mutation_evidence()
+        .ok_or(Error::Command("Claim evidence missing"))?;
+    Ok(record.request.actor == check.actor
+        && A::token(&A::lease(&record.result, &record.request)?) == check.token
+        && record.tenant == *evidence.target().tenant().as_bytes()
+        && record.application == *evidence.target().application().as_bytes())
+}
diff --git a/crates/canopy-server/src/packs/publication/commands.rs b/crates/canopy-server/src/packs/publication/commands.rs
index abc0aeeb..5f455e03 100644
--- a/crates/canopy-server/src/packs/publication/commands.rs
+++ b/crates/canopy-server/src/packs/publication/commands.rs
@@ -151,7 +151,7 @@ pub struct BeginPreparation;
 impl Command for BeginPreparation {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 11;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = BeginRequest;
     type Output = PreparationReply;
     fn execute(
@@ -188,8 +188,10 @@ impl Command for BeginPreparation {
             }
             check_pin(context, &existing)?;
             let base = fact(context, input.repository, format, existing.generation)?;
+            let lease = grant(&existing, format, base, now)?;
+            super::preparation_receipt::save(context, &input, lease)?;
             return Ok(CommandResult::Success(PreparationReply::Granted(Box::new(
-                grant(&existing, format, base, now)?,
+                lease,
             ))));
         }
         if !quota(context, true)? {
@@ -205,13 +207,15 @@ impl Command for BeginPreparation {
         insert_lease(context, new_token, Some(base.generation), expires)?;
         context.sql(&statement("INSERT INTO catalog_operations(id,actor,request_digest,incarnation,owner_epoch,admission_sequence,artifact_operation,generation,expires_at_ms) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9)",vec![blob(input.operation),SqlValue::Text(input.actor.clone()),blob(input.request_digest),blob(new_token.owner.incarnation.as_bytes()),blob(new_token.owner.epoch.to_be_bytes()),number(new_token.attempt)?,blob(new_token.artifact_operation),number(base.generation)?,SqlValue::Integer(expires)]))?;
         let row = Operation {
-            actor: input.actor,
+            actor: input.actor.clone(),
             token: new_token,
             generation: Some(base.generation),
             expires,
         };
+        let lease = grant(&row, format, base, now)?;
+        super::preparation_receipt::save(context, &input, lease)?;
         Ok(CommandResult::Success(PreparationReply::Granted(Box::new(
-            grant(&row, format, base, now)?,
+            lease,
         ))))
     }
 }
@@ -220,7 +224,7 @@ pub struct ClaimPreparation;
 impl Command for ClaimPreparation {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 12;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = LeaseRequest;
     type Output = PreparationReply;
     fn execute(
@@ -238,7 +242,42 @@ impl Command for ClaimPreparation {
             return Ok(denied(PreparationDenial::Unauthorized));
         };
         let Some(existing) = load(context, check.token)? else {
-            return Ok(denied(PreparationDenial::Missing));
+            if !super::preparation_receipt::restart_matches(context, &check)? {
+                return Ok(denied(PreparationDenial::Missing));
+            }
+            let begin = BeginRequest {
+                repository: check.token.repository,
+                operation: check.token.operation,
+                request_digest: check.token.request_digest,
+                actor: check.actor.clone(),
+                lease_ms: input.lease_ms,
+            };
+            if !logical_available(context, &begin)? {
+                return Ok(denied(PreparationDenial::Conflict));
+            }
+            if !quota(context, true)? {
+                return Ok(denied(PreparationDenial::Capacity));
+            }
+            let now = now(context.now_ms())?;
+            let expires = expiry(now, input.lease_ms)?;
+            let base = fact(context, check.token.repository, format, None)?;
+            let next = token(
+                context,
+                check.token.repository,
+                check.token.operation,
+                check.token.request_digest,
+            )?;
+            insert_lease(context, next, Some(base.generation), expires)?;
+            context.sql(&statement("INSERT INTO catalog_operations(id,actor,request_digest,incarnation,owner_epoch,admission_sequence,artifact_operation,generation,expires_at_ms) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9)", vec![blob(next.operation),SqlValue::Text(check.actor.clone()),blob(next.request_digest),blob(next.owner.incarnation.as_bytes()),blob(next.owner.epoch.to_be_bytes()),number(next.attempt)?,blob(next.artifact_operation),number(base.generation)?,SqlValue::Integer(expires)]))?;
+            let row = Operation {
+                actor: check.actor,
+                token: next,
+                generation: Some(base.generation),
+                expires,
+            };
+            return Ok(CommandResult::Success(PreparationReply::Granted(Box::new(
+                grant(&row, format, base, now)?,
+            ))));
         };
         if !matched(&existing, &check) {
             return Ok(denied(PreparationDenial::Stale));
diff --git a/crates/canopy-server/src/packs/publication/compaction/publish.rs b/crates/canopy-server/src/packs/publication/compaction/publish.rs
index 8edbcf5e..17e569b3 100644
--- a/crates/canopy-server/src/packs/publication/compaction/publish.rs
+++ b/crates/canopy-server/src/packs/publication/compaction/publish.rs
@@ -83,7 +83,7 @@ pub struct PublishCatalogCompaction;
 impl Command for PublishCatalogCompaction {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 22;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = CatalogCertificate;
     type Output = CompactionReply;
     fn execute(
@@ -127,7 +127,7 @@ impl Command for PublishCatalogCompaction {
             )));
         }
         if !rows(&context.sql(&statement(
-            "SELECT id FROM pushes WHERE id=?1 AND NOT(actor=?2 AND request_digest=?3 AND initial_staging IS NOT NULL AND response_id IS NULL AND response_root IS NULL AND publication IS NULL)",
+            "SELECT id FROM pushes WHERE id=?1 AND NOT(actor=?2 AND request_digest=?3 AND (initial_staging IS NOT NULL OR initial_preparation IS NOT NULL) AND response_id IS NULL AND response_root IS NULL AND publication IS NULL)",
             vec![blob(data.token.operation), SqlValue::Text(data.actor.clone()), blob(data.token.request_digest)],
         ))?)?
         .is_empty()
diff --git a/crates/canopy-server/src/packs/publication/initialization/publish.rs b/crates/canopy-server/src/packs/publication/initialization/publish.rs
index d908b224..686c49b6 100644
--- a/crates/canopy-server/src/packs/publication/initialization/publish.rs
+++ b/crates/canopy-server/src/packs/publication/initialization/publish.rs
@@ -83,7 +83,7 @@ pub struct InitializeCatalogRefs;
 impl Command for InitializeCatalogRefs {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 31;
-    const CODEC_VERSION: u32 = 2;
+    const CODEC_VERSION: u32 = 3;
     type Input = InitialRefProof;
     type Output = InitializationReply;
     fn execute(
@@ -177,7 +177,7 @@ fn initialize(
     {
         return Ok(denied(PreparationDenial::Conflict));
     }
-    let pristine = context.sql(&statement("SELECT generation=0 AND default_branch=?1 AND NOT EXISTS(SELECT 1 FROM refs) AND NOT EXISTS(SELECT 1 FROM pushes WHERE initial_staging IS NULL OR response_id IS NOT NULL OR publication IS NOT NULL) AND NOT EXISTS(SELECT 1 FROM catalog_compactions) AND NOT EXISTS(SELECT 1 FROM catalog_initialization) AND NOT EXISTS(SELECT 1 FROM catalog_generations WHERE generation>0) FROM ref_generation WHERE singleton=1", vec![SqlValue::Text(INITIAL_HEAD.into())]))?;
+    let pristine = context.sql(&statement("SELECT generation=0 AND default_branch=?1 AND NOT EXISTS(SELECT 1 FROM refs) AND NOT EXISTS(SELECT 1 FROM pushes WHERE (initial_staging IS NULL AND initial_preparation IS NULL) OR response_id IS NOT NULL OR publication IS NOT NULL) AND NOT EXISTS(SELECT 1 FROM catalog_compactions) AND NOT EXISTS(SELECT 1 FROM catalog_initialization) AND NOT EXISTS(SELECT 1 FROM catalog_generations WHERE generation>0) FROM ref_generation WHERE singleton=1", vec![SqlValue::Text(INITIAL_HEAD.into())]))?;
     match rows(&pristine)?.first().map(Vec::as_slice) {
         Some([SqlValue::Integer(1)]) => {}
         Some([SqlValue::Integer(0)]) => return Ok(denied(PreparationDenial::Conflict)),
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 55989b11..979840a4 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -98,6 +98,9 @@ pub use root_completion::{
     RootOutcomeCompletion, RootPushCompletion, RootPushOutcomes, RootPushReplayError,
     RootSignedPushFact, replay_root_push_response,
 };
+mod admission_receipt;
+mod preparation_receipt;
+pub use preparation_receipt::{PreparationAdmission, PreparationReceiptError};
 mod staging_receipt;
 pub use staging_receipt::{StagingAdmission, StagingReceiptError};
 mod staging;
diff --git a/crates/canopy-server/src/packs/publication/preparation_receipt.rs b/crates/canopy-server/src/packs/publication/preparation_receipt.rs
new file mode 100644
index 00000000..1b1e5e64
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/preparation_receipt.rs
@@ -0,0 +1,108 @@
+//! First accepted catalog preparation, retained separately from current custody.
+pub use super::admission_receipt::AdmissionReceiptError as PreparationReceiptError;
+use super::{
+    admission_receipt::{Admission, InitialAdmission},
+    recovery::phase::Recorded,
+    *,
+};
+use cellule_runtime::{CellClient, CellTarget, Committed, MutationIdentity, PendingMutation};
+
+#[derive(Clone)]
+pub(super) struct Preparation;
+impl Admission for Preparation {
+    const DOMAIN: &'static [u8] = b"canopy.initial-preparation-receipt.v1\0";
+    const COLUMN: &'static str = "initial_preparation";
+    type Lease = PreparationLease;
+    type Reply = PreparationReply;
+    fn grant(lease: PreparationLease) -> PreparationReply {
+        PreparationReply::Granted(Box::new(lease))
+    }
+    fn token(lease: &PreparationLease) -> PreparationToken {
+        lease.token
+    }
+    fn lease(result: &Recorded, request: &BeginRequest) -> Result<PreparationLease, CodecError> {
+        let PreparationReply::Granted(lease) = result.decode_reply()? else {
+            return Err(CodecError::Invalid(
+                "initial preparation receipt is not a grant",
+            ));
+        };
+        // Begin can observe a staging attempt that was already bound, or an
+        // existing preparation. Its command sequence then follows admission.
+        if result.rejected()
+            || lease.token.repository != request.repository
+            || lease.token.operation != request.operation
+            || lease.token.request_digest != request.request_digest
+            || lease.token.attempt > result.sequence()
+        {
+            return Err(CodecError::Invalid(
+                "initial preparation receipt result differs",
+            ));
+        }
+        Ok(*lease)
+    }
+}
+
+/// Authenticated original Begin knowledge, including its actual SDK sequence.
+/// The saved clock never extends a live lease. Claim or a fresh Check is needed
+/// before any preparation factory can use this attempt.
+#[derive(Clone)]
+pub struct PreparationAdmission(InitialAdmission<Preparation>);
+impl PreparationAdmission {
+    pub async fn load(
+        client: &CellClient,
+        target: &CellTarget,
+        operation: [u8; 16],
+    ) -> Result<Option<Self>, PreparationReceiptError> {
+        Ok(InitialAdmission::load(client, target, operation)
+            .await?
+            .map(Self))
+    }
+    pub fn request(&self) -> &BeginRequest {
+        self.0.request()
+    }
+    pub fn lease(&self) -> PreparationLease {
+        self.0.lease()
+    }
+    pub fn receipt(&self) -> cellule_runtime::Receipt {
+        self.0.receipt()
+    }
+    pub async fn ready_claim(
+        &self,
+        client: CellClient,
+        lease_ms: u64,
+        identity: MutationIdentity,
+    ) -> Result<ReadyPreparation, PreparationReadyError> {
+        ReadyPreparation::claim(
+            client,
+            self.0.target().clone(),
+            LeaseRequest {
+                check: LeaseCheck {
+                    token: self.lease().token,
+                    actor: self.request().actor.clone(),
+                },
+                lease_ms,
+            },
+            identity,
+        )
+        .await
+    }
+    pub fn original(
+        &self,
+        evidence: &PendingMutation,
+    ) -> Result<Option<Committed<PreparationReply>>, PreparationReceiptError> {
+        self.0.original(evidence)
+    }
+}
+pub(super) fn save(
+    context: &CommandContext<'_, '_>,
+    request: &BeginRequest,
+    lease: PreparationLease,
+) -> cellule_runtime::Result<()> {
+    super::admission_receipt::save::<Preparation>(context, request, lease)
+}
+pub(super) fn restart_matches(
+    context: &CommandContext<'_, '_>,
+    check: &LeaseCheck,
+) -> cellule_runtime::Result<bool> {
+    super::admission_receipt::restart_matches::<Preparation>(context, check)
+}
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index 04a615aa..a0e9ce15 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -65,6 +65,7 @@ CREATE TABLE pushes (
     actor TEXT NOT NULL,
     request_digest BLOB NOT NULL CHECK(length(request_digest) = 32),
     initial_staging BLOB CHECK(initial_staging IS NULL OR (typeof(initial_staging)='blob' AND length(initial_staging) BETWEEN 1 AND 1024)),
+    initial_preparation BLOB CHECK(initial_preparation IS NULL OR (typeof(initial_preparation)='blob' AND length(initial_preparation) BETWEEN 1 AND 1024)),
     options TEXT NOT NULL DEFAULT '[]' CHECK(length(CAST(options AS BLOB)) <= 65536),
     response_id BLOB CHECK(response_id IS NULL OR length(response_id) = 16),
     completion_digest BLOB CHECK(completion_digest IS NULL OR length(completion_digest) = 32),
@@ -109,6 +110,13 @@ CREATE TRIGGER push_initial_staging_retained BEFORE DELETE ON pushes
 WHEN OLD.initial_staging IS NOT NULL
 BEGIN SELECT RAISE(ABORT, 'initial staging receipt must be retained'); END;
 
+CREATE TRIGGER push_initial_preparation_immutable BEFORE UPDATE OF initial_preparation ON pushes
+WHEN OLD.initial_preparation IS NOT NULL AND NEW.initial_preparation IS NOT OLD.initial_preparation
+BEGIN SELECT RAISE(ABORT, 'initial preparation receipt is immutable'); END;
+CREATE TRIGGER push_initial_preparation_retained BEFORE DELETE ON pushes
+WHEN OLD.initial_preparation IS NOT NULL
+BEGIN SELECT RAISE(ABORT, 'initial preparation receipt must be retained'); END;
+
 CREATE TABLE push_certificates (
     digest BLOB PRIMARY KEY CHECK(length(digest) = 32),
     push_id BLOB NOT NULL UNIQUE REFERENCES pushes(id),
diff --git a/crates/canopy-server/src/packs/publication/staging_receipt.rs b/crates/canopy-server/src/packs/publication/staging_receipt.rs
index 6921f563..2d108de1 100644
--- a/crates/canopy-server/src/packs/publication/staging_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/staging_receipt.rs
@@ -1,51 +1,39 @@
 //! Original initial-admission knowledge is independent of live input custody.
-//! The bounded first receipt shares the logical push row and receipt codec.
+pub use super::admission_receipt::AdmissionReceiptError as StagingReceiptError;
 use super::{
-    certificate::CertificateEnvelope,
-    recovery::{Stamp, phase::Recorded},
-    sql::*,
+    admission_receipt::{Admission, InitialAdmission},
+    recovery::phase::Recorded,
     *,
 };
-use cellule_runtime::{
-    CellClient, CellTarget, Committed, InvocationError, MutationIdentity, PendingMutation,
-    primitives::sql::SqlCell,
-};
+use cellule_runtime::{CellClient, CellTarget, Committed, MutationIdentity, PendingMutation};
 
-const DOMAIN: &[u8] = b"canopy.initial-staging-receipt.v1\0";
-#[derive(Debug, thiserror::Error)]
-pub enum StagingReceiptError {
-    #[error("initial staging receipt binding differs")]
-    Context,
-    #[error("initial staging receipt encoding failed")]
-    Codec(#[from] CodecError),
-    #[error("initial staging receipt capability failed")]
-    Capability(#[from] Error),
-    #[error("initial staging receipt query failed")]
-    Query(#[source] Box<InvocationError<Vec<SqlResultSet>>>),
-}
-#[derive(Clone, Debug, PartialEq, Eq)]
-struct Record {
-    tenant: [u8; 16],
-    application: [u8; 16],
-    request: BeginRequest,
-    stamp: Stamp,
-    result: Recorded,
-}
-impl Record {
-    fn lease(&self) -> Result<StagingLease, CodecError> {
-        let StagingReply::Granted(lease) = self.result.decode_reply()? else {
+#[derive(Clone)]
+pub(super) struct Staging;
+impl Admission for Staging {
+    const DOMAIN: &'static [u8] = b"canopy.initial-staging-receipt.v1\0";
+    const COLUMN: &'static str = "initial_staging";
+    type Lease = StagingLease;
+    type Reply = StagingReply;
+    fn grant(lease: StagingLease) -> StagingReply {
+        StagingReply::Granted(Box::new(lease))
+    }
+    fn token(lease: &StagingLease) -> PreparationToken {
+        lease.token
+    }
+    fn lease(result: &Recorded, request: &BeginRequest) -> Result<StagingLease, CodecError> {
+        let StagingReply::Granted(lease) = result.decode_reply()? else {
             return Err(CodecError::Invalid(
                 "initial staging receipt is not a grant",
             ));
         };
-        if self.result.rejected()
-            || lease.token.repository != self.request.repository
-            || lease.token.operation != self.request.operation
-            || lease.token.request_digest != self.request.request_digest
-            || lease.token.attempt != self.result.sequence()
+        if result.rejected()
+            || lease.token.repository != request.repository
+            || lease.token.operation != request.operation
+            || lease.token.request_digest != request.request_digest
+            || lease.token.attempt != result.sequence()
             || lease.observed_at_ms < 0
             || lease.expires_at_ms <= lease.observed_at_ms
-            || lease.expires_at_ms - lease.observed_at_ms != self.request.lease_ms as i64
+            || lease.expires_at_ms - lease.observed_at_ms != request.lease_ms as i64
         {
             return Err(CodecError::Invalid(
                 "initial staging receipt result differs",
@@ -54,96 +42,25 @@ impl Record {
         Ok(*lease)
     }
 }
-impl WireValue for Record {
-    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
-        self.lease()?;
-        e.write_bytes(DOMAIN)?;
-        e.write_bytes(&self.tenant)?;
-        e.write_bytes(&self.application)?;
-        self.request.encode(e)?;
-        self.stamp.encode(e)?;
-        self.result.encode(e)
-    }
-    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
-        if d.read_bytes()? != DOMAIN {
-            return Err(CodecError::Invalid("initial staging receipt purpose"));
-        }
-        let value = Self {
-            tenant: crate::packs::directory::index::codec::fixed(d)?,
-            application: crate::packs::directory::index::codec::fixed(d)?,
-            request: BeginRequest::decode(d)?,
-            stamp: Stamp::decode(d)?,
-            result: Recorded::decode(d)?,
-        };
-        value.lease()?;
-        Ok(value)
-    }
-}
 /// Trusted service knowledge of the first accepted Begin. It grants no upload,
 /// write or response permission. A restarted caller must explicitly Claim.
 #[derive(Clone)]
-pub struct StagingAdmission {
-    target: CellTarget,
-    record: Record,
-}
+pub struct StagingAdmission(InitialAdmission<Staging>);
 impl StagingAdmission {
     pub async fn load(
         client: &CellClient,
         target: &CellTarget,
         operation: [u8; 16],
     ) -> Result<Option<Self>, StagingReceiptError> {
-        let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
-        let result = sql.query(None, SqlBatch { statements: vec![
-            SqlStatement { sql: "SELECT actor,request_digest,initial_staging FROM pushes WHERE id=?1".into(), parameters: vec![blob(operation)] },
-            SqlStatement { sql: "SELECT push_cert_seed FROM repository_identity WHERE singleton=1".into(), parameters: vec![] },
-        ] }).await.map_err(|e| StagingReceiptError::Query(Box::new(e)))?;
-        let Some([SqlValue::Text(actor), digest, value]) =
-            rows(&result.output)?.first().map(Vec::as_slice)
-        else {
-            return Ok(None);
-        };
-        let bytes = match value {
-            SqlValue::Null => return Ok(None),
-            SqlValue::Blob(bytes) => bytes,
-            _ => return Err(StagingReceiptError::Context),
-        };
-        let mut d = BoundedDecoder::new(bytes, CERTIFICATE_BYTES)?;
-        let envelope = CertificateEnvelope::decode(&mut d)?;
-        d.finish()?;
-        let seed = attestation::seed(result.output.get(1..).ok_or(StagingReceiptError::Context)?)?;
-        if !envelope.authenticated(&seed) {
-            return Err(StagingReceiptError::Context);
-        }
-        let record: Record = envelope.data()?;
-        if record.request.actor != *actor
-            || record.request.request_digest != fixed::<32>(digest)?
-            || record.request.operation != operation
-            || record.tenant != *target.tenant().as_bytes()
-            || record.application != *target.application().as_bytes()
-            || crate::repository_target(
-                target.tenant(),
-                target.application(),
-                record.request.repository,
-            )? != *target
-        {
-            return Err(StagingReceiptError::Context);
-        }
-        Ok(Some(Self {
-            target: target.clone(),
-            record,
-        }))
+        Ok(InitialAdmission::load(client, target, operation)
+            .await?
+            .map(Self))
     }
     pub fn lease(&self) -> StagingLease {
-        self.record
-            .lease()
-            .expect("authenticated initial staging receipt")
+        self.0.lease()
     }
     pub fn receipt(&self) -> cellule_runtime::Receipt {
-        cellule_runtime::Receipt {
-            cell: self.target.cell_id(),
-            incarnation: self.lease().token.owner.incarnation,
-            commit_sequence: self.record.result.sequence(),
-        }
+        self.0.receipt()
     }
     pub async fn ready_claim(
         &self,
@@ -153,11 +70,11 @@ impl StagingAdmission {
     ) -> Result<ReadyStaging, StagingError> {
         ReadyStaging::claim(
             client,
-            self.target.clone(),
+            self.0.target().clone(),
             LeaseRequest {
                 check: LeaseCheck {
                     token: self.lease().token,
-                    actor: self.record.request.actor.clone(),
+                    actor: self.0.request().actor.clone(),
                 },
                 lease_ms,
             },
@@ -169,112 +86,19 @@ impl StagingAdmission {
         &self,
         evidence: &PendingMutation,
     ) -> Result<Option<Committed<StagingReply>>, StagingReceiptError> {
-        if self.record.stamp != Stamp::of(evidence) {
-            return Ok(None);
-        }
-        if evidence.target() != &self.target
-            || evidence.incarnation() != self.lease().token.owner.incarnation
-        {
-            return Err(StagingReceiptError::Context);
-        }
-        Ok(Some(self.record.result.committed(evidence)?))
+        self.0.original(evidence)
     }
 }
-/// Called after admission writes. An encoding/SQL failure aborts admission and
-/// its SDK receipt together. This never replaces an earlier logical receipt.
 pub(super) fn save(
     context: &CommandContext<'_, '_>,
     request: &BeginRequest,
     lease: StagingLease,
 ) -> cellule_runtime::Result<()> {
-    let evidence = context
-        .mutation_evidence()
-        .ok_or(Error::Command("initial staging evidence missing"))?;
-    let mut output = BoundedEncoder::new(512)?;
-    StagingReply::Granted(Box::new(lease)).encode(&mut output)?;
-    let record = Record {
-        tenant: *evidence.target().tenant().as_bytes(),
-        application: *evidence.target().application().as_bytes(),
-        request: request.clone(),
-        stamp: Stamp::of(&evidence),
-        result: Recorded::new(context.sequence(), false, output.finish())?,
-    };
-    let seed = attestation::seed(&context.sql(&statement(
-        "SELECT push_cert_seed FROM repository_identity WHERE singleton=1",
-        vec![],
-    ))?)?;
-    let envelope = CertificateEnvelope::seal(&record, &seed)?;
-    let mut encoded = BoundedEncoder::new(CERTIFICATE_BYTES)?;
-    envelope.encode(&mut encoded)?;
-    let existing = context.sql(&statement(
-        "SELECT actor,request_digest,initial_staging FROM pushes WHERE id=?1",
-        vec![blob(request.operation)],
-    ))?;
-    let saved = if let Some(row) = rows(&existing)?.first() {
-        let [SqlValue::Text(actor), digest, original] = row.as_slice() else {
-            return Err(Error::Command("invalid initial staging push row"));
-        };
-        if *actor != request.actor || fixed::<32>(digest)? != request.request_digest {
-            return Err(Error::Command("initial staging push identity differs"));
-        }
-        if *original != SqlValue::Null {
-            return Ok(());
-        }
-        statement(
-            "UPDATE pushes SET initial_staging=?1 WHERE id=?2 AND initial_staging IS NULL AND response_id IS NULL",
-            vec![blob(encoded.finish()), blob(request.operation)],
-        )
-    } else {
-        statement(
-            "INSERT INTO pushes(id,actor,request_digest,initial_staging) VALUES(?1,?2,?3,?4)",
-            vec![
-                blob(request.operation),
-                SqlValue::Text(request.actor.clone()),
-                blob(request.request_digest),
-                blob(encoded.finish()),
-            ],
-        )
-    };
-    publish::changed(context.sql(&saved)?)?;
-    Ok(())
+    super::admission_receipt::save::<Staging>(context, request, lease)
 }
-
-/// Only original authenticated admission knowledge can recreate a missing
-/// staging operation. Completed logical outcomes still refuse recreation.
 pub(super) fn restart_matches(
     context: &CommandContext<'_, '_>,
     check: &LeaseCheck,
 ) -> cellule_runtime::Result<bool> {
-    let sets = context.sql(&statement(
-        "SELECT actor,request_digest,initial_staging FROM pushes WHERE id=?1",
-        vec![blob(check.token.operation)],
-    ))?;
-    let Some([SqlValue::Text(actor), digest, SqlValue::Blob(bytes)]) =
-        rows(&sets)?.first().map(Vec::as_slice)
-    else {
-        return Ok(false);
-    };
-    if *actor != check.actor || fixed::<32>(digest)? != check.token.request_digest {
-        return Ok(false);
-    }
-    let seed = attestation::seed(&context.sql(&statement(
-        "SELECT push_cert_seed FROM repository_identity WHERE singleton=1",
-        vec![],
-    ))?)?;
-    let mut d = BoundedDecoder::new(bytes, CERTIFICATE_BYTES)?;
-    let envelope = CertificateEnvelope::decode(&mut d)?;
-    d.finish()?;
-    if !envelope.authenticated(&seed) {
-        return Err(Error::Command(
-            "initial staging receipt authentication failed",
-        ));
-    }
-    let record: Record = envelope.data()?;
-    let evidence = context
-        .mutation_evidence()
-        .ok_or(Error::Command("staging Claim evidence missing"))?;
-    Ok(record.request.actor == check.actor
-        && record.lease()?.token == check.token
-        && record.tenant == *evidence.target().tenant().as_bytes()
-        && record.application == *evidence.target().application().as_bytes())
+    super::admission_receipt::restart_matches::<Staging>(context, check)
 }
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index b16bb990..368d21a5 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -15,6 +15,7 @@ mod namespaces;
 mod native_capture;
 mod policy_dispatch;
 mod policy_refusal;
+mod preparation_receipt;
 mod prepare;
 mod publishing;
 mod reconcile;
diff --git a/crates/canopy-server/src/packs/publication/tests/completion.rs b/crates/canopy-server/src/packs/publication/tests/completion.rs
index 1de04b12..678dc8b7 100644
--- a/crates/canopy-server/src/packs/publication/tests/completion.rs
+++ b/crates/canopy-server/src/packs/publication/tests/completion.rs
@@ -143,7 +143,13 @@ pub(super) async fn counts(handle: &CellHandle) -> Result<Vec<u64>> {
             ]
             .into_iter()
             .map(|table| {
-                connection.query_row(&format!("SELECT count(*) FROM {table}"), [], |row| {
+                // Admission-only rows are retained knowledge, not completed
+                // push/publication outcomes. Other counts still include every
+                // response/certificate/chunk written by the final transaction.
+                let sql = if table == "pushes" {
+                    "SELECT count(*) FROM pushes WHERE response_id IS NOT NULL OR publication IS NOT NULL".into()
+                } else { format!("SELECT count(*) FROM {table}") };
+                connection.query_row(&sql, [], |row| {
                     row.get::<_, u64>(0)
                 })
             })
diff --git a/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs b/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
index dcfbf5fa..7ea674ba 100644
--- a/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
@@ -476,12 +476,17 @@ async fn complete(
         body.extend_from_slice(&part);
     }
     assert_eq!(body, expected.body);
-    // Initialization and the native attempt each retain an independent pin.
+    // Initialization is retired; the native attempt retains its own pin.
     assert_eq!(f.counts_for(prepared.token()).await?, (0, 1));
+    let operation = prepared.token().operation;
     f.handle
-        .query(0, 1024, |db| {
+        .query(0, 1024, move |db| {
             assert_eq!(
-                db.query_row("SELECT count(*) FROM pushes", [], |r| r.get::<_, u64>(0))?,
+                db.query_row(
+                    "SELECT count(*) FROM pushes WHERE id=?1 AND response_root IS NOT NULL",
+                    [operation.as_slice()],
+                    |r| r.get::<_, u64>(0)
+                )?,
                 1
             );
             assert_eq!(
diff --git a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
new file mode 100644
index 00000000..a067dae9
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
@@ -0,0 +1,531 @@
+//! First preparation admission survives transport loss independently of custody.
+use super::publishing::edit;
+use super::*;
+use cellule_runtime::Resolution;
+use tokio::time::{Duration, timeout};
+
+fn denied(
+    result: std::result::Result<
+        cellule_runtime::Committed<PreparationReply>,
+        InvocationError<PreparationReply>,
+    >,
+    reason: PreparationDenial,
+) {
+    match result {
+        Err(InvocationError::Rejected(value)) => {
+            assert_eq!(value.output, PreparationReply::Denied(reason))
+        }
+        other => panic!("expected preparation denial {reason:?}, observed {other:?}"),
+    }
+}
+
+async fn expire(expires_at_ms: i64) -> Result {
+    let now = sql::now(0)?;
+    if now <= expires_at_ms {
+        tokio::time::sleep(Duration::from_millis(u64::try_from(
+            expires_at_ms - now + 1,
+        )?))
+        .await;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initial_preparation_receipt_is_saved_with_the_actual_admission() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let original = f
+            .client()
+            .command::<BeginPreparation>(&f.target, identity()?, f.begin([218; 16]))
+            .await?;
+        let accepted = lease(original.output)?;
+        let operation = accepted.token.operation;
+        let saved = f
+            .handle
+            .query(0, 2048, move |db| {
+                Ok(db.query_row(
+                    "SELECT initial_preparation FROM pushes WHERE id=?1",
+                    [operation.as_slice()],
+                    |row| row.get::<_, Vec<u8>>(0),
+                )?)
+            })
+            .await?;
+        assert!(!saved.is_empty());
+        assert!(saved.len() <= CERTIFICATE_BYTES as usize);
+        assert_eq!(accepted.token.attempt, original.receipt.commit_sequence);
+        assert_eq!(f.counts().await?, (1, 1));
+        let known = PreparationAdmission::load(&f.client(), &f.target, operation)
+            .await?
+            .ok_or("initial receipt absent")?;
+        assert_eq!(known.lease(), accepted);
+        assert_eq!(known.receipt(), original.receipt);
+        assert_eq!(known.request(), &f.begin(operation));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initial_preparation_receipt_late_write_rolls_back_and_first_result_is_immutable() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for bound in [false, true] {
+            let f = Fixture::new(format).await?;
+            let input = f.begin([219; 16]);
+            let prior = if bound {
+                let staged = f
+                    .client()
+                    .command::<BeginStaging>(&f.target, identity()?, input.clone())
+                    .await?;
+                let StagingReply::Granted(staged) = staged.output else {
+                    return Err("staging grant absent".into());
+                };
+                f.client()
+                    .command::<BindStaging>(&f.target, identity()?, check(staged.token))
+                    .await?;
+                Some(staged.token)
+            } else {
+                None
+            };
+            let command = f
+                .client()
+                .prepare_command::<BeginPreparation>(&f.target, identity()?, input.clone())
+                .await?;
+            let evidence = command.evidence().clone();
+            let event = if bound {
+                "UPDATE OF initial_preparation"
+            } else {
+                "INSERT"
+            };
+            edit(&f, &format!("CREATE TRIGGER initial_preparation_fault BEFORE {event} ON pushes BEGIN SELECT RAISE(ABORT,'late initial preparation receipt failure'); END")).await?;
+            assert!(command.clone().execute().await.is_err());
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Absent
+            ));
+            assert_eq!(f.counts().await?, if bound { (1, 1) } else { (0, 0) });
+            assert!(
+                PreparationAdmission::load(&f.client(), &f.target, input.operation)
+                    .await?
+                    .is_none()
+            );
+            edit(&f, "DROP TRIGGER initial_preparation_fault").await?;
+            let original = command.execute().await?;
+            let accepted = lease(original.output.clone())?;
+            assert_eq!(accepted.token.artifact_operation, artifact_number(1));
+            if let Some(prior) = prior {
+                assert_eq!(accepted.token, prior);
+                assert!(original.receipt.commit_sequence > prior.attempt);
+                assert_eq!(
+                    StagingAdmission::load(&f.client(), &f.target, input.operation)
+                        .await?
+                        .ok_or("staging knowledge lost")?
+                        .lease()
+                        .token,
+                    prior
+                );
+            }
+            let saved = PreparationAdmission::load(&f.client(), &f.target, input.operation)
+                .await?
+                .ok_or("initial receipt absent")?;
+            assert_eq!(
+                saved.original(&evidence)?.ok_or("original stamp absent")?,
+                original
+            );
+            let observer = f
+                .client()
+                .prepare_command::<BeginPreparation>(&f.target, identity()?, input.clone())
+                .await?;
+            assert!(saved.original(observer.evidence())?.is_none());
+            let later = observer.execute().await?;
+            assert_eq!(lease(later.output)?.token, accepted.token);
+            assert!(later.receipt.commit_sequence > original.receipt.commit_sequence);
+            assert_eq!(
+                PreparationAdmission::load(&f.client(), &f.target, input.operation)
+                    .await?
+                    .ok_or("original replaced")?
+                    .receipt(),
+                original.receipt
+            );
+            for statement in [
+                "UPDATE pushes SET initial_preparation=NULL",
+                "UPDATE pushes SET initial_preparation=x'01'",
+                "DELETE FROM pushes",
+                "INSERT OR REPLACE INTO pushes(id,actor,request_digest) SELECT id,actor,request_digest FROM pushes",
+            ] {
+                assert!(edit(&f, statement).await.is_err());
+            }
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initial_preparation_receipt_cold_owner_and_sdk_expiry_preserve_actual_receipt() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let input = f.begin([220; 16]);
+        let mut mutation = identity()?;
+        mutation.expires_at_ms = mutation.issued_at_ms + 1000;
+        let command = f
+            .client()
+            .prepare_command::<BeginPreparation>(&f.target, mutation, input.clone())
+            .await?;
+        let evidence = command.evidence().clone();
+        // Discard the transport response and every prepared factory before
+        // destroying SQLite. Only the logical record remains discoverable.
+        let original = command.execute().await?;
+        let old = lease(original.output.clone())?;
+        let (runtime, handle, client) =
+            super::durable_recovery::restore_owner(&f, &check(old.token)).await?;
+        expire(mutation.expires_at_ms).await?;
+        assert!(matches!(
+            client.resolve(&evidence).await?,
+            Resolution::Expired
+        ));
+        let known = PreparationAdmission::load(&client, &f.target, input.operation)
+            .await?
+            .ok_or("cold receipt absent")?;
+        assert_eq!(
+            known.original(&evidence)?.ok_or("cold original absent")?,
+            original
+        );
+        assert_eq!(known.lease(), old);
+        denied(
+            client
+                .command::<RenewPreparation>(&f.target, identity()?, request(old.token))
+                .await,
+            PreparationDenial::Stale,
+        );
+        let coordinator =
+            PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let ticket = coordinator
+            .submit(
+                known
+                    .ready_claim(client.clone(), DEFAULT_LEASE_MS, identity()?)
+                    .await?,
+            )
+            .await?;
+        let PublicationState::Finished(Ok(PublicationOutcome::Preparation(next))) =
+            timeout(Duration::from_secs(10), ticket.wait()).await?
+        else {
+            return Err("cold Claim did not finish".into());
+        };
+        let next = next.session.map_err(|error| error.to_string())?;
+        assert_eq!(next.lease.token.owner, handle.owner_fence());
+        assert_ne!(next.lease.token.owner, old.token.owner);
+        assert_ne!(
+            next.lease.token.artifact_operation,
+            old.token.artifact_operation
+        );
+        assert_eq!(counts(&handle).await?, (1, 2));
+        let preserved = PreparationAdmission::load(&client, &f.target, input.operation)
+            .await?
+            .ok_or("Claim lost initial receipt")?;
+        assert_eq!(
+            preserved
+                .original(&evidence)?
+                .ok_or("initial identity lost")?,
+            original
+        );
+        assert!(coordinator.close_and_drain().await.is_empty());
+        runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initial_preparation_receipt_reaped_restart_claim_checks_original_and_rolls_back() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let input = f.begin([221; 16]);
+        let original = f
+            .client()
+            .command::<BeginPreparation>(&f.target, identity()?, input.clone())
+            .await?;
+        let old = lease(original.output.clone())?;
+        edit(&f, "UPDATE catalog_operations SET expires_at_ms=0; UPDATE catalog_leases SET expires_at_ms=0").await?;
+        assert_eq!(
+            f.client()
+                .command::<ReapPreparation>(
+                    &f.target,
+                    identity()?,
+                    MaintenanceRequest {
+                        repository: f.repository,
+                        actor: "owner".into(),
+                        owner: f.handle.owner_fence()
+                    }
+                )
+                .await?
+                .output,
+            2
+        );
+        assert_eq!(f.counts().await?, (0, 0));
+        let known = PreparationAdmission::load(&f.client(), &f.target, input.operation)
+            .await?
+            .ok_or("reaping lost receipt")?;
+        assert_eq!(known.receipt(), original.receipt);
+        assert!(
+            PreparationSession::open(
+                f.client(),
+                f.target.clone(),
+                check(old.token),
+                Some(original.receipt)
+            )
+            .await
+            .is_err()
+        );
+        for variant in 0..4 {
+            let mut forged = request(old.token);
+            match variant {
+                0 => forged.check.token.owner.epoch += 1,
+                1 => forged.check.token.attempt += 1,
+                2 => forged.check.token.artifact_operation = artifact_number(71),
+                _ => forged.check.token.request_digest = [72; 32],
+            }
+            denied(
+                f.client()
+                    .command::<ClaimPreparation>(&f.target, identity()?, forged)
+                    .await,
+                PreparationDenial::Missing,
+            );
+            assert_eq!(f.counts().await?, (0, 0));
+        }
+        let command = f
+            .client()
+            .prepare_command::<ClaimPreparation>(&f.target, identity()?, request(old.token))
+            .await?;
+        let evidence = command.evidence().clone();
+        edit(&f, "CREATE TRIGGER preparation_restart_fault BEFORE INSERT ON catalog_operations BEGIN SELECT RAISE(ABORT,'late preparation restart failure'); END").await?;
+        assert!(command.clone().execute().await.is_err());
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Absent
+        ));
+        assert_eq!(f.counts().await?, (0, 0));
+        edit(&f, "DROP TRIGGER preparation_restart_fault").await?;
+        let next = lease(command.execute().await?.output)?;
+        assert_eq!(next.token.artifact_operation, artifact_number(2));
+        assert_eq!(next.token.owner, f.handle.owner_fence());
+        assert_eq!(f.counts().await?, (1, 1));
+        // The original grant cannot displace a known active successor.
+        denied(
+            f.client()
+                .command::<ClaimPreparation>(&f.target, identity()?, request(old.token))
+                .await,
+            PreparationDenial::Stale,
+        );
+        assert_eq!(
+            PreparationAdmission::load(&f.client(), &f.target, input.operation)
+                .await?
+                .ok_or("restart replaced receipt")?
+                .lease(),
+            old
+        );
+        f.client()
+            .command::<AbortPreparation>(&f.target, identity()?, check(next.token))
+            .await?;
+        edit(
+            &f,
+            "UPDATE pushes SET response_id=zeroblob(16),completion_digest=zeroblob(32),rejected=1",
+        )
+        .await?;
+        denied(
+            f.client()
+                .command::<ClaimPreparation>(&f.target, identity()?, request(old.token))
+                .await,
+            PreparationDenial::Conflict,
+        );
+        assert_eq!(f.counts().await?, (0, 1));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initial_preparation_receipt_knowledge_does_not_restore_revoked_or_expired_custody()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for revoked in [false, true] {
+            let f = Fixture::new(format).await?;
+            let input = f.begin([222; 16]);
+            let command = f
+                .client()
+                .prepare_command::<BeginPreparation>(&f.target, identity()?, input.clone())
+                .await?;
+            let evidence = command.evidence().clone();
+            let original = command.execute().await?;
+            let old = lease(original.output.clone())?;
+            if revoked {
+                edit(
+                    &f,
+                    "UPDATE repository_identity SET owner='other' WHERE singleton=1",
+                )
+                .await?;
+            } else {
+                edit(&f, "UPDATE catalog_operations SET expires_at_ms=0; UPDATE catalog_leases SET expires_at_ms=0").await?;
+            }
+            let known = PreparationAdmission::load(&f.client(), &f.target, input.operation)
+                .await?
+                .ok_or("custody hid knowledge")?;
+            assert_eq!(
+                known.original(&evidence)?.ok_or("original hidden")?,
+                original
+            );
+            assert!(
+                PreparationSession::open(
+                    f.client(),
+                    f.target.clone(),
+                    check(old.token),
+                    Some(original.receipt)
+                )
+                .await
+                .is_err()
+            );
+            denied(
+                f.client()
+                    .command::<RenewPreparation>(&f.target, identity()?, request(old.token))
+                    .await,
+                if revoked {
+                    PreparationDenial::Unauthorized
+                } else {
+                    PreparationDenial::Expired
+                },
+            );
+            if revoked {
+                denied(
+                    f.client()
+                        .command::<ClaimPreparation>(&f.target, identity()?, request(old.token))
+                        .await,
+                    PreparationDenial::Unauthorized,
+                );
+            }
+            assert_eq!(f.counts().await?, (1, 1));
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initial_preparation_receipt_rejects_corruption_and_cross_purpose_metadata() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let input = f.begin([223; 16]);
+        let staged = f
+            .client()
+            .command::<BeginStaging>(&f.target, identity()?, input.clone())
+            .await?;
+        let StagingReply::Granted(staged) = staged.output else {
+            return Err("staging grant absent".into());
+        };
+        f.client()
+            .command::<BindStaging>(&f.target, identity()?, check(staged.token))
+            .await?;
+        let original = f
+            .client()
+            .command::<BeginPreparation>(&f.target, identity()?, input.clone())
+            .await?;
+        let body = f
+            .handle
+            .query(0, 2048, |db| {
+                Ok(
+                    db.query_row("SELECT initial_preparation FROM pushes", [], |row| {
+                        row.get::<_, Vec<u8>>(0)
+                    })?,
+                )
+            })
+            .await?;
+        let mut corrupt = body.clone();
+        *corrupt.last_mut().ok_or("empty receipt")? ^= 1;
+        edit(&f, "DROP TRIGGER push_initial_preparation_immutable").await?;
+        edit(
+            &f,
+            &format!(
+                "UPDATE pushes SET initial_preparation=x'{}'",
+                hex::encode(corrupt)
+            ),
+        )
+        .await?;
+        assert!(
+            PreparationAdmission::load(&f.client(), &f.target, input.operation)
+                .await
+                .is_err()
+        );
+        edit(
+            &f,
+            &format!(
+                "UPDATE pushes SET initial_preparation=x'{}'",
+                hex::encode(body)
+            ),
+        )
+        .await?;
+        assert_eq!(
+            PreparationAdmission::load(&f.client(), &f.target, input.operation)
+                .await?
+                .ok_or("restored receipt absent")?
+                .receipt(),
+            original.receipt
+        );
+        // Keep scope, actor, operation, digest and MAC valid. Only the purpose
+        // differs, so a context mismatch cannot satisfy this assertion.
+        edit(&f, "UPDATE pushes SET initial_preparation=initial_staging").await?;
+        assert!(matches!(
+            PreparationAdmission::load(&f.client(), &f.target, input.operation).await,
+            Err(PreparationReceiptError::Codec(CodecError::Invalid(
+                "initial admission receipt purpose"
+            )))
+        ));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initial_preparation_receipt_does_not_invent_knowledge_for_denied_or_unexecuted_begin()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let mut input = f.begin([225; 16]);
+        input.actor = "outsider".into();
+        denied(
+            f.client()
+                .command::<BeginPreparation>(&f.target, identity()?, input.clone())
+                .await,
+            PreparationDenial::Unauthorized,
+        );
+        assert!(
+            PreparationAdmission::load(&f.client(), &f.target, input.operation)
+                .await?
+                .is_none()
+        );
+        let mut mutation = identity()?;
+        mutation.expires_at_ms = mutation.issued_at_ms + 1000;
+        let command = f
+            .client()
+            .prepare_command::<BeginPreparation>(&f.target, mutation, f.begin([226; 16]))
+            .await?;
+        let evidence = command.evidence().clone();
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Absent
+        ));
+        drop(command);
+        expire(mutation.expires_at_ms).await?;
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Expired
+        ));
+        // No domain record does not convert Expired into authoritative absence.
+        assert!(
+            PreparationAdmission::load(&f.client(), &f.target, [226; 16])
+                .await?
+                .is_none()
+        );
+        assert_eq!(f.counts().await?, (0, 0));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/publishing.rs b/crates/canopy-server/src/packs/publication/tests/publishing.rs
index 3f05e5a4..91d05b5d 100644
--- a/crates/canopy-server/src/packs/publication/tests/publishing.rs
+++ b/crates/canopy-server/src/packs/publication/tests/publishing.rs
@@ -206,10 +206,10 @@ pub(super) async fn state(handle: &CellHandle) -> Result<Vec<u8>> {
         }
         let policy_hash=*hash.finalize().as_bytes();
         hash.update(b"\0completed-root-and-operation-state\0");
-        let mut outcomes=connection.prepare("SELECT id,actor,request_digest,response_id,completion_digest,rejected,publication,publication_plan_digest,response_root FROM pushes ORDER BY id")?;
+        let mut outcomes=connection.prepare("SELECT id,actor,request_digest,response_id,completion_digest,rejected,publication,publication_plan_digest,response_root,initial_staging,initial_preparation FROM pushes ORDER BY id")?;
         let mut rows=outcomes.query([])?;
         while let Some(row)=rows.next()? {
-            let record=(row.get::<_,Vec<u8>>(0)?,row.get::<_,String>(1)?,row.get::<_,Vec<u8>>(2)?,row.get::<_,Option<Vec<u8>>>(3)?,row.get::<_,Option<Vec<u8>>>(4)?,row.get::<_,Option<i64>>(5)?,row.get::<_,Option<Vec<u8>>>(6)?,row.get::<_,Option<Vec<u8>>>(7)?,row.get::<_,Option<Vec<u8>>>(8)?);
+            let record=(row.get::<_,Vec<u8>>(0)?,row.get::<_,String>(1)?,row.get::<_,Vec<u8>>(2)?,row.get::<_,Option<Vec<u8>>>(3)?,row.get::<_,Option<Vec<u8>>>(4)?,row.get::<_,Option<i64>>(5)?,row.get::<_,Option<Vec<u8>>>(6)?,row.get::<_,Option<Vec<u8>>>(7)?,row.get::<_,Option<Vec<u8>>>(8)?,row.get::<_,Option<Vec<u8>>>(9)?,row.get::<_,Option<Vec<u8>>>(10)?);
             hash.update(&serde_json::to_vec(&record).map_err(|_|Error::Command("fixture root outcome hash"))?);
         }
         let mut operations=connection.prepare("SELECT id,actor,request_digest,artifact_operation,generation,attestation,attestation_digest FROM catalog_operations ORDER BY id")?;
@@ -738,19 +738,25 @@ async fn later_policy_changes_and_late_transaction_failures_publish_nothing() ->
     .await?;
     edit(&fixture,"UPDATE branch_rules SET version=2,require_pull_request=1 WHERE reference='refs/heads/main';").await?;
     reject(&fixture, valid.clone(), PreparationDenial::Conflict).await?;
-    edit(&fixture,"UPDATE branch_rules SET version=3,require_pull_request=0 WHERE reference='refs/heads/main'; CREATE TRIGGER forced_publication_failure BEFORE INSERT ON pushes BEGIN SELECT RAISE(ABORT,'forced late publication failure'); END;").await?;
+    edit(&fixture,"UPDATE branch_rules SET version=3,require_pull_request=0 WHERE reference='refs/heads/main'; CREATE TRIGGER forced_publication_failure BEFORE UPDATE OF publication ON pushes BEGIN SELECT RAISE(ABORT,'forced late publication failure'); END;").await?;
     let before = state(&fixture.handle).await?;
-    let failed = fixture
+    let command = fixture
         .client()
-        .command::<PublishCatalogRefs>(&fixture.target, identity()?, valid.clone())
-        .await;
-    assert!(failed.is_err(), "{failed:?}");
+        .prepare_command::<PublishCatalogRefs>(&fixture.target, identity()?, valid)
+        .await?;
+    let evidence = command.evidence().clone();
+    let failed = command.clone().execute().await;
+    assert!(
+        matches!(&failed, Err(InvocationError::NotStarted(error)) if format!("{error:?}").contains("forced late publication failure")),
+        "{failed:?}"
+    );
+    assert!(matches!(
+        fixture.client().resolve(&evidence).await?,
+        cellule_runtime::Resolution::Absent
+    ));
     assert_eq!(state(&fixture.handle).await?, before);
     edit(&fixture, "DROP TRIGGER forced_publication_failure;").await?;
-    fixture
-        .client()
-        .command::<PublishCatalogRefs>(&fixture.target, identity()?, valid)
-        .await?;
+    command.execute().await?;
     drop(graph.prepared);
     cleaned(graph.root.path(), &graph.budget).await?;
     drop(next.prepared);
@@ -933,7 +939,7 @@ async fn expired_and_claimed_proofs_and_mutable_publication_facts_fail_closed()
         "UPDATE pushes SET publication=zeroblob(53)",
         "UPDATE pushes SET publication_plan_digest=zeroblob(32)",
         "UPDATE pushes SET actor='outsider'",
-        "INSERT OR REPLACE INTO pushes SELECT id,actor,request_digest,options,response_id,rejected,rejection_reason,publication,publication_plan_digest FROM pushes",
+        "INSERT OR REPLACE INTO pushes SELECT * FROM pushes",
         "INSERT OR REPLACE INTO catalog_generations SELECT * FROM catalog_generations WHERE generation=1",
     ] {
         assert!(edit(&fixture, sql).await.is_err(), "{sql}");
diff --git a/crates/canopy-server/src/server/catalog_initialization.rs b/crates/canopy-server/src/server/catalog_initialization.rs
index e58ceeed..bd4c7175 100644
--- a/crates/canopy-server/src/server/catalog_initialization.rs
+++ b/crates/canopy-server/src/server/catalog_initialization.rs
@@ -6,10 +6,10 @@ use crate::{
         metadata::MetadataLimits,
         publication::{
             BeginPreparation, BeginRequest, CatalogPreparation, CheckInitializedCatalog,
-            ClaimPreparation, DEFAULT_LEASE_MS, GenerationFact, InitializationReply, LeaseCheck,
-            LeaseRequest, MaintenanceRequest, PreparationBaseResolver, PreparationDenial,
-            PreparationReply, PreparationToken, PublicationError, RegisteredRootRecovery,
-            TerminalReleaseReply,
+            CheckPreparation, ClaimPreparation, DEFAULT_LEASE_MS, GenerationFact,
+            InitializationReply, LeaseCheck, LeaseRequest, MaintenanceRequest,
+            PreparationAdmission, PreparationBaseResolver, PreparationDenial, PreparationReply,
+            PreparationToken, PublicationError, RegisteredRootRecovery, TerminalReleaseReply,
         },
     },
 };
@@ -129,6 +129,55 @@ pub(super) async fn ensure(
                 },
             )
             .await?
+    } else if let Some(admission) =
+        PreparationAdmission::load(&client, target, input.operation).await?
+    {
+        if admission.request() != &input {
+            return Err(Error::Command("initialization admission context differs").into());
+        }
+        let original = admission.lease();
+        let check = LeaseCheck {
+            token: original.token,
+            actor: owner.into(),
+        };
+        // The first accepted Begin is permanent knowledge. Its recorded clock
+        // grants no custody; query the exact original attempt under today's
+        // authority before reusing it. Never submit another Begin to replace
+        // the known receipt merely because a transport observer disappeared.
+        let current = if original.token.owner == maintenance.owner {
+            client
+                .query::<CheckPreparation>(target, Some(admission.receipt()), check.clone())
+                .await?
+                .output
+        } else {
+            None
+        };
+        if let Some(current) = current {
+            if current.token != original.token
+                || current.base != original.base
+                || current.format != original.format
+            {
+                return Err(Error::Command("initialization admission result differs").into());
+            }
+            cellule_runtime::Committed {
+                output: PreparationReply::Granted(Box::new(original)),
+                receipt: admission.receipt(),
+            }
+        } else {
+            // An explicit Claim can recover a reaped original admission. If a
+            // different successor exists, Claim refuses this old token rather
+            // than treating that successor as the original command's result.
+            client
+                .command::<ClaimPreparation>(
+                    target,
+                    super::mutation_identity()?,
+                    LeaseRequest {
+                        check,
+                        lease_ms: DEFAULT_LEASE_MS,
+                    },
+                )
+                .await?
+        }
     } else {
         match client
             .command::<BeginPreparation>(target, super::mutation_identity()?, input.clone())
diff --git a/crates/canopy-server/tests/multi_server/workspace.rs b/crates/canopy-server/tests/multi_server/workspace.rs
index f11a3ca9..8605ab16 100644
--- a/crates/canopy-server/tests/multi_server/workspace.rs
+++ b/crates/canopy-server/tests/multi_server/workspace.rs
@@ -135,7 +135,7 @@ async fn new_repositories_bootstrap_the_production_packed_catalog_before_becomin
         let target = canopy_server::repository_target(tenant, application, *repository.as_bytes())?;
         server.shutdown().await?;
         let root = repository_root(&layout, &target, &files.path().join("original.sqlite")).await?;
-        let (catalog, refs, allocation) = {
+        let (catalog, refs, allocation, admission) = {
             let connection = root.connection()?;
             for table in [
                 "objects",
@@ -187,7 +187,13 @@ async fn new_repositories_bootstrap_the_production_packed_catalog_before_becomin
                 |row| row.get::<_, i64>(0),
             )?;
             assert_eq!(allocation, 1);
-            (catalog, refs, allocation)
+            let admission: Vec<u8> =
+                connection.query_row("SELECT initial_preparation FROM pushes", [], |row| {
+                    row.get(0)
+                })?;
+            assert!(!admission.is_empty());
+            assert!(admission.len() <= 1024);
+            (catalog, refs, allocation, admission)
         };
         drop(root);
         let mut decoder = BoundedDecoder::new(&catalog, 256)?;
@@ -235,6 +241,11 @@ async fn new_repositories_bootstrap_the_production_packed_catalog_before_becomin
         let root = repository_root(&layout, &target, &files.path().join("restored.sqlite")).await?;
         {
             let connection = root.connection()?;
+            assert_eq!(
+                connection.query_row("SELECT initial_preparation FROM pushes", [], |row| row
+                    .get::<_, Vec<u8>>(0))?,
+                admission
+            );
             assert_eq!(
                 connection.query_row(
                     "SELECT artifact_sequence FROM repository_identity WHERE singleton=1",
diff --git a/docs/design/bound-preparation-dispatch.md b/docs/design/bound-preparation-dispatch.md
index 7a8a37c7..d38a77af 100644
--- a/docs/design/bound-preparation-dispatch.md
+++ b/docs/design/bound-preparation-dispatch.md
@@ -1,6 +1,6 @@
 # Exact bound preparation command ownership
 
-Long bound preparations and owner takeover need an exact recovery path for ClaimPreparation and RenewPreparation. ReadyPreparation::claim and PreparationSession::ready_renew prepare those SDK commands before admission to the existing PublicationCoordinator. They reuse LeaseCheck, LeaseRequest, PreparationToken, independent generation pins and the same coordinator job, actor queue and command evidence. The private request is boxed so its exact command/context does not enlarge every ReadyPublication value. No schema, command ID, outbox representation or compatibility adapter is added.
+Long bound preparations and owner takeover need an exact recovery path for ClaimPreparation and RenewPreparation. ReadyPreparation::claim and PreparationSession::ready_renew prepare those SDK commands before admission to the existing PublicationCoordinator. They reuse LeaseCheck, LeaseRequest, PreparationToken, independent generation pins and the same coordinator job, actor queue and command evidence. The private request is boxed so its exact command/context does not enlarge every ReadyPublication value. This dispatcher adds no schema, command ID, outbox representation or compatibility adapter. The later [first-admission receipt](initial-preparation-receipts.md) adds one bounded field to the existing logical request row and lets Claim recover a reaped original admission; it does not make these later command snapshots durable.
 
 ## Admission and recovery
 
diff --git a/docs/design/initial-preparation-receipts.md b/docs/design/initial-preparation-receipts.md
new file mode 100644
index 00000000..702c56fa
--- /dev/null
+++ b/docs/design/initial-preparation-receipts.md
@@ -0,0 +1,29 @@
+# First catalog preparation admission
+
+A lost Begin reply must not erase knowledge of an accepted preparation when the SDK mutation identity expires or the process loses its local database. `PreparationAdmission` retains the first accepted Begin result independently of the operation's current custody. This is an incremental part of the hard cutover; it does not close pre-dispatch, denied Begin or subsequent Claim/Renew recovery.
+
+## Shared bounded representation
+
+Preparation and [staging admission](initial-staging-receipts.md) use one private `InitialAdmission` record, authenticated envelope, query, original-result lookup and restart-token verifier. Each kind has a private column, purpose and typed result validator. Staging retains its existing representation and exact admitted-sequence check. Preparation uses `pushes.initial_preparation`, bounded to 1 KiB. No table, durable queue or per-object metadata is added.
+
+The record binds tenant/application, exact Begin request, actual admitted SDK identity/digest and `Recorded` reply/commit sequence. The receipt sequence comes from the executing command, rather than being inferred from the attempt token. Begin can observe an existing preparation or bound staging attempt, so its receipt can have a later sequence than the attempt. Different SDK identities observing that same attempt cannot settle their results using the first command's receipt.
+
+The receiver writes the first receipt after domain admission in the same Cell transaction. Namespace allocation, operation/pin writes, receipt encoding and SDK acceptance either commit together or roll back together. Immutable SQL guards prevent changing, deleting or replacing the initial record. Subsequent Begin, Claim, renewal, completion and reaping preserve first-admission knowledge. Two kinds can coexist in the same logical request row without replacing each other's receipt.
+
+Admission-only rows remain compatible with pristine initialization and matching compaction requests. Terminal or conflicting outcomes still refuse publication/recreation. Current command codecs are Begin 11/2, Claim 12/2, compaction 22/2 and initialization 31/3. The shared registry derives descriptors from these typed commands; no old contract is retained for compatibility.
+
+## Knowledge and custody
+
+`PreparationAdmission::load` performs an indexed logical request lookup on an authoritative durable Cell head. MAC, purpose, target, actor, operation and digest must match. Corrupt or mismatched metadata is an error, never absence. `original` additionally requires the exact original SDK stamp/digest and incarnation. Its result uses the original receipt even after SDK expiry and fresh-owner restore. These trusted service queries grant no product Read, upload or write permission.
+
+Recorded timestamps never refresh a session deadline. Current Write, exact operation/pin, expiry and a fresh query remain necessary for preparation factories. Startup compares the recorded owner with its actual current maintenance fence before considering reuse. If that fence still matches, it queries fresh custody at the original receipt watermark and checks the original token/base/format before opening the ordinary resolver.
+
+The historical base descriptor inside a receipt is evidence of the original reply, not a new artifact retention root. Current independent pins determine preparation retention. Once an attempt is reaped, receipt lookup does not download the old base, and restart Claim selects the current catalog. Typed collection and backup must distinguish this historical knowledge from live custody; retaining every old base merely because its reply is retained would defeat generation reclamation.
+
+When no final initialization has been registered, startup looks up first-admission knowledge before another Begin. An expired or previous-owner original can be explicitly claimed. If its operation was reaped or aborted, Claim authenticates the exact old receipt and token, checks current Write, logical availability and both quotas, then allocates a new namespace/pin under the actual executing fence and sequence. It selects the current catalog floor and never restores the old pin or grants access to expired artifacts. A different active successor refuses an old Claim. Late restart SQL failure leaves the original Claim's SDK resolution absent and all allocation/custody writes rolled back.
+
+## Qualification and remaining work
+
+Seven SHA-1/SHA-256 test families cover actual receipt persistence, distinct receipt/attempt sequences for an already-bound staging attempt, first-result immutability, late insert/update rollback and exact retry, cold restore after deleting SQLite, real SDK expiry, actual new-owner Claim, reaping, forged restart tokens, completed-request refusal, Write revocation, expired custody, corrupt MACs, cross-purpose metadata and absence of invented knowledge for denied/unexecuted Begin. Actual production HTTP creation and fresh-disk restore additionally retain the identical bounded admission record alongside certified initialization and terminal retirement.
+
+The first accepted Begin record is not an intent journal. It cannot reconstruct an unexecuted or denied command after its original prepared identity is lost. Raw competing Begin identities and later Claim/Renew still need durable original snapshots and results beyond SDK expiry. A successor Claim with a lost reply is not resolved by this initial receipt; startup fails the old-token Claim rather than attributing that successor to the original Begin. Complete registered custody-command recovery, orphan service reconstruction and retained-input adoption remain next work. Production producer/reader conversion, final schema removal, typed collection/backup/isolated restore and full repository/team capacity qualification remain mandatory before publication.
diff --git a/docs/design/initial-staging-receipts.md b/docs/design/initial-staging-receipts.md
index 1cef7e25..16f730ed 100644
--- a/docs/design/initial-staging-receipts.md
+++ b/docs/design/initial-staging-receipts.md
@@ -6,6 +6,8 @@ A Begin acknowledgement can be lost even though its input lease committed. The S
 
 The first accepted Begin stores a purpose-specific authenticated record in `pushes.initial_staging`. This reuses the existing logical request row, `CertificateEnvelope`, admitted mutation `Stamp` and `Recorded` result codec. It adds no queue, table or per-object metadata. The blob is at most 1 KiB and contains the tenant/application, exact Begin request, actual SDK identity/digest, original sequence and granted result. The original lease token includes the admitting incarnation, owner fence, attempt and creating namespace.
 
+The private record, query, MAC decoding, original-result lookup and restart-token verifier are now shared with [first catalog preparation admission](initial-preparation-receipts.md). Each kind retains a separate purpose, column and typed result validator. Staging's original wire representation and admitted-sequence rule are preserved.
+
 The receiver records the result in the same Cell transaction that allocates the namespace and inserts the operation and independent lease. A late encoding or SQL failure rolls back all of those writes and SDK acceptance. SQL guards retain the first receipt and forbid mutation, replacement or deletion. Ordinary expiry/reaping may remove custody rows without removing admission knowledge.
 
 Root completion updates this pending logical request row using its actor/digest and null completion fields as conditions. It preserves admission metadata while recording the terminal selection. Joint and ref-free completion share the existing result builder. A matching admission-only row does not conflict with compaction, and admission-only rows do not make an otherwise empty repository non-pristine for initialization. Completed or unrelated outcomes retain their existing conflict checks.
diff --git a/docs/design/mandatory-publication-registration.md b/docs/design/mandatory-publication-registration.md
index 32c95ebc..5b453fb2 100644
--- a/docs/design/mandatory-publication-registration.md
+++ b/docs/design/mandatory-publication-registration.md
@@ -20,7 +20,7 @@ Use recovery purpose `canopy.publication-command-recovery.v4\0` and these comman
 
 | Command | ID | Codec |
 | --- | --- | --- |
-| InitializeCatalogRefs | 31 | 2 |
+| InitializeCatalogRefs | 31 | 3 |
 | RegisterRefPolicyPage | 33 | 2 |
 | CompleteRootPush | 36 | 2 |
 | CompleteRootOutcome | 38 | 3 |
@@ -37,6 +37,8 @@ Live factories persist their exact bundle, then bind it into `ReadyBoundRecovery
 
 Pending startup queries the current indexed operation/pin binding before issuing Begin. A recovered positive verifies the original empty catalog/directory/ref roots. Only a known original Stale/Expired final denial permits Claim of that observed attempt; other uncertainty propagates. Ready restoration observes the retained initialization fact without creating a new attempt.
 
+Without a registered final, pending startup also recovers the [first accepted preparation admission](initial-preparation-receipts.md) before another Begin. Its original receipt is durable independently of SDK expiry, while current owner/custody are checked separately. This does not supply the missing original intent or subsequent Claim/Renew journal.
+
 Cold initialization performs no new preparation or native work. After authoritative SDK absence it restores the exact original bytes and lets the final receiver atomically check actual owner, Admin, live pin, certificate/checkpoint and pristine roots. Requiring a fresh Write-dependent session first would prevent an expired or revoked original from recording its definitive denial. Live bound dispatch still checks its original shared clock/fence. Known journal outcomes retain their original sequence and receipt even after SDK expiry, owner loss, permission revocation and body loss; they grant no current write or read capability.
 
 This closes final-command registration and reconstruction only. Exact initial Begin/Claim/Renew and failure before final registration still need durable integration. The local typed [terminal retirement protocol](terminal-publication-retention.md) now verifies its complete empty catalog/directory/ref graph and moves the same original certificate/journal/release receipt into the shared immutable archive before deleting the exact pin. Positive startup discovers the original closed attempt through the immutable initialization fact’s exact pin identity and retires it before serving. A denied initialization retires only after its active binding closes; a successor keeps its independent pin. Unknown attempts remain protected. Background-service reconstruction of older orphan attempts remains part of complete startup integration. Include the immutable initialization roots, command metadata and receipts in typed collection, backup and isolated restore.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 376a8f50..c23fc10a 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -6,6 +6,18 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## First accepted preparation admission checkpoint
+
+The local cutover now retains the first accepted `BeginPreparation` in the existing logical request row, using the same private bounded admission record, MAC, `Stamp` and `Recorded` result as staging. The two receipt kinds have separate purposes, columns and validators. Preparation records the actual command sequence, which can differ from the attempt sequence when Begin observes an already-bound staging attempt. Immutable SQL guards retain the first result through later admission, Claim, completion and reaping. Receipt encoding or the final insert/update failing rolls back allocation, custody and SDK acceptance together.
+
+Pending initialization looks up this original admission before another Begin. Reuse requires the actual current owner fence and a fresh custody query at the original receipt; historical clocks grant no lease. Explicit Claim can authenticate and recreate a reaped original operation using a new namespace/pin under the executing owner and current catalog floor. It cannot displace an active successor or recreate a completed logical outcome. Admission-only rows are accepted by pristine initialization and matching compaction; current codecs are 11/2, 12/2, 22/2 and 31/3. Source hashing includes both shared and preparation-specific receipt implementations. See the [first preparation admission contract](design/initial-preparation-receipts.md).
+
+Seven new SHA-1/SHA-256 families pass focused qualification. They cover actual receipt sequences, an existing bound staging attempt, first-result immutability, insert/update rollback and exact retry, deleting local SQLite before fresh-owner restoration, real SDK expiry, reaping, forged tokens, completed-request refusal, revoked/expired custody, MAC corruption, purpose separation and no invented knowledge for denied or unexecuted Begin. The first broader audit finds old outcome-count assumptions and a late-failure trigger attached to INSERT rather than the current UPDATE. The fixture corrections count selected outcomes, preserve complete state hashing including both initial receipts, and require the actual injected error, SDK absence and exact original retry. The source-independent purpose test keeps scope/actor/operation/digest/MAC valid and varies only the purpose.
+
+Final frozen-source qualification passes all **271 publication tests** in 188.32 seconds and all **three actual production workspace/startup tests** in 3.97 seconds: **274 unique focused Rust cases**. Workspace/all-target Clippy passes with warnings denied in 105 seconds; the server binary builds in 34.71 seconds. Formatting/diff, 418 unchanged Rust source hashes, 41 checked local documentation links, protected original index/archive and five-manifest/six-lock-entry SDK pins pass. The original missing-receipt regression, pristine-state integration failures and subsequent fixture failures are retained in `/tmp/canopy-preparation-admission-*.log`. Proof is `/tmp/canopy-preparation-admission-validation.json`. These checks do not qualify the entire workspace runtime, provider compatibility, full histories or team capacity on this partial cutover.
+
+This remains an unpublished, unreleasable checkpoint. Denied Begin, competing raw Begin identities, pre-dispatch process loss and subsequent Claim/Renew still need durable original snapshots/results. A lost successor Claim is not attributed to the original Begin. Full production producer/reader conversion and final DDL removal, typed collection/backup/isolated restore, resource containment, continuous maintenance, accelerated reads/physical rewriting and full-history/10,000-developer capacity remain mandatory. Historical capacity results below do not qualify this increment.
+
 ## Production hard cutover started locally
 
 The isolated `codex/packed-production-cutover` branch is aligned with merged PR #33 at `9438bb865959fb975d5349ba8b9908b461653821`. Its first production change wraps the existing `RootPurpose` at the unchanged `canopy-root-v1.json` key in the required `canopy-pack-v1` envelope. There is no legacy decoder. The root remains bounded to 4 KiB, including envelope overhead. Encoding borrows the original purpose and bounds source/pin strings before serialization. Reservations and completion still use the original conditional create/ETag CAS.

From dcef9c89d49cdf851e8d936cb3684d90b9fec0f1 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sat, 3 Oct 2026 23:20:34 -0700
Subject: [PATCH 07/55] Register exact custody intents before namespace
 admission

Persist original SDK snapshots before Begin and retain positive and denied
custody phases atomically with domain execution. Reuse the typed domain
receivers, recorded receipts, namespace allocator and independent pins.
Discover pending initialization and successor grants after cold restore.

Unbind raw custody commands in production; explicit qualification fixtures
retain domain receivers. Keep this partial cutover local pending service
conversion, compact history archival and full capacity qualification.
---
 crates/canopy-server/src/lib.rs               |   3 +
 .../src/packs/publication/commands.rs         |   6 +-
 .../src/packs/publication/custody/codec.rs    | 196 +++++
 .../src/packs/publication/custody/commands.rs | 162 ++++
 .../src/packs/publication/custody/mod.rs      | 544 ++++++++++++++
 .../src/packs/publication/mod.rs              |  14 +-
 .../src/packs/publication/registry.rs         |  17 +-
 .../src/packs/publication/schema.sql          |  33 +
 .../src/packs/publication/staging.rs          |   6 +-
 .../src/packs/publication/tests.rs            |  23 +
 .../src/packs/publication/tests/custody.rs    | 690 ++++++++++++++++++
 .../publication/tests/durable_recovery.rs     |   8 +-
 .../src/server/catalog_initialization.rs      | 215 +++---
 .../tests/multi_server/workspace.rs           |  34 +-
 .../design/durable-custody-command-intents.md |  54 ++
 docs/design/initial-preparation-receipts.md   |   4 +-
 docs/design/initial-staging-receipts.md       |   2 +
 .../mandatory-publication-registration.md     |   6 +-
 .../large-repository-implementation-status.md |  12 +
 19 files changed, 1910 insertions(+), 119 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/custody/codec.rs
 create mode 100644 crates/canopy-server/src/packs/publication/custody/commands.rs
 create mode 100644 crates/canopy-server/src/packs/publication/custody/mod.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/custody.rs
 create mode 100644 docs/design/durable-custody-command-intents.md

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index b2261469..42eb2545 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -262,6 +262,9 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/staging_service.rs"));
                 source.update(include_bytes!("packs/publication/staging_receipt.rs"));
                 source.update(include_bytes!("packs/publication/admission_receipt.rs"));
+                source.update(include_bytes!("packs/publication/custody/mod.rs"));
+                source.update(include_bytes!("packs/publication/custody/codec.rs"));
+                source.update(include_bytes!("packs/publication/custody/commands.rs"));
                 source.update(include_bytes!("packs/publication/preparation_receipt.rs"));
                 source.update(include_bytes!("packs/publication/coordinator.rs"));
                 source.update(include_bytes!("packs/publication/coordinator/policy.rs"));
diff --git a/crates/canopy-server/src/packs/publication/commands.rs b/crates/canopy-server/src/packs/publication/commands.rs
index 5f455e03..5ff1d83c 100644
--- a/crates/canopy-server/src/packs/publication/commands.rs
+++ b/crates/canopy-server/src/packs/publication/commands.rs
@@ -224,7 +224,7 @@ pub struct ClaimPreparation;
 impl Command for ClaimPreparation {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 12;
-    const CODEC_VERSION: u32 = 2;
+    const CODEC_VERSION: u32 = 3;
     type Input = LeaseRequest;
     type Output = PreparationReply;
     fn execute(
@@ -242,7 +242,9 @@ impl Command for ClaimPreparation {
             return Ok(denied(PreparationDenial::Unauthorized));
         };
         let Some(existing) = load(context, check.token)? else {
-            if !super::preparation_receipt::restart_matches(context, &check)? {
+            if !super::preparation_receipt::restart_matches(context, &check)?
+                && !super::custody::restart_matches(context, &check, false)?
+            {
                 return Ok(denied(PreparationDenial::Missing));
             }
             let begin = BeginRequest {
diff --git a/crates/canopy-server/src/packs/publication/custody/codec.rs b/crates/canopy-server/src/packs/publication/custody/codec.rs
new file mode 100644
index 00000000..82128416
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/custody/codec.rs
@@ -0,0 +1,196 @@
+use super::*;
+use crate::packs::directory::index::codec::fixed as wire_fixed;
+
+impl WireValue for CustodyAction {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        match self {
+            Self::BeginPreparation(r) => {
+                e.write_u8(0)?;
+                r.encode(e)
+            }
+            Self::ClaimPreparation(r) => {
+                e.write_u8(1)?;
+                r.encode(e)
+            }
+            Self::RenewPreparation(r) => {
+                e.write_u8(2)?;
+                r.encode(e)
+            }
+            Self::BeginStaging(r) => {
+                e.write_u8(3)?;
+                r.encode(e)
+            }
+            Self::ClaimStaging(r) => {
+                e.write_u8(4)?;
+                r.encode(e)
+            }
+            Self::RenewStaging(r) => {
+                e.write_u8(5)?;
+                r.encode(e)
+            }
+            Self::BindStaging(r) => {
+                e.write_u8(6)?;
+                r.encode(e)
+            }
+        }
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        Ok(match d.read_u8()? {
+            0 => Self::BeginPreparation(BeginRequest::decode(d)?),
+            1 => Self::ClaimPreparation(LeaseRequest::decode(d)?),
+            2 => Self::RenewPreparation(LeaseRequest::decode(d)?),
+            3 => Self::BeginStaging(BeginRequest::decode(d)?),
+            4 => Self::ClaimStaging(LeaseRequest::decode(d)?),
+            5 => Self::RenewStaging(LeaseRequest::decode(d)?),
+            6 => Self::BindStaging(LeaseCheck::decode(d)?),
+            _ => return Err(CodecError::Invalid("custody action purpose")),
+        })
+    }
+}
+impl WireValue for CustodyRequest {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.step > MAX_STEPS || (self.step == 0) != self.previous.is_none() {
+            return Err(CodecError::Invalid("custody predecessor step"));
+        }
+        e.write_bytes(DOMAIN)?;
+        e.write_u32(self.step)?;
+        e.write_bool(self.previous.is_some())?;
+        if let Some(previous) = self.previous {
+            e.write_bytes(&previous)?;
+        }
+        self.action.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != DOMAIN {
+            return Err(CodecError::Invalid("custody request purpose"));
+        }
+        let value = Self {
+            step: d.read_u32()?,
+            previous: if d.read_bool()? {
+                Some(wire_fixed(d)?)
+            } else {
+                None
+            },
+            action: CustodyAction::decode(d)?,
+        };
+        value.encode(&mut BoundedEncoder::new(INPUT_BYTES)?)?;
+        Ok(value)
+    }
+}
+impl WireValue for CustodyReply {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        match self {
+            Self::Preparation(reply) => {
+                e.write_u8(0)?;
+                reply.encode(e)
+            }
+            Self::Staging(reply) => {
+                e.write_u8(1)?;
+                reply.encode(e)
+            }
+        }
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        match d.read_u8()? {
+            0 => Ok(Self::Preparation(PreparationReply::decode(d)?)),
+            1 => Ok(Self::Staging(StagingReply::decode(d)?)),
+            _ => Err(CodecError::Invalid("custody reply purpose")),
+        }
+    }
+}
+impl WireValue for Header {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.operation == [0; 16]
+            || self.step > MAX_STEPS
+            || (self.step == 0) != self.previous.is_none()
+            || validate_component(&self.actor).is_err()
+        {
+            return Err(CodecError::Invalid("custody header identity"));
+        }
+        e.write_bytes(DOMAIN)?;
+        e.write_bytes(&self.tenant)?;
+        e.write_bytes(&self.application)?;
+        e.write_bytes(self.incarnation.as_bytes())?;
+        self.stamp.encode(e)?;
+        e.write_bytes(&self.repository)?;
+        e.write_bytes(&self.operation)?;
+        e.write_bytes(&self.request_digest)?;
+        e.write_text(&self.actor)?;
+        e.write_u32(self.step)?;
+        e.write_bool(self.previous.is_some())?;
+        if let Some(previous) = self.previous {
+            e.write_bytes(&previous)?;
+        }
+        e.write_bytes(&self.bundle_digest)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != DOMAIN {
+            return Err(CodecError::Invalid("custody header purpose"));
+        }
+        let value = Self {
+            tenant: wire_fixed(d)?,
+            application: wire_fixed(d)?,
+            incarnation: IncarnationId::from_bytes(wire_fixed(d)?),
+            stamp: Stamp::decode(d)?,
+            repository: wire_fixed(d)?,
+            operation: wire_fixed(d)?,
+            request_digest: wire_fixed(d)?,
+            actor: d.read_text()?.into(),
+            step: d.read_u32()?,
+            previous: if d.read_bool()? {
+                Some(wire_fixed(d)?)
+            } else {
+                None
+            },
+            bundle_digest: wire_fixed(d)?,
+        };
+        value.encode(&mut BoundedEncoder::new(CERTIFICATE_BYTES)?)?;
+        Ok(value)
+    }
+}
+impl WireValue for CustodyIntent {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.header()?;
+        self.request()?;
+        self.certificate.encode(e)?;
+        e.write_bytes(&self.snapshot.to_bytes()?)?;
+        e.write_bytes(&self.body)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            certificate: CertificateEnvelope::decode(d)?,
+            snapshot: PreparedCommandSnapshot::from_bytes(d.read_bytes()?)?,
+            body: d.read_bytes()?.to_vec(),
+        };
+        value.encode(&mut BoundedEncoder::new(INTENT_BYTES)?)?;
+        Ok(value)
+    }
+}
+
+pub(super) fn validate_phase(phase: &Recorded, request: &CustodyRequest) -> Result<(), CodecError> {
+    let reply: CustodyReply = phase.decode_reply()?;
+    if phase.rejected() != reply.rejected()
+        || request.action.staging() != matches!(reply, CustodyReply::Staging(_))
+    {
+        return Err(CodecError::Invalid("custody result purpose differs"));
+    }
+    let token = match reply {
+        CustodyReply::Preparation(PreparationReply::Granted(lease)) => {
+            lease.base.validate()?;
+            Some(lease.token)
+        }
+        CustodyReply::Staging(StagingReply::Granted(lease)) => Some(lease.token),
+        _ => None,
+    };
+    if let Some(token) = token {
+        let (repository, operation, digest, _) = request.action.identity();
+        if token.repository != repository
+            || token.operation != operation
+            || token.request_digest != digest
+            || token.attempt > phase.sequence()
+        {
+            return Err(CodecError::Invalid("custody grant binding differs"));
+        }
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/custody/commands.rs b/crates/canopy-server/src/packs/publication/custody/commands.rs
new file mode 100644
index 00000000..f14b164d
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/custody/commands.rs
@@ -0,0 +1,162 @@
+//! First-writer registration and domain result commit in the Repository Cell.
+use super::*;
+
+pub struct RegisterCustodyIntent;
+impl Command for RegisterCustodyIntent {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 41;
+    const CODEC_VERSION: u32 = 1;
+    type Input = CustodyIntent;
+    type Output = RootRecoveryReply;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        intent: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        let deny = |reason| Ok(CommandResult::Rejected(RootRecoveryReply::Denied(reason)));
+        let seed = super::super::attestation::seed(&context.sql(&SqlBatch {
+            statements: vec![seed_statement()],
+        })?)?;
+        let header = intent.validate(context.target(), &seed)?;
+        let request = intent.request()?;
+        let bytes = intent.encoded()?;
+        let previous = context.sql(&SqlBatch {
+            statements: vec![row_statement(header.operation, None), seed_statement()],
+        })?;
+        let previous = from_sets(&previous, context.target(), header.operation)?;
+        if let Some(previous) = &previous {
+            if previous.intent == intent {
+                // Exact knowledge is idempotent even after permission/owner loss.
+                return Ok(CommandResult::Success(RootRecoveryReply::Registered));
+            }
+            let old = previous.intent.header()?;
+            if old.step >= header.step
+                || previous.phase.is_none()
+                || old.step.checked_add(1) != Some(header.step)
+                || header.previous != Some(*blake3::hash(&previous.intent.encoded()?).as_bytes())
+                || old.actor != header.actor
+                || old.request_digest != header.request_digest
+                || old.repository != header.repository
+            {
+                return deny(PreparationDenial::Conflict);
+            }
+        } else if header.step != 0 || !request.action.begin() {
+            return deny(PreparationDenial::Missing);
+        }
+        if header.incarnation != context.owner_fence().incarnation {
+            return deny(PreparationDenial::Stale);
+        }
+        if intent.snapshot.evidence().identity().expires_at_ms <= now(context.now_ms())? {
+            return deny(PreparationDenial::Expired);
+        }
+        if super::super::commands::authorized(
+            context,
+            header.repository,
+            &header.actor,
+            TokenScope::Write,
+        )?
+        .is_none()
+        {
+            return deny(PreparationDenial::Unauthorized);
+        }
+        let pending = context.sql(&statement(
+            "SELECT count(*) FROM (SELECT operation FROM catalog_custody_commands WHERE phase IS NULL LIMIT ?1)",
+            vec![number(MAX_OPERATIONS)?],
+        ))?;
+        let Some([SqlValue::Integer(pending)]) = rows(&pending)?.first().map(Vec::as_slice) else {
+            return Err(Error::Command("custody pending count absent"));
+        };
+        if *pending >= MAX_OPERATIONS as i64 {
+            return deny(PreparationDenial::Capacity);
+        }
+        super::super::publish::changed(context.sql(&statement(
+            "INSERT INTO catalog_custody_commands(operation,step,incarnation,request_id,intent,phase) VALUES(?1,?2,?3,?4,?5,NULL)",
+            vec![blob(header.operation),number(u64::from(header.step))?,blob(header.incarnation.as_bytes()),
+                blob(intent.snapshot.evidence().identity().request_id.as_bytes()), SqlValue::Blob(bytes)],
+        ))?)?;
+        Ok(CommandResult::Success(RootRecoveryReply::Registered))
+    }
+}
+
+/// The only receiver of the new custody protocol. Domain methods reuse the
+/// existing allocator, pins, authorization and phase-specific validation.
+pub struct ExecuteCustody;
+impl Command for ExecuteCustody {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 42;
+    const CODEC_VERSION: u32 = 1;
+    type Input = CustodyRequest;
+    type Output = CustodyReply;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        request: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        let (_, operation, _, _) = request.action.identity();
+        let sets = context.sql(&SqlBatch {
+            statements: vec![
+                row_statement(operation, Some(request.step)),
+                seed_statement(),
+            ],
+        })?;
+        let saved = from_sets(&sets, context.target(), operation)?
+            .ok_or(Error::Command("custody command is not registered"))?;
+        let header = saved.intent.header()?;
+        let evidence = context
+            .mutation_evidence()
+            .ok_or(Error::Command("custody command lacks mutation evidence"))?;
+        if header.stamp != Stamp::of(&evidence)
+            || header.incarnation != evidence.incarnation()
+            || saved.intent.request()? != request
+            || saved.phase.is_some()
+        {
+            return Err(Error::Command(
+                "custody command differs from its original intent",
+            ));
+        }
+        let output = match request.action.clone() {
+            CustodyAction::BeginPreparation(input) => {
+                prep(BeginPreparation::execute(context, input)?)
+            }
+            CustodyAction::ClaimPreparation(input) => {
+                prep(ClaimPreparation::execute(context, input)?)
+            }
+            CustodyAction::RenewPreparation(input) => {
+                prep(RenewPreparation::execute(context, input)?)
+            }
+            CustodyAction::BeginStaging(input) => stage(BeginStaging::execute(context, input)?),
+            CustodyAction::ClaimStaging(input) => stage(ClaimStaging::execute(context, input)?),
+            CustodyAction::RenewStaging(input) => stage(RenewStaging::execute(context, input)?),
+            CustodyAction::BindStaging(input) => prep(BindStaging::execute(context, input)?),
+        };
+        let phase = Recorded::new(context.sequence(), output.rejected(), encode(&output, 512)?)?;
+        codec::validate_phase(&phase, &request)?;
+        let token = match &output {
+            CustodyReply::Preparation(PreparationReply::Granted(lease)) => Some(lease.token),
+            CustodyReply::Staging(StagingReply::Granted(lease)) => Some(lease.token),
+            _ => None,
+        };
+        let grant_incarnation = token.map_or(SqlValue::Null, |token| {
+            blob(token.owner.incarnation.as_bytes())
+        });
+        let grant_attempt = token
+            .map(|token| number(token.attempt))
+            .transpose()?
+            .unwrap_or(SqlValue::Null);
+        super::super::publish::changed(context.sql(&statement(
+            "UPDATE catalog_custody_commands SET phase=?1,granted_incarnation=?5,granted_attempt=?6 WHERE operation=?2 AND step=?3 AND intent=?4 AND phase IS NULL",
+            vec![SqlValue::Blob(encode(&phase, 1024)?),blob(operation),number(u64::from(request.step))?,SqlValue::Blob(saved.intent.encoded()?),grant_incarnation,grant_attempt],
+        ))?)?;
+        // Trusted denials commit the original phase alongside SDK acceptance;
+        // the private service normalizes them back to Rejected at its boundary.
+        Ok(CommandResult::Success(output))
+    }
+}
+fn prep(result: CommandResult<PreparationReply>) -> CustodyReply {
+    CustodyReply::Preparation(match result {
+        CommandResult::Success(r) | CommandResult::Rejected(r) => r,
+    })
+}
+fn stage(result: CommandResult<StagingReply>) -> CustodyReply {
+    CustodyReply::Staging(match result {
+        CommandResult::Success(r) | CommandResult::Rejected(r) => r,
+    })
+}
diff --git a/crates/canopy-server/src/packs/publication/custody/mod.rs b/crates/canopy-server/src/packs/publication/custody/mod.rs
new file mode 100644
index 00000000..d286c052
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/custody/mod.rs
@@ -0,0 +1,544 @@
+//! Exact custody commands, including the interval before an artifact namespace exists.
+//! This is command metadata, never an object inventory or a custody permission.
+use super::{
+    certificate::CertificateEnvelope,
+    recovery::{Stamp, phase::Recorded},
+    sql::*,
+    *,
+};
+use cellule_runtime::{
+    CellClient, CellTarget, Committed, InvocationError, MutationIdentity, PendingMutation,
+    PreparedCommandSnapshot, primitives::sql::SqlCell,
+};
+mod codec;
+mod commands;
+pub use commands::{ExecuteCustody, RegisterCustodyIntent};
+
+const INPUT_BYTES: u32 = 1024;
+const INTENT_BYTES: u32 = 4096;
+const MAX_STEPS: u32 = 65_535;
+const DOMAIN: &[u8] = b"canopy.custody-command-intent.v1\0";
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CustodyAction {
+    BeginPreparation(BeginRequest),
+    ClaimPreparation(LeaseRequest),
+    RenewPreparation(LeaseRequest),
+    BeginStaging(BeginRequest),
+    ClaimStaging(LeaseRequest),
+    RenewStaging(LeaseRequest),
+    BindStaging(LeaseCheck),
+}
+impl CustodyAction {
+    fn identity(&self) -> ([u8; 16], [u8; 16], [u8; 32], &str) {
+        match self {
+            Self::BeginPreparation(r) | Self::BeginStaging(r) => {
+                (r.repository, r.operation, r.request_digest, &r.actor)
+            }
+            Self::ClaimPreparation(r)
+            | Self::RenewPreparation(r)
+            | Self::ClaimStaging(r)
+            | Self::RenewStaging(r) => identity_of(&r.check),
+            Self::BindStaging(r) => identity_of(r),
+        }
+    }
+    fn staging(&self) -> bool {
+        matches!(
+            self,
+            Self::BeginStaging(_) | Self::ClaimStaging(_) | Self::RenewStaging(_)
+        )
+    }
+    fn begin(&self) -> bool {
+        matches!(self, Self::BeginPreparation(_) | Self::BeginStaging(_))
+    }
+}
+fn identity_of(check: &LeaseCheck) -> ([u8; 16], [u8; 16], [u8; 32], &str) {
+    (
+        check.token.repository,
+        check.token.operation,
+        check.token.request_digest,
+        &check.actor,
+    )
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CustodyReply {
+    Preparation(PreparationReply),
+    Staging(StagingReply),
+}
+impl CustodyReply {
+    fn rejected(&self) -> bool {
+        matches!(
+            self,
+            Self::Preparation(PreparationReply::Denied(_)) | Self::Staging(StagingReply::Denied(_))
+        )
+    }
+}
+
+/// Private ordinal/predecessor fields prevent a factory from replacing an
+/// unsettled head. Decoded values remain untrusted until receiver verification.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CustodyRequest {
+    step: u32,
+    previous: Option<[u8; 32]>,
+    action: CustodyAction,
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Header {
+    tenant: [u8; 16],
+    application: [u8; 16],
+    incarnation: IncarnationId,
+    stamp: Stamp,
+    repository: [u8; 16],
+    operation: [u8; 16],
+    request_digest: [u8; 32],
+    actor: String,
+    step: u32,
+    previous: Option<[u8; 32]>,
+    bundle_digest: [u8; 32],
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CustodyIntent {
+    certificate: CertificateEnvelope,
+    snapshot: PreparedCommandSnapshot,
+    body: Vec<u8>,
+}
+impl CustodyIntent {
+    fn request(&self) -> Result<CustodyRequest, CodecError> {
+        decode(&self.body, INPUT_BYTES)
+    }
+    fn header(&self) -> Result<Header, CodecError> {
+        self.certificate.data()
+    }
+    fn validate(&self, target: &CellTarget, seed: &[u8; 32]) -> cellule_runtime::Result<Header> {
+        let header = self.header()?;
+        let request = self.request()?;
+        let evidence = self.snapshot.evidence();
+        let (repository, operation, digest, actor) = request.action.identity();
+        if !self.certificate.authenticated(seed)
+            || header.tenant != *target.tenant().as_bytes()
+            || header.application != *target.application().as_bytes()
+            || crate::repository_target(target.tenant(), target.application(), repository)?
+                != *target
+            || evidence.target() != target
+            || header.incarnation != evidence.incarnation()
+            || header.stamp != Stamp::of(evidence)
+            || header.repository != repository
+            || header.operation != operation
+            || header.request_digest != digest
+            || header.actor != actor
+            || header.step != request.step
+            || header.previous != request.previous
+            || header.bundle_digest != bundle_digest(&self.snapshot, &self.body)?
+        {
+            return Err(Error::Command("custody intent binding differs"));
+        }
+        Ok(header)
+    }
+    fn encoded(&self) -> Result<Vec<u8>, CodecError> {
+        encode(self, INTENT_BYTES)
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum CustodyError {
+    #[error("custody command encoding failed")]
+    Codec(#[from] CodecError),
+    #[error("custody command binding failed")]
+    Capability(#[from] Error),
+    #[error("custody command query failed")]
+    Query(#[source] Box<InvocationError<Vec<SqlResultSet>>>),
+    #[error("custody command preparation failed")]
+    Preparation(#[source] Box<InvocationError<CustodyReply>>),
+    #[error("custody intent registration failed")]
+    Registration(#[source] Box<InvocationError<RootRecoveryReply>>),
+    #[error("custody command has an unsettled predecessor")]
+    Unsettled(Box<PendingMutation>),
+    #[error("custody command head differs")]
+    Context,
+}
+
+/// Retains the original SDK snapshot/body even if registration loses its reply.
+/// Registration must become discoverable before this command can execute.
+#[must_use]
+pub struct PreparedCustody {
+    intent: CustodyIntent,
+}
+#[derive(Clone)]
+pub struct RegisteredCustody {
+    intent: CustodyIntent,
+    phase: Option<Recorded>,
+}
+
+fn encode(value: &impl WireValue, limit: u32) -> Result<Vec<u8>, CodecError> {
+    let mut encoder = BoundedEncoder::new(limit)?;
+    value.encode(&mut encoder)?;
+    Ok(encoder.finish())
+}
+fn decode<T: WireValue>(bytes: &[u8], limit: u32) -> Result<T, CodecError> {
+    let mut decoder = BoundedDecoder::new(bytes, limit)?;
+    let value = T::decode(&mut decoder)?;
+    decoder.finish()?;
+    Ok(value)
+}
+fn bundle_digest(snapshot: &PreparedCommandSnapshot, body: &[u8]) -> Result<[u8; 32], CodecError> {
+    let mut hash = blake3::Hasher::new();
+    hash.update(DOMAIN);
+    let bytes = snapshot.to_bytes()?;
+    for part in [bytes.as_slice(), body] {
+        hash.update(&(part.len() as u64).to_be_bytes());
+        hash.update(part);
+    }
+    Ok(*hash.finalize().as_bytes())
+}
+fn seed_statement() -> SqlStatement {
+    SqlStatement {
+        sql: "SELECT push_cert_seed FROM repository_identity WHERE singleton=1".into(),
+        parameters: vec![],
+    }
+}
+fn row_statement(operation: [u8; 16], step: Option<u32>) -> SqlStatement {
+    match step {
+        Some(step) => SqlStatement {
+            sql: "SELECT step,incarnation,request_id,intent,phase FROM catalog_custody_commands WHERE operation=?1 AND step=?2".into(),
+            parameters: vec![blob(operation), SqlValue::Integer(i64::from(step))],
+        },
+        None => SqlStatement {
+            sql: "SELECT step,incarnation,request_id,intent,phase FROM catalog_custody_commands WHERE operation=?1 ORDER BY step DESC LIMIT 1".into(),
+            parameters: vec![blob(operation)],
+        },
+    }
+}
+fn from_sets(
+    sets: &[SqlResultSet],
+    target: &CellTarget,
+    operation: [u8; 16],
+) -> cellule_runtime::Result<Option<RegisteredCustody>> {
+    let Some(row) = rows(sets)?.first() else {
+        return Ok(None);
+    };
+    let [
+        SqlValue::Integer(step),
+        incarnation,
+        request_id,
+        SqlValue::Blob(bytes),
+        phase,
+    ] = row.as_slice()
+    else {
+        return Err(Error::Command("invalid custody command row"));
+    };
+    let intent: CustodyIntent = decode(bytes, INTENT_BYTES)?;
+    let seed =
+        super::attestation::seed(sets.get(1..).ok_or(Error::Command("custody seed absent"))?)?;
+    let header = intent.validate(target, &seed)?;
+    if i64::from(header.step) != *step
+        || header.operation != operation
+        || fixed::<16>(incarnation)? != *header.incarnation.as_bytes()
+        || fixed::<16>(request_id)? != *intent.snapshot.evidence().identity().request_id.as_bytes()
+    {
+        return Err(Error::Command("custody command row binding differs"));
+    }
+    let phase = match phase {
+        SqlValue::Null => None,
+        SqlValue::Blob(bytes) => Some(decode::<Recorded>(bytes, 1024)?),
+        _ => return Err(Error::Command("invalid custody command phase")),
+    };
+    if let Some(phase) = &phase {
+        codec::validate_phase(phase, &intent.request()?)?;
+    }
+    Ok(Some(RegisteredCustody { intent, phase }))
+}
+async fn load(
+    client: &CellClient,
+    target: &CellTarget,
+    operation: [u8; 16],
+    step: Option<u32>,
+) -> Result<Option<RegisteredCustody>, CustodyError> {
+    let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
+    let output = sql
+        .query(
+            None,
+            SqlBatch {
+                statements: vec![row_statement(operation, step), seed_statement()],
+            },
+        )
+        .await
+        .map_err(|error| CustodyError::Query(Box::new(error)))?;
+    Ok(from_sets(&output.output, target, operation)?)
+}
+impl PreparedCustody {
+    pub async fn prepare(
+        client: &CellClient,
+        target: &CellTarget,
+        action: CustodyAction,
+        identity: MutationIdentity,
+    ) -> Result<Self, CustodyError> {
+        let (repository, operation, digest, actor) = action.identity();
+        if crate::repository_target(target.tenant(), target.application(), repository)? != *target {
+            return Err(CustodyError::Context);
+        }
+        let head = load(client, target, operation, None).await?;
+        let (step, previous) = if let Some(head) = head {
+            let header = head.intent.header()?;
+            if header.repository != repository
+                || header.request_digest != digest
+                || header.actor != actor
+            {
+                return Err(CustodyError::Context);
+            }
+            if head.phase.is_none() {
+                return Err(CustodyError::Unsettled(Box::new(head.evidence().clone())));
+            }
+            (
+                header.step.checked_add(1).ok_or(CustodyError::Context)?,
+                Some(*blake3::hash(&head.intent.encoded()?).as_bytes()),
+            )
+        } else {
+            (0, None)
+        };
+        let request = CustodyRequest {
+            step,
+            previous,
+            action,
+        };
+        let command = client
+            .prepare_command::<ExecuteCustody>(target, identity, request)
+            .await
+            .map_err(|error| CustodyError::Preparation(Box::new(error)))?;
+        let snapshot = command.snapshot();
+        let body = command.input_bytes().to_vec();
+        let request: CustodyRequest = decode(&body, INPUT_BYTES)?;
+        let (repository, operation, request_digest, actor) = request.action.identity();
+        let header = Header {
+            tenant: *target.tenant().as_bytes(),
+            application: *target.application().as_bytes(),
+            incarnation: command.evidence().incarnation(),
+            stamp: Stamp::of(command.evidence()),
+            repository,
+            operation,
+            request_digest,
+            actor: actor.into(),
+            step,
+            previous,
+            bundle_digest: bundle_digest(&snapshot, &body)?,
+        };
+        let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
+        let output = sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![seed_statement()],
+                },
+            )
+            .await
+            .map_err(|error| CustodyError::Query(Box::new(error)))?;
+        let seed = super::attestation::seed(&output.output)?;
+        let intent = CustodyIntent {
+            certificate: CertificateEnvelope::seal(&header, &seed)?,
+            snapshot,
+            body,
+        };
+        intent.encoded()?;
+        Ok(Self { intent })
+    }
+    pub fn evidence(&self) -> &PendingMutation {
+        self.intent.snapshot.evidence()
+    }
+    #[cfg(test)]
+    pub(super) fn command_for_test(
+        &self,
+        client: &CellClient,
+    ) -> cellule_runtime::Result<cellule_runtime::PreparedCommand<ExecuteCustody>> {
+        client.restore_command::<ExecuteCustody>(
+            self.intent.snapshot.clone(),
+            self.intent.body.clone(),
+        )
+    }
+    #[cfg(test)]
+    pub(super) fn intent_for_test(&self) -> CustodyIntent {
+        self.intent.clone()
+    }
+    pub async fn register(
+        &self,
+        client: &CellClient,
+        identity: MutationIdentity,
+    ) -> Result<RegisteredCustody, CustodyError> {
+        let header = self.intent.header()?;
+        let target = self.evidence().target();
+        if let Some(saved) = load(client, target, header.operation, Some(header.step)).await? {
+            return if saved.intent == self.intent {
+                Ok(saved)
+            } else {
+                Err(CustodyError::Context)
+            };
+        }
+        // The domain pointer proves registration even after the registration
+        // identity expires. Absence after an uncertain reply proves nothing.
+        let result = client
+            .command::<RegisterCustodyIntent>(target, identity, self.intent.clone())
+            .await;
+        let saved = load(client, target, header.operation, Some(header.step)).await?;
+        if let Some(saved) = saved {
+            if saved.intent == self.intent {
+                return Ok(saved);
+            }
+            return Err(CustodyError::Context);
+        }
+        match result {
+            Err(error) => Err(CustodyError::Registration(Box::new(error))),
+            Ok(_) => Err(CustodyError::Context),
+        }
+    }
+}
+impl RegisteredCustody {
+    /// Trusted private service inventory; loading does not grant current Write.
+    pub async fn load_latest(
+        client: &CellClient,
+        target: &CellTarget,
+        operation: [u8; 16],
+    ) -> Result<Option<Self>, CustodyError> {
+        load(client, target, operation, None).await
+    }
+    pub fn evidence(&self) -> &PendingMutation {
+        self.intent.snapshot.evidence()
+    }
+    pub fn action(&self) -> Result<CustodyAction, CodecError> {
+        Ok(self.intent.request()?.action)
+    }
+    pub fn settled(&self) -> bool {
+        self.phase.is_some()
+    }
+    pub async fn recover_preparation(
+        &self,
+        client: &CellClient,
+    ) -> Result<Committed<PreparationReply>, InvocationError<PreparationReply>> {
+        project(self.recover(client).await, |reply| match reply {
+            CustodyReply::Preparation(reply) => Some(reply),
+            _ => None,
+        })
+    }
+    pub async fn recover_staging(
+        &self,
+        client: &CellClient,
+    ) -> Result<Committed<StagingReply>, InvocationError<StagingReply>> {
+        project(self.recover(client).await, |reply| match reply {
+            CustodyReply::Staging(reply) => Some(reply),
+            _ => None,
+        })
+    }
+    pub async fn recover(
+        &self,
+        client: &CellClient,
+    ) -> Result<Committed<CustodyReply>, InvocationError<CustodyReply>> {
+        let evidence = self.evidence();
+        let recover = async {
+            let header = self.intent.header()?;
+            let current = load(
+                client,
+                evidence.target(),
+                header.operation,
+                Some(header.step),
+            )
+            .await
+            .map_err(|_| Error::Command("custody phase query failed"))?
+            .ok_or(Error::Command("custody intent disappeared"))?;
+            if current.intent != self.intent {
+                return Err(Error::Command("custody recovery binding differs"));
+            }
+            if let Some(phase) = current.phase {
+                return Ok(Some(phase.committed(evidence)?));
+            }
+            Ok::<_, Error>(None::<Committed<CustodyReply>>)
+        }
+        .await;
+        // Keep original evidence on storage/codec failures, rather than
+        // misclassifying them as permission to execute or replace the head.
+        match recover {
+            Ok(Some(known)) => return normalize(known),
+            Ok(None) => {}
+            Err(_) => return Err(InvocationError::Pending(Box::new(evidence.clone()))),
+        }
+        if super::exact::known::<ExecuteCustody>(client, evidence, 512)
+            .await?
+            .is_some()
+        {
+            // Atomic receiver publication requires a domain phase whenever SDK
+            // reports acceptance. Missing application knowledge is corruption.
+            return Err(InvocationError::Pending(Box::new(evidence.clone())));
+        }
+        let command = client
+            .restore_command::<ExecuteCustody>(
+                self.intent.snapshot.clone(),
+                self.intent.body.clone(),
+            )
+            .map_err(InvocationError::NotStarted)?;
+        normalize(command.execute().await?)
+    }
+}
+fn normalize(
+    committed: Committed<CustodyReply>,
+) -> Result<Committed<CustodyReply>, InvocationError<CustodyReply>> {
+    if committed.output.rejected() {
+        Err(InvocationError::Rejected(Box::new(committed)))
+    } else {
+        Ok(committed)
+    }
+}
+
+fn project<T>(
+    result: Result<Committed<CustodyReply>, InvocationError<CustodyReply>>,
+    output: impl FnOnce(CustodyReply) -> Option<T>,
+) -> Result<Committed<T>, InvocationError<T>> {
+    let committed = |value: Committed<CustodyReply>| {
+        let receipt = value.receipt;
+        output(value.output)
+            .map(|output| Committed { output, receipt })
+            .ok_or(InvocationError::InvalidPublishedResult {
+                receipt,
+                source: Box::new(Error::Command("custody reply purpose differs")),
+            })
+    };
+    match result {
+        Ok(value) => committed(value),
+        Err(InvocationError::Rejected(value)) => {
+            Err(InvocationError::Rejected(Box::new(committed(*value)?)))
+        }
+        Err(InvocationError::Pending(evidence)) => Err(InvocationError::Pending(evidence)),
+        Err(InvocationError::NotStarted(error)) => Err(InvocationError::NotStarted(error)),
+        Err(InvocationError::InvalidPublishedResult { receipt, source }) => {
+            Err(InvocationError::InvalidPublishedResult { receipt, source })
+        }
+    }
+}
+
+/// A recorded grant can authorize allocating a *new* attempt after the old row
+/// was reaped. It never reinstates the old namespace, generation pin or clock.
+pub(super) fn restart_matches(
+    context: &CommandContext<'_, '_>,
+    check: &LeaseCheck,
+    staging: bool,
+) -> cellule_runtime::Result<bool> {
+    let sets = context.sql(&SqlBatch { statements: vec![SqlStatement {
+        sql: "SELECT step,incarnation,request_id,intent,phase FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE operation=?1 AND granted_incarnation=?2 AND granted_attempt=?3 ORDER BY step DESC LIMIT 1".into(),
+        parameters: vec![blob(check.token.operation), blob(check.token.owner.incarnation.as_bytes()), number(check.token.attempt)?],
+    }, seed_statement()] })?;
+    let Some(saved) = from_sets(&sets, context.target(), check.token.operation)? else {
+        return Ok(false);
+    };
+    let header = saved.intent.header()?;
+    if header.actor != check.actor {
+        return Ok(false);
+    }
+    let Some(phase) = saved.phase else {
+        return Err(Error::Command("custody restart grant is unsettled"));
+    };
+    Ok(match phase.decode_reply::<CustodyReply>()? {
+        CustodyReply::Preparation(PreparationReply::Granted(lease)) if !staging => {
+            lease.token == check.token
+        }
+        CustodyReply::Staging(StagingReply::Granted(lease)) if staging => {
+            lease.token == check.token
+        }
+        _ => false,
+    })
+}
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 979840a4..47268332 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -99,6 +99,11 @@ pub use root_completion::{
     RootSignedPushFact, replay_root_push_response,
 };
 mod admission_receipt;
+mod custody;
+pub use custody::{
+    CustodyAction, CustodyError, CustodyIntent, CustodyReply, CustodyRequest, ExecuteCustody,
+    PreparedCustody, RegisterCustodyIntent, RegisteredCustody,
+};
 mod preparation_receipt;
 pub use preparation_receipt::{PreparationAdmission, PreparationReceiptError};
 mod staging_receipt;
@@ -222,16 +227,11 @@ pub struct MaintenanceRequest {
 /// Bind the packed production contract. Inline publication/completion adapters
 /// are deliberately excluded; qualification binds its historical fixtures itself.
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
-    registry.bind_command::<BeginStaging>()?;
-    registry.bind_command::<RenewStaging>()?;
-    registry.bind_command::<BindStaging>()?;
-    registry.bind_command::<ClaimStaging>()?;
+    registry.bind_command::<RegisterCustodyIntent>()?;
+    registry.bind_command::<ExecuteCustody>()?;
     registry.bind_command::<RegisterStagedInputs>()?;
     registry.bind_query::<CheckStagedInputs>()?;
     registry.bind_query::<CheckStaging>()?;
-    registry.bind_command::<BeginPreparation>()?;
-    registry.bind_command::<ClaimPreparation>()?;
-    registry.bind_command::<RenewPreparation>()?;
     registry.bind_command::<AbortPreparation>()?;
     registry.bind_command::<ReapPreparation>()?;
     registry.bind_command::<RegisterCatalogAttestation>()?;
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 450c6e6c..29d56c17 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,19 +23,12 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 20] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 15] = [
     crate::operation(1),
-    command::<BeginPreparation>(4096, 4096),
-    command::<ClaimPreparation>(4096, 4096),
-    command::<RenewPreparation>(4096, 4096),
     command::<AbortPreparation>(4096, 4096),
     command::<ReapPreparation>(4096, 4096),
     command::<RegisterCatalogAttestation>(4096, 4096),
     command::<PublishCatalogCompaction>(4096, 4096),
-    command::<BeginStaging>(4096, 4096),
-    command::<RenewStaging>(4096, 4096),
-    command::<BindStaging>(4096, 4096),
-    command::<ClaimStaging>(4096, 4096),
     command::<RegisterStagedInputs>(4096, 4096),
     command::<InitializeCatalogRefs>(INITIALIZATION_BYTES, 512),
     command::<RegisterRefPolicyPage>(REF_POLICY_PAGE_BYTES, 128),
@@ -44,6 +37,8 @@ pub(crate) const COMMANDS: [OperationDescriptor; 20] = [
     command::<CompleteRootOutcome>(ROOT_COMPLETION_BYTES, 512),
     command::<RegisterRootRecovery>(4096, 4096),
     command::<ReleaseTerminalRecovery>(4096, 128),
+    command::<RegisterCustodyIntent>(4096, 4096),
+    command::<ExecuteCustody>(1024, 512),
 ];
 pub(crate) const QUERIES: [OperationDescriptor; 9] = [
     crate::operation(2),
@@ -84,9 +79,7 @@ mod tests {
             .collect();
         assert_eq!(
             ids,
-            vec![
-                1, 11, 12, 13, 14, 16, 17, 22, 24, 25, 26, 28, 29, 31, 33, 35, 36, 38, 39, 40
-            ]
+            vec![1, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42]
         );
         assert_eq!(
             descriptor
@@ -117,6 +110,8 @@ mod tests {
             ),
             (39, RegisterRootRecovery::CODEC_VERSION, 4096, 4096),
             (40, ReleaseTerminalRecovery::CODEC_VERSION, 4096, 128),
+            (41, RegisterCustodyIntent::CODEC_VERSION, 4096, 4096),
+            (42, ExecuteCustody::CODEC_VERSION, 1024, 512),
         ] {
             let operation = descriptor
                 .commands
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index a0e9ce15..553c0d48 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -545,3 +545,36 @@ BEGIN SELECT RAISE(ABORT, 'push outcome bytes are immutable'); END;
 CREATE TRIGGER push_certificate_chunks_not_replaced BEFORE INSERT ON push_certificate_chunks
 WHEN EXISTS(SELECT 1 FROM push_certificate_chunks WHERE push_id=NEW.push_id AND part=NEW.part)
 BEGIN SELECT RAISE(ABORT, 'push outcome bytes cannot be replaced'); END;
+
+-- Bounded exact-command metadata exists before any upload namespace is granted.
+-- One unresolved head per logical request. Rows represent custody transitions,
+-- never Git objects, and historical grants are not generation retention roots.
+CREATE TABLE catalog_custody_commands (
+    operation BLOB NOT NULL CHECK(typeof(operation)='blob' AND length(operation)=16),
+    step INTEGER NOT NULL CHECK(typeof(step)='integer' AND step BETWEEN 0 AND 65535),
+    incarnation BLOB NOT NULL CHECK(typeof(incarnation)='blob' AND length(incarnation)=16),
+    request_id BLOB NOT NULL CHECK(typeof(request_id)='blob' AND length(request_id)=16),
+    intent BLOB NOT NULL CHECK(typeof(intent)='blob' AND length(intent) BETWEEN 1 AND 4096),
+    phase BLOB CHECK(phase IS NULL OR (typeof(phase)='blob' AND length(phase) BETWEEN 1 AND 1024)),
+    granted_incarnation BLOB CHECK(granted_incarnation IS NULL OR (typeof(granted_incarnation)='blob' AND length(granted_incarnation)=16)),
+    granted_attempt INTEGER CHECK(granted_attempt IS NULL OR (typeof(granted_attempt)='integer' AND granted_attempt>0)),
+    CHECK((granted_incarnation IS NULL)=(granted_attempt IS NULL)),
+    CHECK(phase IS NOT NULL OR granted_attempt IS NULL),
+    PRIMARY KEY(operation,step),
+    UNIQUE(incarnation,request_id)
+) WITHOUT ROWID;
+CREATE INDEX catalog_custody_grants ON catalog_custody_commands(operation,granted_incarnation,granted_attempt,step DESC) WHERE granted_attempt IS NOT NULL;
+CREATE UNIQUE INDEX catalog_custody_pending ON catalog_custody_commands(operation) WHERE phase IS NULL;
+CREATE TRIGGER catalog_custody_identity_immutable BEFORE UPDATE OF operation,step,incarnation,request_id,intent ON catalog_custody_commands
+WHEN NEW.operation IS NOT OLD.operation OR NEW.step IS NOT OLD.step
+  OR NEW.incarnation IS NOT OLD.incarnation OR NEW.request_id IS NOT OLD.request_id OR NEW.intent IS NOT OLD.intent
+BEGIN SELECT RAISE(ABORT, 'custody command identity is immutable'); END;
+CREATE TRIGGER catalog_custody_phase_immutable BEFORE UPDATE OF phase,granted_incarnation,granted_attempt ON catalog_custody_commands
+WHEN OLD.phase IS NOT NULL AND (NEW.phase IS NOT OLD.phase OR NEW.granted_incarnation IS NOT OLD.granted_incarnation OR NEW.granted_attempt IS NOT OLD.granted_attempt)
+BEGIN SELECT RAISE(ABORT, 'custody command result is immutable'); END;
+CREATE TRIGGER catalog_custody_not_replaced BEFORE INSERT ON catalog_custody_commands
+WHEN EXISTS(SELECT 1 FROM catalog_custody_commands WHERE operation=NEW.operation AND step=NEW.step)
+  OR EXISTS(SELECT 1 FROM catalog_custody_commands WHERE incarnation=NEW.incarnation AND request_id=NEW.request_id)
+BEGIN SELECT RAISE(ABORT, 'custody command cannot be replaced'); END;
+CREATE TRIGGER catalog_custody_retained BEFORE DELETE ON catalog_custody_commands
+BEGIN SELECT RAISE(ABORT, 'custody command must be retained'); END;
diff --git a/crates/canopy-server/src/packs/publication/staging.rs b/crates/canopy-server/src/packs/publication/staging.rs
index ba210fb0..1637b92f 100644
--- a/crates/canopy-server/src/packs/publication/staging.rs
+++ b/crates/canopy-server/src/packs/publication/staging.rs
@@ -219,7 +219,7 @@ pub struct ClaimStaging;
 impl Command for ClaimStaging {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 28;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = LeaseRequest;
     type Output = StagingReply;
     fn execute(
@@ -237,7 +237,9 @@ impl Command for ClaimStaging {
             return Ok(denied(PreparationDenial::Unauthorized));
         };
         let Some(row) = load(context, check.token)? else {
-            if !super::staging_receipt::restart_matches(context, &check)? {
+            if !super::staging_receipt::restart_matches(context, &check)?
+                && !super::custody::restart_matches(context, &check, true)?
+            {
                 return Ok(denied(PreparationDenial::Missing));
             }
             let begin = BeginRequest {
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 368d21a5..19c4b7de 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -3,6 +3,7 @@ mod attestation;
 mod compaction;
 mod completion;
 mod coordinator;
+mod custody;
 mod durable_policy;
 mod durable_recovery;
 mod frontier;
@@ -72,6 +73,21 @@ impl CellModule for Module {
             complete_descriptor.input_limit = 4 << 20;
             let mut commands = super::registry::COMMANDS.to_vec();
             commands.extend([publish_descriptor, complete_descriptor, ref_descriptor]);
+            // Raw domain receivers qualify their invariants here. Production
+            // binds only the mandatory registered custody envelope.
+            for (id, codec) in [
+                (BeginPreparation::ID, BeginPreparation::CODEC_VERSION),
+                (ClaimPreparation::ID, ClaimPreparation::CODEC_VERSION),
+                (RenewPreparation::ID, RenewPreparation::CODEC_VERSION),
+                (BeginStaging::ID, BeginStaging::CODEC_VERSION),
+                (ClaimStaging::ID, ClaimStaging::CODEC_VERSION),
+                (RenewStaging::ID, RenewStaging::CODEC_VERSION),
+                (BindStaging::ID, BindStaging::CODEC_VERSION),
+            ] {
+                let mut domain = descriptor(id);
+                domain.codec_version = codec;
+                commands.push(domain);
+            }
             let mut queries = super::registry::QUERIES.to_vec();
             queries.push(descriptor(20));
             ModuleDescriptor {
@@ -103,6 +119,13 @@ impl CellModule for Module {
     fn register(self, registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
         cellule_runtime::primitives::sql::register_sql::<RepositoryModule>(registry)?;
         super::register(registry)?;
+        registry.bind_command::<BeginPreparation>()?;
+        registry.bind_command::<ClaimPreparation>()?;
+        registry.bind_command::<RenewPreparation>()?;
+        registry.bind_command::<BeginStaging>()?;
+        registry.bind_command::<ClaimStaging>()?;
+        registry.bind_command::<RenewStaging>()?;
+        registry.bind_command::<BindStaging>()?;
         registry.bind_command::<PublishCatalogRefs>()?;
         registry.bind_command::<CompleteCatalogPush>()?;
         registry.bind_query::<CheckCompletedPush>()?;
diff --git a/crates/canopy-server/src/packs/publication/tests/custody.rs b/crates/canopy-server/src/packs/publication/tests/custody.rs
new file mode 100644
index 00000000..d7bd9cf7
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/custody.rs
@@ -0,0 +1,690 @@
+//! Real Cell receipts, pre-admission recovery and the original command's atomic result.
+use super::{publishing::edit, *};
+use cellule_runtime::{Committed, Resolution};
+use tokio::time::Duration;
+
+async fn prepare(f: &Fixture, action: CustodyAction) -> Result<PreparedCustody> {
+    Ok(PreparedCustody::prepare(&f.client(), &f.target, action, identity()?).await?)
+}
+async fn execute(f: &Fixture, action: CustodyAction) -> Result<Committed<CustodyReply>> {
+    Ok(prepare(f, action)
+        .await?
+        .register(&f.client(), identity()?)
+        .await?
+        .recover(&f.client())
+        .await?)
+}
+fn token(output: &CustodyReply) -> Result<PreparationToken> {
+    match output {
+        CustodyReply::Preparation(PreparationReply::Granted(lease)) => Ok(lease.token),
+        CustodyReply::Staging(StagingReply::Granted(lease)) => Ok(lease.token),
+        other => Err(format!("expected custody grant: {other:?}").into()),
+    }
+}
+async fn expire(identity: MutationIdentity) -> Result {
+    let now = sql::now(0)?;
+    if now <= identity.expires_at_ms {
+        tokio::time::sleep(Duration::from_millis(u64::try_from(
+            identity.expires_at_ms - now + 1,
+        )?))
+        .await;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn intent_precedes_namespace_and_refuses_unregistered_or_losing_execution() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let operation = [231; 16];
+        let action = CustodyAction::BeginPreparation(f.begin(operation));
+        let original = prepare(&f, action.clone()).await?;
+        let command = original.command_for_test(&f.client())?;
+        assert!(matches!(
+            command.clone().execute().await,
+            Err(InvocationError::NotStarted(_))
+        ));
+        assert!(matches!(
+            f.client().resolve(command.evidence()).await?,
+            Resolution::Absent
+        ));
+        let loser = prepare(&f, action.clone()).await?;
+        let registered = original.register(&f.client(), identity()?).await?;
+        assert_eq!(f.counts().await?, (0, 0));
+        assert!(!registered.settled());
+        assert!(
+            matches!(prepare(&f, action).await, Err(error) if error.downcast_ref::<CustodyError>().is_some_and(|e| matches!(e, CustodyError::Unsettled(_))))
+        );
+        assert!(loser.register(&f.client(), identity()?).await.is_err());
+        let losing = loser.command_for_test(&f.client())?;
+        assert!(matches!(
+            losing.clone().execute().await,
+            Err(InvocationError::NotStarted(_))
+        ));
+        assert!(matches!(
+            f.client().resolve(losing.evidence()).await?,
+            Resolution::Absent
+        ));
+        // Discard all capabilities: discovery preserves the first SDK identity.
+        drop(registered);
+        drop(original);
+        let discovered = RegisteredCustody::load_latest(&f.client(), &f.target, operation)
+            .await?
+            .ok_or("intent missing")?;
+        assert_eq!(discovered.evidence(), command.evidence());
+        let accepted = discovered.recover(&f.client()).await?;
+        let granted = token(&accepted.output)?;
+        assert_eq!(granted.attempt, accepted.receipt.commit_sequence);
+        assert_eq!(granted.owner, f.handle.owner_fence());
+        assert_eq!(granted.artifact_operation, artifact_number(1));
+        assert_eq!(f.counts().await?, (1, 1));
+        assert_eq!(discovered.recover(&f.client()).await?, accepted);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn registration_and_late_phase_failure_keep_sdk_absent_and_exact_retry() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let original = prepare(&f, CustodyAction::BeginStaging(f.begin([232; 16]))).await?;
+        let registration = f
+            .client()
+            .prepare_command::<RegisterCustodyIntent>(
+                &f.target,
+                identity()?,
+                original.intent_for_test(),
+            )
+            .await?;
+        edit(&f, "CREATE TRIGGER custody_registration_fault BEFORE INSERT ON catalog_custody_commands BEGIN SELECT RAISE(ABORT,'late custody registration failure'); END").await?;
+        assert!(
+            matches!(registration.clone().execute().await, Err(InvocationError::NotStarted(error)) if format!("{error:?}").contains("late custody registration failure"))
+        );
+        assert!(matches!(
+            f.client().resolve(registration.evidence()).await?,
+            Resolution::Absent
+        ));
+        assert!(
+            RegisteredCustody::load_latest(&f.client(), &f.target, [232; 16])
+                .await?
+                .is_none()
+        );
+        assert_eq!(f.counts().await?, (0, 0));
+        edit(&f, "DROP TRIGGER custody_registration_fault").await?;
+        registration.execute().await?;
+        // Losing the registration acknowledgement is recovered by its durable
+        // pointer, without preparing another original custody command.
+        let registered = RegisteredCustody::load_latest(&f.client(), &f.target, [232; 16])
+            .await?
+            .ok_or("registration absent")?;
+        assert_eq!(registered.evidence(), original.evidence());
+        edit(&f, "CREATE TRIGGER custody_phase_fault BEFORE UPDATE OF phase ON catalog_custody_commands BEGIN SELECT RAISE(ABORT,'late custody phase failure'); END").await?;
+        let command = original.command_for_test(&f.client())?;
+        assert!(
+            matches!(command.clone().execute().await, Err(InvocationError::NotStarted(error)) if format!("{error:?}").contains("late custody phase failure"))
+        );
+        assert!(matches!(
+            f.client().resolve(command.evidence()).await?,
+            Resolution::Absent
+        ));
+        assert_eq!(f.counts().await?, (0, 0));
+        assert!(
+            StagingAdmission::load(&f.client(), &f.target, [232; 16])
+                .await?
+                .is_none()
+        );
+        edit(&f, "DROP TRIGGER custody_phase_fault").await?;
+        let committed = registered.recover(&f.client()).await?;
+        assert_eq!(
+            token(&committed.output)?.artifact_operation,
+            artifact_number(1)
+        );
+        assert_eq!(f.counts().await?, (1, 1));
+        for sql in [
+            "UPDATE catalog_custody_commands SET intent=x'01'",
+            "UPDATE catalog_custody_commands SET phase=NULL",
+            "DELETE FROM catalog_custody_commands",
+            "INSERT OR REPLACE INTO catalog_custody_commands SELECT * FROM catalog_custody_commands",
+        ] {
+            assert!(edit(&f, sql).await.is_err());
+        }
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn every_custody_transition_retains_its_original_result_across_successors() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let operation = [233; 16];
+        let mut known = Vec::new();
+        let mut next = CustodyAction::BeginStaging(f.begin(operation));
+        for step in 0..7 {
+            let original = prepare(&f, next).await?;
+            let registered = original.register(&f.client(), identity()?).await?;
+            let committed = registered.recover(&f.client()).await?;
+            let current = token(&committed.output)?;
+            known.push((registered, committed));
+            next = match step {
+                0 => CustodyAction::RenewStaging(request(current)),
+                1 => CustodyAction::ClaimStaging(request(current)),
+                2 => CustodyAction::BindStaging(check(current)),
+                3 => CustodyAction::RenewPreparation(request(current)),
+                4 => CustodyAction::ClaimPreparation(request(current)),
+                _ => CustodyAction::BeginPreparation(f.begin(operation)),
+            };
+        }
+        for (registered, committed) in known {
+            assert_eq!(registered.recover(&f.client()).await?, committed);
+        }
+        let operation_count = f
+            .handle
+            .query(0, 1024, |db| {
+                Ok(
+                    db.query_row("SELECT count(*) FROM catalog_custody_commands", [], |r| {
+                        r.get::<_, u64>(0).map(|value| value.to_be_bytes().to_vec())
+                    })?,
+                )
+            })
+            .await?;
+        assert_eq!(u64::from_be_bytes(operation_count.try_into().unwrap()), 7);
+        assert_eq!(f.counts().await?, (1, 3));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn denied_begin_is_original_knowledge_after_sdk_expiry_and_authority_changes() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let operation = [234; 16];
+        let mut mutation = identity()?;
+        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+        let original = PreparedCustody::prepare(
+            &f.client(),
+            &f.target,
+            CustodyAction::BeginPreparation(f.begin(operation)),
+            mutation,
+        )
+        .await?;
+        let registered = original.register(&f.client(), identity()?).await?;
+        edit(&f, "UPDATE repository_identity SET owner='other'").await?;
+        let committed = match registered.recover(&f.client()).await {
+            Err(InvocationError::Rejected(committed)) => *committed,
+            other => return Err(format!("expected original unauthorized denial: {other:?}").into()),
+        };
+        assert_eq!(
+            committed.output,
+            CustodyReply::Preparation(PreparationReply::Denied(PreparationDenial::Unauthorized))
+        );
+        assert_eq!(f.counts().await?, (0, 0));
+        expire(mutation).await?;
+        assert!(matches!(
+            f.client().resolve(original.evidence()).await?,
+            Resolution::Expired
+        ));
+        edit(&f, "UPDATE repository_identity SET owner='owner'").await?;
+        let next = execute(&f, CustodyAction::BeginPreparation(f.begin(operation))).await?;
+        assert_eq!(token(&next.output)?.artifact_operation, artifact_number(1));
+        assert!(
+            matches!(registered.recover(&f.client()).await, Err(InvocationError::Rejected(value)) if *value == committed)
+        );
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_owner_restoration_recovers_claim_and_renew_receipts_without_reviving_custody()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for claim in [false, true] {
+            let f = Fixture::new(format).await?;
+            let operation = [235; 16];
+            let started = execute(&f, CustodyAction::BeginPreparation(f.begin(operation))).await?;
+            let old = token(&started.output)?;
+            let mut mutation = identity()?;
+            mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+            let action = if claim {
+                CustodyAction::ClaimPreparation(request(old))
+            } else {
+                CustodyAction::RenewPreparation(request(old))
+            };
+            let original =
+                PreparedCustody::prepare(&f.client(), &f.target, action, mutation).await?;
+            let registered = original.register(&f.client(), identity()?).await?;
+            let accepted = registered.recover(&f.client()).await?;
+            let token = token(&accepted.output)?;
+            let (runtime, handle, client) =
+                super::durable_recovery::restore_owner(&f, &check(token)).await?;
+            expire(mutation).await?;
+            assert!(matches!(
+                client.resolve(original.evidence()).await?,
+                Resolution::Expired
+            ));
+            edit_restored(&handle, "UPDATE repository_identity SET owner='other'").await?;
+            let recovered = RegisteredCustody::load_latest(&client, &f.target, operation)
+                .await?
+                .ok_or("cold custody receipt absent")?;
+            assert_eq!(recovered.evidence(), original.evidence());
+            assert_eq!(recovered.recover(&client).await?, accepted);
+            assert_ne!(token.owner, handle.owner_fence());
+            assert!(
+                client
+                    .query::<CheckPreparation>(&f.target, Some(accepted.receipt), check(token))
+                    .await?
+                    .output
+                    .is_none()
+            );
+            runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+async fn edit_restored(handle: &CellHandle, sql: &'static str) -> Result {
+    super::publishing::edit_handle(handle, sql).await
+}
+
+#[tokio::test]
+async fn expired_unsettled_identity_cannot_be_replaced_or_reported_as_absent() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let operation = [236; 16];
+        let action = CustodyAction::BeginStaging(f.begin(operation));
+        let mut mutation = identity()?;
+        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+        let original =
+            PreparedCustody::prepare(&f.client(), &f.target, action.clone(), mutation).await?;
+        let registered = original.register(&f.client(), identity()?).await?;
+        expire(mutation).await?;
+        assert!(
+            matches!(registered.recover(&f.client()).await, Err(InvocationError::Pending(evidence)) if *evidence == *original.evidence())
+        );
+        assert!(
+            matches!(PreparedCustody::prepare(&f.client(), &f.target, action, identity()?).await, Err(CustodyError::Unsettled(evidence)) if *evidence == *original.evidence())
+        );
+        assert_eq!(f.counts().await?, (0, 0));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn denied_renewal_preserves_knowledge_and_exact_successor_claim_survives_reaping() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for staging in [false, true] {
+            let f = Fixture::new(format).await?;
+            let input = f.begin([237; 16]);
+            let begin = if staging {
+                CustodyAction::BeginStaging(input)
+            } else {
+                CustodyAction::BeginPreparation(input)
+            };
+            let first = execute(&f, begin).await?;
+            let original = token(&first.output)?;
+            let claim = if staging {
+                CustodyAction::ClaimStaging(request(original))
+            } else {
+                CustodyAction::ClaimPreparation(request(original))
+            };
+            let second = execute(&f, claim).await?;
+            let prior = token(&second.output)?;
+            assert_ne!(prior, original);
+            edit(&f, "UPDATE catalog_operations SET expires_at_ms=0; UPDATE catalog_leases SET expires_at_ms=0").await?;
+            let mut mutation = identity()?;
+            mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+            let action = if staging {
+                CustodyAction::RenewStaging(request(prior))
+            } else {
+                CustodyAction::RenewPreparation(request(prior))
+            };
+            let denied = PreparedCustody::prepare(&f.client(), &f.target, action, mutation)
+                .await?
+                .register(&f.client(), identity()?)
+                .await?;
+            let original_denial = match denied.recover(&f.client()).await {
+                Err(InvocationError::Rejected(value)) => *value,
+                other => return Err(format!("expected original expired denial: {other:?}").into()),
+            };
+            let expected = if staging {
+                CustodyReply::Staging(StagingReply::Denied(PreparationDenial::Expired))
+            } else {
+                CustodyReply::Preparation(PreparationReply::Denied(PreparationDenial::Expired))
+            };
+            assert_eq!(original_denial.output, expected);
+            f.client()
+                .command::<ReapPreparation>(
+                    &f.target,
+                    identity()?,
+                    MaintenanceRequest {
+                        repository: f.repository,
+                        actor: "owner".into(),
+                        owner: f.handle.owner_fence(),
+                    },
+                )
+                .await?;
+            assert_eq!(f.counts().await?, (0, 0));
+            // A forged token cannot borrow the authenticated previous grant.
+            let mut forged = prior;
+            forged.request_digest[0] ^= 1;
+            assert!(
+                PreparedCustody::prepare(
+                    &f.client(),
+                    &f.target,
+                    if staging {
+                        CustodyAction::ClaimStaging(request(forged))
+                    } else {
+                        CustodyAction::ClaimPreparation(request(forged))
+                    },
+                    identity()?
+                )
+                .await
+                .is_err()
+            );
+            let claimed = execute(
+                &f,
+                if staging {
+                    CustodyAction::ClaimStaging(request(prior))
+                } else {
+                    CustodyAction::ClaimPreparation(request(prior))
+                },
+            )
+            .await?;
+            let next = token(&claimed.output)?;
+            assert_ne!(next, prior);
+            assert_eq!(next.owner, f.handle.owner_fence());
+            assert_eq!(next.attempt, claimed.receipt.commit_sequence);
+            assert_eq!(next.artifact_operation, artifact_number(3));
+            assert_eq!(f.counts().await?, (1, 1));
+            expire(mutation).await?;
+            assert!(matches!(
+                f.client().resolve(denied.evidence()).await?,
+                Resolution::Expired
+            ));
+            assert!(
+                matches!(denied.recover(&f.client()).await, Err(InvocationError::Rejected(value)) if *value == original_denial)
+            );
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn corrupted_metadata_blocks_sdk_fallback_and_journal_queries_are_indexed() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let operation = [238; 16];
+        let registered = prepare(&f, CustodyAction::BeginPreparation(f.begin(operation)))
+            .await?
+            .register(&f.client(), identity()?)
+            .await?;
+        registered.recover(&f.client()).await?;
+        let plans = f.handle.query(0, 4096, |db| {
+            let mut all = String::new();
+            for sql in [
+                "EXPLAIN QUERY PLAN SELECT intent,phase FROM catalog_custody_commands WHERE operation=zeroblob(16) ORDER BY step DESC LIMIT 1",
+                "EXPLAIN QUERY PLAN SELECT operation FROM catalog_custody_commands WHERE phase IS NULL LIMIT 1024",
+                "EXPLAIN QUERY PLAN SELECT intent,phase FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE operation=zeroblob(16) AND granted_incarnation=zeroblob(16) AND granted_attempt=1 ORDER BY step DESC LIMIT 1",
+            ] {
+                let mut statement = db.prepare(sql)?;
+                let mut rows = statement.query([])?;
+                while let Some(row) = rows.next()? { all.push_str(&row.get::<_,String>(3)?); all.push('\n'); }
+            }
+            Ok(all.into_bytes())
+        }).await?;
+        let plans = String::from_utf8(plans)?;
+        assert!(plans.contains("PRIMARY KEY"), "{plans}");
+        assert!(plans.contains("catalog_custody_pending"), "{plans}");
+        assert!(plans.contains("catalog_custody_grants"), "{plans}");
+        assert!(matches!(
+            f.client().resolve(registered.evidence()).await?,
+            Resolution::Committed(_)
+        ));
+        edit(&f, "DROP TRIGGER catalog_custody_identity_immutable").await?;
+        f.handle
+            .execute(
+                identity()?,
+                Digest::from_bytes([239; 32]),
+                sql::now(0)?,
+                4096,
+                0,
+                move |tx| {
+                    let mut bytes: Vec<u8> = tx.query_row(
+                        "SELECT intent FROM catalog_custody_commands WHERE operation=?1",
+                        [operation.as_slice()],
+                        |row| row.get(0),
+                    )?;
+                    *bytes
+                        .last_mut()
+                        .ok_or(cellule_runtime::Error::Command("custody body absent"))? ^= 1;
+                    tx.execute(
+                        "UPDATE catalog_custody_commands SET intent=?1 WHERE operation=?2",
+                        rusqlite::params![bytes, operation.as_slice()],
+                    )?;
+                    Ok(cellule_runtime::cell::executor::HandlerOutcome::Success(
+                        Vec::new(),
+                    ))
+                },
+            )
+            .await?;
+        assert!(
+            RegisteredCustody::load_latest(&f.client(), &f.target, operation)
+                .await
+                .is_err()
+        );
+        assert!(
+            matches!(registered.recover(&f.client()).await, Err(InvocationError::Pending(evidence)) if *evidence == *registered.evidence())
+        );
+        assert_eq!(f.counts().await?, (1, 1));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn initialized_generation_grants_fit_the_journal_and_preserve_joint_roots() -> Result {
+    use canopy_object_storage::artifact::ArtifactStore;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let (prepared, _root, _budget) = super::initialization::empty(&f, [240; 16], store).await?;
+        let proof = prepared.empty_ref_initialization().await?;
+        let (initialization, _) =
+            super::initialization::registered(&f, &prepared, proof, identity()?).await?;
+        let initialized = initialization.execute().await?;
+        let InitializationReply::Initialized(fact) = initialized.output else {
+            return Err("initialization failed".into());
+        };
+        assert!(fact.catalog.is_some() && fact.refs.is_some());
+        let original = prepare(&f, CustodyAction::BeginPreparation(f.begin([241; 16])))
+            .await?
+            .register(&f.client(), identity()?)
+            .await?;
+        let committed = original.recover_preparation(&f.client()).await?;
+        let PreparationReply::Granted(lease) = committed.output else {
+            return Err("grant absent".into());
+        };
+        assert_eq!(lease.base, *fact);
+        let renewed = execute(&f, CustodyAction::RenewPreparation(request(lease.token))).await?;
+        let CustodyReply::Preparation(PreparationReply::Granted(renewed)) = renewed.output else {
+            return Err("renewal absent".into());
+        };
+        assert_eq!(renewed.base, *fact);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn ignored_registration_or_phase_write_cannot_commit_without_domain_knowledge() -> Result {
+    for phase in [false, true] {
+        let f = Fixture::new(ObjectFormat::Sha256).await?;
+        let operation = [242; 16];
+        let original = prepare(&f, CustodyAction::BeginPreparation(f.begin(operation))).await?;
+        if phase {
+            original.register(&f.client(), identity()?).await?;
+        }
+        let event = if phase { "UPDATE OF phase" } else { "INSERT" };
+        edit(&f, &format!("CREATE TRIGGER custody_ignore_fault BEFORE {event} ON catalog_custody_commands BEGIN SELECT RAISE(IGNORE); END")).await?;
+        if phase {
+            let command = original.command_for_test(&f.client())?;
+            assert!(
+                matches!(command.clone().execute().await, Err(InvocationError::NotStarted(error)) if format!("{error:?}").contains("publication changed unexpected rows"))
+            );
+            assert!(matches!(
+                f.client().resolve(command.evidence()).await?,
+                Resolution::Absent
+            ));
+        } else {
+            let command = f
+                .client()
+                .prepare_command::<RegisterCustodyIntent>(
+                    &f.target,
+                    identity()?,
+                    original.intent_for_test(),
+                )
+                .await?;
+            assert!(
+                matches!(command.clone().execute().await, Err(InvocationError::NotStarted(error)) if format!("{error:?}").contains("publication changed unexpected rows"))
+            );
+            assert!(matches!(
+                f.client().resolve(command.evidence()).await?,
+                Resolution::Absent
+            ));
+            assert!(
+                RegisteredCustody::load_latest(&f.client(), &f.target, operation)
+                    .await?
+                    .is_none()
+            );
+        }
+        assert_eq!(f.counts().await?, (0, 0));
+        edit(&f, "DROP TRIGGER custody_ignore_fault").await?;
+        original
+            .register(&f.client(), identity()?)
+            .await?
+            .recover(&f.client())
+            .await?;
+        assert_eq!(f.counts().await?, (1, 1));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn registered_unexecuted_begin_survives_deleted_sqlite_and_cold_owner_restore() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for staging in [false, true] {
+            let f = Fixture::new(format).await?;
+            let operation = [243; 16];
+            let action = if staging {
+                CustodyAction::BeginStaging(f.begin(operation))
+            } else {
+                CustodyAction::BeginPreparation(f.begin(operation))
+            };
+            let prepared = prepare(&f, action.clone()).await?;
+            let original = prepared.evidence().clone();
+            prepared.register(&f.client(), identity()?).await?;
+            assert_eq!(f.counts().await?, (0, 0));
+            assert!(matches!(
+                f.client().resolve(&original).await?,
+                Resolution::Absent
+            ));
+            drop(prepared);
+            let (runtime, handle, client) =
+                super::durable_recovery::restore_owner_fence(&f, f.handle.owner_fence()).await?;
+            assert_eq!(super::counts(&handle).await?, (0, 0));
+            let recovered = RegisteredCustody::load_latest(&client, &f.target, operation)
+                .await?
+                .ok_or("pre-namespace intent missing")?;
+            assert_eq!(recovered.evidence(), &original);
+            assert_eq!(recovered.action()?, action);
+            assert!(matches!(
+                client.resolve(&original).await?,
+                Resolution::Absent
+            ));
+            let committed = recovered.recover(&client).await?;
+            let admitted = token(&committed.output)?;
+            assert_eq!(admitted.owner, handle.owner_fence());
+            assert_eq!(admitted.attempt, committed.receipt.commit_sequence);
+            assert_eq!(admitted.artifact_operation, artifact_number(1));
+            assert_eq!(super::counts(&handle).await?, (1, 1));
+            assert_eq!(recovered.recover(&client).await?, committed);
+            runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn denied_claim_keeps_its_original_receipt_after_sdk_expiry_and_cold_restore() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for staging in [false, true] {
+            let f = Fixture::new(format).await?;
+            let operation = [244; 16];
+            let begun = execute(
+                &f,
+                if staging {
+                    CustodyAction::BeginStaging(f.begin(operation))
+                } else {
+                    CustodyAction::BeginPreparation(f.begin(operation))
+                },
+            )
+            .await?;
+            let old = token(&begun.output)?;
+            let accepted = execute(
+                &f,
+                if staging {
+                    CustodyAction::ClaimStaging(request(old))
+                } else {
+                    CustodyAction::ClaimPreparation(request(old))
+                },
+            )
+            .await?;
+            let successor = token(&accepted.output)?;
+            let mut mutation = identity()?;
+            mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+            let action = if staging {
+                CustodyAction::ClaimStaging(request(old))
+            } else {
+                CustodyAction::ClaimPreparation(request(old))
+            };
+            let denied = PreparedCustody::prepare(&f.client(), &f.target, action, mutation)
+                .await?
+                .register(&f.client(), identity()?)
+                .await?;
+            let original = match denied.recover(&f.client()).await {
+                Err(InvocationError::Rejected(value)) => *value,
+                other => return Err(format!("expected original stale Claim: {other:?}").into()),
+            };
+            let expected = if staging {
+                CustodyReply::Staging(StagingReply::Denied(PreparationDenial::Stale))
+            } else {
+                CustodyReply::Preparation(PreparationReply::Denied(PreparationDenial::Stale))
+            };
+            assert_eq!(original.output, expected);
+            assert_eq!(f.counts().await?, (1, 2));
+            let evidence = denied.evidence().clone();
+            let (runtime, handle, client) =
+                super::durable_recovery::restore_owner_fence(&f, successor.owner).await?;
+            expire(mutation).await?;
+            assert!(matches!(
+                client.resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            let restored = RegisteredCustody::load_latest(&client, &f.target, operation)
+                .await?
+                .ok_or("cold Claim denial missing")?;
+            assert_eq!(restored.evidence(), &evidence);
+            assert!(
+                matches!(restored.recover(&client).await, Err(InvocationError::Rejected(value)) if *value == original)
+            );
+            assert_eq!(super::counts(&handle).await?, (1, 2));
+            runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
index abf0a58c..593925d4 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
@@ -358,6 +358,12 @@ async fn assert_pin_retained(handle: &CellHandle, token: PreparationToken) -> Re
 pub(super) async fn restore_owner(
     f: &Fixture,
     check: &LeaseCheck,
+) -> Result<(CellRuntime, CellHandle, CellClient)> {
+    restore_owner_fence(f, check.token.owner).await
+}
+pub(super) async fn restore_owner_fence(
+    f: &Fixture,
+    old: OwnerFence,
 ) -> Result<(CellRuntime, CellHandle, CellClient)> {
     f.handle.drain().await?;
     f.runtime.shutdown().await?;
@@ -395,7 +401,7 @@ pub(super) async fn restore_owner(
             },
         )
         .await?;
-    assert!(handle.owner_fence().epoch > check.token.owner.epoch);
+    assert!(handle.owner_fence().epoch > old.epoch);
     let client = CellClient::local(f.registry.clone(), handle.clone());
     Ok((runtime, handle, client))
 }
diff --git a/crates/canopy-server/src/server/catalog_initialization.rs b/crates/canopy-server/src/server/catalog_initialization.rs
index bd4c7175..66c56bd6 100644
--- a/crates/canopy-server/src/server/catalog_initialization.rs
+++ b/crates/canopy-server/src/server/catalog_initialization.rs
@@ -5,11 +5,11 @@ use crate::{
         catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes},
         metadata::MetadataLimits,
         publication::{
-            BeginPreparation, BeginRequest, CatalogPreparation, CheckInitializedCatalog,
-            CheckPreparation, ClaimPreparation, DEFAULT_LEASE_MS, GenerationFact,
-            InitializationReply, LeaseCheck, LeaseRequest, MaintenanceRequest,
-            PreparationAdmission, PreparationBaseResolver, PreparationDenial, PreparationReply,
-            PreparationToken, PublicationError, RegisteredRootRecovery, TerminalReleaseReply,
+            BeginRequest, CatalogPreparation, CheckInitializedCatalog, CheckPreparation,
+            CustodyAction, DEFAULT_LEASE_MS, GenerationFact, InitializationReply, LeaseCheck,
+            LeaseRequest, MaintenanceRequest, PreparationBaseResolver, PreparationDenial,
+            PreparationReply, PreparationToken, PreparedCustody, PublicationError,
+            RegisteredCustody, RegisteredRootRecovery, TerminalReleaseReply,
         },
     },
 };
@@ -52,6 +52,32 @@ fn request(repository: &RepositoryCell, owner: &str) -> BeginRequest {
     }
 }
 
+fn initialization_custody(action: &CustodyAction, input: &BeginRequest) -> bool {
+    match action {
+        CustodyAction::BeginPreparation(request) => request == input,
+        CustodyAction::ClaimPreparation(request) | CustodyAction::RenewPreparation(request) => {
+            let check = &request.check;
+            check.actor == input.actor
+                && check.token.repository == input.repository
+                && check.token.operation == input.operation
+                && check.token.request_digest == input.request_digest
+        }
+        _ => false,
+    }
+}
+async fn custody_command(
+    client: &CellClient,
+    target: &cellule_runtime::CellTarget,
+    action: CustodyAction,
+) -> Result<cellule_runtime::Committed<PreparationReply>, Failure> {
+    let prepared =
+        PreparedCustody::prepare(client, target, action, super::mutation_identity()?).await?;
+    let registered = prepared
+        .register(client, super::mutation_identity()?)
+        .await?;
+    Ok(registered.recover_preparation(client).await?)
+}
+
 async fn verify(
     fact: GenerationFact,
     store: &ArtifactStore,
@@ -118,98 +144,70 @@ pub(super) async fn ensure(
     } else {
         None
     };
-    let started = if let Some(check) = claim {
-        client
-            .command::<ClaimPreparation>(
-                target,
-                super::mutation_identity()?,
-                LeaseRequest {
-                    check,
-                    lease_ms: DEFAULT_LEASE_MS,
-                },
-            )
-            .await?
-    } else if let Some(admission) =
-        PreparationAdmission::load(&client, target, input.operation).await?
-    {
-        if admission.request() != &input {
-            return Err(Error::Command("initialization admission context differs").into());
+    // Discover the exact latest custody phase before constructing another SDK
+    // identity. Both accepted and denied Begin/Claim/Renew survive process loss.
+    let custody = RegisteredCustody::load_latest(&client, target, input.operation).await?;
+    let refused_attempt = claim.as_ref().map(|check| check.token);
+    let action = if let Some(check) = claim {
+        CustodyAction::ClaimPreparation(LeaseRequest {
+            check,
+            lease_ms: DEFAULT_LEASE_MS,
+        })
+    } else {
+        CustodyAction::BeginPreparation(input.clone())
+    };
+    let result = if let Some(ref custody) = custody {
+        if !initialization_custody(&custody.action()?, &input) {
+            return Err(Error::Command("initialization custody context differs").into());
         }
-        let original = admission.lease();
-        let check = LeaseCheck {
-            token: original.token,
-            actor: owner.into(),
-        };
-        // The first accepted Begin is permanent knowledge. Its recorded clock
-        // grants no custody; query the exact original attempt under today's
-        // authority before reusing it. Never submit another Begin to replace
-        // the known receipt merely because a transport observer disappeared.
-        let current = if original.token.owner == maintenance.owner {
-            client
-                .query::<CheckPreparation>(target, Some(admission.receipt()), check.clone())
-                .await?
-                .output
-        } else {
-            None
-        };
-        if let Some(current) = current {
-            if current.token != original.token
-                || current.base != original.base
-                || current.format != original.format
+        custody
+            .recover_preparation(&client)
+            .await
+            .map_err(|error| Box::new(error) as Failure)
+    } else {
+        custody_command(&client, target, action.clone()).await
+    };
+    let started = match result {
+        Ok(started) => started,
+        Err(error) => {
+            let error = match error.downcast::<InvocationError<PreparationReply>>() {
+                Ok(error) => *error,
+                Err(error) => return Err(error),
+            };
+            if let InvocationError::Rejected(ref rejected) = error
+                && matches!(
+                    rejected.output,
+                    PreparationReply::Denied(PreparationDenial::Stale | PreparationDenial::Expired)
+                )
             {
-                return Err(Error::Command("initialization admission result differs").into());
-            }
-            cellule_runtime::Committed {
-                output: PreparationReply::Granted(Box::new(original)),
-                receipt: admission.receipt(),
-            }
-        } else {
-            // An explicit Claim can recover a reaped original admission. If a
-            // different successor exists, Claim refuses this old token rather
-            // than treating that successor as the original command's result.
-            client
-                .command::<ClaimPreparation>(
+                let prior = custody
+                    .as_ref()
+                    .map(RegisteredCustody::action)
+                    .transpose()?
+                    .unwrap_or(action);
+                let check = match prior {
+                    CustodyAction::ClaimPreparation(request)
+                    | CustodyAction::RenewPreparation(request) => request.check,
+                    CustodyAction::BeginPreparation(_) => {
+                        prior_attempt(&client, repository, &input, rejected.receipt).await?
+                    }
+                    _ => {
+                        return Err(Error::Command("initialization custody purpose differs").into());
+                    }
+                };
+                custody_command(
+                    &client,
                     target,
-                    super::mutation_identity()?,
-                    LeaseRequest {
+                    CustodyAction::ClaimPreparation(LeaseRequest {
                         check,
                         lease_ms: DEFAULT_LEASE_MS,
-                    },
+                    }),
                 )
                 .await?
-        }
-    } else {
-        match client
-            .command::<BeginPreparation>(target, super::mutation_identity()?, input.clone())
-            .await
-        {
-            Ok(started) => started,
-            Err(InvocationError::Rejected(rejected))
-                if matches!(
-                    rejected.output,
-                    PreparationReply::Denied(PreparationDenial::Stale | PreparationDenial::Expired)
-                ) =>
-            {
-                // Claim only after a known domain refusal. Read the exact old
-                // binding; the Claim receiver verifies its pin and actual owner.
-                let check = prior_attempt(&client, repository, &input, rejected.receipt).await?;
-                client
-                    .command::<ClaimPreparation>(
-                        target,
-                        super::mutation_identity()?,
-                        LeaseRequest {
-                            check,
-                            lease_ms: DEFAULT_LEASE_MS,
-                        },
-                    )
-                    .await?
-            }
-            Err(error) => {
-                // A logical initialization can win between the first query and
-                // Begin. Only a known conflict may use that exact retained result;
-                // uncertain command evidence stays an error, never fresh admission.
-                if matches!(&error, InvocationError::Rejected(value)
-                if value.output == PreparationReply::Denied(PreparationDenial::Conflict))
+            } else {
+                // Only a known conflict can observe a winning initialization.
+                // Unknown/expired SDK evidence never authorizes a new Begin.
+                if matches!(&error, InvocationError::Rejected(value) if value.output == PreparationReply::Denied(PreparationDenial::Conflict))
                     && let Some(fact) = client
                         .query::<CheckInitializedCatalog>(target, None, input.clone())
                         .await?
@@ -229,6 +227,43 @@ pub(super) async fn ensure(
             }
         }
     };
+    let PreparationReply::Granted(ref original) = started.output else {
+        return Err(Error::Command("initialization custody grant absent").into());
+    };
+    // A historical result is knowledge only. Fresh custody and the actual owner
+    // are required before using its token; never restart its recorded clock.
+    let check = LeaseCheck {
+        token: original.token,
+        actor: owner.into(),
+    };
+    let current =
+        if original.token.owner == maintenance.owner && refused_attempt != Some(original.token) {
+            client
+                .query::<CheckPreparation>(target, Some(started.receipt), check.clone())
+                .await?
+                .output
+        } else {
+            None
+        };
+    let started = if let Some(current) = current {
+        if current.token != original.token
+            || current.base != original.base
+            || current.format != original.format
+        {
+            return Err(Error::Command("initialization custody result differs").into());
+        }
+        started
+    } else {
+        custody_command(
+            &client,
+            target,
+            CustodyAction::ClaimPreparation(LeaseRequest {
+                check,
+                lease_ms: DEFAULT_LEASE_MS,
+            }),
+        )
+        .await?
+    };
     if let Some(recovered) = recovered {
         retire(&recovered, client.clone(), &store, &maintenance).await?;
     }
diff --git a/crates/canopy-server/tests/multi_server/workspace.rs b/crates/canopy-server/tests/multi_server/workspace.rs
index 8605ab16..49e35db7 100644
--- a/crates/canopy-server/tests/multi_server/workspace.rs
+++ b/crates/canopy-server/tests/multi_server/workspace.rs
@@ -135,7 +135,7 @@ async fn new_repositories_bootstrap_the_production_packed_catalog_before_becomin
         let target = canopy_server::repository_target(tenant, application, *repository.as_bytes())?;
         server.shutdown().await?;
         let root = repository_root(&layout, &target, &files.path().join("original.sqlite")).await?;
-        let (catalog, refs, allocation, admission) = {
+        let (catalog, refs, allocation, admission, custody) = {
             let connection = root.connection()?;
             for table in [
                 "objects",
@@ -193,7 +193,21 @@ async fn new_repositories_bootstrap_the_production_packed_catalog_before_becomin
                 })?;
             assert!(!admission.is_empty());
             assert!(admission.len() <= 1024);
-            (catalog, refs, allocation, admission)
+            let custody: (Vec<u8>, Vec<u8>) = connection.query_row(
+                "SELECT intent,phase FROM catalog_custody_commands WHERE step=0",
+                [],
+                |row| Ok((row.get(0)?, row.get(1)?)),
+            )?;
+            assert!(custody.0.len() <= 4096 && custody.1.len() <= 1024);
+            assert_eq!(
+                connection.query_row(
+                    "SELECT count(*) FROM catalog_custody_commands",
+                    [],
+                    |row| row.get::<_, i64>(0)
+                )?,
+                1
+            );
+            (catalog, refs, allocation, admission, custody)
         };
         drop(root);
         let mut decoder = BoundedDecoder::new(&catalog, 256)?;
@@ -241,6 +255,22 @@ async fn new_repositories_bootstrap_the_production_packed_catalog_before_becomin
         let root = repository_root(&layout, &target, &files.path().join("restored.sqlite")).await?;
         {
             let connection = root.connection()?;
+            assert_eq!(
+                connection.query_row(
+                    "SELECT intent,phase FROM catalog_custody_commands WHERE step=0",
+                    [],
+                    |row| Ok((row.get::<_, Vec<u8>>(0)?, row.get::<_, Vec<u8>>(1)?))
+                )?,
+                custody
+            );
+            assert_eq!(
+                connection.query_row(
+                    "SELECT count(*) FROM catalog_custody_commands",
+                    [],
+                    |row| row.get::<_, i64>(0)
+                )?,
+                1
+            );
             assert_eq!(
                 connection.query_row("SELECT initial_preparation FROM pushes", [], |row| row
                     .get::<_, Vec<u8>>(0))?,
diff --git a/docs/design/durable-custody-command-intents.md b/docs/design/durable-custody-command-intents.md
new file mode 100644
index 00000000..bf22c2a4
--- /dev/null
+++ b/docs/design/durable-custody-command-intents.md
@@ -0,0 +1,54 @@
+# Durable custody command intents
+
+Status: local, unpublished production cutover. Repository initialization uses this protocol. Staging and publication service conversion, compact terminal archival and capacity qualification remain required before release.
+
+A prepared command can be lost before Begin grants an artifact namespace. A final publication's existing [registered recovery root](mandatory-publication-registration.md) cannot cover that interval: its body artifacts require an independently admitted namespace. Allocating a fake namespace or reconstructing a fresh SDK identity would cross the custody or exact-command boundary.
+
+## Representation and bounds
+
+The protocol reuses `PreparedCommandSnapshot`, `Stamp`, `Recorded`, `CertificateEnvelope`, the existing Begin/Claim/Renew/Bind domain logic, namespace allocator and independent generation pins. One additional `WITHOUT ROWID` relation, `catalog_custody_commands`, stores command metadata before and after admission. It stores no Git object, object edge, physical pack or inventory entry. Its rows are proportional to custody transitions.
+
+Each row is keyed by logical operation and ordinal. A separate unique key binds the original incarnation and SDK request ID. The authenticated intent binds tenant/application, repository, actor, logical operation/digest, original SDK stamp, ordinal, exact predecessor digest and the snapshot/body digest. The typed body distinguishes preparation Begin/Claim/Renew and staging Begin/Claim/Renew/Bind. It preserves the original encoded bytes, compiled contract, incarnation, identity and expiration. Neither restoration nor registration extends that expiration.
+
+The input is bounded to 1 KiB, SDK snapshot to its existing 2 KiB ceiling, authenticated carrier to 1 KiB, complete stored intent to 4 KiB and recorded phase to 1 KiB with a 512-byte typed reply. Every factory and receiver applies its complete encoded limit; individual ceilings do not authorize a sum exceeding the complete limit. Factory encoding fails before registration or allocation if the combined representation exceeds it. Actor identifiers retain their existing 64-byte limit. Ordinals use the existing recovery protocol's 65,535 ceiling; exhaustion refuses preparation rather than replacing history.
+
+At most one unresolved row exists per logical operation. Indexed admission counts at most 1,024 pending heads; settled history does not consume this unresolved-work quota. A partial index serves that count. The primary key serves latest-head and exact-ordinal discovery. An explicit indexed lookup on operation/incarnation/admission sequence discovers an authentic historical grant for restart Claim without scanning the operation's renewal history. SQL guards prevent changing or replacing an intent, changing a settled phase or its grant identity, and deleting retained knowledge.
+
+## Registration and execution
+
+Command 41 registers the authenticated exact intent. The first matching ordinal wins. Advancing requires a settled predecessor, its exact encoded digest and matching logical actor/digest. Unknown work cannot be skipped. A new registration checks current Write, the actual incarnation and original command expiry. Exact existing knowledge remains discoverable after permission or owner loss; this grants no execution or upload permission.
+
+The factory retains its original snapshot/body through registration. A private query of the exact row proves registration even after a lost acknowledgement or registrar SDK expiry. It returns an identical winner before issuing another registration mutation. A missing or corrupt row after uncertainty remains an error. A competing candidate cannot dispatch its original command. New registration knowledge is observed through the authoritative Cell query, and execution independently verifies the same pointer.
+
+Command 42 accepts only the registered original SDK stamp and typed body at that ordinal. It reuses the domain receiver's current authorization, actual owner fence, exact token/pin, expiration, generation and quota checks. Namespace/pin/domain writes and the original typed result share the same transaction and SDK acceptance. SQL or encoding failure rolls back all of them. Positive results and domain denials both commit an authenticated-intent-bound phase; private service boundaries normalize trusted negative replies back to `Rejected` while preserving their original receipt.
+
+Recovery queries the original ordinal and observes its phase before SDK resolution or any current-custody query. Known history returns the original receipt after later renewals, Claim, owner loss, revoked Write or SDK expiry. A phase missing despite SDK acceptance is treated as uncertainty. Only authoritative SDK `Absent` can restore and execute the original unchanged bytes. `Unknown`, `Expired`, query failure and corrupt metadata retain the original evidence. In particular, an expired unresolved command is not replaced with a new identity.
+
+Historical grants are knowledge, not leases or artifact retention roots. They never restart a clock or retain every old base forever. Fresh authorized queries and actual independent pins determine current custody. After a grant's operation and pin are reaped, Claim can authenticate that exact indexed historical token, recheck current Write/logical availability/quotas and allocate a different namespace/pin under the actual executing fence and sequence. It cannot displace an active successor or recreate a completed outcome.
+
+## Startup integration
+
+Pending repository initialization discovers its latest registered custody head before constructing another original command. It recovers pre-dispatch Begin, accepted/denied Begin and subsequent Claim/Renew results. A matching current owner and fresh exact custody query are required before using a historical grant. Otherwise, a known resolved phase can precede an explicit registered Claim. A known denied final initialization forces Claim of that refused attempt even when its old Begin grant is still readable; a previously accepted successor Claim is recovered rather than repeated. Unknown phases stop initialization.
+
+The certified final initializer, its immutable root graph and [terminal retirement](terminal-publication-retention.md) remain the authority before repository Ready. The existing tracked repository transition owns startup through cancellation. Ready restore observes the immutable initialization and preserves the original intent/phase bytes without allocating another namespace. There is no new product API or permission granted by these private metadata queries.
+
+## Cost and release work
+
+Each new custody transition currently adds one registration mutation plus one execution mutation. Exact known lookup/replay adds no execution mutation; already registered retries avoid another registration mutation. Count these phases, policy/native checkpoints, final registration and completion in serialized service-time and fairness budgets. The earlier two-command illustration is not this protocol's total push cost.
+
+Inline command metadata closes the pre-namespace correctness gap, but retaining one SQL row per renewal forever is not the intended final storage strategy. Before release, compact settled per-operation history into bounded immutable frames in a genuinely admitted namespace, reusing the existing saved-command/root/frame codecs and indexed immutable storage. Keep an authenticated discoverable SQL head and retain exact historical lookup; denied pre-admission work cannot depend on a fabricated namespace. Include this history in typed collection, backup and isolated restore, without treating the historical grant's base descriptors as new live roots. The current implementation conservatively retains rows and does not claim repository/team capacity.
+
+Convert the StagingCoordinator, ReadyPreparation/PublicationCoordinator and direct session renewal factories to this protocol, retaining fair admission charges and uncertainty across cancellation and service closure. Remove raw custody bindings from production; domain methods remain callable inside the registered receiver and explicit qualification fixtures only. Remove redundant first-admission columns after their consumers and restart proofs use this journal. Complete foreground producers/readers, final schema removal, serving-generation retention, typed collection/backup, OS resource containment, continuous maintenance, physical rewriting and full-history mixed load before publishing the hard cutover.
+
+Qualification covers SHA-1/SHA-256 first-writer races, pre-namespace persistence/discovery, unregistered and losing identities, late registration/phase rollback with SDK absence and exact retry, immutable metadata, all seven transitions, historical receipts after successors, original denied Begin/Renew after real SDK expiry, cold SQLite removal and owner restore, reaped successor Claim, forged tokens, corrupt metadata and bounded indexed lookup. A joint initialized catalog/ref base is tested against the reply ceiling. Real workspace tests check certified repository creation and identical custody metadata after fresh-disk restore. These are focused correctness checks, not a full-history or 10,000-developer capacity claim.
+
+Reproduce the focused checks with the pinned SDK dependencies and Rust 1.98.0:
+
+```sh
+cargo +1.98.0 test -p canopy-server --lib packs::publication --locked -- --test-threads=4
+cargo +1.98.0 test -p canopy-server --test multi_server workspace --locked -- --test-threads=4
+cargo +1.98.0 clippy --workspace --all-targets --locked -- -D warnings
+cargo +1.98.0 build -p canopy-server --bin canopy --locked
+```
+
+The current checkpoint passes 283 publication and nine workspace/lifecycle cases, all-target workspace Clippy and the server build on macOS. Frozen Rust-source hashes and protected-checkout/dependency checks accompany the validation. Linux/provider CI and the complete runtime/capacity campaign remain release gates.
diff --git a/docs/design/initial-preparation-receipts.md b/docs/design/initial-preparation-receipts.md
index 702c56fa..6e816437 100644
--- a/docs/design/initial-preparation-receipts.md
+++ b/docs/design/initial-preparation-receipts.md
@@ -10,7 +10,7 @@ The record binds tenant/application, exact Begin request, actual admitted SDK id
 
 The receiver writes the first receipt after domain admission in the same Cell transaction. Namespace allocation, operation/pin writes, receipt encoding and SDK acceptance either commit together or roll back together. Immutable SQL guards prevent changing, deleting or replacing the initial record. Subsequent Begin, Claim, renewal, completion and reaping preserve first-admission knowledge. Two kinds can coexist in the same logical request row without replacing each other's receipt.
 
-Admission-only rows remain compatible with pristine initialization and matching compaction requests. Terminal or conflicting outcomes still refuse publication/recreation. Current command codecs are Begin 11/2, Claim 12/2, compaction 22/2 and initialization 31/3. The shared registry derives descriptors from these typed commands; no old contract is retained for compatibility.
+Admission-only rows remain compatible with pristine initialization and matching compaction requests. Terminal or conflicting outcomes still refuse publication/recreation. That checkpoint used Begin 11/2, Claim 12/2, compaction 22/2 and initialization 31/3. The newer [custody journal](durable-custody-command-intents.md) unbinds raw Begin/Claim/Renew from production, while reusing their domain logic inside commands 41/42. Raw qualification Claim 12 now uses codec 3 for historical journal-grant restart; it is not a production fallback. The shared registry derives descriptors from these typed commands; no old contract is retained for compatibility.
 
 ## Knowledge and custody
 
@@ -27,3 +27,5 @@ When no final initialization has been registered, startup looks up first-admissi
 Seven SHA-1/SHA-256 test families cover actual receipt persistence, distinct receipt/attempt sequences for an already-bound staging attempt, first-result immutability, late insert/update rollback and exact retry, cold restore after deleting SQLite, real SDK expiry, actual new-owner Claim, reaping, forged restart tokens, completed-request refusal, Write revocation, expired custody, corrupt MACs, cross-purpose metadata and absence of invented knowledge for denied/unexecuted Begin. Actual production HTTP creation and fresh-disk restore additionally retain the identical bounded admission record alongside certified initialization and terminal retirement.
 
 The first accepted Begin record is not an intent journal. It cannot reconstruct an unexecuted or denied command after its original prepared identity is lost. Raw competing Begin identities and later Claim/Renew still need durable original snapshots and results beyond SDK expiry. A successor Claim with a lost reply is not resolved by this initial receipt; startup fails the old-token Claim rather than attributing that successor to the original Begin. Complete registered custody-command recovery, orphan service reconstruction and retained-input adoption remain next work. Production producer/reader conversion, final schema removal, typed collection/backup/isolated restore and full repository/team capacity qualification remain mandatory before publication.
+
+The later custody journal supersedes first-positive-only startup recovery with original pre-dispatch snapshots and accepted/denied phases, including successor Claim/Renew. This first-admission representation remains in the domain and staging qualification consumers until their conversion; it should be removed rather than retained as a redundant second architecture. See the [journal contract](durable-custody-command-intents.md) for current integration and remaining release work.
diff --git a/docs/design/initial-staging-receipts.md b/docs/design/initial-staging-receipts.md
index 16f730ed..a288a157 100644
--- a/docs/design/initial-staging-receipts.md
+++ b/docs/design/initial-staging-receipts.md
@@ -27,3 +27,5 @@ After recovering a known grant, the existing supervisor queries live staging cus
 The original failing test confirms acceptance and a still-live artifact lease, waits for real SDK identity expiry, then recovers the original Begin. Lost acknowledgements and post-execution panics cover both Git object formats. Additional tests exercise final-write rollback and exact retry, local SQL destruction and fresh-owner restore, independent Claim namespaces, lease reaping, Write revocation, immutable rows, mismatched SDK identities, corrupt MACs, forged restart tokens, rollback of a restarted Claim, completed-request refusal and retained uncertainty/credits.
 
 The full goal remains open. This record preserves the first accepted initial Begin. Denied Begin commands, competing/repeated raw Begin identities and subsequent Claim/Renew receipts still need the complete registered attempt journal for recovery beyond their SDK expiry. No pre-admission command snapshot is yet discoverable after process loss. Mandatory registration must remove raw unregistered execution paths. Retained input adoption/repreparation, production producers/readers, the fresh-schema hard cutover, full typed GC/backup/restore, continuous maintenance and full-history mixed-load qualification remain required. These receipt tests do not prove the large-team capacity target.
+
+The local [custody journal](durable-custody-command-intents.md) now provides original pre-dispatch snapshots and positive/negative phases for staging Begin/Claim/Renew/Bind. Production has unbound the raw custody commands; this first-positive-only carrier remains in explicit domain/service qualification consumers pending conversion. Convert those consumers to the journal and remove the redundant carrier before the complete hard cutover is published.
diff --git a/docs/design/mandatory-publication-registration.md b/docs/design/mandatory-publication-registration.md
index 5b453fb2..c1a05179 100644
--- a/docs/design/mandatory-publication-registration.md
+++ b/docs/design/mandatory-publication-registration.md
@@ -35,13 +35,13 @@ Live factories persist their exact bundle, then bind it into `ReadyBoundRecovery
 
 `ReadyInitialization` derives the private empty proof from its retained `PreparedCatalog`, freezes command 31 and persists the same exact SDK snapshot/body/header before dispatch. Registration command 39 pins `Kind::Initialization` in the existing attempt namespace. Matching original capabilities can bind into the existing fair publication queue. Production repository startup instead retains this same owner through its already admitted, tracked repository transition. Unknown registration never authorizes final execution.
 
-Pending startup queries the current indexed operation/pin binding before issuing Begin. A recovered positive verifies the original empty catalog/directory/ref roots. Only a known original Stale/Expired final denial permits Claim of that observed attempt; other uncertainty propagates. Ready restoration observes the retained initialization fact without creating a new attempt.
+Pending startup discovers the latest authenticated custody command before constructing another Begin identity, then queries the current indexed operation/pin binding separately. A recovered positive verifies the original empty catalog/directory/ref roots. Only a known original Stale/Expired final denial permits Claim of that observed attempt; other uncertainty propagates. Ready restoration observes the retained initialization fact without creating a new attempt.
 
-Without a registered final, pending startup also recovers the [first accepted preparation admission](initial-preparation-receipts.md) before another Begin. Its original receipt is durable independently of SDK expiry, while current owner/custody are checked separately. This does not supply the missing original intent or subsequent Claim/Renew journal.
+The preceding first-admission increment recovered the [first accepted preparation admission](initial-preparation-receipts.md) before another Begin. Its original receipt is durable independently of SDK expiry, while current owner/custody are checked separately. The later local [custody intent protocol](durable-custody-command-intents.md) supersedes this startup lookup with a registered original snapshot and positive/negative phase journal. The first-admission carrier remains in domain/qualification consumers pending their conversion.
 
 Cold initialization performs no new preparation or native work. After authoritative SDK absence it restores the exact original bytes and lets the final receiver atomically check actual owner, Admin, live pin, certificate/checkpoint and pristine roots. Requiring a fresh Write-dependent session first would prevent an expired or revoked original from recording its definitive denial. Live bound dispatch still checks its original shared clock/fence. Known journal outcomes retain their original sequence and receipt even after SDK expiry, owner loss, permission revocation and body loss; they grant no current write or read capability.
 
-This closes final-command registration and reconstruction only. Exact initial Begin/Claim/Renew and failure before final registration still need durable integration. The local typed [terminal retirement protocol](terminal-publication-retention.md) now verifies its complete empty catalog/directory/ref graph and moves the same original certificate/journal/release receipt into the shared immutable archive before deleting the exact pin. Positive startup discovers the original closed attempt through the immutable initialization fact’s exact pin identity and retires it before serving. A denied initialization retires only after its active binding closes; a successor keeps its independent pin. Unknown attempts remain protected. Background-service reconstruction of older orphan attempts remains part of complete startup integration. Include the immutable initialization roots, command metadata and receipts in typed collection, backup and isolated restore.
+This closes final-command registration and reconstruction only. Initial Begin/Claim/Renew now have a registered snapshot/result protocol in production initialization; the staging/publication services and complete pre-final orphan recovery still need conversion. The local typed [terminal retirement protocol](terminal-publication-retention.md) now verifies its complete empty catalog/directory/ref graph and moves the same original certificate/journal/release receipt into the shared immutable archive before deleting the exact pin. Positive startup discovers the original closed attempt through the immutable initialization fact’s exact pin identity and retires it before serving. A denied initialization retires only after its active binding closes; a successor keeps its independent pin. Unknown attempts remain protected. Background-service reconstruction of older orphan attempts remains part of complete startup integration. Include the immutable initialization roots, command metadata and receipts in typed collection, backup and isolated restore.
 
 ## Remaining implementation sequence
 
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index c23fc10a..95266e66 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -6,6 +6,18 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Durable custody command journal started locally
+
+The production cutover now registers exact custody metadata before an upload namespace exists. The journal reuses the SDK snapshot/body contract, authenticated carrier, `Stamp`, `Recorded`, domain admission logic and namespace/pin allocator. Command 41 first-writer registration and command 42 exact execution cover preparation/staging Begin, Claim and Renew plus Bind. Positive and denied results share domain writes and SDK acceptance atomically. Late errors or ignored SQL writes leave SDK resolution absent; exact retry preserves the original identity. Corrupt metadata, `Unknown` and `Expired` are never treated as absence. Historical grants do not grant current custody or become new generation-retention roots. See the [durable custody contract](design/durable-custody-command-intents.md).
+
+Actual repository startup now discovers its latest custody head before preparing another original identity, including lost Begin and successor Claim results. It requires the current owner and a fresh custody query before using a historical grant; known denied final attempts require explicit registered Claim. Indexed authenticated historical grants allow fresh allocation after successor reaping without restoring an old namespace/pin. Production unbinds raw custody commands 11–13, 24–26 and 28; their domain methods are reused inside command 42 and explicit qualification fixtures. The production registry has 15 commands and nine queries. No old custody contract is retained as a production fallback.
+
+The journal uses a bounded command relation rather than per-object metadata: 4 KiB intents, 1 KiB phases with 512-byte replies, at most one unresolved head per operation, 1,024 pending heads and a 65,535 ordinal ceiling. Primary/partial grant indexes bound discovery. Registering every custody transition currently adds a mutation before execution. This local append history remains conservatively retained; before release, compact settled metadata into immutable per-operation frames with exact historical lookup. Count actual commands and metadata growth in capacity gates. Do not publish this partial cutover merely because primitive tests pass.
+
+Final-source macOS/Rust 1.98.0 qualification passes **283 publication tests** in 169.10 seconds and **nine workspace/lifecycle tests** in 3.58 seconds: **292 unique focused cases**, excluding repeated reruns. All-target workspace Clippy passes with warnings denied in 22.03 seconds; the server binary builds. Formatting/diff, 422 frozen Rust hashes, protected index/archive, clean SDK checkout and five-manifest/six-lock-entry SDK pins pass. Evidence is `/tmp/canopy-custody-intent-validation.json`; logs retain compilation failures, the deliberately rejected late writes and the initial query-plan failure. Twelve SHA-1/SHA-256 families cover original identities/receipts, pre-namespace persistence, denials, first-writer races, every transition, cold owner restore with deleted SQLite, actual SDK expiry, joint initialized bases, reaped successors, forgery/corruption, indexed lookup, late abort and silently ignored SQL writes. Real workspace tests check certified startup and byte-identical journal restore. The partial cutover still requires complete runtime/provider/Linux and capacity qualification.
+
+Highest priority remains production service conversion: StagingCoordinator, preparation/publication ready factories and direct session renewal must preserve these original intents under fair admission and process-loss reconstruction before their raw qualification bindings can be removed. Then close terminal history archival/retention, complete producer/reader conversion and final DDL removal, serving-generation ownership, typed collection/backup/restore, OS containment, continuous maintenance, physical rewrite/accelerated reads and full Linux/Kubernetes/Chromium histories with the 10,000-developer mixed-load gates. Unresolved expired identities remain protected; bounded orphan discovery and explicit lifecycle recovery remain open. No whole-goal or capacity claim is made.
+
 ## First accepted preparation admission checkpoint
 
 The local cutover now retains the first accepted `BeginPreparation` in the existing logical request row, using the same private bounded admission record, MAC, `Stamp` and `Recorded` result as staging. The two receipt kinds have separate purposes, columns and validators. Preparation records the actual command sequence, which can differ from the attempt sequence when Begin observes an already-bound staging attempt. Immutable SQL guards retain the first result through later admission, Claim, completion and reaping. Receipt encoding or the final insert/update failing rolls back allocation, custody and SDK acceptance together.

From 1a1116268f09e07ea59a9768d012a11d04cf6412 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 01:00:07 -0700
Subject: [PATCH 08/55] Own registered staging and preparation commands through
 recovery

Retain original custody and registrar commands in the staging service and
fair preparation dispatcher. Preserve both identities through cancellation,
registrar uncertainty and closed recovery; gate absent execution on the local
fence and deadlines while returning recorded knowledge first.

Remove caller-owned raw renewal APIs. Restore renewals with the existing
shared session fence so a failed fresh observation also fences old resolvers.
Charge bounded intent/body copies without raising admission or byte caps.

Qualify 286 publication and nine startup/workspace tests, warnings-denied
all-target Clippy, server build, frozen sources, dependency pins and protected
checkout files. Document asynchronous file attribution and its native studies.

This is an unpublished, unreleasable cutover checkpoint. Current-owner fencing
for cold sessions, orphan lifecycle/history archival, complete production
producer/reader/schema conversion and the remaining runtime/capacity gates
are still required.
---
 crates/canopy-server/src/lib.rs               |   1 +
 .../src/packs/publication/base.rs             |  15 +-
 .../publication/coordinator/preparation.rs    | 137 ++++++--
 .../src/packs/publication/coordinator/work.rs |   8 +
 .../src/packs/publication/custody/dispatch.rs | 136 ++++++++
 .../src/packs/publication/custody/mod.rs      |  38 ++-
 .../src/packs/publication/session.rs          |  39 +--
 .../src/packs/publication/staging_receipt.rs  |   8 +-
 .../src/packs/publication/staging_service.rs  | 299 +++++++++++-------
 .../src/packs/publication/tests.rs            |  46 ++-
 .../tests/coordinator/preparation.rs          |  73 +++--
 .../src/packs/publication/tests/custody.rs    |  81 +++++
 .../src/packs/publication/tests/inputs.rs     |  10 +-
 .../publication/tests/inputs/requests.rs      |   5 +-
 .../publication/tests/preparation_receipt.rs  |  21 +-
 .../src/packs/publication/tests/prepare.rs    |   5 +-
 .../publication/tests/staging_receipt.rs      |  66 ++--
 .../publication/tests/staging_service.rs      | 145 ++++++++-
 .../tests/staging_service/bound.rs            |  49 ++-
 .../tests/staging_service/publication.rs      |  10 +-
 docs/design/bound-preparation-dispatch.md     |  10 +-
 .../design/durable-custody-command-intents.md |  16 +-
 docs/design/file-attribution.md               |  77 +++++
 docs/design/shared-publication-dispatch.md    |  10 +-
 docs/design/staging-service-lifecycle.md      |  14 +-
 docs/large-repository-implementation-plan.md  |   1 +
 .../large-repository-implementation-status.md |  14 +-
 27 files changed, 1013 insertions(+), 321 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/custody/dispatch.rs
 create mode 100644 docs/design/file-attribution.md

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 42eb2545..cc001057 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -265,6 +265,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/custody/mod.rs"));
                 source.update(include_bytes!("packs/publication/custody/codec.rs"));
                 source.update(include_bytes!("packs/publication/custody/commands.rs"));
+                source.update(include_bytes!("packs/publication/custody/dispatch.rs"));
                 source.update(include_bytes!("packs/publication/preparation_receipt.rs"));
                 source.update(include_bytes!("packs/publication/coordinator.rs"));
                 source.update(include_bytes!("packs/publication/coordinator/policy.rs"));
diff --git a/crates/canopy-server/src/packs/publication/base.rs b/crates/canopy-server/src/packs/publication/base.rs
index df527c3e..716b4f5d 100644
--- a/crates/canopy-server/src/packs/publication/base.rs
+++ b/crates/canopy-server/src/packs/publication/base.rs
@@ -18,8 +18,6 @@ pub enum PreparationBaseError {
     Query(#[source] Box<InvocationError<Option<PreparationLease>>>),
     #[error("authoritative preparation frontier query failed")]
     Frontier(#[source] Box<InvocationError<Option<PreparationFrontier>>>),
-    #[error("preparation renewal failed")]
-    Command(#[source] Box<InvocationError<PreparationReply>>),
     #[error("preparation catalog loading failed")]
     Catalog(#[from] IndexError),
     #[error("preparation has no active matching lease")]
@@ -192,12 +190,19 @@ impl PreparationBaseResolver {
         .await
         .map_err(|_| PreparationBaseError::Inactive)?
     }
-    pub async fn renew(
+    /// Preparation does not submit a command. The caller transfers this exact
+    /// renewal into the service-owned publication coordinator.
+    pub async fn ready_renew(
         &self,
         identity: MutationIdentity,
         lease_ms: u64,
-    ) -> Result<(), PreparationBaseError> {
-        self.session.renew(identity, lease_ms).await
+    ) -> Result<ReadyPreparation, PreparationReadyError> {
+        Arc::new(self.session.clone())
+            .ready_renew(identity, lease_ms)
+            .await
+    }
+    pub async fn restore_renewal(&self) -> Result<ReadyPreparation, PreparationReadyError> {
+        Arc::new(self.session.clone()).restore_renewal().await
     }
 }
 impl BaseResolver for PreparationBaseResolver {
diff --git a/crates/canopy-server/src/packs/publication/coordinator/preparation.rs b/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
index 9ae78618..da322afd 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
@@ -1,8 +1,9 @@
 //! Bound attempt commands share exact publication ownership and admission.
+use super::super::custody::OwnedCustody;
 use super::*;
 
 const INLINE_BYTES: u32 = 4096;
-pub(super) const RESERVATION: u64 = 2 * INLINE_BYTES as u64;
+pub(super) const RESERVATION: u64 = super::super::custody::RESERVATION;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum PreparationCommandKind {
@@ -11,19 +12,19 @@ pub enum PreparationCommandKind {
 }
 #[derive(Debug, thiserror::Error)]
 pub enum PreparationReadyError {
+    #[error("preparation custody intent failed")]
+    Custody(#[from] CustodyError),
     #[error("preparation inactive or context differs")]
     Base(#[from] PreparationBaseError),
     #[error("preparation command encoding failed")]
     Codec(#[from] CodecError),
-    #[error("preparation command preparation failed")]
-    Command(#[source] Box<InvocationError<PreparationReply>>),
 }
 #[derive(Clone)]
 enum ExactPreparation {
-    Claim(PreparedCommand<ClaimPreparation>),
+    Claim(OwnedCustody),
     Renew {
-        command: PreparedCommand<RenewPreparation>,
-        session: Arc<PreparationSession>,
+        command: OwnedCustody,
+        session: Option<Arc<PreparationSession>>,
     },
 }
 #[must_use]
@@ -71,6 +72,36 @@ fn validate(target: &CellTarget, request: &LeaseRequest) -> Result<(), Preparati
     Ok(())
 }
 impl ReadyPreparation {
+    /// Reconstruct the registered original after process loss. Known results
+    /// remain knowledge; dispatch separately queries current lease authority.
+    pub async fn restore(
+        client: CellClient,
+        target: CellTarget,
+        operation: [u8; 16],
+    ) -> Result<Self, PreparationReadyError> {
+        let command = OwnedCustody::restore(&client, &target, operation).await?;
+        let (request, renew) = match command.action()? {
+            CustodyAction::ClaimPreparation(request) => (request, false),
+            CustodyAction::RenewPreparation(request) => (request, true),
+            _ => return Err(CustodyError::Context.into()),
+        };
+        validate(&target, &request)?;
+        Ok(Self {
+            inner: Box::new(PreparationRequest {
+                client,
+                target,
+                check: request.check,
+                exact: if renew {
+                    ExactPreparation::Renew {
+                        command,
+                        session: None,
+                    }
+                } else {
+                    ExactPreparation::Claim(command)
+                },
+            }),
+        })
+    }
     /// Claim may recover an expired or previous-owner attempt. Do not require a
     /// local live session; authoritative execution checks the exact old token.
     pub async fn claim(
@@ -81,10 +112,13 @@ impl ReadyPreparation {
     ) -> Result<Self, PreparationReadyError> {
         validate(&target, &request)?;
         let check = request.check.clone();
-        let command = client
-            .prepare_command::<ClaimPreparation>(&target, identity, request)
-            .await
-            .map_err(|e| PreparationReadyError::Command(Box::new(e)))?;
+        let command = OwnedCustody::prepare(
+            &client,
+            &target,
+            CustodyAction::ClaimPreparation(request),
+            identity,
+        )
+        .await?;
         Ok(Self {
             inner: Box::new(PreparationRequest {
                 client,
@@ -111,20 +145,31 @@ impl ReadyPreparation {
     }
     pub(super) async fn dispatch(self, recover: bool, fault: u8) -> DispatchResult {
         let inner = *self.inner;
-        let (kind, result, existing) = match inner.exact {
-            ExactPreparation::Claim(command) => (
-                PreparationCommandKind::Claim,
-                super::super::exact::invoke(&inner.client, command, recover, INLINE_BYTES, fault)
-                    .await,
-                None,
-            ),
-            ExactPreparation::Renew { command, session } => (
-                PreparationCommandKind::Renew,
-                super::super::exact::invoke(&inner.client, command, recover, INLINE_BYTES, fault)
-                    .await,
-                Some(session),
-            ),
+        let (kind, command, existing) = match inner.exact {
+            ExactPreparation::Claim(command) => (PreparationCommandKind::Claim, command, None),
+            ExactPreparation::Renew { command, session } => {
+                (PreparationCommandKind::Renew, command, session)
+            }
         };
+        let guard = existing.clone();
+        let result = command
+            .invoke(&inner.client, recover, fault, move || {
+                if let Some(session) = guard {
+                    session
+                        .live_lease()
+                        .map_err(|_| Error::Command("preparation renewal custody inactive"))?;
+                }
+                Ok(())
+            })
+            .await
+            .map_err(|source| PublicationError::Custody {
+                evidence: Box::new(command.evidence().clone()),
+                source: Box::new(source),
+            })?;
+        let result = super::super::custody::project(result, |reply| match reply {
+            CustodyReply::Preparation(reply) => Some(reply),
+            _ => None,
+        });
         let committed = match result {
             Ok(committed) => committed,
             Err(error) => {
@@ -155,7 +200,10 @@ impl ReadyPreparation {
                 if lease.token.repository != inner.check.token.repository
                     || lease.token.operation != inner.check.token.operation
                     || lease.token.request_digest != inner.check.token.request_digest
-                    || lease.token == inner.check.token
+                    || match kind {
+                        PreparationCommandKind::Claim => lease.token == inner.check.token,
+                        PreparationCommandKind::Renew => lease.token != inner.check.token,
+                    }
                 {
                     return Err(PreparationBaseError::Context);
                 }
@@ -189,6 +237,33 @@ impl ReadyPreparation {
     }
 }
 impl PreparationSession {
+    /// Restore the registered renewal while retaining this session's permanent
+    /// fence and conservative clock. Restoration is also valid after fencing:
+    /// known outcomes remain recoverable, but absence cannot restart custody.
+    pub async fn restore_renewal(
+        self: &Arc<Self>,
+    ) -> Result<ReadyPreparation, PreparationReadyError> {
+        let command =
+            OwnedCustody::restore(&self.client, &self.target, self.check.token.operation).await?;
+        let CustodyAction::RenewPreparation(request) = command.action()? else {
+            return Err(CustodyError::Context.into());
+        };
+        validate(&self.target, &request)?;
+        if request.check.token != self.check.token || request.check.actor != self.check.actor {
+            return Err(PreparationBaseError::Context.into());
+        }
+        Ok(ReadyPreparation {
+            inner: Box::new(PreparationRequest {
+                client: self.client.clone(),
+                target: self.target.clone(),
+                check: self.check.clone(),
+                exact: ExactPreparation::Renew {
+                    command,
+                    session: Some(self.clone()),
+                },
+            }),
+        })
+    }
     /// Prepare an exact renewal for service dispatch; a refused admission keeps
     /// the same identity. An ambiguous renewal keeps the previously observed
     /// deadline until resolved, and never grants custody from a recorded clock.
@@ -203,11 +278,13 @@ impl PreparationSession {
             lease_ms,
         };
         validate(&self.target, &request)?;
-        let command = self
-            .client
-            .prepare_command::<RenewPreparation>(&self.target, identity, request)
-            .await
-            .map_err(|e| PreparationReadyError::Command(Box::new(e)))?;
+        let command = OwnedCustody::prepare(
+            &self.client,
+            &self.target,
+            CustodyAction::RenewPreparation(request),
+            identity,
+        )
+        .await?;
         self.live_lease()?;
         Ok(ReadyPreparation {
             inner: Box::new(PreparationRequest {
@@ -216,7 +293,7 @@ impl PreparationSession {
                 check: self.check.clone(),
                 exact: ExactPreparation::Renew {
                     command,
-                    session: self.clone(),
+                    session: Some(self.clone()),
                 },
             }),
         })
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index 9e2c42d7..904faa4a 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -266,6 +266,11 @@ pub enum PublicationOutcome {
 }
 #[derive(Debug, thiserror::Error)]
 pub enum PublicationError {
+    #[error("publication custody intent failed")]
+    Custody {
+        evidence: Box<cellule_runtime::PendingMutation>,
+        source: Box<CustodyError>,
+    },
     #[error("repository initialization publication: {0}")]
     Initialization(#[source] InvocationError<InitializationReply>),
     #[error("terminal recovery release: {0}")]
@@ -300,6 +305,8 @@ impl PublicationError {
             }
         }
         match self {
+            Self::Custody { source, .. } if source.uncertain() => "pending",
+            Self::Custody { .. } => "not_started",
             Self::Recovery { .. } => "pending",
             Self::Initialization(error) => kind(error),
             Self::Push(error) => kind(error),
@@ -319,6 +326,7 @@ impl PublicationError {
             )
         }
         match self {
+            Self::Custody { source, .. } => source.uncertain(),
             Self::Recovery { .. } => true,
             Self::Initialization(error) => unknown(error),
             Self::Push(error) => unknown(error),
diff --git a/crates/canopy-server/src/packs/publication/custody/dispatch.rs b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
new file mode 100644
index 00000000..98cc05ba
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
@@ -0,0 +1,136 @@
+//! Service-owned original registration and custody command, never a fresh retry.
+use super::*;
+use cellule_runtime::PreparedCommand;
+
+// Retained and dispatch owners each hold intent + registrar body (four copies).
+// Registrar transport and bounded query decode add two more intent ceilings.
+// Original execution bodies and phase/reply decoding have independent ceilings.
+pub(in crate::packs::publication) const RESERVATION: u64 =
+    6 * INTENT_BYTES as u64 + 2 * INPUT_BYTES as u64 + 2 * 1024;
+
+#[derive(Clone)]
+pub(in crate::packs::publication) struct OwnedCustody {
+    prepared: PreparedCustody,
+    registration: Option<PreparedCommand<RegisterCustodyIntent>>,
+}
+impl OwnedCustody {
+    pub(in crate::packs::publication) async fn prepare(
+        client: &CellClient,
+        target: &CellTarget,
+        action: CustodyAction,
+        identity: MutationIdentity,
+    ) -> Result<Self, CustodyError> {
+        let prepared = PreparedCustody::prepare(client, target, action, identity).await?;
+        let registration = client
+            .prepare_command::<RegisterCustodyIntent>(
+                target,
+                crate::server::mutation_identity()
+                    .map_err(|error| CustodyError::Clock(Box::new(error)))?,
+                prepared.intent.clone(),
+            )
+            .await
+            .map_err(|error| CustodyError::Registration(Box::new(error)))?;
+        Ok(Self {
+            prepared,
+            registration: Some(registration),
+        })
+    }
+    pub(in crate::packs::publication) async fn restore(
+        client: &CellClient,
+        target: &CellTarget,
+        operation: [u8; 16],
+    ) -> Result<Self, CustodyError> {
+        let registered = load(client, target, operation, None)
+            .await?
+            .ok_or(CustodyError::Context)?;
+        Ok(Self {
+            prepared: PreparedCustody {
+                intent: registered.intent,
+            },
+            registration: None,
+        })
+    }
+    pub(in crate::packs::publication) fn action(&self) -> Result<CustodyAction, CodecError> {
+        Ok(self.prepared.intent.request()?.action)
+    }
+    pub(in crate::packs::publication) fn evidence(&self) -> &PendingMutation {
+        self.prepared.evidence()
+    }
+    #[cfg(test)]
+    pub(in crate::packs::publication) fn registration_evidence(&self) -> Option<&PendingMutation> {
+        self.registration.as_ref().map(PreparedCommand::evidence)
+    }
+    async fn persist(
+        &self,
+        client: &CellClient,
+        recover: bool,
+        fault: u8,
+    ) -> Result<RegisteredCustody, CustodyError> {
+        let header = self.prepared.intent.header()?;
+        let target = self.evidence().target();
+        if let Some(saved) = load(client, target, header.operation, Some(header.step)).await? {
+            return if saved.intent == self.prepared.intent {
+                Ok(saved)
+            } else {
+                Err(CustodyError::Context)
+            };
+        }
+        let registration = self.registration.as_ref().ok_or(CustodyError::Context)?;
+        let registration_fault = match fault {
+            4 => 1,
+            5 => 2,
+            6 => 3,
+            _ => 0,
+        };
+        let result = super::super::exact::invoke(
+            client,
+            registration.clone(),
+            recover,
+            4096,
+            registration_fault,
+        )
+        .await;
+        // Injected lost registrar replies remain uncertain until the observer
+        // requests recovery; ordinary network loss can use a durable pointer.
+        if registration_fault != 0 {
+            result.map_err(|error| CustodyError::Registration(Box::new(error)))?;
+        } else if let Some(saved) =
+            load(client, target, header.operation, Some(header.step)).await?
+        {
+            return if saved.intent == self.prepared.intent {
+                Ok(saved)
+            } else {
+                Err(CustodyError::Context)
+            };
+        } else {
+            result.map_err(|error| CustodyError::Registration(Box::new(error)))?;
+        }
+        Err(CustodyError::Context)
+    }
+    pub(in crate::packs::publication) async fn invoke(
+        &self,
+        client: &CellClient,
+        recover: bool,
+        fault: u8,
+        before_execute: impl FnOnce() -> Result<(), Error> + Send,
+    ) -> Result<Result<Committed<CustodyReply>, InvocationError<CustodyReply>>, CustodyError> {
+        let saved = self.persist(client, recover, fault).await?;
+        let execution_fault = if fault <= 3 { fault } else { 0 };
+        if execution_fault == 1 {
+            return Ok(Err(InvocationError::Pending(Box::new(
+                self.evidence().clone(),
+            ))));
+        }
+        let result = saved.recover_guarded(client, before_execute).await;
+        if execution_fault == 2 {
+            return Ok(Err(InvocationError::Pending(Box::new(
+                self.evidence().clone(),
+            ))));
+        }
+        assert_ne!(
+            execution_fault, 3,
+            "injected custody command panic after execution"
+        );
+        Ok(result)
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/custody/mod.rs b/crates/canopy-server/src/packs/publication/custody/mod.rs
index d286c052..cf19af9c 100644
--- a/crates/canopy-server/src/packs/publication/custody/mod.rs
+++ b/crates/canopy-server/src/packs/publication/custody/mod.rs
@@ -12,7 +12,9 @@ use cellule_runtime::{
 };
 mod codec;
 mod commands;
+mod dispatch;
 pub use commands::{ExecuteCustody, RegisterCustodyIntent};
+pub(super) use dispatch::{OwnedCustody, RESERVATION};
 
 const INPUT_BYTES: u32 = 1024;
 const INTENT_BYTES: u32 = 4096;
@@ -142,6 +144,8 @@ impl CustodyIntent {
 
 #[derive(Debug, thiserror::Error)]
 pub enum CustodyError {
+    #[error("custody command clock failed")]
+    Clock(#[source] Box<crate::server::ServerError>),
     #[error("custody command encoding failed")]
     Codec(#[from] CodecError),
     #[error("custody command binding failed")]
@@ -158,8 +162,32 @@ pub enum CustodyError {
     Context,
 }
 
+impl CustodyError {
+    pub(super) fn uncertain(&self) -> bool {
+        match self {
+            Self::Registration(error) => matches!(
+                &**error,
+                InvocationError::Pending(_) | InvocationError::InvalidPublishedResult { .. }
+            ),
+            Self::Preparation(error) => matches!(
+                &**error,
+                InvocationError::Pending(_) | InvocationError::InvalidPublishedResult { .. }
+            ),
+            Self::Clock(_) => false,
+            // Failure to authenticate or observe metadata is never proof of
+            // absence. Keep the owned original until its disposition is known.
+            Self::Query(_)
+            | Self::Codec(_)
+            | Self::Capability(_)
+            | Self::Unsettled(_)
+            | Self::Context => true,
+        }
+    }
+}
+
 /// Retains the original SDK snapshot/body even if registration loses its reply.
 /// Registration must become discoverable before this command can execute.
+#[derive(Clone)]
 #[must_use]
 pub struct PreparedCustody {
     intent: CustodyIntent,
@@ -429,6 +457,13 @@ impl RegisteredCustody {
     pub async fn recover(
         &self,
         client: &CellClient,
+    ) -> Result<Committed<CustodyReply>, InvocationError<CustodyReply>> {
+        self.recover_guarded(client, || Ok(())).await
+    }
+    async fn recover_guarded(
+        &self,
+        client: &CellClient,
+        before_execute: impl FnOnce() -> Result<(), Error> + Send,
     ) -> Result<Committed<CustodyReply>, InvocationError<CustodyReply>> {
         let evidence = self.evidence();
         let recover = async {
@@ -466,6 +501,7 @@ impl RegisteredCustody {
             // reports acceptance. Missing application knowledge is corruption.
             return Err(InvocationError::Pending(Box::new(evidence.clone())));
         }
+        before_execute().map_err(InvocationError::NotStarted)?;
         let command = client
             .restore_command::<ExecuteCustody>(
                 self.intent.snapshot.clone(),
@@ -485,7 +521,7 @@ fn normalize(
     }
 }
 
-fn project<T>(
+pub(super) fn project<T>(
     result: Result<Committed<CustodyReply>, InvocationError<CustodyReply>>,
     output: impl FnOnce(CustodyReply) -> Option<T>,
 ) -> Result<Committed<T>, InvocationError<T>> {
diff --git a/crates/canopy-server/src/packs/publication/session.rs b/crates/canopy-server/src/packs/publication/session.rs
index 31db7887..556937c2 100644
--- a/crates/canopy-server/src/packs/publication/session.rs
+++ b/crates/canopy-server/src/packs/publication/session.rs
@@ -1,6 +1,6 @@
 //! Shared authoritative preparation lease; no artifact loads or scratch.
 use super::*;
-use cellule_runtime::{CellClient, CellTarget, MutationIdentity, Receipt};
+use cellule_runtime::{CellClient, CellTarget, Receipt};
 use std::{
     sync::{
         Arc, Mutex,
@@ -62,43 +62,6 @@ impl PreparationSession {
         }
         Ok((self.lease, deadline))
     }
-    /// A recorded renewal result is never a fresh clock observation. Query
-    /// after the durability gate even when the command is exact-outcome replay.
-    pub async fn renew(
-        &self,
-        identity: MutationIdentity,
-        lease_ms: u64,
-    ) -> Result<(), PreparationBaseError> {
-        let result = self.renew_inner(identity, lease_ms).await;
-        if result.is_err() {
-            self.fenced.store(true, Ordering::Release);
-        }
-        result
-    }
-    async fn renew_inner(
-        &self,
-        identity: MutationIdentity,
-        lease_ms: u64,
-    ) -> Result<(), PreparationBaseError> {
-        if self.fenced.load(Ordering::Acquire)
-            || self.ceiling.is_some_and(|limit| Instant::now() >= limit)
-        {
-            return Err(PreparationBaseError::Inactive);
-        }
-        let committed = self
-            .client
-            .command::<RenewPreparation>(
-                &self.target,
-                identity,
-                LeaseRequest {
-                    check: self.check.clone(),
-                    lease_ms,
-                },
-            )
-            .await
-            .map_err(|error| PreparationBaseError::Command(Box::new(error)))?;
-        self.refresh(committed.receipt).await
-    }
     pub(super) fn fence(&self) {
         self.fenced.store(true, Ordering::Release);
     }
diff --git a/crates/canopy-server/src/packs/publication/staging_receipt.rs b/crates/canopy-server/src/packs/publication/staging_receipt.rs
index 2d108de1..7c57a791 100644
--- a/crates/canopy-server/src/packs/publication/staging_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/staging_receipt.rs
@@ -5,7 +5,7 @@ use super::{
     recovery::phase::Recorded,
     *,
 };
-use cellule_runtime::{CellClient, CellTarget, Committed, MutationIdentity, PendingMutation};
+use cellule_runtime::{CellClient, CellTarget, MutationIdentity};
 
 #[derive(Clone)]
 pub(super) struct Staging;
@@ -82,12 +82,6 @@ impl StagingAdmission {
         )
         .await
     }
-    pub(super) fn original(
-        &self,
-        evidence: &PendingMutation,
-    ) -> Result<Option<Committed<StagingReply>>, StagingReceiptError> {
-        self.0.original(evidence)
-    }
 }
 pub(super) fn save(
     context: &CommandContext<'_, '_>,
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index 890a92e6..b26901f7 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -1,5 +1,6 @@
 //! Service-owned, bounded input custody. Never infer a live deadline from a
 //! replayed command, discard ambiguous evidence, or let an observer cancel work.
+use super::custody::OwnedCustody;
 use super::*;
 use crate::packs::catalog::{CatalogFiles, CatalogIndexes};
 use cellule_runtime::{
@@ -110,13 +111,13 @@ pub enum StagingError {
     BoundClaim(#[source] Box<InvocationError<PreparationReply>>),
     #[error("staging bind failed")]
     Bind(#[source] Box<InvocationError<PreparationReply>>),
-    #[error("initial staging receipt recovery failed")]
-    ReceiptRecovery {
+    #[error("staging custody preparation failed")]
+    CustodyReady(#[source] Box<CustodyError>),
+    #[error("staging custody protocol failed")]
+    Custody {
         evidence: Box<cellule_runtime::PendingMutation>,
-        source: Box<StagingReceiptError>,
+        source: Box<CustodyError>,
     },
-    #[error("initial staging receipt lookup failed")]
-    ReceiptLookup(#[source] Box<StagingReceiptError>),
     #[error("staging query failed")]
     Query(#[source] Box<InvocationError<Option<StagingLease>>>),
     #[error("bound base failed")]
@@ -126,9 +127,9 @@ pub enum StagingError {
     #[error("final publication failed: {0}")]
     Publication(#[source] Arc<PublicationError>),
 }
-impl From<StagingReceiptError> for StagingError {
-    fn from(error: StagingReceiptError) -> Self {
-        Self::ReceiptLookup(Box::new(error))
+impl From<CustodyError> for StagingError {
+    fn from(error: CustodyError) -> Self {
+        Self::CustodyReady(Box::new(error))
     }
 }
 impl StagingError {
@@ -142,7 +143,7 @@ impl StagingError {
         match self {
             Self::Begin(e) | Self::Renew(e) | Self::Claim(e) | Self::Checkpoint(e) => unknown(e),
             Self::Bind(e) | Self::BoundRenew(e) | Self::BoundClaim(e) => unknown(e),
-            Self::ReceiptRecovery { .. } => true,
+            Self::Custody { source, .. } => source.uncertain(),
             _ => false,
         }
     }
@@ -204,23 +205,25 @@ impl ReadyStaging {
         request
             .encode(&mut BoundedEncoder::new(COMMAND_BYTES).map_err(|_| StagingError::Context)?)
             .map_err(|_| StagingError::Context)?;
-        if StagingAdmission::load(&client, &target, request.operation)
+        if RegisteredCustody::load_latest(&client, &target, request.operation)
             .await?
             .is_some()
         {
             return Err(StagingError::Duplicate);
         }
-        let command = client
-            .prepare_command::<BeginStaging>(&target, identity, request.clone())
-            .await
-            .map_err(|e| StagingError::Begin(Box::new(e)))?;
-        let operation = request.operation;
+        let command = OwnedCustody::prepare(
+            &client,
+            &target,
+            CustodyAction::BeginStaging(request.clone()),
+            identity,
+        )
+        .await?;
         Ok(Self {
             inner: Box::new(StagingRequest {
                 client,
                 target,
                 request,
-                command: Exact::Begin(command, operation),
+                command: Exact::Begin(command),
                 bound_source: None,
             }),
         })
@@ -249,10 +252,13 @@ impl ReadyStaging {
         request
             .encode(&mut BoundedEncoder::new(COMMAND_BYTES).map_err(|_| StagingError::Context)?)
             .map_err(|_| StagingError::Context)?;
-        let command = client
-            .prepare_command::<ClaimStaging>(&target, identity, request)
-            .await
-            .map_err(|e| StagingError::Claim(Box::new(e)))?;
+        let command = OwnedCustody::prepare(
+            &client,
+            &target,
+            CustodyAction::ClaimStaging(request),
+            identity,
+        )
+        .await?;
         Ok(Self {
             inner: Box::new(StagingRequest {
                 client,
@@ -288,10 +294,13 @@ impl ReadyStaging {
             .encode(&mut BoundedEncoder::new(COMMAND_BYTES).map_err(|_| StagingError::Context)?)
             .map_err(|_| StagingError::Context)?;
         let source = request.check.clone();
-        let command = client
-            .prepare_command::<ClaimPreparation>(&target, identity, request)
-            .await
-            .map_err(|e| StagingError::BoundClaim(Box::new(e)))?;
+        let command = OwnedCustody::prepare(
+            &client,
+            &target,
+            CustodyAction::ClaimPreparation(request),
+            identity,
+        )
+        .await?;
         Ok(Self {
             inner: Box::new(StagingRequest {
                 client,
@@ -365,14 +374,14 @@ struct Job {
 }
 #[derive(Clone)]
 enum Exact {
-    Begin(PreparedCommand<BeginStaging>, [u8; 16]),
-    Claim(PreparedCommand<ClaimStaging>),
+    Begin(OwnedCustody),
+    Claim(OwnedCustody),
     Checkpoint(PreparedCommand<RegisterStagedInputs>),
     BoundCheckpoint(PreparedCommand<RegisterStagedInputs>),
-    Renew(PreparedCommand<RenewStaging>),
-    Bind(PreparedCommand<BindStaging>),
-    BoundClaim(PreparedCommand<ClaimPreparation>),
-    BoundRenew(PreparedCommand<RenewPreparation>),
+    Renew(OwnedCustody),
+    Bind(OwnedCustody),
+    BoundClaim(OwnedCustody),
+    BoundRenew(OwnedCustody),
 }
 enum Outcome {
     Stage(Committed<StagingReply>),
@@ -385,7 +394,7 @@ enum Outcome {
 impl Exact {
     fn pending(&self) -> StagingError {
         match self {
-            Self::Begin(c, _) => StagingError::Begin(Box::new(InvocationError::Pending(Box::new(
+            Self::Begin(c) => StagingError::Begin(Box::new(InvocationError::Pending(Box::new(
                 c.evidence().clone(),
             )))),
             Self::Claim(c) => StagingError::Claim(Box::new(InvocationError::Pending(Box::new(
@@ -408,41 +417,105 @@ impl Exact {
             )))),
         }
     }
+    async fn custody<T>(
+        command: OwnedCustody,
+        client: &CellClient,
+        recover: bool,
+        fault: u8,
+        job: &Job,
+        project: fn(CustodyReply) -> Option<T>,
+        role: fn(Box<InvocationError<T>>) -> StagingError,
+    ) -> Result<Committed<T>, StagingError> {
+        let result = command
+            .invoke(client, recover, fault, || {
+                let local = job
+                    .local
+                    .lock()
+                    .map_err(|_| Error::Command("staging custody poisoned"))?;
+                let now = Instant::now();
+                if local.fenced
+                    || now >= local.lifetime
+                    || ((local.lease.is_some() || local.bound.is_some()) && now >= local.deadline)
+                {
+                    return Err(Error::Command("staging custody inactive"));
+                }
+                Ok(())
+            })
+            .await
+            .map_err(|source| StagingError::Custody {
+                evidence: Box::new(command.evidence().clone()),
+                source: Box::new(source),
+            })?;
+        super::custody::project(result, project).map_err(|error| role(Box::new(error)))
+    }
     async fn execute(
         self,
         client: CellClient,
+        job: Arc<Job>,
         recover: bool,
         fault: u8,
     ) -> Result<Outcome, StagingError> {
+        fn stage(reply: CustodyReply) -> Option<StagingReply> {
+            match reply {
+                CustodyReply::Staging(reply) => Some(reply),
+                _ => None,
+            }
+        }
+        fn preparation(reply: CustodyReply) -> Option<PreparationReply> {
+            match reply {
+                CustodyReply::Preparation(reply) => Some(reply),
+                _ => None,
+            }
+        }
         match self {
-            Self::Begin(c, operation) => {
-                if recover {
-                    let known = async {
-                        match StagingAdmission::load(&client, c.evidence().target(), operation)
-                            .await?
-                        {
-                            Some(saved) => saved.original(c.evidence()),
-                            None => Ok(None),
-                        }
-                    }
+            Self::Begin(c) => {
+                Self::custody(c, &client, recover, fault, &job, stage, StagingError::Begin)
                     .await
-                    .map_err(|source| StagingError::ReceiptRecovery {
-                        evidence: Box::new(c.evidence().clone()),
-                        source: Box::new(source),
-                    })?;
-                    if let Some(value) = known {
-                        return Ok(Outcome::Stage(value));
-                    }
-                }
-                super::exact::invoke(&client, c, recover, COMMAND_BYTES, fault)
+                    .map(Outcome::Stage)
+            }
+            Self::Claim(c) => {
+                Self::custody(c, &client, recover, fault, &job, stage, StagingError::Claim)
                     .await
                     .map(Outcome::Stage)
-                    .map_err(|e| StagingError::Begin(Box::new(e)))
             }
-            Self::Claim(c) => super::exact::invoke(&client, c, recover, COMMAND_BYTES, fault)
-                .await
-                .map(Outcome::Stage)
-                .map_err(|e| StagingError::Claim(Box::new(e))),
+            Self::Renew(c) => {
+                Self::custody(c, &client, recover, fault, &job, stage, StagingError::Renew)
+                    .await
+                    .map(Outcome::Stage)
+            }
+            Self::Bind(c) => Self::custody(
+                c,
+                &client,
+                recover,
+                fault,
+                &job,
+                preparation,
+                StagingError::Bind,
+            )
+            .await
+            .map(Outcome::Bound),
+            Self::BoundClaim(c) => Self::custody(
+                c,
+                &client,
+                recover,
+                fault,
+                &job,
+                preparation,
+                StagingError::BoundClaim,
+            )
+            .await
+            .map(Outcome::BoundClaim),
+            Self::BoundRenew(c) => Self::custody(
+                c,
+                &client,
+                recover,
+                fault,
+                &job,
+                preparation,
+                StagingError::BoundRenew,
+            )
+            .await
+            .map(Outcome::BoundRenew),
             Self::Checkpoint(c) => super::exact::invoke(&client, c, recover, COMMAND_BYTES, fault)
                 .await
                 .map(Outcome::Checkpoint)
@@ -453,22 +526,6 @@ impl Exact {
                     .map(Outcome::BoundCheckpoint)
                     .map_err(|e| StagingError::Checkpoint(Box::new(e)))
             }
-            Self::Renew(c) => super::exact::invoke(&client, c, recover, COMMAND_BYTES, fault)
-                .await
-                .map(Outcome::Stage)
-                .map_err(|e| StagingError::Renew(Box::new(e))),
-            Self::BoundClaim(c) => super::exact::invoke(&client, c, recover, COMMAND_BYTES, fault)
-                .await
-                .map(Outcome::BoundClaim)
-                .map_err(|e| StagingError::BoundClaim(Box::new(e))),
-            Self::BoundRenew(c) => super::exact::invoke(&client, c, recover, COMMAND_BYTES, fault)
-                .await
-                .map(Outcome::BoundRenew)
-                .map_err(|e| StagingError::BoundRenew(Box::new(e))),
-            Self::Bind(c) => super::exact::invoke(&client, c, recover, COMMAND_BYTES, fault)
-                .await
-                .map(Outcome::Bound)
-                .map_err(|e| StagingError::Bind(Box::new(e))),
         }
     }
 }
@@ -625,9 +682,9 @@ impl StagingCoordinator {
                 .jobs
                 .values()
                 .map(|job| {
-                    let copies =
-                        2 + u64::from(job.checkpoint.lock().expect("staging checkpoint").is_some());
-                    copies * COMMAND_BYTES as u64
+                    super::custody::RESERVATION
+                        + u64::from(job.checkpoint.lock().expect("staging checkpoint").is_some())
+                            * u64::from(COMMAND_BYTES)
                 })
                 .sum(),
             closed: a.closed,
@@ -722,6 +779,28 @@ impl StagedInputsTicket {
     }
 }
 impl StagingTicket {
+    #[cfg(test)]
+    pub(super) fn custody_evidence_for_test(
+        &self,
+    ) -> Option<(
+        cellule_runtime::PendingMutation,
+        Option<cellule_runtime::PendingMutation>,
+    )> {
+        let exact = self.job.exact.lock().expect("staging exact");
+        let command = match exact.as_ref()? {
+            Exact::Begin(command)
+            | Exact::Claim(command)
+            | Exact::Renew(command)
+            | Exact::Bind(command)
+            | Exact::BoundClaim(command)
+            | Exact::BoundRenew(command) => command,
+            Exact::Checkpoint(_) | Exact::BoundCheckpoint(_) => return None,
+        };
+        Some((
+            command.evidence().clone(),
+            command.registration_evidence().cloned(),
+        ))
+    }
     /// Synchronously transfer one bounded checkpoint request into service
     /// custody. A dropped observer cannot cancel or replace its exact identity.
     pub fn register_inputs(
@@ -1302,9 +1381,10 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
             #[cfg(not(test))]
             let fault = 0;
             let pending = command.pending();
-            let result = tokio::spawn(command.execute(job.client.clone(), recover, fault))
-                .await
-                .unwrap_or(Err(pending));
+            let result =
+                tokio::spawn(command.execute(job.client.clone(), Arc::clone(&job), recover, fault))
+                    .await
+                    .unwrap_or(Err(pending));
             match result {
                 Err(error) if error.uncertain() => {
                     job.status
@@ -1680,12 +1760,15 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
                 job.status.send_replace(StagingState::Binding);
                 let identity = crate::server::mutation_identity().map_err(|_| StagingError::Clock);
                 let result = match identity {
-                    Ok(id) => job
-                        .client
-                        .prepare_command::<BindStaging>(&job.target, id, check)
-                        .await
-                        .map(Exact::Bind)
-                        .map_err(|e| StagingError::Bind(Box::new(e))),
+                    Ok(id) => OwnedCustody::prepare(
+                        &job.client,
+                        &job.target,
+                        CustodyAction::BindStaging(check),
+                        id,
+                    )
+                    .await
+                    .map(Exact::Bind)
+                    .map_err(StagingError::from),
                     Err(e) => Err(e),
                 };
                 match result {
@@ -1701,19 +1784,18 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
             Next::BoundRenew(check) => {
                 let identity = crate::server::mutation_identity().map_err(|_| StagingError::Clock);
                 let result = match identity {
-                    Ok(id) => job
-                        .client
-                        .prepare_command::<RenewPreparation>(
-                            &job.target,
-                            id,
-                            LeaseRequest {
-                                check,
-                                lease_ms: inner.limits.lease_ms,
-                            },
-                        )
-                        .await
-                        .map(Exact::BoundRenew)
-                        .map_err(|e| StagingError::BoundRenew(Box::new(e))),
+                    Ok(id) => OwnedCustody::prepare(
+                        &job.client,
+                        &job.target,
+                        CustodyAction::RenewPreparation(LeaseRequest {
+                            check,
+                            lease_ms: inner.limits.lease_ms,
+                        }),
+                        id,
+                    )
+                    .await
+                    .map(Exact::BoundRenew)
+                    .map_err(StagingError::from),
                     Err(e) => Err(e),
                 };
                 match result {
@@ -1729,19 +1811,18 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
             Next::Renew(check) => {
                 let identity = crate::server::mutation_identity().map_err(|_| StagingError::Clock);
                 let result = match identity {
-                    Ok(id) => job
-                        .client
-                        .prepare_command::<RenewStaging>(
-                            &job.target,
-                            id,
-                            LeaseRequest {
-                                check,
-                                lease_ms: inner.limits.lease_ms,
-                            },
-                        )
-                        .await
-                        .map(Exact::Renew)
-                        .map_err(|e| StagingError::Renew(Box::new(e))),
+                    Ok(id) => OwnedCustody::prepare(
+                        &job.client,
+                        &job.target,
+                        CustodyAction::RenewStaging(LeaseRequest {
+                            check,
+                            lease_ms: inner.limits.lease_ms,
+                        }),
+                        id,
+                    )
+                    .await
+                    .map(Exact::Renew)
+                    .map_err(StagingError::from),
                     Err(e) => Err(e),
                 };
                 match result {
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 19c4b7de..7b8aa747 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -309,6 +309,22 @@ fn identity() -> std::io::Result<MutationIdentity> {
         expires_at_ms: now + 60_000,
     })
 }
+async fn registered_preparation(
+    f: &Fixture,
+    operation: [u8; 16],
+) -> Result<cellule_runtime::Committed<PreparationReply>> {
+    Ok(PreparedCustody::prepare(
+        &f.client(),
+        &f.target,
+        CustodyAction::BeginPreparation(f.begin(operation)),
+        identity()?,
+    )
+    .await?
+    .register(&f.client(), identity()?)
+    .await?
+    .recover_preparation(&f.client())
+    .await?)
+}
 fn lease(reply: PreparationReply) -> Result<PreparationLease> {
     match reply {
         PreparationReply::Granted(lease) => Ok(*lease),
@@ -1030,9 +1046,7 @@ async fn authoritative_base_resolution_uses_live_queried_facts_and_fences_failed
                 .await?;
         fixture.install_catalog(1, native.stored).await?;
         let client = fixture.client();
-        let started = client
-            .command::<BeginPreparation>(&fixture.target, identity()?, fixture.begin([36; 16]))
-            .await?;
+        let started = registered_preparation(&fixture, [36; 16]).await?;
         let granted = lease(started.output)?;
         let budget = DiskBudget::new(128 << 20);
         let files = Arc::new(CatalogFiles::new(
@@ -1079,7 +1093,17 @@ async fn authoritative_base_resolution_uses_live_queried_facts_and_fences_failed
             Err(ClosureError::Integrity)
         ));
         let renewal = identity()?;
-        resolver.renew(renewal, DEFAULT_LEASE_MS).await?;
+        let coordinator =
+            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let ticket = coordinator
+            .submit(resolver.ready_renew(renewal, DEFAULT_LEASE_MS).await?)
+            .await?;
+        let PublicationState::Finished(Ok(PublicationOutcome::Preparation(outcome))) =
+            ticket.wait().await
+        else {
+            return Err("renewal did not finish".into());
+        };
+        outcome.session.map_err(|e| e.to_string())?;
         fixture
             .handle
             .execute(
@@ -1099,10 +1123,20 @@ async fn authoritative_base_resolution_uses_live_queried_facts_and_fences_failed
             .await?;
         // The exact renewal RPC replays success, but the subsequent fresh query
         // sees expiry. It cannot restart a local deadline from the old reply.
+        let replay = coordinator
+            .submit(resolver.restore_renewal().await?)
+            .await?;
+        let PublicationState::Finished(Ok(PublicationOutcome::Preparation(replayed))) =
+            replay.wait().await
+        else {
+            return Err("renewal replay did not finish".into());
+        };
+        assert_eq!(replayed.committed, outcome.committed);
         assert!(matches!(
-            resolver.renew(renewal, DEFAULT_LEASE_MS).await,
-            Err(PreparationBaseError::Inactive)
+            &replayed.session,
+            Err(error) if matches!(&**error, PreparationBaseError::Inactive)
         ));
+        assert!(coordinator.close_and_drain().await.is_empty());
         assert!(matches!(
             resolver.resolve(base, &ids).await,
             Err(ClosureError::LeaseExpired)
diff --git a/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs b/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
index 8f402a03..3bd78332 100644
--- a/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
+++ b/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
@@ -1,10 +1,7 @@
 use super::*;
 
 async fn session(f: &Fixture, operation: [u8; 16]) -> Result<Arc<PreparationSession>> {
-    let started = f
-        .client()
-        .command::<BeginPreparation>(&f.target, identity()?, f.begin(operation))
-        .await?;
+    let started = registered_preparation(f, operation).await?;
     let lease = lease(started.output)?;
     Ok(Arc::new(
         PreparationSession::open(
@@ -47,25 +44,26 @@ async fn replay(
     kind: PreparationCommandKind,
     mutation: MutationIdentity,
 ) -> Result<cellule_runtime::Committed<PreparationReply>> {
-    Ok(match kind {
-        PreparationCommandKind::Claim => {
-            f.client()
-                .command::<ClaimPreparation>(&f.target, mutation, request_for(s))
-                .await?
-        }
-        PreparationCommandKind::Renew => {
-            f.client()
-                .command::<RenewPreparation>(&f.target, mutation, request_for(s))
-                .await?
-        }
-    })
+    let saved = RegisteredCustody::load_latest(&f.client(), &f.target, s.lease.token.operation)
+        .await?
+        .ok_or("registered command missing")?;
+    assert_eq!(saved.evidence().identity(), mutation);
+    let result = saved.recover_preparation(&f.client()).await?;
+    let PreparationReply::Granted(lease) = &result.output else {
+        return Err("unexpected replay denial".into());
+    };
+    assert_eq!(
+        lease.token == s.lease.token,
+        kind == PreparationCommandKind::Renew
+    );
+    Ok(result)
 }
 #[tokio::test]
 async fn bound_lease_commands_keep_exact_identity_and_original_floor_through_closed_uncertain_recovery()
 -> Result {
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         for kind in [PreparationCommandKind::Claim, PreparationCommandKind::Renew] {
-            for fault in [1, 2, 3] {
+            for fault in [1, 2, 3, 4, 5, 6] {
                 let f = Fixture::new(format).await?;
                 let s = session(&f, [196; 16]).await?;
                 f.install_empty_root(1).await?;
@@ -81,20 +79,31 @@ async fn bound_lease_commands_keep_exact_identity_and_original_floor_through_clo
                 else {
                     return Err("lease uncertainty".into());
                 };
-                let PublicationError::Preparation(cellule_runtime::InvocationError::Pending(
-                    evidence,
-                )) = &*error
-                else {
-                    return Err("exact lease evidence".into());
+                let (evidence, registrar) = match &*error {
+                    PublicationError::Preparation(cellule_runtime::InvocationError::Pending(
+                        evidence,
+                    )) => ((**evidence).clone(), None),
+                    PublicationError::Custody { evidence, source } => {
+                        let CustodyError::Registration(source) = &**source else {
+                            return Err("wrong registrar error".into());
+                        };
+                        let InvocationError::Pending(registrar) = &**source else {
+                            return Err("registrar identity lost".into());
+                        };
+                        ((**evidence).clone(), Some((**registrar).clone()))
+                    }
+                    _ => return Err("exact lease evidence".into()),
                 };
-                let evidence = (**evidence).clone();
                 let original = match f.client().resolve(&evidence).await? {
                     cellule_runtime::Resolution::Absent => None,
                     cellule_runtime::Resolution::Committed(value) => Some(value.commit_sequence()),
                     other => return Err(format!("unexpected {other:?}").into()),
                 };
-                assert_eq!(original.is_some(), fault != 1);
-                assert_eq!(coordinator.reservations_for_test().await, (1, 8192, 1));
+                assert_eq!(original.is_some(), matches!(fault, 2 | 3));
+                assert_eq!(
+                    coordinator.reservations_for_test().await,
+                    (1, super::super::super::custody::RESERVATION, 1)
+                );
                 drop(ticket);
                 let retained = coordinator
                     .pending([196; 16])
@@ -104,6 +113,12 @@ async fn bound_lease_commands_keep_exact_identity_and_original_floor_through_clo
                 coordinator.recover(&retained).await?;
                 let outcome = changed(timeout(Duration::from_secs(10), retained.wait()).await?)?;
                 assert_eq!(outcome.kind, kind);
+                if let Some(registrar) = registrar {
+                    assert!(matches!(
+                        f.client().resolve(&registrar).await?,
+                        cellule_runtime::Resolution::Committed(_)
+                    ));
+                }
                 assert_eq!(outcome.committed, replay(&f, &s, kind, mutation).await?);
                 if let Some(sequence) = original {
                     assert_eq!(outcome.committed.receipt.commit_sequence, sequence);
@@ -397,9 +412,11 @@ async fn bound_lease_claim_after_actual_owner_restore_uses_new_fence_and_preserv
             .ok_or("restored Claim retained")?;
         coordinator.recover(&retained).await?;
         let outcome = changed(timeout(Duration::from_secs(10), retained.wait()).await?)?;
-        let replay = client
-            .command::<ClaimPreparation>(&f.target, mutation, request_for(&original))
-            .await?;
+        let original_command = RegisteredCustody::load_latest(&client, &f.target, old.operation)
+            .await?
+            .ok_or("claim journal missing")?;
+        assert_eq!(original_command.evidence().identity(), mutation);
+        let replay = original_command.recover_preparation(&client).await?;
         assert_eq!(outcome.committed, replay);
         let current = outcome.session.map_err(|e| e.to_string())?;
         let next = current.live_lease()?.0;
diff --git a/crates/canopy-server/src/packs/publication/tests/custody.rs b/crates/canopy-server/src/packs/publication/tests/custody.rs
index d7bd9cf7..c0f8f8c6 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody.rs
@@ -32,6 +32,87 @@ async fn expire(identity: MutationIdentity) -> Result {
     Ok(())
 }
 
+#[tokio::test]
+async fn owned_registrar_loss_preserves_both_originals_and_recovers_without_new_namespace() -> Result
+{
+    use crate::packs::publication::custody::OwnedCustody;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in [4, 5, 6] {
+            let f = Fixture::new(format).await?;
+            let operation = [fault + 180; 16];
+            let owned = OwnedCustody::prepare(
+                &f.client(),
+                &f.target,
+                CustodyAction::BeginPreparation(f.begin(operation)),
+                identity()?,
+            )
+            .await?;
+            let original = owned.evidence().clone();
+            let registrar = owned
+                .registration_evidence()
+                .ok_or("registrar missing")?
+                .clone();
+            assert_ne!(original, registrar);
+            let dispatch = owned.clone();
+            let client = f.client();
+            let result =
+                tokio::spawn(
+                    async move { dispatch.invoke(&client, false, fault, || Ok(())).await },
+                )
+                .await;
+            if fault == 6 {
+                assert!(result.is_err_and(|error| error.is_panic()));
+            } else {
+                let Err(CustodyError::Registration(error)) = result? else {
+                    return Err("registrar fault did not preserve uncertainty".into());
+                };
+                let InvocationError::Pending(evidence) = *error else {
+                    return Err("registrar fault returned terminal evidence".into());
+                };
+                assert_eq!(*evidence, registrar);
+            }
+            assert_eq!(owned.evidence(), &original);
+            assert_eq!(owned.registration_evidence(), Some(&registrar));
+            assert_eq!(f.counts().await?, (0, 0));
+            assert!(matches!(
+                f.client().resolve(&original).await?,
+                Resolution::Absent
+            ));
+            let registered =
+                RegisteredCustody::load_latest(&f.client(), &f.target, operation).await?;
+            assert_eq!(registered.is_some(), fault != 4);
+            if let Some(registered) = registered {
+                assert_eq!(registered.evidence(), &original);
+            }
+            let committed = owned.invoke(&f.client(), true, 0, || Ok(())).await??;
+            assert_eq!(
+                token(&committed.output)?.artifact_operation,
+                artifact_number(1)
+            );
+            assert_eq!(f.counts().await?, (1, 1));
+            assert!(matches!(
+                f.client().resolve(&registrar).await?,
+                Resolution::Committed(_)
+            ));
+            drop(owned);
+            let restored = OwnedCustody::restore(&f.client(), &f.target, operation).await?;
+            assert_eq!(restored.evidence(), &original);
+            assert!(restored.registration_evidence().is_none());
+            // Recorded knowledge precedes a fresh execution guard; recovery
+            // must not execute another Begin or allocate another namespace.
+            let replay = restored
+                .invoke(&f.client(), true, 0, || {
+                    Err(Error::Command("fresh custody denied"))
+                })
+                .await??;
+            assert_eq!(replay, committed);
+            assert_eq!(f.counts().await?, (1, 1));
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn intent_precedes_namespace_and_refuses_unregistered_or_losing_execution() -> Result {
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs.rs b/crates/canopy-server/src/packs/publication/tests/inputs.rs
index c35dad57..75d383a3 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs.rs
@@ -587,7 +587,10 @@ async fn claimed_staging_retains_exact_dispatch_after_absence_lost_ack_and_panic
         let retained = coordinator
             .pending(old.token.operation)
             .ok_or("retained claim")?;
-        assert_eq!(coordinator.stats().command_bytes, 8192);
+        assert_eq!(
+            coordinator.stats().command_bytes,
+            super::super::custody::RESERVATION
+        );
         coordinator.recover(&retained)?;
         let StagingState::Active(next) = timeout(Duration::from_secs(10), retained.wait()).await?
         else {
@@ -859,7 +862,10 @@ async fn service_checkpoint_retains_exact_identity_after_cancellation_absence_lo
             assert!(
                 matches!(retained.wait().await, Err(e) if matches!(&*e, StagingError::Checkpoint(_)))
             );
-            assert_eq!(coordinator.stats().command_bytes, 3 * 4096);
+            assert_eq!(
+                coordinator.stats().command_bytes,
+                super::super::custody::RESERVATION + 4096
+            );
             // Closing retains unknown registrations and their charged command.
             let pending = timeout(Duration::from_secs(10), coordinator.close_and_drain()).await?;
             assert_eq!(pending.len(), 1);
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs/requests.rs b/crates/canopy-server/src/packs/publication/tests/inputs/requests.rs
index ae37e7d4..f2e04eb6 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs/requests.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs/requests.rs
@@ -583,7 +583,10 @@ async fn request_checkpoint_append_recovers_exact_uncertain_registration_and_old
                 .register_inputs(next.clone(), identity()?)
                 .is_err()
         );
-        assert_eq!(request.coordinator.stats().command_bytes, 12 << 10);
+        assert_eq!(
+            request.coordinator.stats().command_bytes,
+            super::super::super::custody::RESERVATION + 4096
+        );
         request.coordinator.recover(&request.ticket)?;
         let registered = request
             .ticket
diff --git a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
index a067dae9..1576cf26 100644
--- a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
@@ -168,14 +168,21 @@ async fn initial_preparation_receipt_cold_owner_and_sdk_expiry_preserve_actual_r
         let input = f.begin([220; 16]);
         let mut mutation = identity()?;
         mutation.expires_at_ms = mutation.issued_at_ms + 1000;
-        let command = f
-            .client()
-            .prepare_command::<BeginPreparation>(&f.target, mutation, input.clone())
-            .await?;
+        let command = PreparedCustody::prepare(
+            &f.client(),
+            &f.target,
+            CustodyAction::BeginPreparation(input.clone()),
+            mutation,
+        )
+        .await?;
         let evidence = command.evidence().clone();
-        // Discard the transport response and every prepared factory before
-        // destroying SQLite. Only the logical record remains discoverable.
-        let original = command.execute().await?;
+        // Discard every factory after acceptance; cold Claim starts from the
+        // mandatory registered predecessor, never a raw command adapter.
+        let original = command
+            .register(&f.client(), identity()?)
+            .await?
+            .recover_preparation(&f.client())
+            .await?;
         let old = lease(original.output.clone())?;
         let (runtime, handle, client) =
             super::durable_recovery::restore_owner(&f, &check(old.token)).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/prepare.rs b/crates/canopy-server/src/packs/publication/tests/prepare.rs
index 97d16ca5..93d32d99 100644
--- a/crates/canopy-server/src/packs/publication/tests/prepare.rs
+++ b/crates/canopy-server/src/packs/publication/tests/prepare.rs
@@ -50,10 +50,7 @@ pub(super) async fn opened(
     Arc<CatalogFiles>,
     Arc<CatalogIndexes>,
 )> {
-    let started = fixture
-        .client()
-        .command::<BeginPreparation>(&fixture.target, identity()?, fixture.begin(operation))
-        .await?;
+    let started = registered_preparation(fixture, operation).await?;
     let token = lease(started.output)?.token;
     let indexes = Arc::new(CatalogIndexes::new(Arc::clone(&store), fixture.format));
     let files = Arc::new(CatalogFiles::new(
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs b/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
index 0bdc0bee..f94f0881 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
@@ -82,12 +82,19 @@ async fn initial_staging_receipt_cold_restore_requires_actual_claim_and_keeps_or
         let input = f.begin([217; 16]);
         let mut mutation = identity()?;
         mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
-        let command = f
-            .client()
-            .prepare_command::<BeginStaging>(&f.target, mutation, input.clone())
-            .await?;
+        let command = PreparedCustody::prepare(
+            &f.client(),
+            &f.target,
+            CustodyAction::BeginStaging(input.clone()),
+            mutation,
+        )
+        .await?;
         let evidence = command.evidence().clone();
-        let original = command.execute().await?;
+        let original = command
+            .register(&f.client(), identity()?)
+            .await?
+            .recover_staging(&f.client())
+            .await?;
         let StagingReply::Granted(old) = original.output else {
             return Err("missing admission".into());
         };
@@ -146,10 +153,17 @@ async fn initial_staging_receipt_survives_reaping_but_does_not_restore_expired_c
         let f = Fixture::new(format).await?;
         let mut input = f.begin([218; 16]);
         input.lease_ms = 1_000;
-        let original = f
-            .client()
-            .command::<BeginStaging>(&f.target, identity()?, input.clone())
-            .await?;
+        let original = PreparedCustody::prepare(
+            &f.client(),
+            &f.target,
+            CustodyAction::BeginStaging(input.clone()),
+            identity()?,
+        )
+        .await?
+        .register(&f.client(), identity()?)
+        .await?
+        .recover_staging(&f.client())
+        .await?;
         let StagingReply::Granted(lease) = original.output else {
             return Err("missing admission".into());
         };
@@ -253,7 +267,7 @@ async fn initial_staging_receipt_is_internal_knowledge_after_write_revocation()
 }
 
 #[tokio::test]
-async fn initial_staging_receipt_corruption_keeps_original_evidence_and_reservation() -> Result {
+async fn staging_custody_intent_corruption_keeps_original_evidence_and_reservation() -> Result {
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let f = Fixture::new(format).await?;
         let input = f.begin([214; 16]);
@@ -276,19 +290,15 @@ async fn initial_staging_receipt_corruption_keeps_original_evidence_and_reservat
             return Err("missing evidence".into());
         };
         let evidence = (**evidence).clone();
-        let saved = StagingAdmission::load(&f.client(), &f.target, input.operation)
+        let saved = RegisteredCustody::load_latest(&f.client(), &f.target, input.operation)
             .await?
-            .ok_or("receipt missing")?;
-        let original = saved.original(&evidence)?.ok_or("original stamp differs")?;
-        let other = f
-            .client()
-            .prepare_command::<BeginStaging>(&f.target, identity()?, input)
-            .await?;
-        assert!(saved.original(other.evidence())?.is_none());
+            .ok_or("intent missing")?;
+        assert_eq!(saved.evidence(), &evidence);
+        let original = saved.recover_staging(&f.client()).await?;
         let body = f
             .handle
-            .query(0, 2048, |db| {
-                Ok(db.query_row("SELECT initial_staging FROM pushes", [], |r| {
+            .query(0, 4096, |db| {
+                Ok(db.query_row("SELECT intent FROM catalog_custody_commands WHERE operation = x'd6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6'", [], |r| {
                     r.get::<_, Vec<u8>>(0)
                 })?)
             })
@@ -296,11 +306,11 @@ async fn initial_staging_receipt_corruption_keeps_original_evidence_and_reservat
         let mut corrupt = body.clone();
         let end = corrupt.last_mut().ok_or("empty receipt")?;
         *end ^= 1;
-        edit(&f, "DROP TRIGGER push_initial_staging_immutable").await?;
+        edit(&f, "DROP TRIGGER catalog_custody_identity_immutable").await?;
         edit(
             &f,
             &format!(
-                "UPDATE pushes SET initial_staging=x'{}'",
+                "UPDATE catalog_custody_commands SET intent=x'{}' WHERE step=0",
                 hex::encode(corrupt)
             ),
         )
@@ -311,14 +321,17 @@ async fn initial_staging_receipt_corruption_keeps_original_evidence_and_reservat
         else {
             return Err("corruption lost uncertainty".into());
         };
-        let StagingError::ReceiptRecovery {
+        let StagingError::Custody {
             evidence: retained, ..
         } = error.as_ref()
         else {
             return Err("missing receipt recovery error".into());
         };
         assert_eq!(retained.as_ref(), &evidence);
-        assert_eq!(coordinator.stats().command_bytes, 8192);
+        assert_eq!(
+            coordinator.stats().command_bytes,
+            super::super::custody::RESERVATION
+        );
         assert!(matches!(
             ticket.spawn(|_| async { Ok(()) }),
             Err(StagingError::Inactive)
@@ -326,7 +339,10 @@ async fn initial_staging_receipt_corruption_keeps_original_evidence_and_reservat
         assert_eq!(f.counts().await?, (1, 1));
         edit(
             &f,
-            &format!("UPDATE pushes SET initial_staging=x'{}'", hex::encode(body)),
+            &format!(
+                "UPDATE catalog_custody_commands SET intent=x'{}' WHERE step=0",
+                hex::encode(body)
+            ),
         )
         .await?;
         coordinator.recover(&ticket)?;
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index a1a76e1e..91ab0e53 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -44,6 +44,132 @@ async fn changed_lease(ticket: &StagingTicket, old: i64) -> Result<StagingLease>
     .await?
 }
 
+#[tokio::test]
+async fn staged_service_registrar_loss_retains_both_commands_through_cancellation_and_close()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in [4, 5, 6] {
+            let f = Fixture::new(format).await?;
+            let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+            c.fault_for_test(fault);
+            let ticket = submit(&f, &c, [fault + 120; 16], "owner").await?;
+            let StagingState::Uncertain(error) = terminal(&ticket).await? else {
+                return Err("registrar loss not retained".into());
+            };
+            let (original, registrar) = ticket
+                .custody_evidence_for_test()
+                .ok_or("custody command missing")?;
+            let registrar = registrar.ok_or("registrar missing")?;
+            assert_ne!(original, registrar);
+            if fault != 6 {
+                let StagingError::Custody { evidence, source } = &*error else {
+                    return Err("registrar source lost".into());
+                };
+                assert_eq!(**evidence, original);
+                let CustodyError::Registration(source) = &**source else {
+                    return Err("wrong protocol phase".into());
+                };
+                let InvocationError::Pending(evidence) = &**source else {
+                    return Err("registrar original lost".into());
+                };
+                assert_eq!(**evidence, registrar);
+            }
+            assert!(matches!(
+                f.client().resolve(&original).await?,
+                cellule_runtime::Resolution::Absent
+            ));
+            assert_eq!(f.counts().await?, (0, 0));
+            assert_eq!(c.stats().command_bytes, super::super::custody::RESERVATION);
+            drop(ticket);
+            let retained = c
+                .pending([fault + 120; 16])
+                .ok_or("observer dropped admitted work")?;
+            assert_eq!(c.close_and_drain().await.len(), 1);
+            assert_eq!(
+                retained.custody_evidence_for_test(),
+                Some((original.clone(), Some(registrar.clone())))
+            );
+            c.recover(&retained)?;
+            assert!(matches!(terminal(&retained).await?, StagingState::Stopped));
+            let saved = RegisteredCustody::load_latest(&f.client(), &f.target, [fault + 120; 16])
+                .await?
+                .ok_or("registered original missing")?;
+            assert_eq!(saved.evidence(), &original);
+            let result = saved.recover_staging(&f.client()).await?;
+            assert!(matches!(result.output, StagingReply::Granted(_)));
+            assert!(matches!(
+                f.client().resolve(&registrar).await?,
+                cellule_runtime::Resolution::Committed(_)
+            ));
+            assert_eq!(f.counts().await?, (1, 1));
+            assert_eq!(c.stats().admitted, 0);
+            assert_eq!(c.stats().command_bytes, 0);
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn staged_service_renew_and_bind_registrar_loss_never_replaces_either_identity() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in [4, 5, 6] {
+            let f = Fixture::new(format).await?;
+            let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+            let ticket = submit(&f, &c, [fault + 130; 16], "owner").await?;
+            let staged = active(&ticket).await?;
+            c.fault_for_test(fault);
+            ticket.renew_for_test();
+            assert!(matches!(
+                terminal(&ticket).await?,
+                StagingState::Uncertain(_)
+            ));
+            let renewal = ticket
+                .custody_evidence_for_test()
+                .ok_or("renewal originals lost")?;
+            assert!(matches!(
+                f.client().resolve(&renewal.0).await?,
+                cellule_runtime::Resolution::Absent
+            ));
+            c.recover(&ticket)?;
+            assert_eq!(active(&ticket).await?.token, staged.token);
+            let registered =
+                RegisteredCustody::load_latest(&f.client(), &f.target, staged.token.operation)
+                    .await?
+                    .ok_or("renewal registration missing")?;
+            assert_eq!(registered.evidence(), &renewal.0);
+            c.fault_for_test(fault);
+            ticket.seal()?;
+            assert!(matches!(
+                terminal(&ticket).await?,
+                StagingState::Uncertain(_)
+            ));
+            let binding = ticket
+                .custody_evidence_for_test()
+                .ok_or("bind originals lost")?;
+            assert_ne!(binding, renewal);
+            c.recover(&ticket)?;
+            let StagingState::Bound(bound) = terminal(&ticket).await? else {
+                return Err("bind not recovered".into());
+            };
+            let registered =
+                RegisteredCustody::load_latest(&f.client(), &f.target, staged.token.operation)
+                    .await?
+                    .ok_or("bind registration missing")?;
+            assert_eq!(registered.evidence(), &binding.0);
+            assert_eq!(
+                registered.recover_preparation(&f.client()).await?.receipt,
+                bound.receipt
+            );
+            assert_eq!(bound.lease.token, staged.token);
+            assert_eq!(f.counts().await?, (1, 1));
+            assert!(c.close_and_drain().await.is_empty());
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn staged_service_recovers_original_begin_after_sdk_expiry_before_allowing_uploads() -> Result
 {
@@ -73,7 +199,10 @@ async fn staged_service_recovers_original_begin_after_sdk_expiry_before_allowing
             return Err("missing original Begin evidence".into());
         };
         let evidence = (**evidence).clone();
-        assert_eq!(coordinator.stats().command_bytes, 8192);
+        assert_eq!(
+            coordinator.stats().command_bytes,
+            super::super::custody::RESERVATION
+        );
         assert!(matches!(
             ticket.spawn(|_| async { Ok(()) }),
             Err(StagingError::Inactive)
@@ -84,7 +213,9 @@ async fn staged_service_recovers_original_begin_after_sdk_expiry_before_allowing
             return Err("lost acknowledgement did not follow an accepted Begin".into());
         };
         let mut decoder = BoundedDecoder::new(original.result(), 4096)?;
-        let StagingReply::Granted(lease) = StagingReply::decode(&mut decoder)? else {
+        let CustodyReply::Staging(StagingReply::Granted(lease)) =
+            CustodyReply::decode(&mut decoder)?
+        else {
             return Err("original admission was not granted".into());
         };
         decoder.finish()?;
@@ -202,7 +333,10 @@ async fn staged_service_resolves_begin_renew_and_bind_exactly_after_absence_lost
             StagingState::Uncertain(_)
         ));
         assert_eq!(coordinator.stats().admitted, 1);
-        assert_eq!(coordinator.stats().command_bytes, 8192);
+        assert_eq!(
+            coordinator.stats().command_bytes,
+            super::super::custody::RESERVATION
+        );
         coordinator.recover(&ticket)?;
         let original = active(&ticket).await?;
         assert_eq!(original.token.artifact_operation, artifact_number(1));
@@ -231,7 +365,10 @@ async fn staged_service_resolves_begin_renew_and_bind_exactly_after_absence_lost
         let evidence = (**evidence).clone();
         let pending = timeout(Duration::from_secs(10), coordinator.close_and_drain()).await?;
         assert_eq!(pending.len(), 1);
-        assert_eq!(coordinator.stats().command_bytes, 8192);
+        assert_eq!(
+            coordinator.stats().command_bytes,
+            super::super::custody::RESERVATION
+        );
         coordinator.recover(&pending[0])?;
         let StagingState::Bound(bound) = terminal(&pending[0]).await? else {
             return Err("bind did not resolve".into());
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
index 97951482..62ed7551 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
@@ -50,13 +50,7 @@ pub(super) async fn claim(
     Ok(c.submit(ready).map_err(|(e, _)| e)?)
 }
 async fn new_token(f: &Fixture, op: [u8; 16]) -> Result<PreparationToken> {
-    Ok(lease(
-        f.client()
-            .command::<BeginPreparation>(&f.target, identity()?, f.begin(op))
-            .await?
-            .output,
-    )?
-    .token)
+    Ok(lease(registered_preparation(f, op).await?.output)?.token)
 }
 #[tokio::test]
 async fn bound_service_automatic_renewal_keeps_canceled_worker_and_result_owned_through_close()
@@ -168,7 +162,10 @@ async fn bound_service_renewal_retains_exact_absent_lost_and_panicked_commands_t
                 other => return Err(format!("unexpected {other:?}").into()),
             };
             assert_eq!(sequence.is_some(), fault != 1);
-            assert_eq!(c.stats().command_bytes, 8192);
+            assert_eq!(
+                c.stats().command_bytes,
+                super::super::super::custody::RESERVATION
+            );
             drop(ticket);
             let retained = c.pending([204; 16]).ok_or("renewal lost")?;
             assert_eq!(c.close_and_drain().await.len(), 1);
@@ -232,17 +229,11 @@ async fn bound_service_claim_retains_exact_identity_and_new_namespace_through_cl
             };
             assert_ne!(bound.lease.token, old);
             assert_ne!(bound.lease.token.artifact_operation, old.artifact_operation);
-            let replay = f
-                .client()
-                .command::<ClaimPreparation>(
-                    &f.target,
-                    mutation,
-                    LeaseRequest {
-                        check: check(old),
-                        lease_ms: DEFAULT_LEASE_MS,
-                    },
-                )
-                .await?;
+            let saved = RegisteredCustody::load_latest(&f.client(), &f.target, old.operation)
+                .await?
+                .ok_or("claim intent missing")?;
+            assert_eq!(saved.evidence().identity(), mutation);
+            let replay = saved.recover_preparation(&f.client()).await?;
             assert_eq!(bound.receipt, replay.receipt);
             assert_eq!(bound.lease, lease(replay.output)?);
             let cellule_runtime::Resolution::Committed(value) =
@@ -551,7 +542,10 @@ async fn bound_service_checkpoint_shares_renewal_order_exact_recovery_and_origin
                 return Err("checkpoint evidence".into());
             };
             let evidence = (**evidence).clone();
-            assert_eq!(c.stats().command_bytes, 12 << 10);
+            assert_eq!(
+                c.stats().command_bytes,
+                super::super::super::custody::RESERVATION + 4096
+            );
             if fault == 2 {
                 super::super::publishing::edit(
                     &f,
@@ -655,16 +649,11 @@ async fn bound_service_restored_owner_claim_retains_old_pin_and_owns_new_session
         };
         assert_ne!(bound.lease.token.owner, old.owner);
         assert_ne!(bound.lease.token.artifact_operation, old.artifact_operation);
-        let replay = client
-            .command::<ClaimPreparation>(
-                &f.target,
-                mutation,
-                LeaseRequest {
-                    check: check(old),
-                    lease_ms: DEFAULT_LEASE_MS,
-                },
-            )
-            .await?;
+        let saved = RegisteredCustody::load_latest(&client, &f.target, old.operation)
+            .await?
+            .ok_or("claim intent missing")?;
+        assert_eq!(saved.evidence().identity(), mutation);
+        let replay = saved.recover_preparation(&client).await?;
         assert_eq!(bound.receipt, replay.receipt);
         let old_pin = handle.query(0, 32, move |conn| { Ok(conn.query_row("SELECT generation FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2", rusqlite::params![old.owner.incarnation.as_bytes().as_slice(), old.attempt as i64], |row| row.get::<_, i64>(0))?.to_be_bytes().to_vec()) }).await?;
         assert_eq!(old_pin.as_slice(), 0i64.to_be_bytes());
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
index fda38912..43c5c127 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
@@ -65,7 +65,10 @@ async fn bound_final_waits_for_exact_renewal_and_adopted_checkpoint_recovery_bef
                     assert!(matches!(error.as_ref(), StagingError::Checkpoint(_)));
                 }
                 assert!(matches!(observer.state(), PublicationState::Held));
-                assert_eq!(c.stats().command_bytes, 12 << 10);
+                assert_eq!(
+                    c.stats().command_bytes,
+                    super::super::super::custody::RESERVATION + 4096
+                );
                 assert_eq!(p.stats().await.held, 1);
                 assert_eq!(c.close_and_drain().await.len(), 1);
                 assert_eq!(p.close_and_drain().await.len(), 1);
@@ -250,7 +253,10 @@ async fn exact_case(format: ObjectFormat, fault: u8, expired: bool) -> Result {
         other => return Err(format!("unexpected resolution {other:?}").into()),
     };
     assert_eq!(original.is_some(), fault != 1);
-    assert_eq!(c.stats().command_bytes, 8 << 10);
+    assert_eq!(
+        c.stats().command_bytes,
+        super::super::super::custody::RESERVATION
+    );
     assert_eq!(p.stats().await.command_bytes, 8 << 20);
     if expired {
         tokio::time::pause();
diff --git a/docs/design/bound-preparation-dispatch.md b/docs/design/bound-preparation-dispatch.md
index d38a77af..0bb8bfad 100644
--- a/docs/design/bound-preparation-dispatch.md
+++ b/docs/design/bound-preparation-dispatch.md
@@ -1,16 +1,16 @@
 # Exact bound preparation command ownership
 
-Long bound preparations and owner takeover need an exact recovery path for ClaimPreparation and RenewPreparation. ReadyPreparation::claim and PreparationSession::ready_renew prepare those SDK commands before admission to the existing PublicationCoordinator. They reuse LeaseCheck, LeaseRequest, PreparationToken, independent generation pins and the same coordinator job, actor queue and command evidence. The private request is boxed so its exact command/context does not enlarge every ReadyPublication value. This dispatcher adds no schema, command ID, outbox representation or compatibility adapter. The later [first-admission receipt](initial-preparation-receipts.md) adds one bounded field to the existing logical request row and lets Claim recover a reaped original admission; it does not make these later command snapshots durable.
+Long bound preparations and owner takeover use `ReadyPreparation::claim`, `PreparationSession::ready_renew` and `PreparationBaseResolver::ready_renew` to prepare original typed custody command 42 and exact registrar 41 before admission to the existing PublicationCoordinator. These factories reuse LeaseCheck, LeaseRequest, PreparationToken, independent generation pins and the same coordinator job, actor queue and command evidence. Direct caller-owned raw renewal APIs have been removed. The private request is boxed so its exact command/context does not enlarge every ReadyPublication value. The [custody journal](durable-custody-command-intents.md) is the original command's durable representation; there is no compatibility adapter for raw commands 12/13.
 
 ## Admission and recovery
 
-Both commands enter the foreground class with an 8 KiB reservation for two bounded encoded copies. Account/operation limits, operation-ID exclusivity, FIFO account rotation, reserved maintenance slots and concurrent durability waits are shared with checkpoints and push completions. An uncertain command keeps its exact identity, bytes and credits. Dropping an observer does not cancel an accepted command. pending, recover and close_and_drain retain their existing behavior; recovery remains available after closing. Refused admission returns the original ready value.
+Both commands enter the foreground class with a 28 KiB reservation covering retained/dispatch intents, registrar transport/query decode and original body/reply ceilings. Global byte, class/account, operation and durability-wait caps stay unchanged. Account/operation limits, operation-ID exclusivity, FIFO account rotation, reserved maintenance slots and concurrent durability waits are shared with checkpoints and push completions. An uncertain command keeps its exact identity, bytes and credits. Dropping an observer does not cancel an accepted command. pending, recover and close_and_drain retain their existing behavior; recovery remains available after closing. Refused admission returns the original ready value.
 
-The factories check repository target equality, a nonzero lease duration within MAX_LEASE_MS and a 4 KiB encoded request. Renewal checks its shared session before and after SDK preparation. Claim intentionally accepts a previous-owner or expired token: the authoritative command checks exact operation identity, actor, phase, current write access, current admitted owner and SQL pin/quota invariants. An expired source may be claimed while it remains present; it cannot be renewed. Claim does not grant custody over old input bytes. Adopt and register the authenticated retained checkpoint before using borrowed physical inputs.
+The factories check repository target equality, a nonzero lease duration within MAX_LEASE_MS and the complete 1 KiB original body/4 KiB intent limits. Renewal checks its shared session before and after SDK preparation. Claim intentionally accepts a previous-owner or expired token: the authoritative command checks exact operation identity, actor, phase, current write access, current admitted owner and SQL pin/quota invariants. An expired source may be claimed while it remains present; it cannot be renewed. Claim does not grant custody over old input bytes. Adopt and register the authenticated retained checkpoint before using borrowed physical inputs.
 
 ## Original outcome and fresh custody
 
-PublicationOutcome::Preparation returns PreparationCommandOutcome with the command kind, original Committed<PreparationReply> and a separate session Result. Neither the reply's recorded timestamps nor replay alone constructs usable custody. Claim freshly opens CheckPreparation at the original receipt, matches the granted token, floor and format, and exposes a new private session. Renewal freshly queries the same attempt/floor/format and updates the existing shared conservative deadline. Existing fences remain permanent. Each query measures its local deadline from before request dispatch so queue/transport time shortens usable custody.
+PublicationOutcome::Preparation returns PreparationCommandOutcome with the command kind, original Committed<PreparationReply> and a separate session Result. Neither the reply's recorded timestamps nor replay alone constructs usable custody. Claim freshly opens CheckPreparation at the original receipt, matches the granted token, floor and format, and exposes a new private session. Renewal freshly queries the same attempt/floor/format and updates the existing shared conservative deadline. Existing fences remain permanent. `restore_renewal` on a session or base resolver reconstructs the registered original while preserving that same shared fence and deadline; restoring a separate session would leave old resolvers usable after a failed fresh observation. Each query measures its local deadline from before request dispatch so queue/transport time shortens usable custody.
 
 A known success remains a known success when current permission, expiry or a later Claim prevents usable custody. The original receipt is returned alongside the custody error. Renewal failures fence the original shared session; an ambiguous command retains its old conservative deadline until resolved. Exact rejected/not-started renewals fence that session. Claim does not depend on or revive a previous local session. Final proof factories and authoritative commands continue to recheck custody independently. Preparation outcomes cannot become Git push responses.
 
@@ -18,7 +18,7 @@ Renewal preserves the original generation floor and creating namespace. Claim cr
 
 ## Remaining lifecycle work
 
-This dispatcher owns one accepted Claim or Renew command, not the entire bound preparation lifecycle. Automatic renewal, bound worker/result ownership, checkpoint serialization, a separate local residence ceiling and shutdown drain now reuse the staging lifecycle; see the [bound lifecycle contract](bound-preparation-lifecycle.md). Final-publication lifecycle serialization, production producer integration, SQL floor-capacity qualification and durable takeover reconstruction remain required. The process-local exact command survives caller cancellation, not process loss. Unknown or expired SDK evidence cannot justify issuing a replacement command; durable exact/logical recovery must preserve that distinction. Complete retained-root enumeration, writer/reader drain and isolated restore remain required before collection. No remote deletion authority is introduced.
+This dispatcher owns one accepted Claim or Renew command, not the entire bound preparation lifecycle. Automatic renewal, bound worker/result ownership, checkpoint serialization, a separate local residence ceiling and shutdown drain now reuse the staging lifecycle; see the [bound lifecycle contract](bound-preparation-lifecycle.md). Final-publication lifecycle serialization, production producer integration, SQL floor-capacity qualification and durable takeover reconstruction remain required. `ReadyPreparation::restore` reconstructs the registered Claim/Renew head with its original identity and bytes; it submits through the same fair queue. Known outcome restoration precedes fresh session observation. Current actual-owner fencing must still be integrated with cold session construction: a successful SQL lease query alone does not prove the active owner epoch. That is an explicit release gate, not completed takeover authority. Unknown or expired SDK evidence cannot justify issuing a replacement command; durable exact/logical recovery must preserve that distinction. Complete retained-root enumeration, writer/reader drain and isolated restore remain required before collection. No remote deletion authority is introduced.
 
 ## Validation scope
 
diff --git a/docs/design/durable-custody-command-intents.md b/docs/design/durable-custody-command-intents.md
index bf22c2a4..ecb5b58d 100644
--- a/docs/design/durable-custody-command-intents.md
+++ b/docs/design/durable-custody-command-intents.md
@@ -1,6 +1,6 @@
 # Durable custody command intents
 
-Status: local, unpublished production cutover. Repository initialization uses this protocol. Staging and publication service conversion, compact terminal archival and capacity qualification remain required before release.
+Status: local, unpublished production cutover. Repository initialization and the staging/preparation service factories use this protocol. Cold service owner fencing/reconstruction, compact terminal archival and capacity qualification remain required before release.
 
 A prepared command can be lost before Begin grants an artifact namespace. A final publication's existing [registered recovery root](mandatory-publication-registration.md) cannot cover that interval: its body artifacts require an independently admitted namespace. Allocating a fake namespace or reconstructing a fresh SDK identity would cross the custody or exact-command boundary.
 
@@ -26,6 +26,16 @@ Recovery queries the original ordinal and observes its phase before SDK resoluti
 
 Historical grants are knowledge, not leases or artifact retention roots. They never restart a clock or retain every old base forever. Fresh authorized queries and actual independent pins determine current custody. After a grant's operation and pin are reaped, Claim can authenticate that exact indexed historical token, recheck current Write/logical availability/quotas and allocate a different namespace/pin under the actual executing fence and sequence. It cannot displace an active successor or recreate a completed outcome.
 
+## Service ownership
+
+`OwnedCustody` retains the exact original 42 and original registrar 41. The StagingCoordinator's Begin/Claim/Renew/Bind and bound Claim/Renew variants use that owner, as do ReadyPreparation factories in the fair PublicationCoordinator. An ordinary lost registrar reply can be resolved by the identical authoritative pointer. Registrar uncertainty and worker panic retain original execution evidence and both command bodies; observer cancellation or closing cannot replace them. Cold restore loads a registered head without issuing a new registrar or original identity.
+
+Each admitted custody job reserves 28 KiB, including retained/dispatch intent bodies, registrar transport/query decode and original body/reply ceilings. The staging checkpoint slot adds its existing 4 KiB, totaling 32 KiB. This accounting leaves operation, actor, worker, class and global byte caps unchanged. It does not measure the entire process heap or native resource use.
+
+Known phase results precede SDK resolution and local custody guards. Only proven absence can invoke an original under a still-valid local fence/deadline/ceiling; expired or unknown evidence stays retained. Fresh post-result queries establish a conservative clock, never from recorded reply timestamps. Direct caller-owned raw session/base renewal methods have been removed; ready renewals transfer into the service-owned coordinator.
+
+Cold service reconstruction still needs an independent current actual-owner check before constructing usable sessions. QueryContext exposes no active owner epoch, so a matching historical SQL token plus a fresh clock query is insufficient. Actual startup already obtains this fact from validated Cell Control and a live node advertisement; service/session reconstruction must carry the same authority. Original outcome knowledge remains recoverable even when current custody is refused.
+
 ## Startup integration
 
 Pending repository initialization discovers its latest registered custody head before constructing another original command. It recovers pre-dispatch Begin, accepted/denied Begin and subsequent Claim/Renew results. A matching current owner and fresh exact custody query are required before using a historical grant. Otherwise, a known resolved phase can precede an explicit registered Claim. A known denied final initialization forces Claim of that refused attempt even when its old Begin grant is still readable; a previously accepted successor Claim is recovered rather than repeated. Unknown phases stop initialization.
@@ -38,7 +48,7 @@ Each new custody transition currently adds one registration mutation plus one ex
 
 Inline command metadata closes the pre-namespace correctness gap, but retaining one SQL row per renewal forever is not the intended final storage strategy. Before release, compact settled per-operation history into bounded immutable frames in a genuinely admitted namespace, reusing the existing saved-command/root/frame codecs and indexed immutable storage. Keep an authenticated discoverable SQL head and retain exact historical lookup; denied pre-admission work cannot depend on a fabricated namespace. Include this history in typed collection, backup and isolated restore, without treating the historical grant's base descriptors as new live roots. The current implementation conservatively retains rows and does not claim repository/team capacity.
 
-Convert the StagingCoordinator, ReadyPreparation/PublicationCoordinator and direct session renewal factories to this protocol, retaining fair admission charges and uncertainty across cancellation and service closure. Remove raw custody bindings from production; domain methods remain callable inside the registered receiver and explicit qualification fixtures only. Remove redundant first-admission columns after their consumers and restart proofs use this journal. Complete foreground producers/readers, final schema removal, serving-generation retention, typed collection/backup, OS resource containment, continuous maintenance, physical rewriting and full-history mixed load before publishing the hard cutover.
+The staging and preparation factories now retain this protocol through admission, cancellation and service closure. Complete cold service reconstruction and current actual-owner session fencing before release. Remove raw custody bindings from production; domain methods remain callable inside the registered receiver and explicit qualification fixtures only. Remove redundant first-admission columns after their consumers and restart proofs use this journal. Complete foreground producers/readers, final schema removal, serving-generation retention, typed collection/backup, OS resource containment, continuous maintenance, physical rewriting and full-history mixed load before publishing the hard cutover.
 
 Qualification covers SHA-1/SHA-256 first-writer races, pre-namespace persistence/discovery, unregistered and losing identities, late registration/phase rollback with SDK absence and exact retry, immutable metadata, all seven transitions, historical receipts after successors, original denied Begin/Renew after real SDK expiry, cold SQLite removal and owner restore, reaped successor Claim, forged tokens, corrupt metadata and bounded indexed lookup. A joint initialized catalog/ref base is tested against the reply ceiling. Real workspace tests check certified repository creation and identical custody metadata after fresh-disk restore. These are focused correctness checks, not a full-history or 10,000-developer capacity claim.
 
@@ -51,4 +61,4 @@ cargo +1.98.0 clippy --workspace --all-targets --locked -- -D warnings
 cargo +1.98.0 build -p canopy-server --bin canopy --locked
 ```
 
-The current checkpoint passes 283 publication and nine workspace/lifecycle cases, all-target workspace Clippy and the server build on macOS. Frozen Rust-source hashes and protected-checkout/dependency checks accompany the validation. Linux/provider CI and the complete runtime/capacity campaign remain release gates.
+The owned service checkpoint passes 286 publication and nine workspace/lifecycle cases, all-target workspace Clippy with warnings denied and the server build on macOS. The publication suite includes registrar loss before submission, after acceptance and after a panic, cancellation/closed-service recovery, and restored renewal preserving an existing resolver fence. Frozen Rust-source hashes and protected-checkout/dependency checks accompany the validation. Linux/provider CI and the complete runtime/capacity campaign remain release gates.
diff --git a/docs/design/file-attribution.md b/docs/design/file-attribution.md
new file mode 100644
index 00000000..6380c1f8
--- /dev/null
+++ b/docs/design/file-attribution.md
@@ -0,0 +1,77 @@
+# Directory entry file attribution
+
+Canopy should show the last commit that changed each directory entry at the selected revision. Return the directory page immediately and fill attribution asynchronously from an immutable, commit-specific cache. Use bounded native Git history queries for cold misses; add a persistent index to share unchanged attribution between commits as measured demand warrants. This is a proposed browser implementation, not an implemented endpoint or a production performance result.
+
+## Current behavior and exact meaning
+
+`git_read/browse.rs::browser_tree` returns up to 32 entries containing raw names and paths, kind, mode and OID, plus the selected commit. The selected commit is not each entry's last-changing commit. `browser_history` follows first parents and cannot serve as the attribution oracle without changing the semantics below.
+
+Define the initial algorithm version by the result of this invocation against an authorized, certified snapshot:
+
+```text
+git --no-replace-objects --literal-pathspecs log -1 --format=%H <commit> -- <raw-path>
+```
+
+Pass arguments directly, preserving raw path bytes; never concatenate a shell command. Disable ambient Git configuration and graft/replacement behavior in the managed native workspace. This is path history without rename following. An entry changes when its kind, mode or object ID changes; a directory changes when its subtree changes. Renaming creates attribution at the new path. Deleting and later adding identical bytes counts as a new change. Author timestamps do not define the last change.
+
+Git's default path history uses parent comparisons and history simplification at merges. A merge identical to a parent can inherit that parent's history; a merge resolution different from every parent is itself a change. Preserve ordered parents. Never silently substitute first-parent integration history. See [Git history simplification](https://git-scm.com/docs/git-log#_history_simplification).
+
+Display the commit's author, subject, time and a link to that commit. A raw Git author identity is not proof of a Canopy account or the authenticated actor that pushed it. Author-to-account decoration must preserve that distinction.
+
+## Read protocol
+
+Resolve the requested ref once to commit C and a certified read generation. Every directory and attribution result carries C. A moving ref must not mix attribution from another revision into the same page.
+
+Keep the existing directory pagination and expose a batch attribution request for at most one page of paths. Use repository identity, object format, C, literal raw path, and algorithm version as the logical cache key. A blob OID or Git tree OID alone is insufficient: identical content can occur in different histories.
+
+The response contains the selected commit, one state per requested path, and a dictionary of commit summaries keyed by commit OID. States are `ready`, `pending`, or an explicit unavailable/error disposition. Never fill a missing result with the selected commit. A response can include ready entries while others remain pending. Use a bounded request deadline and an existing bounded polling mechanism or bounded retry token; do not introduce an unbounded job registry or a stream held indefinitely.
+
+The UI renders names and file actions immediately, reserves space for attribution, then fills author/subject/time together. Discard responses whose commit or page no longer matches the visible page. Coalesce requests for the same commit and directory so many users do not launch duplicate history walks.
+
+Authorize every request, including cache hits. Acquire the selected certified generation and retain its objects/workspace pins until native work and response ownership finish. Caching attribution neither grants Read nor proves object reachability. A detached observer cannot release resources still owned by a worker. Recheck current access according to the browser read contract before returning results.
+
+## Cold computation and acceleration
+
+Initially, use bounded native per-path queries inside the admitted repository read service. Bound workers, queued paths, output bytes, scratch and subprocess lifetime; schedule fairly between repositories and accounts. Do not spawn 32 unconstrained processes for a directory. Cache successful immutable answers and coalesce concurrent misses. Permission failures and budget exhaustion are not history results.
+
+Generate verified commit graphs with changed-path Bloom filters in background maintenance of certified native workspaces. Bloom filters help history traversal reject commits that did not touch a path; a positive filter result is not proof of a change. They do not guarantee constant-time cold answers. See [Git commit graph maintenance](https://git-scm.com/docs/git-commit-graph).
+
+Do not replace per-path queries with one naive `git log -- pathA pathB ...` and assign commits from that stream. History simplification for a union of paths can differ from simplification for each individual path. A shared custom walker requires differential qualification per path, including merges.
+
+Prewarm the default branch's root page and recently viewed directories after publication. Full imports and pushes must not wait for attribution of every file or every historical commit. Under overload, retain immediate directory browsing and return pending attribution.
+
+## Persistent index and shared data structures
+
+For large sustained workloads, add an immutable derived index. Its commit binding identifies repository, format, algorithm version and C. An entry contains the exact path, kind/mode/OID and last-changing commit OID. Store commit summaries separately to avoid repeating author and message bytes for every file.
+
+Reuse the packed architecture's `IndexKey`, `IndexRecord`, `RangeIndex`, `NodeRef`, bounded codecs, verified artifact transport and path-copy updates. Add distinct attribution codec domains and byte-ordered path keys; do not manufacture object IDs from paths. Qualify variable-length keys, node byte limits and wide/deep directories before adopting the generic index. Long keys may require different fanout bounds from object-directory records. A tree node's integrity does not establish that its attribution is semantically correct.
+
+The proposed recurrence for a present path is: if its exact entry matches a parent, inherit the first matching ordered parent's last-change record; otherwise record C. A root records itself. For directories, compare the subtree entry. This recurrence matched a finite native Git experiment, but remains subject to broader differential qualification before becoming the serving algorithm. Parent order, unusual histories and supported Git versions are part of that qualification.
+
+Share nodes only when their attribution contents match. Matching Git content trees alone cannot justify sharing history-dependent attribution. An incremental single-parent update should write changed records and their ancestor index nodes, rather than copy all repository paths. Merges require comparison with all relevant parents; their work is not necessarily proportional only to a first-parent diff. Budget and measure merge work independently.
+
+Use bounded commit-to-attribution-root indexes in immutable artifacts rather than a Cellule SQL row for every file at every commit. Cellule coordinates authoritative repository/catalog facts and, if needed, a bounded descriptor for a published derived index. It does not compute history inside a transaction. Keep attribution replaceable and disposable; it must not delay ref acceptance.
+
+Represent incomplete coverage explicitly. A missing parent index triggers a bounded history fallback or deferred computation, never inheritance from an incomplete record. Start with per-directory cache coverage and measured hot revisions. Add complete historical roots only through admitted backfill. Avoid accumulating a chain of deltas that every directory request must replay.
+
+Derived cache retention has explicit quotas and eviction. It must not keep all old commits alive by accident. If attribution artifacts become durable/shared, register their typed storage ownership and retention under the final artifact/GC design; do not use an unrelated staging namespace or historical receipt as a GC root. Rebuilding from certified Git history remains possible after cache loss.
+
+## Implementation sequence and acceptance
+
+1. Add a typed attribution record and native history helper, with the exact algorithm version above. Differential tests cover both object formats, empty commits, ordered merges, identical parents with different histories, conflict resolution, octopus merges, modes, symlinks, gitlinks, renames, reverts, delete/re-add, raw non-UTF-8 paths and literal pathspec characters. Include generated DAGs and skewed clocks.
+2. Add the commit-pinned batch endpoint, byte/count limits, fair read admission, coalesced cache fills and certified-generation ownership. Test access revocation, force pushes, concurrent pagination, cancellation, timeout, worker death and cache eviction. HTTP history work must stay outside Cellule commands.
+3. Add asynchronous directory row decoration. Test navigation during pending requests and partial batch completion. Confirm file browsing works while attribution is backlogged.
+4. Measure native fallback and warm cache behavior on Tokio, then full Linux, Kubernetes and Chromium histories. Record cold versus warm storage, path count, history depth, merge shape, native CPU/RSS, queue latency and artifact I/O. Do not reuse line-blame benchmarks as evidence for this feature.
+5. If native fallback and page caching miss the workload targets, implement and differentially qualify the shared persistent index. Verify bounded update/read amplification, incomplete backfill, process loss, integrity rejection and rebuild after deleting the cache. Persist only validated answers.
+
+The proposed warm attribution batch target is p95 below 100 ms. It is an engineering target, not a current guarantee. Keep the directory listing latency independent of attribution history depth. Report cache hit rate, oldest queued job, cache-fill latency, budget refusals and index lag alongside request percentiles.
+
+Capacity qualification must include 10,000 engineers making 10 commits each in an eight-hour day: 100,000 commits/day, about 3.47 commits/second on average, plus measured bursts. This is not the attribution read rate; model concurrent browsers, pages per session, cache locality and cold misses separately. Require bounded backlog, fair service, stable memory/disk use and foreground push/clone performance while attribution and maintenance run.
+
+## Evidence and remaining work
+
+The local design experiment used Git 2.50.1 and compared 101 present file/directory paths across 17 commit states. It passed for its tested root, empty commit, merge, mode, revert, delete/re-add, rename, octopus and literal-path scenarios. The experiment is finite evidence for the proposed recurrence, not a proof for all Git histories or a Canopy API benchmark.
+
+A separate local Tokio measurement queried 25 root-directory entries at commit `5d5cd8b5b896796445920b3b78c1ad5f9b853fc6` using four bounded native workers with a verified commit graph enabled. Three batch runs took 233.118, 146.671 and 140.715 ms; the median was 146.671 ms. The OS caches were not flushed and the host was shared. These are native fallback measurements, not cache-hit, HTTP, cold-storage or large-team results.
+
+The production helper, endpoint, UI, cache/index and large-team qualification remain to be implemented. The storage cutover's certified readers, ownership and final retention model are prerequisites for serving this feature through the new architecture.
diff --git a/docs/design/shared-publication-dispatch.md b/docs/design/shared-publication-dispatch.md
index 812664a6..b343aa45 100644
--- a/docs/design/shared-publication-dispatch.md
+++ b/docs/design/shared-publication-dispatch.md
@@ -6,15 +6,15 @@
 
 `PreparedCatalog::ready_push` retains the verified catalog and exact command 19 when publishing refs. `PreparationSession::ready_outcome` retains only the admitted session and exact command 19 for refused/empty outcomes; it requires no catalog artifacts. The prepared-catalog wrapper delegates those outcomes to the same session factory and drops catalog ownership from the ready value. See the [outcome-only contract](outcome-only-completion.md). `PreparedCompaction::ready_compaction` retains the verified compaction and exact command 22; it issues the existing maintenance certificate, checks a 4 KiB input envelope and checks the live lease before and after SDK preparation. Both factories perform verification/certification before admission. Raw descriptors and a caller-selected class cannot construct either ready object.
 
-`PreparedCatalog::ready_root_push` composes the private registered-native completion factory with exact command 36. It verifies the 8 KiB input bound and shared live custody before and after SDK preparation, then retains the prepared catalog and original command. `ReadyPublication::RootPush` enters the foreground class with a 16 KiB reservation for the retained and dispatch copies. PreparationSession::ready_root_outcome retains exact command 38 with only the shared session for registered failed/empty native results. Both use the same RootPush variant and 512-byte reply. It reuses the existing bound handoff, class/account scheduling and recovery slots; no independent queue or mutable response identity is introduced. See the [immutable completion contract](immutable-push-outcomes.md).
+`PreparedCatalog::ready_root_push` composes the private registered-native completion factory with exact command 36. It verifies the 8 KiB input bound and shared live custody before and after SDK preparation, then retains the prepared catalog and original command. The raw `ReadyRootPush` factory must persist and bind its original before admission as `ReadyPublication::BoundRecovery`; cold registered work enters as `ReadyPublication::RootRecovery`. Both reserve 32 KiB for the original body and recovery header copies. See the mandatory [registration contract](mandatory-publication-registration.md). PreparationSession::ready_root_outcome retains exact command 38 with only the shared session for registered failed/empty native results. Both use the same registered recovery variants and 512-byte reply. It reuses the existing bound handoff, class/account scheduling and recovery slots; no independent queue or mutable response identity is introduced. See the [immutable completion contract](immutable-push-outcomes.md).
 
 `Arc<RefPolicyPreparation>::ready_page` retains the original intent/evidence, verified catalog and exact command 33 under a 512 KiB reservation for two 256 KiB encoded copies. Its `PolicyPage` result preserves the original receipt and never becomes a native response. `StagingTicket::register_policy_page` reuses the existing held publication slot as an intermediate barrier: known success resumes Bound, unarmed known refusal fences, and uncertainty blocks final handoff even if historical SQL progress is complete. Current guard queries and final transactional guard checks remain mandatory. See the [paged-policy contract](paged-ref-policy-guards.md).
 
-An armed policy page retains a shared `ready_root_refusal` command as well as its original page. Composition requires the exact session and refusal-only role; failures preserve both inputs. Its wire reservation is 528 KiB. A known page refusal changes the local phase before executing the exact terminal command; uncertainty/panic recovery preserves the phase-specific SDK evidence. Known page success resumes Bound and does not submit that command. Sharing one refusal Arc across pages avoids repeated native report freezing. The same Arc can also enter final RootPush handoff after later policy/write changes. Refusal-only handoff uses local live custody and the final transaction's authoritative checks rather than requiring fresh Write for renewal/observation. Queued checkpoints and owned work still drain. See the [immutable refusal contract](immutable-push-outcomes.md).
+An armed policy page retains a shared `ready_root_refusal` command as well as its original page. Composition requires the exact session and refusal-only role; failures preserve both inputs. Its wire reservation is 544 KiB, including the mandatory original refusal registration header. A known page refusal changes the local phase before executing the exact terminal command; uncertainty/panic recovery preserves the phase-specific SDK evidence. Known page success resumes Bound and does not submit that command. Sharing one refusal Arc across pages avoids repeated native report freezing. The same Arc can also enter final RootPush handoff after later policy/write changes. Refusal-only handoff uses local live custody and the final transaction's authoritative checks rather than requiring fresh Write for renewal/observation. Queued checkpoints and owned work still drain. See the [immutable refusal contract](immutable-push-outcomes.md).
 
 PreparationSession::ready_inputs retains the existing command 29 and shared bound session for an adopted native input checkpoint. It checks exact scope/format/adoption context and bounded encoding before SDK preparation; the final command still checks MAC, source custody, current permission, owner, pin and expiry. These checkpoints use the foreground queue. See the [checkpoint contract](native-input-checkpoint.md). They establish descriptor retention rather than physical, canonical or ref authority.
 
-ReadyPreparation::claim and PreparationSession::ready_renew retain exact commands 12/13 with bounded requests and fresh post-commit session observations; see the [bound preparation contract](bound-preparation-dispatch.md). They share foreground admission with an 8 KiB reservation. The [bound lifecycle](bound-preparation-lifecycle.md) now schedules renewal automatically; durable takeover reconstruction remains required.
+ReadyPreparation::claim and PreparationSession::ready_renew retain original typed custody command 42 and exact registrar 41 with bounded requests and fresh post-commit session observations; see the [bound preparation contract](bound-preparation-dispatch.md). They share foreground admission with a 28 KiB reservation for both originals and their bounded transport/query copies. The [bound lifecycle](bound-preparation-lifecycle.md) now schedules renewal automatically; durable takeover reconstruction remains required.
 
 `ReadyPublication` wraps those private factory outputs. `submit` accepts any factory output and returns the same `PublicationTicket`. Admission failure returns the original typed ready value, preserving its mutation identity and wire bytes. Logical IDs are unique across both classes in one coordinator.
 
@@ -28,7 +28,7 @@ ReadyPreparation::claim and PreparationSession::ready_renew retain exact command
 | Maintenance operations | Four reserved slots |
 | Foreground operations | Remaining 28 slots |
 | Per actor | Eight operations per class |
-| Encoded command reservation | 8 MiB per inline push; 16 KiB per immutable root push; 512 KiB per unarmed policy page, 528 KiB per armed page; 8 KiB per compaction, input checkpoint or bound Claim/Renew command |
+| Encoded command reservation | 8 MiB per inline push; 32 KiB per immutable root push; 512 KiB per unarmed policy page, 544 KiB per armed page; 8 KiB per compaction or input checkpoint; 28 KiB per bound Claim/Renew command |
 | Total command-byte budget | 256 MiB |
 | Concurrent durability waits | Eight |
 | Maintenance durability waits | At most two |
@@ -50,7 +50,7 @@ The shared queue contains two instances of the existing account-fair queue. With
 
 Catalog/ref CAS and current policy/ACL checks remain in the authoritative command. Two preparations against one old catalog can conflict even when both dispatch fairly. Uploads, native decoding, canonical verification and reconciliation never run inside this queue. A known durable catalog conflict may reenter only with a newly prepared command identity and a properly reconciled certificate.
 
-Dropping an observer does not cancel admitted execution. Pending, malformed published and panicked-task outcomes retain the original ready value and reservation. `pending`, `recover` and `close_and_drain` handle both classes. Recovery joins the same class/account queues. Staging Begin/Renew/Bind now reuse this same exact invocation/resolution implementation with a 4 KiB decoded-result bound; inline push and compaction results retain their 128-byte bound; immutable root push and policy-page results use a 512-byte bound. Bound input checkpoints and Claim/Renew commands share this foreground dispatcher with a 4 KiB decoded-result bound and fresh post-commit custody queries. Staging has its own long-input admission/lifecycle rather than entering the final-command fair queues; see the [service contract](staging-service-lifecycle.md). Inline push, immutable root push, policy-page and compaction dispatch check local session custody before initial submission and after authoritative absence. Resolve a known committed outcome before that guard; decode a committed result with its original receipt without rerunning its handler. Unknown, expired, unreachable or changed-incarnation evidence remains uncertain. Never replace its proof or mutation identity while acceptance is unknown.
+Dropping an observer does not cancel admitted execution. Pending, malformed published and panicked-task outcomes retain the original ready value and reservation. `pending`, `recover` and `close_and_drain` handle both classes. Recovery joins the same class/account queues. Staging and bound custody commands now use mandatory registered-original recovery with metadata-first outcomes and retained registrar identity; inline push and compaction results retain their 128-byte bound; immutable root push and policy-page results use a 512-byte bound. Bound input checkpoints and Claim/Renew commands share this foreground dispatcher with a 4 KiB decoded-result bound and fresh post-commit custody queries. Staging has its own long-input admission/lifecycle rather than entering the final-command fair queues; see the [service contract](staging-service-lifecycle.md). Inline push, immutable root push, policy-page and compaction dispatch check local session custody before initial submission and after authoritative absence. Resolve a known committed outcome before that guard; decode a committed result with its original receipt without rerunning its handler. Unknown, expired, unreachable or changed-incarnation evidence remains uncertain. Never replace its proof or mutation identity while acceptance is unknown.
 
 A terminal result drops dispatch/retained proof ownership before releasing class/account/byte credits. Resolved tickets retain only bounded result/read context. Recovery remains possible after closing admission. The bound lifecycle now owns automatic renewal and bound Claim; accepted input registration does not renew a lease or extend the original generation floor. The coordinator is service-owned local state, not a durable outbox or permission to delete remote inputs.
 
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index f92971f6..f7c6eaaa 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -4,7 +4,7 @@
 
 ## Admission and ownership
 
-Keep one service-owned coordinator per repository. `ReadyStaging::new` prepares the exact SDK BeginStaging command without executing it; `submit` performs synchronous local admission and starts service-owned supervision. Failure returns the original ready command and reason, so retry preserves mutation identity and bytes. Foreign targets, incompatible lease duration, duplicate logical IDs, closed admission and capacity reject before execution.
+Keep one service-owned coordinator per repository. `ReadyStaging::new` prepares the original typed custody command 42 and its exact registrar command 41 without executing either; `submit` performs synchronous local admission and starts service-owned supervision. Failure returns the original ready command and reason, so retry preserves mutation identity and bytes. Foreign targets, incompatible lease duration, duplicate logical IDs, closed admission and capacity reject before execution.
 
 | Default bound | Value |
 | --- | --- |
@@ -12,8 +12,8 @@ Keep one service-owned coordinator per repository. `ReadyStaging::new` prepares
 | Operations per actor | Eight |
 | Input workers and retained completed results | 64 |
 | Workers and retained results per actor | Eight |
-| Encoded command envelope | 4 KiB |
-| Command reservation per operation | 8 KiB for retained and transport copies; another 4 KiB after checkpoint admission |
+| Custody envelopes | 1 KiB original execution body; 4 KiB complete registrar intent |
+| Command reservation per operation | 28 KiB covering retained/dispatch intent bodies, registrar transport/query decode and original reply/body ceilings; another 4 KiB after checkpoint admission |
 | Checkpoint slots per operation | One bounded request and retained result |
 | Renewed input lease | 60 seconds |
 | Renewal lead time | 30 seconds |
@@ -36,7 +36,7 @@ Use existing admitted native-process, workspace, reader and disk primitives insi
 
 ## Durable input checkpoint registration
 
-After sealing a NativeInputCertificate, call `ticket.register_inputs(proof, identity)` before seal or stop. Admission synchronously transfers that bounded envelope and exact mutation identity into one service-owned checkpoint slot. Local checks require an active live stage and matching actor/token/target. A completed successful slot can be replaced while unbound only by a proof naming that exact checkpoint digest, enabling the [request-before-native append sequence](durable-push-request.md). Pending/uncertain/failed slots and unrelated proofs reject; failure returns the original proof without executing. Existing observers retain their original receipt. The slot remains charged while the job is admitted, including uncertainty and retained completion. It adds 4 KiB to the existing 8 KiB command reservation; it cannot form an unbounded queue.
+After sealing a NativeInputCertificate, call `ticket.register_inputs(proof, identity)` before seal or stop. Admission synchronously transfers that bounded envelope and exact mutation identity into one service-owned checkpoint slot. Local checks require an active live stage and matching actor/token/target. A completed successful slot can be replaced while unbound only by a proof naming that exact checkpoint digest, enabling the [request-before-native append sequence](durable-push-request.md). Pending/uncertain/failed slots and unrelated proofs reject; failure returns the original proof without executing. Existing observers retain their original receipt. The slot remains charged while the job is admitted, including uncertainty and retained completion. It adds 4 KiB to the existing 28 KiB command reservation; it cannot form an unbounded queue.
 
 The same supervisor prepares command 29 and stores its exact SDK command before dispatch. Due renewal precedes queued registration; accepted registration precedes Bind or graceful stop. `StagedInputsTicket::wait` observes the original durable receipt or uncertainty/error. Dropping it never discards the queued or executing command; `pending_inputs` retrieves the observer. `recover(ticket)` resolves the exact registration without replacing identity or bytes. Closing returns uncertain registrations with their existing reservations.
 
@@ -46,7 +46,7 @@ A known registration stores its original receipt before a fresh CheckStaging que
 
 Call seal when the input phase should finish. It prevents new producer admission and enters Draining. Existing producers and retained completed results continue under renewed staging custody. Bind does not begin until all input slots have drained through handoff or failure. This prevents a canceled observer from silently losing a physical witness while the service advances to catalog preparation.
 
-BindStaging uses a freshly prepared exact SDK command. Known binding preserves the token, creating namespace and artifact expiry, and adds only the current catalog floor. Bound records that durable result and its original receipt; its recorded timestamps are not a fresh live-lease observation. Stage contexts become inactive after handoff. The operation remains admitted through bound preparation. `ticket.open_base` refreshes at the binding receipt and uses the existing PreparationBaseResolver with the supervisor's shared session, validating current access and expiry while inheriting automatic renewal, shutdown fencing and the bound residence ceiling.
+Bind uses a newly prepared original command 42 and registrar 41 under the shared registered custody protocol. Known binding preserves the token, creating namespace and artifact expiry, and adds only the current catalog floor. Bound records that durable result and its original receipt; its recorded timestamps are not a fresh live-lease observation. Stage contexts become inactive after handoff. The operation remains admitted through bound preparation. `ticket.open_base` refreshes at the binding receipt and uses the existing PreparationBaseResolver with the supervisor's shared session, validating current access and expiry while inheriting automatic renewal, shutdown fencing and the bound residence ceiling.
 
 A producer can physically verify a native pack and return its private PhysicalPackWitness and sealed metadata segments. Take that result, seal, observe Bound, open the base, and feed the witness/segments to CatalogPreparation. The existing assembler rechecks store, namespace, partition completeness, canonical overlap and closure. Its private factories issue the publication proof. Bind and a generic producer result do not grant canonical or publication authority.
 
@@ -54,13 +54,13 @@ Bound preparation is now automatically renewed by this service, and spawn_bound
 
 ## Exact uncertainty and shutdown
 
-Begin, Claim, Renew, RegisterStagedInputs and Bind share the same exact invocation/resolution implementation with push and compaction dispatch. Resolution of authoritative absence permits execution of the retained exact command. A committed outcome decodes with its original receipt; it never reruns the handler. Unknown, expired, unreachable, changed-incarnation and malformed published results retain evidence and reservation.
+Staging and bound Begin/Claim/Renew/Bind retain both original command 42 and registrar 41 through the [custody intent protocol](durable-custody-command-intents.md). Registration must be known before original execution; metadata results are observed before SDK expiry or local execution guards. RegisterStagedInputs retains its separate original checkpoint command and exact SDK invocation/resolution path. Resolution of authoritative absence permits execution of the retained exact command only while the local fence, deadline and residence ceiling allow new execution. Known outcomes are returned before that guard. A committed outcome decodes with its original receipt; it never reruns the handler. Unknown, expired, unreachable, changed-incarnation and malformed published results retain evidence and reservation.
 
 Uncertain stops new producer admission. Existing work can continue only through its previously established deadline. `recover(ticket)` resumes the exact retained command; it cannot replace its identity or bytes. No new renewal, registration or bind is issued while an earlier command remains ambiguous. Panicked command tasks retain pending evidence. Unexpected service-worker failure fences local work and requires explicit exact recovery before restarting supervision.
 
 `stop` prevents new workers and waits for accepted input tasks/results to drain while renewal continues. It does not retract an independent SQL pin. `close_and_drain` closes all admission, stops jobs and returns still-charged uncertain tickets once running commands and input slots have drained. Service consumers must take retained completed results before a graceful stop can finish; retrieve lost observers through pending_task. Recovery remains possible after closing. A reached lifetime or lost authority fences and discards untransferred results conservatively.
 
-This service is process-local ownership, not a durable outbox or authenticated input inventory after process loss. Owner takeover must resolve exact/logical outcomes and reconstruct or adopt retained physical inputs under the new admitted namespace through the [authenticated input checkpoint protocol](native-input-checkpoint.md). ReadyStaging::claim now retains/resolves the exact Claim command and supplies a fresh staging context. Staging checkpoint supervision now exists; exact checkpoint supervision after bound Claim now uses the publication dispatcher. Production producer wiring, durable takeover reconstruction and complete wire-plan/response recovery remain required. Final publication now uses the existing fair coordinator through an observation-only lifecycle ticket; accepted final intent continues through close, while a pre-activation fence discards only proven unexecuted work. Neither local completion nor SQL reaping authorizes remote deletion.
+This service map is process-local. Registered custody intents preserve original command knowledge across process loss, but they do not reconstruct local worker ownership, a fresh current-owner lease or an authenticated physical input inventory. Owner takeover must resolve exact/logical outcomes and reconstruct or adopt retained physical inputs under the new admitted namespace through the [authenticated input checkpoint protocol](native-input-checkpoint.md). ReadyStaging::claim now retains/resolves the exact Claim command and supplies a fresh staging context. Staging checkpoint supervision now exists; exact checkpoint supervision after bound Claim now uses the publication dispatcher. Production producer wiring, durable takeover reconstruction and complete wire-plan/response recovery remain required. Final publication now uses the existing fair coordinator through an observation-only lifecycle ticket; accepted final intent continues through close, while a pre-activation fence discards only proven unexecuted work. Neither local completion nor SQL reaping authorizes remote deletion.
 
 ## Evidence and remaining work
 
diff --git a/docs/large-repository-implementation-plan.md b/docs/large-repository-implementation-plan.md
index 1e557a80..4cf0645a 100644
--- a/docs/large-repository-implementation-plan.md
+++ b/docs/large-repository-implementation-plan.md
@@ -156,6 +156,7 @@ The earlier [SQL fixture](design/packed-repository-schema.sql) is not the releas
 2. For generated candidate validation, compare expected canonical OID/body digest/size and certified metadata. Preserve ordered commit parents and exact policy inputs; unordered `commit_parents` is not an order proof.
 3. Replace ancestry's in-memory discovered-commit limit and permanent mutable SQL ancestry projection with certified immutable commit metadata/native commit graphs plus admitted disk-backed traversal scratch when needed. Reuse existing OID/typed parent meanings and verify every selected path against the pinned certified catalog. Bind a bounded ancestry certificate to the exact old/new OIDs, canonical inventories and publication context; authenticate it in the final policy transaction. Do not submit the legacy parent-proof command to tables removed by the fresh schema. Keep cancellation and admission; incomplete traversal is an error, not a negative result. The fallback now reuses admitted SQLite growth, exclusive per-walker traversal, exact StoredCatalog memo binding and permanent failure/cancellation fencing. Queue resets page at most 512 keys and preserve bounded exact-catalog answers. Native commit-graph acceleration, serving/candidate integration and native histories exceeding 100k commits still require implementation/qualification.
 4. Audit minimum receipts and ref snapshots across product reads after owner movement. Do not read a locally cached newer/older branch in place of the selected authoritative snapshot.
+5. Implement asynchronous, commit-pinned directory entry attribution through the [file attribution design](design/file-attribution.md). Qualify exact per-path Git merge semantics, bounded cold history jobs and cache/generation ownership before serving results. Reuse the immutable index infrastructure if measured workloads require persistent attribution; do not add per-file/per-commit SQL storage or put historical backfill on the push critical path.
 
 **Acceptance:** a synthetic history exceeding 100k commits can check positive/negative ancestry, prepare merge/rebase candidates and exercise branch protection within configured budgets; wrong parent order/body digest is rejected; wide tree pagination and binary paths remain correct. Signed commits/tags and SHA-256 candidates pass existing semantics.
 
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 95266e66..dd039e33 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -1,11 +1,21 @@
 # Large-repository implementation status
 
-Updated during implementation on 2026-10-03. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
+Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Owned staging and preparation conversion in progress
+
+The local staging service now prepares both the exact custody original and its exact registrar for all seven custody actions. The fair preparation dispatcher uses the same owner for Claim/Renew, including original-head reconstruction. Direct caller-owned raw session/base renewal APIs have been removed; base renewals prepare a ready command for transfer to the service. Jobs retain both originals through uncertainty, observer cancellation and closure. Recorded phase knowledge precedes SDK expiry and local guards. Restored renewals on an existing session/base retain the original shared fence; a failed fresh query fences all of its existing resolvers. New execution after authoritative absence checks the local fence, deadline and residence ceiling.
+
+Custody reservation is 28 KiB; an admitted staging checkpoint raises it to 32 KiB. Existing operation, worker, actor, class and global byte caps have not increased. Twenty-seven staging service tests pass, including original reply loss/expiry, renewal/revocation, actual owner Claim, registrar loss before submission/after acceptance/panic, canceled observers and closed-service recovery in both formats. Final-source macOS/Rust 1.98.0 checks pass: 286 publication cases in 214.01 seconds and nine real startup/workspace lifecycle cases in 5.17 seconds, totaling 295 unique focused Rust tests. All-target workspace Clippy passes with warnings denied, the server binary builds, formatting/diff checks pass, and 423 Rust source hashes plus 90 local documentation links and the unchanged protected checkout/SDK pins are verified. The proof is `/tmp/canopy-registered-services-validation.json`. These checks qualify this local service checkpoint, not the whole production cutover or team capacity.
+
+The next custody priorities are actual current-owner fencing for cold sessions, complete staging reconstruction and bounded unresolved-head stop/scan plus settled-history archival. A fresh SQL lease query cannot establish the current owner epoch. Startup's validated Cell Control/live node advertisement is the authority to carry into session construction. The full producer/reader/final-schema cutover, serving retention, typed collection/backup/restore, resource containment, maintenance/acceleration and full-history/team capacity gates remain open.
+
+The proposed [directory file attribution](design/file-attribution.md) uses commit-pinned asynchronous page batches and bounded history caching, with an optional shared immutable index. Its native experiment passes 101 path comparisons across 17 commit states. Its production endpoint, UI, cache/index and load qualification remain unimplemented.
+
 ## Durable custody command journal started locally
 
 The production cutover now registers exact custody metadata before an upload namespace exists. The journal reuses the SDK snapshot/body contract, authenticated carrier, `Stamp`, `Recorded`, domain admission logic and namespace/pin allocator. Command 41 first-writer registration and command 42 exact execution cover preparation/staging Begin, Claim and Renew plus Bind. Positive and denied results share domain writes and SDK acceptance atomically. Late errors or ignored SQL writes leave SDK resolution absent; exact retry preserves the original identity. Corrupt metadata, `Unknown` and `Expired` are never treated as absence. Historical grants do not grant current custody or become new generation-retention roots. See the [durable custody contract](design/durable-custody-command-intents.md).
@@ -14,7 +24,7 @@ Actual repository startup now discovers its latest custody head before preparing
 
 The journal uses a bounded command relation rather than per-object metadata: 4 KiB intents, 1 KiB phases with 512-byte replies, at most one unresolved head per operation, 1,024 pending heads and a 65,535 ordinal ceiling. Primary/partial grant indexes bound discovery. Registering every custody transition currently adds a mutation before execution. This local append history remains conservatively retained; before release, compact settled metadata into immutable per-operation frames with exact historical lookup. Count actual commands and metadata growth in capacity gates. Do not publish this partial cutover merely because primitive tests pass.
 
-Final-source macOS/Rust 1.98.0 qualification passes **283 publication tests** in 169.10 seconds and **nine workspace/lifecycle tests** in 3.58 seconds: **292 unique focused cases**, excluding repeated reruns. All-target workspace Clippy passes with warnings denied in 22.03 seconds; the server binary builds. Formatting/diff, 422 frozen Rust hashes, protected index/archive, clean SDK checkout and five-manifest/six-lock-entry SDK pins pass. Evidence is `/tmp/canopy-custody-intent-validation.json`; logs retain compilation failures, the deliberately rejected late writes and the initial query-plan failure. Twelve SHA-1/SHA-256 families cover original identities/receipts, pre-namespace persistence, denials, first-writer races, every transition, cold owner restore with deleted SQLite, actual SDK expiry, joint initialized bases, reaped successors, forgery/corruption, indexed lookup, late abort and silently ignored SQL writes. Real workspace tests check certified startup and byte-identical journal restore. The partial cutover still requires complete runtime/provider/Linux and capacity qualification.
+The preceding custody-journal checkpoint `dcef9c8` passed **283 publication tests** in 169.10 seconds and **nine workspace/lifecycle tests** in 3.58 seconds: **292 unique focused cases**, excluding repeated reruns. All-target workspace Clippy passes with warnings denied in 22.03 seconds; the server binary builds. Formatting/diff, 422 frozen Rust hashes, protected index/archive, clean SDK checkout and five-manifest/six-lock-entry SDK pins pass. Evidence is `/tmp/canopy-custody-intent-validation.json`; logs retain compilation failures, the deliberately rejected late writes and the initial query-plan failure. Twelve SHA-1/SHA-256 families cover original identities/receipts, pre-namespace persistence, denials, first-writer races, every transition, cold owner restore with deleted SQLite, actual SDK expiry, joint initialized bases, reaped successors, forgery/corruption, indexed lookup, late abort and silently ignored SQL writes. Real workspace tests check certified startup and byte-identical journal restore. The partial cutover still requires complete runtime/provider/Linux and capacity qualification.
 
 Highest priority remains production service conversion: StagingCoordinator, preparation/publication ready factories and direct session renewal must preserve these original intents under fair admission and process-loss reconstruction before their raw qualification bindings can be removed. Then close terminal history archival/retention, complete producer/reader conversion and final DDL removal, serving-generation ownership, typed collection/backup/restore, OS containment, continuous maintenance, physical rewrite/accelerated reads and full Linux/Kubernetes/Chromium histories with the 10,000-developer mixed-load gates. Unresolved expired identities remain protected; bounded orphan discovery and explicit lifecycle recovery remain open. No whole-goal or capacity claim is made.
 

From 26bee4f8871b567722e04d6225f7085d9923bcf6 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 01:28:03 -0700
Subject: [PATCH 09/55] Fence restored custody against current durable Cell
 ownership

A fresh CheckPreparation can still return the previous owner's historical lease after actual owner restoration. Reopening that result incorrectly made the old token usable. Require a target-bound server-owned authority source and compare the admitted incarnation/epoch before and after fresh lease probes. Production reuses validated Cell Control and live node advertisements.

Carry the source through preparation and staging handoff, base/frontier loading and standalone positive recovery. Failed observations permanently fence shared sessions; original known outcomes remain recoverable. Explicit registered Claim under the current owner can still restore a usable session.

Validation: 289 publication and nine real startup/workspace tests on frozen source, workspace/all-target Clippy with warnings denied, canopy binary build, formatting, dependency/protection and documentation-link checks. New SHA-1/SHA-256 regressions cover cold old-owner renewal replay, current-owner takeover and missing/corrupt authority repair without un-fencing old sessions.

This is a local unreleasable cutover checkpoint. Cold staging reconstruction, orphan intent lifecycle/history archival, production ingress/read conversion, retention and full-history/team capacity remain open.
---
 .../src/packs/publication/base.rs             |   9 +-
 .../publication/coordinator/initialization.rs |   7 +-
 .../publication/coordinator/preparation.rs    |  14 ++
 .../packs/publication/coordinator/recovery.rs |   3 +-
 .../src/packs/publication/mod.rs              |   2 +
 .../src/packs/publication/owner.rs            |  70 ++++++
 .../packs/publication/preparation_receipt.rs  |   2 +
 .../publication/recovery/initialization.rs    |   7 +-
 .../src/packs/publication/recovery/mod.rs     |  30 ++-
 .../src/packs/publication/recovery/ready.rs   |  14 +-
 .../packs/publication/recovery/supervisor.rs  |  17 +-
 .../src/packs/publication/session.rs          |  32 ++-
 .../src/packs/publication/staging_service.rs  |  18 +-
 .../publication/staging_service/bound.rs      |   1 +
 .../src/packs/publication/tests.rs            |   7 +-
 .../tests/compaction/coordinator.rs           |   6 +-
 .../publication/tests/completion/outcome.rs   |   1 +
 .../packs/publication/tests/coordinator.rs    |   1 +
 .../tests/coordinator/preparation.rs          | 222 +++++++++++++++++-
 .../packs/publication/tests/durable_policy.rs |  56 +++--
 .../publication/tests/durable_recovery.rs     |  28 ++-
 .../packs/publication/tests/initialization.rs |  16 +-
 .../tests/initialization_recovery.rs          |  24 +-
 .../tests/initialization_retirement.rs        |  24 +-
 .../src/packs/publication/tests/inputs.rs     |  26 +-
 .../packs/publication/tests/inputs/bound.rs   |   3 +
 .../packs/publication/tests/inputs/custody.rs |   7 +-
 .../publication/tests/inputs/requests.rs      |  14 +-
 .../tests/mandatory_registration.rs           |  10 +-
 .../packs/publication/tests/native_capture.rs |   9 +-
 .../publication/tests/preparation_receipt.rs  |   8 +-
 .../src/packs/publication/tests/prepare.rs    |   1 +
 .../publication/tests/recovery_discovery.rs   |  17 +-
 .../publication/tests/ref_policy/fixture.rs   |   3 +-
 .../publication/tests/root_completion.rs      |   9 +-
 .../packs/publication/tests/staged_durable.rs |   7 +-
 .../src/packs/publication/tests/staging.rs    |   4 +-
 .../publication/tests/staging_receipt.rs      |  12 +-
 .../publication/tests/staging_service.rs      |  68 ++++--
 .../tests/staging_service/bound.rs            |  21 +-
 .../tests/staging_service/publication.rs      |  16 +-
 .../publication/tests/terminal_retention.rs   |  16 +-
 .../src/server/catalog_initialization.rs      |  23 +-
 crates/canopy-server/src/server/peer.rs       |   2 +-
 .../canopy-server/src/server/residency/mod.rs |  16 +-
 .../design/durable-custody-command-intents.md |  12 +-
 .../large-repository-implementation-status.md |   4 +-
 47 files changed, 765 insertions(+), 154 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/owner.rs

diff --git a/crates/canopy-server/src/packs/publication/base.rs b/crates/canopy-server/src/packs/publication/base.rs
index 716b4f5d..cdcf7e01 100644
--- a/crates/canopy-server/src/packs/publication/base.rs
+++ b/crates/canopy-server/src/packs/publication/base.rs
@@ -14,6 +14,8 @@ use tokio::time::{Instant, timeout_at};
 
 #[derive(Debug, thiserror::Error)]
 pub enum PreparationBaseError {
+    #[error("authoritative owner observation failed")]
+    Owner(#[source] Box<dyn std::error::Error + Send + Sync>),
     #[error("authoritative preparation query failed")]
     Query(#[source] Box<InvocationError<Option<PreparationLease>>>),
     #[error("authoritative preparation frontier query failed")]
@@ -43,8 +45,9 @@ impl PreparationBaseResolver {
         indexes: Arc<CatalogIndexes>,
         files: Arc<CatalogFiles>,
         minimum: Option<Receipt>,
+        authority: PreparationAuthority,
     ) -> Result<Self, PreparationBaseError> {
-        let session = PreparationSession::open(client, target, check, minimum).await?;
+        let session = PreparationSession::open(client, target, check, minimum, authority).await?;
         Self::from_session(session, indexes, files).await
     }
     pub(super) async fn from_session(
@@ -52,6 +55,7 @@ impl PreparationBaseResolver {
         indexes: Arc<CatalogIndexes>,
         files: Arc<CatalogFiles>,
     ) -> Result<Self, PreparationBaseError> {
+        session.check_owner().await?;
         let (lease, deadline) = session.live_lease()?;
         if indexes.store().repository() != lease.token.repository
             || indexes.sources().format() != lease.format
@@ -67,6 +71,7 @@ impl PreparationBaseResolver {
         } else {
             None
         };
+        session.check_owner().await?;
         session.live_lease()?;
         Ok(Self {
             session,
@@ -125,6 +130,7 @@ impl PreparationBaseResolver {
     /// Select only facts read through the exact active attempt. The original
     /// floor, namespace, deadline and renewal fence are shared by all selections.
     pub(super) async fn select_current(&self) -> Result<Self, PreparationBaseError> {
+        self.session.check_owner().await?;
         let (_, deadline) = self.live_lease()?;
         timeout_at(deadline, async {
             let started = Instant::now();
@@ -175,6 +181,7 @@ impl PreparationBaseResolver {
                     None => None,
                 }
             };
+            self.session.check_owner().await?;
             self.live_lease()?;
             if Instant::now() >= deadline {
                 return Err(PreparationBaseError::Inactive);
diff --git a/crates/canopy-server/src/packs/publication/coordinator/initialization.rs b/crates/canopy-server/src/packs/publication/coordinator/initialization.rs
index a49816d2..bd229b2a 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/initialization.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/initialization.rs
@@ -89,7 +89,12 @@ impl ReadyInitialization {
         }
         let client = self.owner.base.capability().0;
         let result = registered
-            .dispatch_initialization(client, store, Some(&self.owner.base.session))
+            .dispatch_initialization(
+                client,
+                store,
+                &self.owner.base.session.authority,
+                Some(&self.owner.base.session),
+            )
             .await;
         drop(self.owner);
         result
diff --git a/crates/canopy-server/src/packs/publication/coordinator/preparation.rs b/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
index da322afd..f8e1141c 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
@@ -33,6 +33,7 @@ pub struct ReadyPreparation {
 }
 #[derive(Clone)]
 struct PreparationRequest {
+    authority: PreparationAuthority,
     client: CellClient,
     target: CellTarget,
     check: LeaseCheck,
@@ -78,6 +79,7 @@ impl ReadyPreparation {
         client: CellClient,
         target: CellTarget,
         operation: [u8; 16],
+        authority: PreparationAuthority,
     ) -> Result<Self, PreparationReadyError> {
         let command = OwnedCustody::restore(&client, &target, operation).await?;
         let (request, renew) = match command.action()? {
@@ -86,8 +88,12 @@ impl ReadyPreparation {
             _ => return Err(CustodyError::Context.into()),
         };
         validate(&target, &request)?;
+        if !authority.matches(&target) {
+            return Err(PreparationBaseError::Context.into());
+        }
         Ok(Self {
             inner: Box::new(PreparationRequest {
+                authority,
                 client,
                 target,
                 check: request.check,
@@ -109,8 +115,12 @@ impl ReadyPreparation {
         target: CellTarget,
         request: LeaseRequest,
         identity: MutationIdentity,
+        authority: PreparationAuthority,
     ) -> Result<Self, PreparationReadyError> {
         validate(&target, &request)?;
+        if !authority.matches(&target) {
+            return Err(PreparationBaseError::Context.into());
+        }
         let check = request.check.clone();
         let command = OwnedCustody::prepare(
             &client,
@@ -121,6 +131,7 @@ impl ReadyPreparation {
         .await?;
         Ok(Self {
             inner: Box::new(PreparationRequest {
+                authority,
                 client,
                 target,
                 check,
@@ -215,6 +226,7 @@ impl ReadyPreparation {
                         actor: inner.check.actor.clone(),
                     },
                     Some(committed.receipt),
+                    inner.authority.clone(),
                 )
                 .await?;
                 if session.lease.base != lease.base || session.lease.format != lease.format {
@@ -254,6 +266,7 @@ impl PreparationSession {
         }
         Ok(ReadyPreparation {
             inner: Box::new(PreparationRequest {
+                authority: self.authority.clone(),
                 client: self.client.clone(),
                 target: self.target.clone(),
                 check: self.check.clone(),
@@ -288,6 +301,7 @@ impl PreparationSession {
         self.live_lease()?;
         Ok(ReadyPreparation {
             inner: Box::new(PreparationRequest {
+                authority: self.authority.clone(),
                 client: self.client.clone(),
                 target: self.target.clone(),
                 check: self.check.clone(),
diff --git a/crates/canopy-server/src/packs/publication/coordinator/recovery.rs b/crates/canopy-server/src/packs/publication/coordinator/recovery.rs
index ee19df86..f3d18c6a 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/recovery.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/recovery.rs
@@ -45,10 +45,11 @@ impl ReadyBoundRecovery {
         store: &ArtifactStore,
     ) -> Self {
         let client = owner.capability().0.clone();
+        let authority = owner.session().authority.clone();
         Self {
             owner,
             intent,
-            ready: ReadyRootRecovery::from_verified(registered, client, store.clone()),
+            ready: ReadyRootRecovery::from_verified(registered, client, store.clone(), authority),
             refusal,
         }
     }
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 47268332..bec5e93f 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -14,7 +14,9 @@ use cellule_runtime::{
     primitives::sql::{SqlBatch, SqlResultSet, SqlStatement, SqlValue},
     registry::{CommandContext, CommandResult, OwnerFence, QueryContext},
 };
+mod owner;
 pub(crate) mod registry;
+pub use owner::PreparationAuthority;
 mod session;
 pub use session::PreparationSession;
 mod base;
diff --git a/crates/canopy-server/src/packs/publication/owner.rs b/crates/canopy-server/src/packs/publication/owner.rs
new file mode 100644
index 00000000..b440acc0
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/owner.rs
@@ -0,0 +1,70 @@
+//! Fresh durable owner observations, separate from historical lease replies.
+use super::*;
+use cellule_runtime::CellTarget;
+
+/// Server-owned authority source for one repository Cell. A decoded lease or
+/// caller-supplied fence cannot construct this capability.
+#[derive(Clone)]
+pub struct PreparationAuthority {
+    target: CellTarget,
+    source: Source,
+}
+#[derive(Clone)]
+enum Source {
+    Node(crate::server::peer::NodePeer),
+    // The local runtime fixture has real durable Control ownership but no
+    // network node advertisement. This path is absent in production builds.
+    #[cfg(test)]
+    Local(std::sync::Arc<cellule_runtime::control::authority::CellAuthority>),
+}
+impl PreparationAuthority {
+    pub(crate) fn node(peer: crate::server::peer::NodePeer, target: CellTarget) -> Self {
+        Self {
+            target,
+            source: Source::Node(peer),
+        }
+    }
+    #[cfg(test)]
+    pub(super) fn local(layout: cellule_ltx::CellStorageLayout, target: CellTarget) -> Self {
+        Self {
+            target,
+            source: Source::Local(std::sync::Arc::new(
+                cellule_runtime::control::authority::CellAuthority::new(layout),
+            )),
+        }
+    }
+    pub(super) fn matches(&self, target: &CellTarget) -> bool {
+        self.target == *target
+    }
+    pub(super) async fn check(
+        &self,
+        target: &CellTarget,
+        expected: OwnerFence,
+    ) -> Result<(), PreparationBaseError> {
+        if !self.matches(target) {
+            return Err(PreparationBaseError::Context);
+        }
+        let actual = match &self.source {
+            Source::Node(peer) => peer
+                .current_owner_fence(target)
+                .await
+                .map_err(|error| PreparationBaseError::Owner(Box::new(error)))?,
+            #[cfg(test)]
+            Source::Local(authority) => {
+                let control = authority
+                    .load(target.cell_id())
+                    .await
+                    .map_err(|error| PreparationBaseError::Owner(Box::new(error)))?
+                    .ok_or(PreparationBaseError::Inactive)?;
+                if control.value().owner.is_none() {
+                    return Err(PreparationBaseError::Inactive);
+                }
+                control.value().owner_fence()
+            }
+        };
+        if actual != expected {
+            return Err(PreparationBaseError::Inactive);
+        }
+        Ok(())
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/preparation_receipt.rs b/crates/canopy-server/src/packs/publication/preparation_receipt.rs
index 1b1e5e64..b9c7be33 100644
--- a/crates/canopy-server/src/packs/publication/preparation_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/preparation_receipt.rs
@@ -71,6 +71,7 @@ impl PreparationAdmission {
         client: CellClient,
         lease_ms: u64,
         identity: MutationIdentity,
+        authority: PreparationAuthority,
     ) -> Result<ReadyPreparation, PreparationReadyError> {
         ReadyPreparation::claim(
             client,
@@ -83,6 +84,7 @@ impl PreparationAdmission {
                 lease_ms,
             },
             identity,
+            authority,
         )
         .await
     }
diff --git a/crates/canopy-server/src/packs/publication/recovery/initialization.rs b/crates/canopy-server/src/packs/publication/recovery/initialization.rs
index 98468de1..ddef2b4b 100644
--- a/crates/canopy-server/src/packs/publication/recovery/initialization.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/initialization.rs
@@ -56,13 +56,16 @@ impl RegisteredRootRecovery {
         &self,
         client: &CellClient,
         store: &ArtifactStore,
+        authority: &PreparationAuthority,
     ) -> Result<Committed<InitializationReply>, PublicationError> {
-        self.dispatch_initialization(client, store, None).await
+        self.dispatch_initialization(client, store, authority, None)
+            .await
     }
     pub(in crate::packs::publication) async fn dispatch_initialization(
         &self,
         client: &CellClient,
         store: &ArtifactStore,
+        authority: &PreparationAuthority,
         original: Option<&PreparationSession>,
     ) -> Result<Committed<InitializationReply>, PublicationError> {
         if self.record.kind != Kind::Initialization {
@@ -72,7 +75,7 @@ impl RegisteredRootRecovery {
             });
         }
         let result = self
-            .dispatch_command::<InitializeCatalogRefs>(client, store, false, original)
+            .dispatch_command::<InitializeCatalogRefs>(client, store, authority, false, original)
             .await
             .map_err(|error| {
                 error.publication(self.evidence(), PublicationError::Initialization)
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index 7502f6f5..918aeccb 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -311,23 +311,27 @@ impl RegisteredRootRecovery {
         &self,
         client: &CellClient,
         store: &ArtifactStore,
+        authority: &PreparationAuthority,
     ) -> Result<Committed<RootCompletionReply>, PublicationError> {
-        self.dispatch_root(client, store, None).await
+        self.dispatch_root(client, store, authority, None).await
     }
     async fn dispatch_root(
         &self,
         client: &CellClient,
         store: &ArtifactStore,
+        authority: &PreparationAuthority,
         original: Option<&PreparationSession>,
     ) -> Result<Committed<RootCompletionReply>, PublicationError> {
         let result = match self.record.kind {
             Kind::Publish => {
-                self.dispatch_command::<CompleteRootPush>(client, store, false, original)
+                self.dispatch_command::<CompleteRootPush>(client, store, authority, false, original)
                     .await
             }
             Kind::Outcome => {
-                self.dispatch_command::<CompleteRootOutcome>(client, store, false, original)
-                    .await
+                self.dispatch_command::<CompleteRootOutcome>(
+                    client, store, authority, false, original,
+                )
+                .await
             }
             Kind::Policy | Kind::Initialization => {
                 Err(AttemptError::Invocation(InvocationError::NotStarted(
@@ -344,11 +348,13 @@ impl RegisteredRootRecovery {
         &self,
         client: &CellClient,
         store: &ArtifactStore,
+        authority: &PreparationAuthority,
         refusing: &std::sync::atomic::AtomicBool,
     ) -> Result<PublicationOutcome, PublicationError> {
         self.dispatch_bound(
             client,
             store,
+            authority,
             refusing,
             None,
             #[cfg(test)]
@@ -360,25 +366,29 @@ impl RegisteredRootRecovery {
         &self,
         client: &CellClient,
         store: &ArtifactStore,
+        authority: &PreparationAuthority,
         refusing: &std::sync::atomic::AtomicBool,
         original: Option<&PreparationSession>,
         #[cfg(test)] refusal_fault: Option<&std::sync::atomic::AtomicU8>,
     ) -> Result<PublicationOutcome, PublicationError> {
         if self.record.kind == Kind::Initialization {
             return self
-                .dispatch_initialization(client, store, original)
+                .dispatch_initialization(client, store, authority, original)
                 .await
                 .map(PublicationOutcome::Initialization);
         }
         if self.record.kind != Kind::Policy {
             let result = match original {
-                Some(original) => self.dispatch_root(client, store, Some(original)).await,
-                None => self.dispatch(client, store).await,
+                Some(original) => {
+                    self.dispatch_root(client, store, authority, Some(original))
+                        .await
+                }
+                None => self.dispatch(client, store, authority).await,
             };
             return result.map(PublicationOutcome::RootPush);
         }
         let result = self
-            .dispatch_command::<RegisterRefPolicyPage>(client, store, false, original)
+            .dispatch_command::<RegisterRefPolicyPage>(client, store, authority, false, original)
             .await;
         let refused = match &result {
             Ok(value) => {
@@ -431,7 +441,7 @@ impl RegisteredRootRecovery {
                 )));
             }
             let outcome = self
-                .dispatch_command::<CompleteRootOutcome>(client, store, true, original)
+                .dispatch_command::<CompleteRootOutcome>(client, store, authority, true, original)
                 .await;
             #[cfg(test)]
             if fault == 2 {
@@ -489,6 +499,7 @@ impl RegisteredRootRecovery {
         &self,
         client: &CellClient,
         store: &ArtifactStore,
+        authority: &PreparationAuthority,
         refusal: bool,
         original: Option<&PreparationSession>,
     ) -> Result<Committed<C::Output>, AttemptError<C::Output>> {
@@ -546,6 +557,7 @@ impl RegisteredRootRecovery {
                     self.evidence().target().clone(),
                     self.record.check.clone(),
                     None,
+                    authority.clone(),
                 )
                 .await
                 {
diff --git a/crates/canopy-server/src/packs/publication/recovery/ready.rs b/crates/canopy-server/src/packs/publication/recovery/ready.rs
index faf00b61..ce064874 100644
--- a/crates/canopy-server/src/packs/publication/recovery/ready.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/ready.rs
@@ -8,6 +8,7 @@ pub struct ReadyRootRecovery {
     recovery: std::sync::Arc<RegisteredRootRecovery>,
     client: CellClient,
     store: ArtifactStore,
+    authority: PreparationAuthority,
     refusing: std::sync::Arc<std::sync::atomic::AtomicBool>,
     #[cfg(test)]
     refusal_fault: std::sync::Arc<std::sync::atomic::AtomicU8>,
@@ -20,9 +21,15 @@ impl RegisteredRootRecovery {
         self,
         client: CellClient,
         store: ArtifactStore,
+        authority: PreparationAuthority,
     ) -> Result<ReadyRootRecovery, RootRecoveryError> {
         target_matches(self.evidence().target(), &store, &self.record.check)?;
-        Ok(ReadyRootRecovery::from_verified(self, client, store))
+        if !authority.matches(self.evidence().target()) {
+            return Err(RootRecoveryError::Context);
+        }
+        Ok(ReadyRootRecovery::from_verified(
+            self, client, store, authority,
+        ))
     }
 }
 impl ReadyRootRecovery {
@@ -41,11 +48,13 @@ impl ReadyRootRecovery {
         recovery: RegisteredRootRecovery,
         client: CellClient,
         store: ArtifactStore,
+        authority: PreparationAuthority,
     ) -> Self {
         Self {
             recovery: std::sync::Arc::new(recovery),
             client,
             store,
+            authority,
             refusing: std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
             #[cfg(test)]
             refusal_fault: std::sync::Arc::new(std::sync::atomic::AtomicU8::new(0)),
@@ -126,6 +135,7 @@ impl ReadyRootRecovery {
                     .dispatch_bound(
                         &self.client,
                         &self.store,
+                        &self.authority,
                         &self.refusing,
                         Some(original),
                         #[cfg(test)]
@@ -135,7 +145,7 @@ impl ReadyRootRecovery {
             }
             None => {
                 self.recovery
-                    .dispatch_any(&self.client, &self.store, &self.refusing)
+                    .dispatch_any(&self.client, &self.store, &self.authority, &self.refusing)
                     .await
             }
         };
diff --git a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
index 47e230ea..0db27223 100644
--- a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
@@ -79,8 +79,9 @@ impl RecoverySupervisor {
         store: ArtifactStore,
         coordinator: PublicationCoordinator,
         limits: RecoveryScanLimits,
+        authority: PreparationAuthority,
     ) -> Result<Self, RootRecoveryError> {
-        Self::start_inner(client, target, store, coordinator, limits, None)
+        Self::start_inner(client, target, store, coordinator, limits, authority, None)
     }
     /// The service supplies current repository administration and actual owner
     /// custody. Closed attempts release through the same fair maintenance queue;
@@ -91,6 +92,7 @@ impl RecoverySupervisor {
         store: ArtifactStore,
         coordinator: PublicationCoordinator,
         limits: RecoveryScanLimits,
+        authority: PreparationAuthority,
         maintenance: MaintenanceRequest,
     ) -> Result<Self, RootRecoveryError> {
         if maintenance.repository != store.repository() {
@@ -103,6 +105,7 @@ impl RecoverySupervisor {
             store,
             coordinator,
             limits,
+            authority,
             Some(maintenance),
         )
     }
@@ -112,10 +115,12 @@ impl RecoverySupervisor {
         store: ArtifactStore,
         coordinator: PublicationCoordinator,
         limits: RecoveryScanLimits,
+        authority: PreparationAuthority,
         maintenance: Option<MaintenanceRequest>,
     ) -> Result<Self, RootRecoveryError> {
         limits.validate()?;
-        if !coordinator.matches_target(&target)
+        if !authority.matches(&target)
+            || !coordinator.matches_target(&target)
             || crate::repository_target(target.tenant(), target.application(), store.repository())?
                 != target
         {
@@ -130,6 +135,7 @@ impl RecoverySupervisor {
                 target,
                 store,
                 coordinator,
+                authority,
                 maintenance,
             },
             sql,
@@ -211,6 +217,7 @@ struct Scan {
     target: CellTarget,
     store: ArtifactStore,
     coordinator: PublicationCoordinator,
+    authority: PreparationAuthority,
     maintenance: Option<MaintenanceRequest>,
 }
 impl Scan {
@@ -302,7 +309,11 @@ impl Scan {
         }
         match self
             .coordinator
-            .submit(registered.ready(self.client.clone(), self.store.clone())?)
+            .submit(registered.ready(
+                self.client.clone(),
+                self.store.clone(),
+                self.authority.clone(),
+            )?)
             .await
         {
             Ok(_) => stats.submitted = stats.submitted.saturating_add(1),
diff --git a/crates/canopy-server/src/packs/publication/session.rs b/crates/canopy-server/src/packs/publication/session.rs
index 556937c2..08c10e4f 100644
--- a/crates/canopy-server/src/packs/publication/session.rs
+++ b/crates/canopy-server/src/packs/publication/session.rs
@@ -12,6 +12,7 @@ use tokio::time::Instant;
 
 #[derive(Clone)]
 pub struct PreparationSession {
+    pub(super) authority: PreparationAuthority,
     pub(super) client: CellClient,
     pub(super) target: CellTarget,
     pub(super) check: LeaseCheck,
@@ -26,6 +27,7 @@ impl PreparationSession {
         target: CellTarget,
         check: LeaseCheck,
         minimum: Option<Receipt>,
+        authority: PreparationAuthority,
     ) -> Result<Self, PreparationBaseError> {
         if crate::repository_target(
             target.tenant(),
@@ -34,11 +36,13 @@ impl PreparationSession {
         )
         .map_err(|_| PreparationBaseError::Context)?
             != target
+            || !authority.matches(&target)
         {
             return Err(PreparationBaseError::Context);
         }
-        let (lease, deadline) = probe(&client, &target, &check, minimum).await?;
+        let (lease, deadline) = probe(&client, &target, &check, minimum, &authority).await?;
         Ok(Self {
+            authority,
             client,
             target,
             check,
@@ -62,6 +66,16 @@ impl PreparationSession {
         }
         Ok((self.lease, deadline))
     }
+    pub(super) async fn check_owner(&self) -> Result<(), PreparationBaseError> {
+        let result = self
+            .authority
+            .check(&self.target, self.check.token.owner)
+            .await;
+        if result.is_err() {
+            self.fence();
+        }
+        result
+    }
     pub(super) fn fence(&self) {
         self.fenced.store(true, Ordering::Release);
     }
@@ -78,8 +92,14 @@ impl PreparationSession {
         {
             return Err(PreparationBaseError::Inactive);
         }
-        let (lease, deadline) =
-            probe(&self.client, &self.target, &self.check, Some(minimum)).await?;
+        let (lease, deadline) = probe(
+            &self.client,
+            &self.target,
+            &self.check,
+            Some(minimum),
+            &self.authority,
+        )
+        .await?;
         if lease.token != self.lease.token
             || lease.base != self.lease.base
             || lease.format != self.lease.format
@@ -104,10 +124,12 @@ async fn probe(
     target: &CellTarget,
     check: &LeaseCheck,
     minimum: Option<Receipt>,
+    authority: &PreparationAuthority,
 ) -> Result<(PreparationLease, Instant), PreparationBaseError> {
     // Start before the query, not after its reply, so transport/queue time can
     // only shorten the usable lease. Queries do not replay stored commands.
     let started = Instant::now();
+    authority.check(target, check.token.owner).await?;
     let lease = client
         .query::<CheckPreparation>(target, minimum, check.clone())
         .await
@@ -127,5 +149,9 @@ async fn probe(
     if Instant::now() >= deadline {
         return Err(PreparationBaseError::Inactive);
     }
+    authority.check(target, check.token.owner).await?;
+    if Instant::now() >= deadline {
+        return Err(PreparationBaseError::Inactive);
+    }
     Ok((lease, deadline))
 }
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index b26901f7..5e1768a1 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -323,6 +323,7 @@ struct Admission {
     actors: HashMap<String, ActorAdmission>,
 }
 struct Inner {
+    authority: PreparationAuthority,
     target: CellTarget,
     limits: StagingLimits,
     admission: Mutex<Admission>,
@@ -359,6 +360,7 @@ struct WorkSlots {
     slots: HashMap<u64, Arc<dyn RetainedWork>>,
 }
 struct Job {
+    authority: PreparationAuthority,
     client: CellClient,
     target: CellTarget,
     actor: String,
@@ -552,10 +554,18 @@ pub struct StagingStats {
     pub closed: bool,
 }
 impl StagingCoordinator {
-    pub fn new(target: CellTarget, limits: StagingLimits) -> Result<Self, StagingError> {
+    pub fn new(
+        target: CellTarget,
+        limits: StagingLimits,
+        authority: PreparationAuthority,
+    ) -> Result<Self, StagingError> {
         limits.validate()?;
+        if !authority.matches(&target) {
+            return Err(StagingError::Context);
+        }
         Ok(Self {
             inner: Arc::new(Inner {
+                authority,
                 target,
                 limits,
                 admission: Mutex::new(Admission::default()),
@@ -606,6 +616,7 @@ impl StagingCoordinator {
         let actor_workers = Arc::clone(&actor.workers);
         let now = Instant::now();
         let job = Arc::new(Job {
+            authority: self.inner.authority.clone(),
             client: ready.inner.client,
             target: ready.inner.target,
             actor: ready.inner.request.actor,
@@ -1266,6 +1277,7 @@ async fn probe(job: &Job, minimum: Receipt) -> Result<(StagingLease, Instant), S
         Some(l) => l.token,
         None => return Err(StagingError::Context),
     };
+    job.authority.check(&job.target, token.owner).await?;
     let lease = job
         .client
         .query::<CheckStaging>(
@@ -1292,6 +1304,10 @@ async fn probe(job: &Job, minimum: Receipt) -> Result<(StagingLease, Instant), S
     if deadline <= Instant::now() {
         return Err(StagingError::Inactive);
     }
+    job.authority.check(&job.target, token.owner).await?;
+    if Instant::now() >= deadline {
+        return Err(StagingError::Inactive);
+    }
     Ok((lease, deadline))
 }
 async fn supervise(inner: Arc<Inner>, job: Arc<Job>) {
diff --git a/crates/canopy-server/src/packs/publication/staging_service/bound.rs b/crates/canopy-server/src/packs/publication/staging_service/bound.rs
index 8aab4f1a..d7b19f01 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/bound.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/bound.rs
@@ -55,6 +55,7 @@ pub(super) async fn accept_bound(
             actor: job.actor.clone(),
         },
         Some(value.receipt),
+        job.authority.clone(),
     )
     .await;
     let mut session = match session {
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 7b8aa747..b5dccc0f 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -144,6 +144,9 @@ struct Fixture {
     handle: CellHandle,
 }
 impl Fixture {
+    fn authority(&self) -> PreparationAuthority {
+        PreparationAuthority::local(self.layout.clone(), self.target.clone())
+    }
     async fn new(format: ObjectFormat) -> Result<Self> {
         Self::with_artifact_sequence(format, 0).await
     }
@@ -1067,6 +1070,7 @@ async fn authoritative_base_resolution_uses_live_queried_facts_and_fences_failed
             Arc::clone(&native.indexes),
             Arc::clone(&files),
             Some(started.receipt),
+            fixture.authority(),
         )
         .await?;
         let base = resolver.context().base.ok_or("base")?;
@@ -1148,7 +1152,8 @@ async fn authoritative_base_resolution_uses_live_queried_facts_and_fences_failed
                 check(granted.token),
                 Arc::clone(&native.indexes),
                 Arc::clone(&files),
-                None
+                None,
+                fixture.authority(),
             )
             .await,
             Err(PreparationBaseError::Inactive)
diff --git a/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs b/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
index 35c56508..36ed1fd4 100644
--- a/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
@@ -16,7 +16,11 @@ async fn maintenance_final_publication_uses_shared_bound_lifecycle_and_reserved_
         let fixture = Fixture::new(format).await?;
         let inventory = seed(&fixture, 2).await?;
         let before_refs = refs(&fixture.handle).await?;
-        let stages = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+        let stages = StagingCoordinator::new(
+            fixture.target.clone(),
+            StagingLimits::default(),
+            fixture.authority(),
+        )?;
         let ready = ReadyStaging::new(
             fixture.client(),
             fixture.target.clone(),
diff --git a/crates/canopy-server/src/packs/publication/tests/completion/outcome.rs b/crates/canopy-server/src/packs/publication/tests/completion/outcome.rs
index dd946a1d..38a49796 100644
--- a/crates/canopy-server/src/packs/publication/tests/completion/outcome.rs
+++ b/crates/canopy-server/src/packs/publication/tests/completion/outcome.rs
@@ -26,6 +26,7 @@ async fn opened(fixture: &Fixture, operation: [u8; 16]) -> Result<Arc<Preparatio
             fixture.target.clone(),
             check(token),
             Some(started.receipt),
+            fixture.authority(),
         )
         .await?,
     ))
diff --git a/crates/canopy-server/src/packs/publication/tests/coordinator.rs b/crates/canopy-server/src/packs/publication/tests/coordinator.rs
index 404ecfb0..fd3041cb 100644
--- a/crates/canopy-server/src/packs/publication/tests/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/tests/coordinator.rs
@@ -102,6 +102,7 @@ pub(super) async fn empty_in_store(
             indexes,
             files,
             Some(started.receipt),
+            fixture.authority(),
         )
         .await?,
     );
diff --git a/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs b/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
index 3bd78332..cf930cf7 100644
--- a/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
+++ b/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
@@ -1,5 +1,192 @@
 use super::*;
 
+#[tokio::test]
+async fn cold_original_renewal_keeps_history_but_cannot_grant_previous_owner_custody() -> Result {
+    let mut observations = Vec::new();
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let original_session = session(&f, [209; 16]).await?;
+        let coordinator =
+            PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let ticket = coordinator
+            .submit(
+                original_session
+                    .ready_renew(identity()?, DEFAULT_LEASE_MS)
+                    .await?,
+            )
+            .await?;
+        let original = changed(ticket.wait().await)?.committed;
+        assert!(coordinator.close_and_drain().await.is_empty());
+        let old_owner = original_session.lease.token.owner;
+        let (runtime, handle, client) =
+            super::super::durable_recovery::restore_owner(&f, &original_session.check).await?;
+        assert_ne!(handle.owner_fence(), old_owner);
+        // SQL still has the original operation and pin. Such historical facts
+        // are not an observation of the current admitted owner epoch.
+        let historical = client
+            .query::<CheckPreparation>(
+                &f.target,
+                Some(original.receipt),
+                original_session.check.clone(),
+            )
+            .await?
+            .output;
+        let restored = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let ticket = restored
+            .submit(
+                ReadyPreparation::restore(client, f.target.clone(), [209; 16], f.authority())
+                    .await?,
+            )
+            .await?;
+        let outcome = changed(ticket.wait().await)?;
+        assert_eq!(outcome.committed, original);
+        observations.push((format, historical.is_some(), outcome.session.is_ok()));
+        assert!(restored.close_and_drain().await.is_empty());
+        runtime.shutdown().await?;
+    }
+    assert!(
+        observations.iter().all(|(_, _, usable)| !usable),
+        "previous owner became usable after cold restoration: {observations:?}"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_takeover_fences_shared_old_session_and_restores_current_claim() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let old = session(&f, [210; 16]).await?;
+        let shared = old.clone();
+        let (runtime, handle, client) =
+            super::super::durable_recovery::restore_owner(&f, &old.check).await?;
+        assert!(matches!(
+            old.check_owner().await,
+            Err(PreparationBaseError::Inactive)
+        ));
+        assert!(matches!(
+            shared.live_lease(),
+            Err(PreparationBaseError::Inactive)
+        ));
+        let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let ready = ReadyPreparation::claim(
+            client.clone(),
+            f.target.clone(),
+            request_for(&old),
+            identity()?,
+            f.authority(),
+        )
+        .await?;
+        let result = changed(queue.submit(ready).await?.wait().await)?;
+        let current = result
+            .session
+            .as_ref()
+            .map_err(|e| format!("current claim: {e}"))?;
+        assert_eq!(current.lease.token.owner, handle.owner_fence());
+        assert_ne!(
+            current.lease.token.artifact_operation,
+            old.lease.token.artifact_operation
+        );
+        assert_eq!(current.lease.token.operation, old.lease.token.operation);
+        let restored =
+            ReadyPreparation::restore(client.clone(), f.target.clone(), [210; 16], f.authority())
+                .await?;
+        let replay = changed(queue.submit(restored).await?.wait().await)?;
+        assert_eq!(replay.committed, result.committed);
+        replay
+            .session
+            .as_ref()
+            .map_err(|e| format!("restored current claim: {e}"))?
+            .live_lease()?;
+        // A fresh granted session can renew through the same registered service.
+        let renewed = changed(
+            queue
+                .submit(current.ready_renew(identity()?, DEFAULT_LEASE_MS).await?)
+                .await?
+                .wait()
+                .await,
+        )?;
+        assert_eq!(
+            renewed
+                .session
+                .as_ref()
+                .map_err(|e| format!("current renewal: {e}"))?
+                .lease
+                .token,
+            current.lease.token
+        );
+        assert!(shared.live_lease().is_err());
+        assert!(queue.close_and_drain().await.is_empty());
+        runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn missing_or_corrupt_owner_preserves_original_outcome_and_permanently_fences_session()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for corrupt in [false, true] {
+            let f = Fixture::new(format).await?;
+            let original_session = session(&f, [211; 16]).await?;
+            let queue =
+                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            let original = changed(
+                queue
+                    .submit(
+                        original_session
+                            .ready_renew(identity()?, DEFAULT_LEASE_MS)
+                            .await?,
+                    )
+                    .await?
+                    .wait()
+                    .await,
+            )?
+            .committed;
+            let control_path = f.layout.control_path(f.target.cell_id().as_bytes());
+            let (control, _) = f.layout.store().get_with_etag(&control_path).await?;
+            if corrupt {
+                f.layout
+                    .store()
+                    .put_overwrite(&control_path, bytes::Bytes::from_static(b"invalid control"))
+                    .await?;
+            } else {
+                f.layout.store().delete(&control_path).await?;
+            }
+            let restored =
+                ReadyPreparation::restore(f.client(), f.target.clone(), [211; 16], f.authority())
+                    .await?;
+            let result = changed(queue.submit(restored).await?.wait().await)?;
+            assert_eq!(result.committed, original);
+            assert!(result.session.is_err());
+            assert!(original_session.refresh(original.receipt).await.is_err());
+            assert!(
+                original_session
+                    .fenced
+                    .load(std::sync::atomic::Ordering::Acquire)
+            );
+            // Repairing the durable source does not undo a previously observed
+            // session fence. A fresh constructor must reacquire authority.
+            f.layout
+                .store()
+                .put_overwrite(&control_path, control)
+                .await?;
+            assert!(original_session.refresh(original.receipt).await.is_err());
+            PreparationSession::open(
+                f.client(),
+                f.target.clone(),
+                original_session.check.clone(),
+                Some(original.receipt),
+                f.authority(),
+            )
+            .await?
+            .live_lease()?;
+            assert!(queue.close_and_drain().await.is_empty());
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
 async fn session(f: &Fixture, operation: [u8; 16]) -> Result<Arc<PreparationSession>> {
     let started = registered_preparation(f, operation).await?;
     let lease = lease(started.output)?;
@@ -9,6 +196,7 @@ async fn session(f: &Fixture, operation: [u8; 16]) -> Result<Arc<PreparationSess
             f.target.clone(),
             check(lease.token),
             Some(started.receipt),
+            f.authority(),
         )
         .await?,
     ))
@@ -27,7 +215,14 @@ async fn ready(
 ) -> Result<ReadyPreparation> {
     Ok(match kind {
         PreparationCommandKind::Claim => {
-            ReadyPreparation::claim(f.client(), f.target.clone(), request_for(s), mutation).await?
+            ReadyPreparation::claim(
+                f.client(),
+                f.target.clone(),
+                request_for(s),
+                mutation,
+                f.authority(),
+            )
+            .await?
         }
         PreparationCommandKind::Renew => s.ready_renew(mutation, DEFAULT_LEASE_MS).await?,
     })
@@ -324,16 +519,28 @@ async fn bound_lease_ready_rejects_invalid_context_size_duration_and_never_reviv
     let mut wrong = request_for(&s);
     wrong.check.token.repository = uuid::Uuid::new_v4().into_bytes();
     assert!(
-        ReadyPreparation::claim(f.client(), f.target.clone(), wrong, identity()?)
-            .await
-            .is_err()
+        ReadyPreparation::claim(
+            f.client(),
+            f.target.clone(),
+            wrong,
+            identity()?,
+            f.authority(),
+        )
+        .await
+        .is_err()
     );
     let mut huge = request_for(&s);
     huge.check.actor = "x".repeat(8192);
     assert!(
-        ReadyPreparation::claim(f.client(), f.target.clone(), huge, identity()?)
-            .await
-            .is_err()
+        ReadyPreparation::claim(
+            f.client(),
+            f.target.clone(),
+            huge,
+            identity()?,
+            f.authority(),
+        )
+        .await
+        .is_err()
     );
     let coordinator = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
     coordinator.fault_for_test(2);
@@ -397,6 +604,7 @@ async fn bound_lease_claim_after_actual_owner_restore_uses_new_fence_and_preserv
                     f.target.clone(),
                     request_for(&original),
                     mutation,
+                    f.authority(),
                 )
                 .await?,
             )
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
index 2db9aec7..e8ce75c5 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
@@ -68,7 +68,12 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
         .await?;
     } else {
         edit(f, "CREATE TRIGGER phase_late_fault BEFORE UPDATE OF recovery_phase ON catalog_leases WHEN NEW.recovery_phase IS NOT NULL BEGIN SELECT RAISE(ABORT,'late phase fault'); END;").await?;
-        assert!(first.dispatch_any(&f.client(), store, &flag).await.is_err());
+        assert!(
+            first
+                .dispatch_any(&f.client(), store, &f.authority(), &flag,)
+                .await
+                .is_err()
+        );
         assert!(matches!(
             f.client().resolve(&first_evidence).await?,
             Resolution::Absent
@@ -94,7 +99,9 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
             .await?;
         edit(f, "DROP TRIGGER phase_late_fault").await?;
     }
-    let original = first.dispatch_any(&f.client(), store, &flag).await?;
+    let original = first
+        .dispatch_any(&f.client(), store, &f.authority(), &flag)
+        .await?;
     let mut head = first.clone();
     let mut saved_first = None;
     let expected = if refusal_case {
@@ -128,8 +135,9 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
             let registered = page
                 .persist_recovery(store, identity()?, Some(&head))
                 .await?;
-            let PublicationOutcome::PolicyPage(value) =
-                registered.dispatch_any(&f.client(), store, &flag).await?
+            let PublicationOutcome::PolicyPage(value) = registered
+                .dispatch_any(&f.client(), store, &f.authority(), &flag)
+                .await?
             else {
                 return Err("successor page did not complete".into());
             };
@@ -173,13 +181,14 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
             head = ready
                 .persist_recovery_after(store, identity()?, &head)
                 .await?;
-            head.dispatch(&f.client(), store).await?
+            head.dispatch(&f.client(), store, &f.authority()).await?
         }
     };
     // Return the same settled page through its retained predecessor frame.
     if let Some(expected) = &saved_first {
-        let PublicationOutcome::PolicyPage(actual) =
-            first.dispatch_any(&f.client(), store, &flag).await?
+        let PublicationOutcome::PolicyPage(actual) = first
+            .dispatch_any(&f.client(), store, &f.authority(), &flag)
+            .await?
         else {
             return Err("original page history missing".into());
         };
@@ -219,7 +228,9 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
     let loaded = RegisteredRootRecovery::load(&client, &f.target, store, &check)
         .await?
         .ok_or("restored durable phase")?;
-    let PublicationOutcome::RootPush(actual) = loaded.dispatch_any(&client, store, &flag).await?
+    let PublicationOutcome::RootPush(actual) = loaded
+        .dispatch_any(&client, store, &f.authority(), &flag)
+        .await?
     else {
         return Err("restored terminal phase missing".into());
     };
@@ -248,8 +259,9 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
             ))
             .await?;
         }
-        let PublicationOutcome::PolicyPage(actual) =
-            first.dispatch_any(&client, store, &flag).await?
+        let PublicationOutcome::PolicyPage(actual) = first
+            .dispatch_any(&client, store, &f.authority(), &flag)
+            .await?
         else {
             return Err("expired predecessor reply missing".into());
         };
@@ -276,14 +288,23 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
             Ok(Vec::new())
         })
         .await?;
-    Box::pin(query_failure(&loaded, &client, &handle, store, &expected)).await?;
+    Box::pin(query_failure(
+        &loaded,
+        &client,
+        &handle,
+        store,
+        &expected,
+        f.authority(),
+    ))
+    .await?;
     let _released = Box::pin(super::terminal_retention::archive(
         f, &client, &handle, store, &loaded, &expected, 0,
     ))
     .await?;
     if let Some(expected) = &saved_first {
-        let PublicationOutcome::PolicyPage(actual) =
-            first.dispatch_any(&client, store, &flag).await?
+        let PublicationOutcome::PolicyPage(actual) = first
+            .dispatch_any(&client, store, &f.authority(), &flag)
+            .await?
         else {
             return Err("archived original page lost".into());
         };
@@ -302,6 +323,7 @@ async fn query_failure(
     handle: &CellHandle,
     store: &canopy_object_storage::artifact::ArtifactStore,
     expected: &cellule_runtime::Committed<RootCompletionReply>,
+    authority: PreparationAuthority,
 ) -> Result {
     // The service is stopped and the original outcome has settled. Hide the
     // phase table to inject a real private-query failure without changing data.
@@ -310,7 +332,9 @@ async fn query_failure(
         "ALTER TABLE catalog_leases RENAME TO phase_query_fault",
     )
     .await?;
-    let ready = loaded.clone().ready(client.clone(), store.clone())?;
+    let ready = loaded
+        .clone()
+        .ready(client.clone(), store.clone(), authority)?;
     let reservation = ready.reservation();
     let queue = PublicationCoordinator::new(
         loaded.evidence().target().clone(),
@@ -423,7 +447,9 @@ async fn late_write_case(
     let registered = refusal
         .persist_recovery_after(store, identity()?, head)
         .await?;
-    let result = registered.dispatch(&f.client(), store).await?;
+    let result = registered
+        .dispatch(&f.client(), store, &f.authority())
+        .await?;
     assert!(
         matches!(&result.output, RootCompletionReply::Completed(value)
                 if value.completion.rejected && value.completion.publication.is_none())
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
index 593925d4..ed41975e 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
@@ -188,7 +188,11 @@ async fn qualify_ready(
             .is_err()
     );
     let original_result = if fault == 2 {
-        Some(registered.dispatch(&f.client(), store).await?)
+        Some(
+            registered
+                .dispatch(&f.client(), store, &f.authority())
+                .await?,
+        )
     } else {
         None
     };
@@ -219,7 +223,7 @@ async fn qualify_ready(
         .await?
         .ok_or("durable record missing after restore")?;
     assert_eq!(loaded.evidence(), &original);
-    let result = loaded.dispatch(&client, store).await;
+    let result = loaded.dispatch(&client, store, &f.authority()).await;
     if fault == 2 {
         let result = result?;
         assert!(
@@ -229,7 +233,11 @@ async fn qualify_ready(
         let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
         queue.fault_for_test(2);
         let observer = queue
-            .submit(loaded.clone().ready(client.clone(), store.clone())?)
+            .submit(
+                loaded
+                    .clone()
+                    .ready(client.clone(), store.clone(), f.authority())?,
+            )
             .await
             .map_err(|failure| format!("durable admission: {:?}", failure.reason))?;
         assert!(
@@ -251,7 +259,10 @@ async fn qualify_ready(
             (expected.output, expected.receipt)
         );
         assert_eq!(
-            loaded.dispatch(&client, store).await?.receipt,
+            loaded
+                .dispatch(&client, store, &f.authority(),)
+                .await?
+                .receipt,
             result.receipt
         );
         if revoked {
@@ -268,7 +279,10 @@ async fn qualify_ready(
             ));
             // Known results still resolve; this grants no current response read.
             assert_eq!(
-                loaded.dispatch(&client, store).await?.receipt,
+                loaded
+                    .dispatch(&client, store, &f.authority(),)
+                    .await?
+                    .receipt,
                 result.receipt
             );
         } else {
@@ -300,7 +314,9 @@ async fn qualify_ready(
             denied.output,
             RootCompletionReply::Denied(PreparationDenial::Stale)
         );
-        assert!(matches!(loaded.dispatch(&client, store).await,
+        assert!(matches!(loaded.dispatch(&client,
+store,
+&f.authority(),).await,
             Err(PublicationError::RootPush(InvocationError::Rejected(replayed))) if replayed.receipt == denied.receipt && replayed.output == denied.output));
         assert!(
             client
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization.rs b/crates/canopy-server/src/packs/publication/tests/initialization.rs
index c5e01f7e..87d75b42 100644
--- a/crates/canopy-server/src/packs/publication/tests/initialization.rs
+++ b/crates/canopy-server/src/packs/publication/tests/initialization.rs
@@ -73,7 +73,7 @@ async fn reject(
         )
     ));
     let recovered = registered
-        .recover_initialization(&fixture.client(), store)
+        .recover_initialization(&fixture.client(), store, &fixture.authority())
         .await;
     assert!(
         matches!(recovered,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==result.receipt && value.output==result.output)
@@ -142,7 +142,7 @@ async fn cold_initialization_records_original_expiry_and_revocation_denials() ->
         edit(&fixture, sql).await?;
         let before = state(&fixture.handle).await?;
         let result = registered
-            .recover_initialization(&fixture.client(), &store)
+            .recover_initialization(&fixture.client(), &store, &fixture.authority())
             .await;
         assert!(
             matches!(result,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.output==InitializationReply::Denied(reason)),
@@ -253,7 +253,7 @@ async fn fresh_initialization_commits_joint_empty_roots_and_enables_first_ref_pr
             Err(InvocationError::NotStarted(_))
         ));
         let recovered = registered
-            .recover_initialization(&fixture.client(), &store)
+            .recover_initialization(&fixture.client(), &store, &fixture.authority())
             .await?;
         assert_eq!(
             (recovered.output, recovered.receipt),
@@ -510,7 +510,7 @@ async fn initialization_late_failure_rolls_back_roots_checkpoint_and_outcome_and
             .is_none()
     );
     let recovered = registered_loser
-        .recover_initialization(&client, &first.base.indexes().store())
+        .recover_initialization(&client, &first.base.indexes().store(), &fixture.authority())
         .await;
     assert!(
         matches!(recovered,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==losing.receipt && value.output==losing.output)
@@ -583,7 +583,7 @@ async fn initialization_exact_outcome_survives_owner_restore_and_pending_old_att
         Err(InvocationError::NotStarted(_))
     ));
     let recovered = registered_a
-        .recover_initialization(&client, &first.base.indexes().store())
+        .recover_initialization(&client, &first.base.indexes().store(), &fixture.authority())
         .await?;
     assert_eq!(
         (recovered.output, recovered.receipt),
@@ -593,7 +593,11 @@ async fn initialization_exact_outcome_survives_owner_restore_and_pending_old_att
     // Cold recovery must settle the absent original under the new owner. It
     // cannot depend on opening the old owner's now-invalid live capability.
     let denied = registered_b
-        .recover_initialization(&client, &second.base.indexes().store())
+        .recover_initialization(
+            &client,
+            &second.base.indexes().store(),
+            &fixture.authority(),
+        )
         .await;
     assert!(
         matches!(denied,Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.output==InitializationReply::Denied(PreparationDenial::Stale)),
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs b/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
index e230f2c0..56785eff 100644
--- a/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
@@ -105,7 +105,10 @@ async fn lost_initialization_registration_is_discovered_after_fresh_disk_owner_r
         Resolution::Absent
     ));
     let before = state(&handle).await?;
-    let denied = match saved.recover_initialization(&client, &store).await {
+    let denied = match saved
+        .recover_initialization(&client, &store, &f.authority())
+        .await
+    {
         Err(PublicationError::Initialization(InvocationError::Rejected(value))) => value,
         other => {
             return Err(format!("cold original must settle its stale owner: {other:?}").into());
@@ -116,9 +119,9 @@ async fn lost_initialization_registration_is_discovered_after_fresh_disk_owner_r
         InitializationReply::Denied(PreparationDenial::Stale)
     );
     assert_eq!(state(&handle).await?, before);
-    assert!(
-        matches!(saved.recover_initialization(&client, &store).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==denied.receipt)
-    );
+    assert!(matches!(saved.recover_initialization(&client,
+&store,
+&f.authority(),).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==denied.receipt));
     // Only a definitive original denial permits a new owner to claim. It gets
     // its own namespace; the original pin and result remain unchanged.
     let started = client
@@ -156,6 +159,7 @@ async fn lost_initialization_registration_is_discovered_after_fresh_disk_owner_r
             indexes,
             files,
             Some(started.receipt),
+            f.authority(),
         )
         .await?,
     );
@@ -171,9 +175,9 @@ async fn lost_initialization_registration_is_discovered_after_fresh_disk_owner_r
     assert!(
         matches!(result.output, InitializationReply::Initialized(ref fact) if fact.generation==1)
     );
-    assert!(
-        matches!(saved.recover_initialization(&client, &store).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==denied.receipt)
-    );
+    assert!(matches!(saved.recover_initialization(&client,
+&store,
+&f.authority(),).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.receipt==denied.receipt));
     handle
         .query(0, 128, |db| {
             assert_eq!(
@@ -278,14 +282,16 @@ async fn original_initialization_receipt_survives_lost_ack_expiry_body_loss_and_
         .ok_or("original initialization pin absent")?;
     assert_eq!(loaded.evidence(), &original);
     let before = state(&handle).await?;
-    let result = loaded.recover_initialization(&client, &store).await?;
+    let result = loaded
+        .recover_initialization(&client, &store, &f.authority())
+        .await?;
     assert_eq!(
         (result.output, result.receipt),
         (expected.output.clone(), expected.receipt)
     );
     let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
     let observer = queue
-        .submit(loaded.ready(client, (*store).clone())?)
+        .submit(loaded.ready(client, (*store).clone(), f.authority())?)
         .await
         .map_err(|failure| format!("cold initialization admission: {:?}", failure.reason))?;
     assert!(
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs b/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
index fc05d9d3..379551a1 100644
--- a/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
+++ b/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
@@ -67,7 +67,9 @@ async fn initialized_repository_releases_zero_floor_and_recovers_original_receip
         let loaded = RegisteredRootRecovery::load(&f.client(), &f.target, &store, &check)
             .await?
             .ok_or("initial receipt archive missing")?;
-        let recovered = loaded.recover_initialization(&f.client(), &store).await?;
+        let recovered = loaded
+            .recover_initialization(&f.client(), &store, &f.authority())
+            .await?;
         assert_eq!(
             (recovered.output, recovered.receipt),
             (original.output, original.receipt)
@@ -191,7 +193,7 @@ async fn missing_typed_initial_metadata_cannot_authorize_retirement() -> Result
         );
         assert_eq!(
             saved
-                .recover_initialization(&f.client(), &store)
+                .recover_initialization(&f.client(), &store, &f.authority(),)
                 .await?
                 .receipt,
             original.receipt
@@ -238,7 +240,10 @@ async fn denied_initial_attempt_retires_only_after_claim_and_keeps_its_receipt_a
         "UPDATE catalog_operations SET expires_at_ms=0; UPDATE catalog_leases SET expires_at_ms=0",
     )
     .await?;
-    let denied = match saved.recover_initialization(&f.client(), &store).await {
+    let denied = match saved
+        .recover_initialization(&f.client(), &store, &f.authority())
+        .await
+    {
         Err(PublicationError::Initialization(InvocationError::Rejected(value))) => value,
         other => return Err(format!("expected original expiry: {other:?}").into()),
     };
@@ -263,6 +268,7 @@ async fn denied_initial_attempt_retires_only_after_claim_and_keeps_its_receipt_a
             page: 1,
             interval: Duration::from_secs(1),
         },
+        f.authority(),
         admin.clone(),
     )?;
     timeout(Duration::from_secs(10), async {
@@ -321,9 +327,9 @@ async fn denied_initial_attempt_retires_only_after_claim_and_keeps_its_receipt_a
     let old = RegisteredRootRecovery::load(&f.client(), &f.target, &store, &old)
         .await?
         .ok_or("old denied archive absent")?;
-    assert!(
-        matches!(old.recover_initialization(&f.client(), &store).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.output == denied.output && value.receipt == denied.receipt)
-    );
+    assert!(matches!(old.recover_initialization(&f.client(),
+&store,
+&f.authority(),).await, Err(PublicationError::Initialization(InvocationError::Rejected(ref value))) if value.output == denied.output && value.receipt == denied.receipt));
     f.handle
         .query(0, 128, |db| {
             assert_eq!(
@@ -417,7 +423,9 @@ async fn lost_initial_retirement_ack_keeps_original_receipts_after_expiry_body_l
     let restored = RegisteredRootRecovery::load(&client, &f.target, &store, &check)
         .await?
         .ok_or("restored archive absent")?;
-    let result = restored.recover_initialization(&client, &store).await?;
+    let result = restored
+        .recover_initialization(&client, &store, &f.authority())
+        .await?;
     assert_eq!(
         (result.output, result.receipt),
         (original.output, original.receipt)
@@ -451,6 +459,7 @@ async fn automatic_initialization_retirement_recovers_uncertainty_after_pin_disa
             page: 1,
             interval: Duration::from_secs(1),
         },
+        f.authority(),
         maintenance(&f.handle, f.repository).await?,
     )?;
     let observer = timeout(Duration::from_secs(10), async {
@@ -489,6 +498,7 @@ async fn automatic_initialization_retirement_recovers_uncertainty_after_pin_disa
             page: 1,
             interval: Duration::from_secs(1),
         },
+        f.authority(),
         maintenance(&f.handle, f.repository).await?,
     )?;
     timeout(Duration::from_secs(10), async {
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs.rs b/crates/canopy-server/src/packs/publication/tests/inputs.rs
index 75d383a3..02e04f28 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs.rs
@@ -48,7 +48,11 @@ pub(super) async fn active(
     fixture: &Fixture,
     operation: [u8; 16],
 ) -> Result<(StagingCoordinator, StagingTicket)> {
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ready = ReadyStaging::new(
         fixture.client(),
         fixture.target.clone(),
@@ -408,7 +412,11 @@ async fn source_pin_expiry_after_reconstruction_refuses_final_adoption() -> Resu
         .await?;
     old_ticket.stop();
     assert!(old_coordinator.close_and_drain().await.is_empty());
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ready = ReadyStaging::claim(
         fixture.client(),
         fixture.target.clone(),
@@ -513,6 +521,7 @@ async fn bound_preparation_claim_adopts_exact_input_root_without_copying_nodes()
                 actor: "owner".into(),
             },
             Some(claimed.receipt),
+            fixture.authority(),
         )
         .await?,
     );
@@ -552,8 +561,11 @@ async fn claimed_staging_retains_exact_dispatch_after_absence_lost_ack_and_panic
         };
         old_ticket.stop();
         assert!(old_coordinator.close_and_drain().await.is_empty());
-        let coordinator =
-            StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+        let coordinator = StagingCoordinator::new(
+            fixture.target.clone(),
+            StagingLimits::default(),
+            fixture.authority(),
+        )?;
         coordinator.fault_for_test(fault);
         let ready = ReadyStaging::claim(
             fixture.client(),
@@ -675,7 +687,11 @@ async fn restored_owner_claims_and_adopts_only_a_retained_exact_input_checkpoint
         check(&client, &fixture.target, proof.token()?).await?,
         Some(proof.clone())
     );
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ready = ReadyStaging::claim(
         client.clone(),
         fixture.target.clone(),
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs/bound.rs b/crates/canopy-server/src/packs/publication/tests/inputs/bound.rs
index 88a4f451..f6dd43cc 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs/bound.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs/bound.rs
@@ -59,6 +59,7 @@ impl Bound {
                         lease_ms: DEFAULT_LEASE_MS,
                     },
                     identity()?,
+                    fixture.authority(),
                 )
                 .await?,
             )
@@ -247,6 +248,7 @@ async fn bound_checkpoint_canceled_observer_and_foreign_duplicate_closed_admissi
                 actor: "owner".into(),
             },
             Some(result.registration.receipt),
+            fixture.authority(),
         )
         .await?,
     );
@@ -423,6 +425,7 @@ async fn bound_checkpoint_real_retained_pair_publishes_after_source_pin_expiry_i
                 indexes,
                 files,
                 Some(registered.registration.receipt),
+                bound.fixture.authority(),
             )
             .await?,
         );
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs/custody.rs b/crates/canopy-server/src/packs/publication/tests/inputs/custody.rs
index 23f57b1c..637a743e 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs/custody.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs/custody.rs
@@ -62,8 +62,11 @@ impl Recovered {
         checkpoint.wait().await.map_err(|e| e.to_string())?;
         old_ticket.stop();
         assert!(old_coordinator.close_and_drain().await.is_empty());
-        let coordinator =
-            StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+        let coordinator = StagingCoordinator::new(
+            fixture.target.clone(),
+            StagingLimits::default(),
+            fixture.authority(),
+        )?;
         let ready = ReadyStaging::claim(
             fixture.client(),
             fixture.target.clone(),
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs/requests.rs b/crates/canopy-server/src/packs/publication/tests/inputs/requests.rs
index f2e04eb6..27608b7a 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs/requests.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs/requests.rs
@@ -116,8 +116,11 @@ impl Request {
             operation,
         )
         .await?;
-        let coordinator =
-            StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+        let coordinator = StagingCoordinator::new(
+            fixture.target.clone(),
+            StagingLimits::default(),
+            fixture.authority(),
+        )?;
         let ticket = coordinator
             .submit(
                 ReadyStaging::new(
@@ -371,8 +374,11 @@ async fn request_checkpoint_owner_restore_adopts_original_bytes_after_source_pin
         )
         .await?;
     let client = CellClient::local(request.fixture.registry.clone(), handle.clone());
-    let coordinator =
-        StagingCoordinator::new(request.fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        request.fixture.target.clone(),
+        StagingLimits::default(),
+        request.fixture.authority(),
+    )?;
     let old = retained.token()?;
     let ticket = coordinator
         .submit(
diff --git a/crates/canopy-server/src/packs/publication/tests/mandatory_registration.rs b/crates/canopy-server/src/packs/publication/tests/mandatory_registration.rs
index afc0f659..383512d9 100644
--- a/crates/canopy-server/src/packs/publication/tests/mandatory_registration.rs
+++ b/crates/canopy-server/src/packs/publication/tests/mandatory_registration.rs
@@ -140,8 +140,9 @@ pub(super) async fn qualify(context: Context<'_>) -> Result {
         not_started(f, refusal_command).await?;
         let original = Box::pin(command.clone().execute()).await?;
         assert!(matches!(original.output, RefPolicyReply::Registered(value) if value.valid));
-        let PublicationOutcome::PolicyPage(recovered) =
-            registered.dispatch_any(&f.client(), store, &flag).await?
+        let PublicationOutcome::PolicyPage(recovered) = registered
+            .dispatch_any(&f.client(), store, &f.authority(), &flag)
+            .await?
         else {
             return Err("registered page lost its original result".into());
         };
@@ -178,8 +179,9 @@ pub(super) async fn qualify(context: Context<'_>) -> Result {
         matches!(&original.output, RootCompletionReply::Completed(value)
         if !value.completion.rejected && value.completion.publication.is_some())
     );
-    let PublicationOutcome::RootPush(recovered) =
-        registered.dispatch_any(&f.client(), store, &flag).await?
+    let PublicationOutcome::RootPush(recovered) = registered
+        .dispatch_any(&f.client(), store, &f.authority(), &flag)
+        .await?
     else {
         return Err("registered root lost its original result".into());
     };
diff --git a/crates/canopy-server/src/packs/publication/tests/native_capture.rs b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
index bfead167..c33dabbb 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_capture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
@@ -586,7 +586,8 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
     ) {
         staging_limits.bound_lifetime_ms = 5000;
     }
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), staging_limits)?;
+    let coordinator =
+        StagingCoordinator::new(fixture.target.clone(), staging_limits, fixture.authority())?;
     let ready = ReadyStaging::new(
         fixture.client(),
         fixture.target.clone(),
@@ -1104,7 +1105,11 @@ async fn native_capture_rejects_scope_limits_mutation_and_active_native_workers(
         Arc::new(InMemory::new()),
         fixture.repository,
     ));
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ready = ReadyStaging::new(
         fixture.client(),
         fixture.target.clone(),
diff --git a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
index 1576cf26..b39b7fa5 100644
--- a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
@@ -210,7 +210,7 @@ async fn initial_preparation_receipt_cold_owner_and_sdk_expiry_preserve_actual_r
         let ticket = coordinator
             .submit(
                 known
-                    .ready_claim(client.clone(), DEFAULT_LEASE_MS, identity()?)
+                    .ready_claim(client.clone(), DEFAULT_LEASE_MS, identity()?, f.authority())
                     .await?,
             )
             .await?;
@@ -279,7 +279,8 @@ async fn initial_preparation_receipt_reaped_restart_claim_checks_original_and_ro
                 f.client(),
                 f.target.clone(),
                 check(old.token),
-                Some(original.receipt)
+                Some(original.receipt),
+                f.authority(),
             )
             .await
             .is_err()
@@ -386,7 +387,8 @@ async fn initial_preparation_receipt_knowledge_does_not_restore_revoked_or_expir
                     f.client(),
                     f.target.clone(),
                     check(old.token),
-                    Some(original.receipt)
+                    Some(original.receipt),
+                    f.authority(),
                 )
                 .await
                 .is_err()
diff --git a/crates/canopy-server/src/packs/publication/tests/prepare.rs b/crates/canopy-server/src/packs/publication/tests/prepare.rs
index 93d32d99..9dd4b5bd 100644
--- a/crates/canopy-server/src/packs/publication/tests/prepare.rs
+++ b/crates/canopy-server/src/packs/publication/tests/prepare.rs
@@ -68,6 +68,7 @@ pub(super) async fn opened(
             Arc::clone(&indexes),
             Arc::clone(&files),
             Some(started.receipt),
+            fixture.authority(),
         )
         .await?,
     );
diff --git a/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs b/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
index 49ae5bc7..e14f73a9 100644
--- a/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
@@ -48,6 +48,7 @@ async fn restart_scan_seeks_bounded_keys_and_revisits_corrupt_pins_without_starv
         store.clone(),
         queue.clone(),
         scan_limits(17),
+        f.authority(),
     )?;
     let stats = scanned(&service, |stats| stats.passes >= 2).await?;
     assert!(stats.scanned >= 600);
@@ -76,7 +77,8 @@ async fn restart_scan_seeks_bounded_keys_and_revisits_corrupt_pins_without_starv
             f.target.clone(),
             foreign,
             queue.clone(),
-            scan_limits(1)
+            scan_limits(1),
+            f.authority(),
         ),
         Err(RootRecoveryError::Context)
     ));
@@ -95,6 +97,7 @@ pub(super) async fn leaves_live_owner(
         store.clone(),
         queue.clone(),
         scan_limits(1),
+        f.authority(),
         super::terminal_retention::maintenance(&f.handle, f.repository).await?,
     )?;
     let stats = scanned(&service, |stats| stats.deferred > 0).await?;
@@ -150,6 +153,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
             page: 1,
             interval: Duration::from_secs(1),
         },
+        f.authority(),
     )?;
     timeout(Duration::from_secs(10), entered).await??;
     let observer = queue
@@ -182,6 +186,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
                 page: 1,
                 interval: Duration::from_secs(1),
             },
+            f.authority(),
         )?
     } else {
         service
@@ -217,6 +222,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
         store.clone(),
         queue.clone(),
         scan_limits(1),
+        f.authority(),
     )?;
     let stats = scanned(&service, |stats| stats.settled > 0).await?;
     assert_eq!(stats.submitted, 0);
@@ -225,7 +231,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
         .await?
         .ok_or("settled pin lost on owner restore")?;
     assert_eq!(restored.evidence(), &original);
-    let recovered = restored.dispatch(&client, store).await?;
+    let recovered = restored.dispatch(&client, store, &f.authority()).await?;
     assert_eq!(recovered.receipt, completed.receipt);
     assert_eq!(recovered.output, completed.output);
     let lookup = BeginRequest {
@@ -259,7 +265,11 @@ pub(super) async fn advanced_head(
     let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
     queue.fault_for_test(2);
     let observer = queue
-        .submit(original.clone().ready(client.clone(), store.clone())?)
+        .submit(
+            original
+                .clone()
+                .ready(client.clone(), store.clone(), f.authority())?,
+        )
         .await
         .map_err(|error| format!("historical admission: {:?}", error.reason))?;
     assert!(matches!(
@@ -273,6 +283,7 @@ pub(super) async fn advanced_head(
         store.clone(),
         queue.clone(),
         scan_limits(1),
+        f.authority(),
     )?;
     let stats = scanned(&service, |stats| stats.recovered > 0 || stats.deferred > 0).await?;
     assert!(
diff --git a/crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs b/crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs
index 6e7c7780..89ec11df 100644
--- a/crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs
@@ -77,7 +77,8 @@ pub(super) fn attempt<'a>(
             *uuid::Uuid::new_v4().as_bytes(),
         )
         .await?;
-        let staging = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+        let staging =
+            StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
         let ticket = staging
             .submit(
                 ReadyStaging::new(
diff --git a/crates/canopy-server/src/packs/publication/tests/root_completion.rs b/crates/canopy-server/src/packs/publication/tests/root_completion.rs
index a2ae610b..36f05fa2 100644
--- a/crates/canopy-server/src/packs/publication/tests/root_completion.rs
+++ b/crates/canopy-server/src/packs/publication/tests/root_completion.rs
@@ -536,7 +536,9 @@ pub(super) async fn qualify(
         fixture.client().resolve(competing.evidence()).await?,
         Resolution::Absent
     ));
-    let known = registered.dispatch(&fixture.client(), store).await?;
+    let known = registered
+        .dispatch(&fixture.client(), store, &fixture.authority())
+        .await?;
     assert_eq!(known.output, committed.output);
     assert_eq!(known.receipt, committed.receipt);
     assert_eq!(
@@ -626,7 +628,10 @@ pub(super) async fn restored(
         client.resolve(competing.evidence()).await?,
         Resolution::Absent
     ));
-    let known = replay.registered.dispatch(&client, store).await?;
+    let known = replay
+        .registered
+        .dispatch(&client, store, &fixture.authority())
+        .await?;
     assert_eq!(known.output, replay.committed.output);
     assert_eq!(known.receipt, replay.committed.receipt);
     assert_eq!(state(&handle).await?, before);
diff --git a/crates/canopy-server/src/packs/publication/tests/staged_durable.rs b/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
index d5099a3d..a5f393ab 100644
--- a/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
@@ -102,7 +102,9 @@ pub(super) async fn qualify(
             assert_eq!(failure.original.evidence_for_test(), evidence);
             assert_eq!(failure.registered.evidence(), &evidence);
         }
-        let cold = registered.clone().ready(f.client(), store.clone())?;
+        let cold = registered
+            .clone()
+            .ready(f.client(), store.clone(), f.authority())?;
         let failure = ticket
             .publish(&queue, cold)
             .err()
@@ -233,6 +235,7 @@ pub(super) async fn qualify(
             .dispatch_any(
                 &f.client(),
                 store,
+                &f.authority(),
                 &std::sync::atomic::AtomicBool::new(false),
             )
             .await?;
@@ -321,7 +324,7 @@ pub(super) async fn qualify(
             .await?
             .ok_or("durable terminal record")?;
         assert_eq!(loaded.evidence(), &evidence);
-        let actual = loaded.dispatch(&f.client(), store).await?;
+        let actual = loaded.dispatch(&f.client(), store, &f.authority()).await?;
         assert_eq!(
             (&actual.output, actual.receipt),
             (&value.output, value.receipt)
diff --git a/crates/canopy-server/src/packs/publication/tests/staging.rs b/crates/canopy-server/src/packs/publication/tests/staging.rs
index 1bca2e25..102ed2f8 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging.rs
@@ -373,7 +373,8 @@ async fn physical_inputs_verified_before_binding_feed_the_existing_catalog_proof
                 check(staged.token),
                 Arc::clone(&indexes),
                 Arc::clone(&files),
-                None
+                None,
+                fixture.authority(),
             )
             .await,
             Err(PreparationBaseError::Inactive)
@@ -397,6 +398,7 @@ async fn physical_inputs_verified_before_binding_feed_the_existing_catalog_proof
                 indexes,
                 files,
                 Some(bound.receipt),
+                fixture.authority(),
             )
             .await?,
         );
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs b/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
index f94f0881..8649459f 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
@@ -120,7 +120,8 @@ async fn initial_staging_receipt_cold_restore_requires_actual_claim_and_keeps_or
                 .await,
             PreparationDenial::Stale,
         );
-        let coordinator = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+        let coordinator =
+            StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
         let ticket = coordinator
             .submit(
                 saved
@@ -185,7 +186,8 @@ async fn initial_staging_receipt_survives_reaping_but_does_not_restore_expired_c
             .ok_or("reaped receipt missing")?;
         assert_eq!(saved.receipt(), original.receipt);
         assert_eq!(saved.lease(), *lease);
-        let coordinator = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+        let coordinator =
+            StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
         let ticket = coordinator
             .submit(
                 saved
@@ -227,7 +229,8 @@ async fn initial_staging_receipt_is_internal_knowledge_after_write_revocation()
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let f = Fixture::new(format).await?;
         let input = f.begin([215; 16]);
-        let coordinator = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+        let coordinator =
+            StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
         coordinator.fault_for_test(2);
         let ticket = coordinator
             .submit(
@@ -271,7 +274,8 @@ async fn staging_custody_intent_corruption_keeps_original_evidence_and_reservati
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let f = Fixture::new(format).await?;
         let input = f.begin([214; 16]);
-        let coordinator = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+        let coordinator =
+            StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
         coordinator.fault_for_test(2);
         let ticket = coordinator
             .submit(
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index 91ab0e53..ebb11810 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -50,7 +50,8 @@ async fn staged_service_registrar_loss_retains_both_commands_through_cancellatio
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         for fault in [4, 5, 6] {
             let f = Fixture::new(format).await?;
-            let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+            let c =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
             c.fault_for_test(fault);
             let ticket = submit(&f, &c, [fault + 120; 16], "owner").await?;
             let StagingState::Uncertain(error) = terminal(&ticket).await? else {
@@ -115,7 +116,8 @@ async fn staged_service_renew_and_bind_registrar_loss_never_replaces_either_iden
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         for fault in [4, 5, 6] {
             let f = Fixture::new(format).await?;
-            let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+            let c =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
             let ticket = submit(&f, &c, [fault + 130; 16], "owner").await?;
             let staged = active(&ticket).await?;
             c.fault_for_test(fault);
@@ -180,8 +182,11 @@ async fn staged_service_recovers_original_begin_after_sdk_expiry_before_allowing
         (ObjectFormat::Sha256, 3),
     ] {
         let fixture = Fixture::new(format).await?;
-        let coordinator =
-            StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+        let coordinator = StagingCoordinator::new(
+            fixture.target.clone(),
+            StagingLimits::default(),
+            fixture.authority(),
+        )?;
         let request = fixture.begin([219; 16]);
         let mut mutation = identity()?;
         mutation.expires_at_ms = mutation.issued_at_ms + 2_000;
@@ -272,7 +277,11 @@ async fn staged_service_recovers_original_begin_after_sdk_expiry_before_allowing
 async fn staged_service_canceled_observers_keep_workers_and_results_until_single_handoff() -> Result
 {
     let fixture = Fixture::new(ObjectFormat::Sha256).await?;
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ticket = submit(&fixture, &coordinator, [220; 16], "owner").await?;
     let initial = active(&ticket).await?;
     let (release, wait) = oneshot::channel();
@@ -324,8 +333,11 @@ async fn staged_service_resolves_begin_renew_and_bind_exactly_after_absence_lost
 -> Result {
     for fault in [1, 2, 3] {
         let fixture = Fixture::new(ObjectFormat::Sha256).await?;
-        let coordinator =
-            StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+        let coordinator = StagingCoordinator::new(
+            fixture.target.clone(),
+            StagingLimits::default(),
+            fixture.authority(),
+        )?;
         coordinator.fault_for_test(fault);
         let ticket = submit(&fixture, &coordinator, [221; 16], "owner").await?;
         assert!(matches!(
@@ -396,7 +408,11 @@ async fn staged_service_replayed_renewal_is_not_a_new_clock_or_permission_after_
         "INSERT INTO repository_members VALUES('writer','write')",
     )
     .await?;
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ticket = submit(&fixture, &coordinator, [222; 16], "writer").await?;
     active(&ticket).await?;
     let (entered, started) = oneshot::channel();
@@ -448,6 +464,7 @@ async fn staged_service_account_operation_and_worker_bounds_preserve_rejected_re
             workers_per_actor: 1,
             ..StagingLimits::default()
         },
+        fixture.authority(),
     )?;
     let first = submit(&fixture, &coordinator, [223; 16], "owner").await?;
     active(&first).await?;
@@ -505,8 +522,11 @@ async fn staged_service_worker_failure_and_panic_fence_before_binding_and_releas
 -> Result {
     for panic in [false, true] {
         let fixture = Fixture::new(ObjectFormat::Sha1).await?;
-        let coordinator =
-            StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+        let coordinator = StagingCoordinator::new(
+            fixture.target.clone(),
+            StagingLimits::default(),
+            fixture.authority(),
+        )?;
         let ticket = submit(&fixture, &coordinator, [226; 16], "owner").await?;
         let lease = active(&ticket).await?;
         let work = ticket.spawn(move |_| async move {
@@ -542,8 +562,11 @@ async fn staged_service_owned_native_verification_hands_off_to_the_existing_priv
     use cellule_ltx::DiskBudget;
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let fixture = Fixture::new(format).await?;
-        let coordinator =
-            StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+        let coordinator = StagingCoordinator::new(
+            fixture.target.clone(),
+            StagingLimits::default(),
+            fixture.authority(),
+        )?;
         let ticket = submit(&fixture, &coordinator, [227; 16], "owner").await?;
         let initial = active(&ticket).await?;
         let provider: Arc<dyn object_store::ObjectStore> = Arc::new(InMemory::new());
@@ -632,6 +655,7 @@ async fn staged_service_automatic_renewal_runs_without_an_observer_or_manual_tic
             renew_before_ms: DEFAULT_LEASE_MS - 1000,
             ..StagingLimits::default()
         },
+        fixture.authority(),
     )?;
     let ticket = submit(&fixture, &coordinator, [228; 16], "owner").await?;
     let lease = active(&ticket).await?;
@@ -706,11 +730,15 @@ async fn staged_service_rejects_invalid_profiles_foreign_targets_and_duplicate_l
         },
     ] {
         assert!(matches!(
-            StagingCoordinator::new(fixture.target.clone(), limits),
+            StagingCoordinator::new(fixture.target.clone(), limits, fixture.authority(),),
             Err(StagingError::InvalidLimits)
         ));
     }
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ready = ReadyStaging::new(
         fixture.client(),
         fixture.target.clone(),
@@ -736,7 +764,11 @@ async fn staged_service_rejects_invalid_profiles_foreign_targets_and_duplicate_l
         .ok_or("duplicate accepted")?;
     assert!(matches!(error, StagingError::Duplicate));
     let foreign = Fixture::new(ObjectFormat::Sha256).await?;
-    let other = StagingCoordinator::new(foreign.target.clone(), StagingLimits::default())?;
+    let other = StagingCoordinator::new(
+        foreign.target.clone(),
+        StagingLimits::default(),
+        foreign.authority(),
+    )?;
     let (error, _) = other.submit(ready).err().ok_or("foreign accepted")?;
     assert!(matches!(error, StagingError::Foreign));
     assert!(matches!(other.recover(&ticket), Err(StagingError::Foreign)));
@@ -780,7 +812,11 @@ async fn staged_service_revocation_drops_completed_owned_results_before_releasin
         "INSERT INTO repository_members VALUES('writer','write')",
     )
     .await?;
-    let coordinator = StagingCoordinator::new(fixture.target.clone(), StagingLimits::default())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ticket = submit(&fixture, &coordinator, [231; 16], "writer").await?;
     active(&ticket).await?;
     let dropped = Arc::new(AtomicBool::new(false));
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
index 62ed7551..6ccfe200 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
@@ -62,6 +62,7 @@ async fn bound_service_automatic_renewal_keeps_canceled_worker_and_result_owned_
             renew_before_ms: DEFAULT_LEASE_MS - 1000,
             ..StagingLimits::default()
         },
+        f.authority(),
     )?;
     let ticket = bind(&f, &c, [203; 16], "owner").await?;
     let original = ticket.bound_result().ok_or("binding receipt")?;
@@ -135,7 +136,8 @@ async fn bound_service_renewal_retains_exact_absent_lost_and_panicked_commands_t
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         for fault in [1, 2, 3] {
             let f = Fixture::new(format).await?;
-            let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+            let c =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
             let ticket = bind(&f, &c, [204; 16], "owner").await?;
             let original = ticket.bound_result().ok_or("binding")?;
             let shared = ticket.bound_session()?;
@@ -206,7 +208,8 @@ async fn bound_service_claim_retains_exact_identity_and_new_namespace_through_cl
         for fault in [1, 2, 3] {
             let f = Fixture::new(format).await?;
             let old = new_token(&f, [205; 16]).await?;
-            let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+            let c =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
             let mutation = identity()?;
             c.fault_for_test(fault);
             let ticket = claim(&f, &c, old, mutation).await?;
@@ -256,7 +259,8 @@ async fn bound_service_known_renewal_receipts_survive_revocation_expiry_and_supe
     for committed in [false, true] {
         for mode in [0, 1, 2] {
             let f = Fixture::new(ObjectFormat::Sha256).await?;
-            let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+            let c =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
             let ticket = bind(&f, &c, [206; 16], "owner").await?;
             let session = ticket.bound_session()?;
             let binding = ticket.bound_result().ok_or("binding")?;
@@ -343,7 +347,7 @@ async fn bound_service_phase_handoff_and_residence_cap_fence_existing_bases_and_
     let native =
         crate::packs::catalog::tests::prepared_for_repository(f.format, f.repository).await?;
     f.install_catalog(1, native.stored).await?;
-    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
     let ticket = submit(&f, &c, [207; 16], "owner").await?;
     active(&ticket).await?;
     let work = ticket.spawn(|ctx| async { Ok(ctx) })?;
@@ -431,6 +435,7 @@ async fn bound_service_worker_caps_results_and_failure_reuse_staging_admission()
             workers_per_actor: 1,
             ..StagingLimits::default()
         },
+        f.authority(),
     )?;
     let a = bind(&f, &c, [208; 16], "owner").await?;
     let b = bind(&f, &c, [209; 16], "owner").await?;
@@ -470,7 +475,8 @@ async fn bound_service_worker_caps_results_and_failure_reuse_staging_admission()
                 StagingLimits {
                     bound_lifetime_ms: invalid,
                     ..StagingLimits::default()
-                }
+                },
+                f.authority(),
             )
             .is_err()
         );
@@ -499,7 +505,8 @@ async fn bound_service_checkpoint_shares_renewal_order_exact_recovery_and_origin
                 return Err("source bind".into());
             };
             assert!(source.close_and_drain().await.is_empty());
-            let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+            let c =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
             let ticket = claim(&f, &c, old.lease.token, identity()?).await?;
             assert!(matches!(terminal(&ticket).await?, StagingState::Bound(_)));
             let session = ticket.bound_session()?;
@@ -625,7 +632,7 @@ async fn bound_service_restored_owner_claim_retains_old_pin_and_owns_new_session
             )
             .await?;
         let client = CellClient::local(f.registry.clone(), handle.clone());
-        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
         let mutation = identity()?;
         c.fault_for_test(2);
         let ready = ReadyStaging::claim_bound(
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
index 43c5c127..75c7b2b0 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
@@ -30,7 +30,11 @@ async fn bound_final_waits_for_exact_renewal_and_adopted_checkpoint_recovery_bef
                     return Err("source binding lost".into());
                 };
                 assert!(source.close_and_drain().await.is_empty());
-                let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+                let c = StagingCoordinator::new(
+                    f.target.clone(),
+                    StagingLimits::default(),
+                    f.authority(),
+                )?;
                 let p =
                     PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
                 let ticket = super::bound::claim(&f, &c, original.lease.token, identity()?).await?;
@@ -124,7 +128,7 @@ async fn bound_final_publication_drains_retained_work_and_due_renewal_through_cl
 -> Result {
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let f = Fixture::new(format).await?;
-        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
         let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
         let ticket = super::bound::bind(&f, &c, [231; 16], "owner").await?;
         let session = ticket.bound_session()?;
@@ -224,6 +228,7 @@ async fn exact_case(format: ObjectFormat, fault: u8, expired: bool) -> Result {
             bound_lifetime_ms: 1000,
             ..StagingLimits::default()
         },
+        f.authority(),
     )?;
     let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
     let ticket = super::bound::bind(&f, &c, [232; 16], "owner").await?;
@@ -337,6 +342,7 @@ async fn bound_final_ceiling_discards_held_proof_and_drops_result_before_worker_
             bound_lifetime_ms: 1000,
             ..StagingLimits::default()
         },
+        f.authority(),
     )?;
     let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
     let ticket = super::bound::bind(&f, &c, [233; 16], "owner").await?;
@@ -381,7 +387,7 @@ async fn bound_final_ceiling_discards_held_proof_and_drops_result_before_worker_
 async fn bound_final_refusals_keep_exact_ready_and_require_shared_session_and_final_kind() -> Result
 {
     let f = Fixture::new(ObjectFormat::Sha256).await?;
-    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
     let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
     let ticket = super::bound::bind(&f, &c, [234; 16], "owner").await?;
     let session = ticket.bound_session()?;
@@ -391,6 +397,7 @@ async fn bound_final_refusals_keep_exact_ready_and_require_shared_session_and_fi
             f.target.clone(),
             check(session.lease.token),
             None,
+            f.authority(),
         )
         .await?,
     );
@@ -457,6 +464,7 @@ async fn bound_final_queued_transport_rechecks_ceiling_before_initial_execution(
             bound_lifetime_ms: 1000,
             ..StagingLimits::default()
         },
+        f.authority(),
     )?;
     let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
     let ticket = super::bound::bind(&f, &c, [236; 16], "owner").await?;
@@ -490,7 +498,7 @@ async fn bound_final_queued_transport_rechecks_ceiling_before_initial_execution(
 async fn bound_final_observes_shared_coordinator_recovery_without_losing_lifecycle_admission()
 -> Result {
     let f = Fixture::new(ObjectFormat::Sha256).await?;
-    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default())?;
+    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
     let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
     let ticket = super::bound::bind(&f, &c, [237; 16], "owner").await?;
     let session = ticket.bound_session()?;
diff --git a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
index 80246f67..f8c2e765 100644
--- a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
+++ b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
@@ -110,7 +110,9 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, provider: Arc<InMem
             .await
             .is_err()
     );
-    let completed = registered.dispatch(&f.client(), store).await?;
+    let completed = registered
+        .dispatch(&f.client(), store, &f.authority())
+        .await?;
     drop(ready);
     drop(session);
     assert!(staging.close_and_drain().await.is_empty());
@@ -241,7 +243,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, provider: Arc<InMem
         .await?
         .ok_or("archived recovery missing after owner restore")?;
     assert_eq!(loaded.evidence(), &original);
-    let recovered = loaded.dispatch(&client, store).await?;
+    let recovered = loaded.dispatch(&client, store, &f.authority()).await?;
     assert_eq!(
         (&recovered.output, recovered.receipt),
         (&completed.output, completed.receipt)
@@ -295,7 +297,10 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, provider: Arc<InMem
     )
     .await?;
     assert_eq!(
-        loaded.dispatch(&client, store).await?.receipt,
+        loaded
+            .dispatch(&client, store, &f.authority(),)
+            .await?
+            .receipt,
         completed.receipt
     );
     assert!(matches!(
@@ -396,6 +401,7 @@ pub(super) async fn archive(
             store.clone(),
             queue.clone(),
             limits,
+            f.authority(),
             admin.clone(),
         )?;
         timeout(Duration::from_secs(10), entered).await??;
@@ -436,6 +442,7 @@ pub(super) async fn archive(
                 store.clone(),
                 queue.clone(),
                 limits,
+                f.authority(),
                 admin.clone(),
             )?;
             service.shutdown().await?;
@@ -447,6 +454,7 @@ pub(super) async fn archive(
             store.clone(),
             queue.clone(),
             limits,
+            f.authority(),
             admin.clone(),
         )?;
         // No caller recovery request: the supervisor retries the original
@@ -507,11 +515,13 @@ pub(super) async fn archive(
     let original = loaded.clone();
     let artifacts = store.clone();
     let reader = client.clone();
+    let authority = f.authority();
     let actual = tokio::spawn(async move {
         original
             .dispatch_any(
                 &reader,
                 &artifacts,
+                &authority,
                 &std::sync::atomic::AtomicBool::new(false),
             )
             .await
diff --git a/crates/canopy-server/src/server/catalog_initialization.rs b/crates/canopy-server/src/server/catalog_initialization.rs
index 66c56bd6..caf664c7 100644
--- a/crates/canopy-server/src/server/catalog_initialization.rs
+++ b/crates/canopy-server/src/server/catalog_initialization.rs
@@ -7,9 +7,9 @@ use crate::{
         publication::{
             BeginRequest, CatalogPreparation, CheckInitializedCatalog, CheckPreparation,
             CustodyAction, DEFAULT_LEASE_MS, GenerationFact, InitializationReply, LeaseCheck,
-            LeaseRequest, MaintenanceRequest, PreparationBaseResolver, PreparationDenial,
-            PreparationReply, PreparationToken, PreparedCustody, PublicationError,
-            RegisteredCustody, RegisteredRootRecovery, TerminalReleaseReply,
+            LeaseRequest, MaintenanceRequest, PreparationAuthority, PreparationBaseResolver,
+            PreparationDenial, PreparationReply, PreparationToken, PreparedCustody,
+            PublicationError, RegisteredCustody, RegisteredRootRecovery, TerminalReleaseReply,
         },
     },
 };
@@ -90,15 +90,24 @@ async fn verify(
 /// The caller's tracked cold-transition task owns this work through cancellation.
 /// Ready repositories only observe their immutable initialization; they cannot
 /// reconstruct missing ownership or publish a new empty catalog during restore.
+pub(super) struct InitializationCustody {
+    pub authority: PreparationAuthority,
+    pub maintenance: MaintenanceRequest,
+}
+
 pub(super) async fn ensure(
+    custody: InitializationCustody,
     repository: &RepositoryCell,
     client: CellClient,
-    maintenance: MaintenanceRequest,
     provider: Arc<dyn ObjectStore>,
     workspace: &Path,
     budget: DiskBudget,
     pending: bool,
 ) -> Result<(), Failure> {
+    let InitializationCustody {
+        authority,
+        maintenance,
+    } = custody;
     let owner = maintenance.actor.as_str();
     let input = request(repository, owner);
     let target = &repository.target;
@@ -117,7 +126,10 @@ pub(super) async fn ensure(
     let recovered =
         RegisteredRootRecovery::load_initialization(&client, target, &store, &input).await?;
     let claim = if let Some(ref recovered) = recovered {
-        match recovered.recover_initialization(&client, &store).await {
+        match recovered
+            .recover_initialization(&client, &store, &authority)
+            .await
+        {
             Ok(committed) => {
                 let InitializationReply::Initialized(fact) = committed.output else {
                     return Err(Error::Command("invalid recovered initialization reply").into());
@@ -293,6 +305,7 @@ pub(super) async fn ensure(
             indexes,
             files,
             Some(started.receipt),
+            authority.clone(),
         )
         .await?,
     );
diff --git a/crates/canopy-server/src/server/peer.rs b/crates/canopy-server/src/server/peer.rs
index acdf31c2..abd7774a 100644
--- a/crates/canopy-server/src/server/peer.rs
+++ b/crates/canopy-server/src/server/peer.rs
@@ -118,7 +118,7 @@ impl NodePeer {
             .is_some_and(|owner| owner.session() != self.0.session))
     }
 
-    pub(super) async fn current_owner_fence(
+    pub(crate) async fn current_owner_fence(
         &self,
         target: &CellTarget,
     ) -> Result<cellule_runtime::registry::OwnerFence, ServerError> {
diff --git a/crates/canopy-server/src/server/residency/mod.rs b/crates/canopy-server/src/server/residency/mod.rs
index 7cfd5cb5..f22d54cb 100644
--- a/crates/canopy-server/src/server/residency/mod.rs
+++ b/crates/canopy-server/src/server/residency/mod.rs
@@ -328,13 +328,19 @@ impl RepositoryManager {
                 ));
             }
             super::catalog_initialization::ensure(
+                super::catalog_initialization::InitializationCustody {
+                    authority: crate::packs::publication::PreparationAuthority::node(
+                        self.peer.clone(),
+                        repository.target.clone(),
+                    ),
+                    maintenance: crate::packs::publication::MaintenanceRequest {
+                        repository: entry.repository_id,
+                        actor: entry.owner.clone(),
+                        owner: self.peer.current_owner_fence(&repository.target).await?,
+                    },
+                },
                 &repository,
                 client,
-                crate::packs::publication::MaintenanceRequest {
-                    repository: entry.repository_id,
-                    actor: entry.owner.clone(),
-                    owner: self.peer.current_owner_fence(&repository.target).await?,
-                },
                 Arc::clone(&self.external_store),
                 self.local.path(),
                 self.disk_budget.clone(),
diff --git a/docs/design/durable-custody-command-intents.md b/docs/design/durable-custody-command-intents.md
index ecb5b58d..34eeef3e 100644
--- a/docs/design/durable-custody-command-intents.md
+++ b/docs/design/durable-custody-command-intents.md
@@ -34,7 +34,11 @@ Each admitted custody job reserves 28 KiB, including retained/dispatch intent bo
 
 Known phase results precede SDK resolution and local custody guards. Only proven absence can invoke an original under a still-valid local fence/deadline/ceiling; expired or unknown evidence stays retained. Fresh post-result queries establish a conservative clock, never from recorded reply timestamps. Direct caller-owned raw session/base renewal methods have been removed; ready renewals transfer into the service-owned coordinator.
 
-Cold service reconstruction still needs an independent current actual-owner check before constructing usable sessions. QueryContext exposes no active owner epoch, so a matching historical SQL token plus a fresh clock query is insufficient. Actual startup already obtains this fact from validated Cell Control and a live node advertisement; service/session reconstruction must carry the same authority. Original outcome knowledge remains recoverable even when current custody is refused.
+Session construction now requires a mandatory server-owned `PreparationAuthority` bound to the exact repository Cell target. Production reuses `NodePeer`'s validated durable Cell Control and live node advertisement; a decoded lease or supplied epoch cannot construct this capability. Owner incarnation and epoch are checked before and after the lease query, and its conservative monotonic deadline starts before those observations. Staging probes, bound handoff, preparation Claim/Renew restoration, base catalog loading/frontier selection and standalone positive root recovery retain the same authority source. No optional legacy source exists. Local runtime qualification fixtures read actual durable Control records, with their network-advertisement difference explicit and absent from production builds.
+
+Fresh observations add durable Control/live-advertisement reads at custody and catalog-selection boundaries, rather than per Git object. Their existing bounded readers limit persisted inputs, but those I/O buffers are outside the 28 KiB command-wire reservation. Count their resident memory, I/O and tail latency in mixed-load qualification; an unvalidated owner cache cannot replace them.
+
+A missing, corrupt, unowned or changed authority observation prevents fresh custody. A failed refresh or base observation permanently fences the existing shared session; repairing the durable source cannot un-fence it. Original known outcomes still resolve first and remain recoverable even when no usable session can be returned. Explicit registered Claim under the current owner can allocate and restore a new usable session. An owner observation is not a lease on ownership or an atomic publication check: final receivers retain their actual-owner transaction checks. Complete cold staging lifecycle reconstruction, owner-loss worker drain qualification and bounded orphan handling remain release work.
 
 ## Startup integration
 
@@ -48,7 +52,7 @@ Each new custody transition currently adds one registration mutation plus one ex
 
 Inline command metadata closes the pre-namespace correctness gap, but retaining one SQL row per renewal forever is not the intended final storage strategy. Before release, compact settled per-operation history into bounded immutable frames in a genuinely admitted namespace, reusing the existing saved-command/root/frame codecs and indexed immutable storage. Keep an authenticated discoverable SQL head and retain exact historical lookup; denied pre-admission work cannot depend on a fabricated namespace. Include this history in typed collection, backup and isolated restore, without treating the historical grant's base descriptors as new live roots. The current implementation conservatively retains rows and does not claim repository/team capacity.
 
-The staging and preparation factories now retain this protocol through admission, cancellation and service closure. Complete cold service reconstruction and current actual-owner session fencing before release. Remove raw custody bindings from production; domain methods remain callable inside the registered receiver and explicit qualification fixtures only. Remove redundant first-admission columns after their consumers and restart proofs use this journal. Complete foreground producers/readers, final schema removal, serving-generation retention, typed collection/backup, OS resource containment, continuous maintenance, physical rewriting and full-history mixed load before publishing the hard cutover.
+The staging and preparation factories now retain this protocol through admission, cancellation and service closure. Complete cold service reconstruction and owner-loss worker lifecycle qualification before release. Remove raw custody bindings from production; domain methods remain callable inside the registered receiver and explicit qualification fixtures only. Remove redundant first-admission columns after their consumers and restart proofs use this journal. Complete foreground producers/readers, final schema removal, serving-generation retention, typed collection/backup, OS resource containment, continuous maintenance, physical rewriting and full-history mixed load before publishing the hard cutover.
 
 Qualification covers SHA-1/SHA-256 first-writer races, pre-namespace persistence/discovery, unregistered and losing identities, late registration/phase rollback with SDK absence and exact retry, immutable metadata, all seven transitions, historical receipts after successors, original denied Begin/Renew after real SDK expiry, cold SQLite removal and owner restore, reaped successor Claim, forged tokens, corrupt metadata and bounded indexed lookup. A joint initialized catalog/ref base is tested against the reply ceiling. Real workspace tests check certified repository creation and identical custody metadata after fresh-disk restore. These are focused correctness checks, not a full-history or 10,000-developer capacity claim.
 
@@ -61,4 +65,6 @@ cargo +1.98.0 clippy --workspace --all-targets --locked -- -D warnings
 cargo +1.98.0 build -p canopy-server --bin canopy --locked
 ```
 
-The owned service checkpoint passes 286 publication and nine workspace/lifecycle cases, all-target workspace Clippy with warnings denied and the server build on macOS. The publication suite includes registrar loss before submission, after acceptance and after a panic, cancellation/closed-service recovery, and restored renewal preserving an existing resolver fence. Frozen Rust-source hashes and protected-checkout/dependency checks accompany the validation. Linux/provider CI and the complete runtime/capacity campaign remain release gates.
+The `1a11162` owned service checkpoint passes 286 publication and nine workspace/lifecycle cases, all-target workspace Clippy with warnings denied and the server build on macOS. The publication suite includes registrar loss before submission, after acceptance and after a panic, cancellation/closed-service recovery, and restored renewal preserving an existing resolver fence. Frozen Rust-source hashes and protected-checkout/dependency checks accompany the validation. Linux/provider CI and the complete runtime/capacity campaign remain release gates.
+
+The owner-fencing checkpoint passes 289 publication and nine real startup/workspace cases on frozen macOS/Rust 1.98.0 source, with warnings-denied workspace/all-target Clippy, the server build, formatting and static protection checks. Three new regression families use real durable ownership restoration and missing/corrupt Control objects in both formats. They preserve original committed receipts, reject previous-owner custody, retain permanent shared fences and permit a registered current-owner Claim to restore a usable session. The original failing cold-renewal log is retained. Production mixed-load cost and complete owner-loss/cold staging lifecycle qualification remain open.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index dd039e33..e1151c82 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -10,9 +10,9 @@ All five Cellule dependency declarations and six lockfile entries pin `161067f5a
 
 The local staging service now prepares both the exact custody original and its exact registrar for all seven custody actions. The fair preparation dispatcher uses the same owner for Claim/Renew, including original-head reconstruction. Direct caller-owned raw session/base renewal APIs have been removed; base renewals prepare a ready command for transfer to the service. Jobs retain both originals through uncertainty, observer cancellation and closure. Recorded phase knowledge precedes SDK expiry and local guards. Restored renewals on an existing session/base retain the original shared fence; a failed fresh query fences all of its existing resolvers. New execution after authoritative absence checks the local fence, deadline and residence ceiling.
 
-Custody reservation is 28 KiB; an admitted staging checkpoint raises it to 32 KiB. Existing operation, worker, actor, class and global byte caps have not increased. Twenty-seven staging service tests pass, including original reply loss/expiry, renewal/revocation, actual owner Claim, registrar loss before submission/after acceptance/panic, canceled observers and closed-service recovery in both formats. Final-source macOS/Rust 1.98.0 checks pass: 286 publication cases in 214.01 seconds and nine real startup/workspace lifecycle cases in 5.17 seconds, totaling 295 unique focused Rust tests. All-target workspace Clippy passes with warnings denied, the server binary builds, formatting/diff checks pass, and 423 Rust source hashes plus 90 local documentation links and the unchanged protected checkout/SDK pins are verified. The proof is `/tmp/canopy-registered-services-validation.json`. These checks qualify this local service checkpoint, not the whole production cutover or team capacity.
+Custody reservation is 28 KiB; an admitted staging checkpoint raises it to 32 KiB. Existing operation, worker, actor, class and global byte caps have not increased. Twenty-seven staging service tests pass, including original reply loss/expiry, renewal/revocation, actual owner Claim, registrar loss before submission/after acceptance/panic, canceled observers and closed-service recovery in both formats. At checkpoint `1a11162`, final-source macOS/Rust 1.98.0 checks passed: 286 publication cases in 214.01 seconds and nine real startup/workspace lifecycle cases in 5.17 seconds, totaling 295 unique focused Rust tests. All-target workspace Clippy passes with warnings denied, the server binary builds, formatting/diff checks pass, and 423 Rust source hashes plus 90 local documentation links and the unchanged protected checkout/SDK pins are verified. The proof is `/tmp/canopy-registered-services-validation.json`. These checks qualify this local service checkpoint, not the whole production cutover or team capacity.
 
-The next custody priorities are actual current-owner fencing for cold sessions, complete staging reconstruction and bounded unresolved-head stop/scan plus settled-history archival. A fresh SQL lease query cannot establish the current owner epoch. Startup's validated Cell Control/live node advertisement is the authority to carry into session construction. The full producer/reader/final-schema cutover, serving retention, typed collection/backup/restore, resource containment, maintenance/acceleration and full-history/team capacity gates remain open.
+Cold session construction now carries mandatory `PreparationAuthority`, bound to the exact Cell target and backed in production by startup's validated Cell Control/live node advertisement. It checks actual incarnation/epoch before and after the lease query; staging probes, bound handoff, base catalog/frontier loading and standalone positive recovery share this source. An owner observation failure permanently fences existing shared sessions, while original known outcomes remain recoverable. New registered Claim can restore current-owner custody. The regression set includes prior-owner cold restore, genuine current-owner takeover and missing/corrupt Control records in both formats. Final-source macOS/Rust 1.98.0 qualification passes 289 publication cases in 176.00 seconds and nine real startup/workspace lifecycle cases in 3.61 seconds, totaling 298 unique focused Rust tests. All-target workspace Clippy with warnings denied, the server build, formatting/diff checks, 424 frozen Rust-source hashes, 134 local documentation links, the five manifest/six lockfile SDK pins and protected index/archive checks pass. Evidence is `/tmp/canopy-owner-validation.json`; the original failing regression is retained in `/tmp/canopy-cold-owner-red.log`. These checks do not establish the full hard cutover or large-team capacity. The next custody priorities are complete staging reconstruction, owner-loss worker drain qualification and bounded unresolved-head stop/scan plus settled-history archival. The full producer/reader/final-schema cutover, serving retention, typed collection/backup/restore, resource containment, maintenance/acceleration and full-history/team capacity gates remain open.
 
 The proposed [directory file attribution](design/file-attribution.md) uses commit-pinned asynchronous page batches and bounded history caching, with an optional shared immutable index. Its native experiment passes 101 path comparisons across 17 commit states. Its production endpoint, UI, cache/index and load qualification remain unimplemented.
 

From 0a33a67536fdd94b460675fa6678439d5cc48c31 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 02:04:22 -0700
Subject: [PATCH 10/55] Reconstruct registered staging custody and wake fenced
 bound workers

Restore all seven original custody actions without changing identities or
receipts. Retain positive and negative history before fresh owner/lease
checks, including after closed-service recovery and SDK expiry.

Wake bound callback supervisors from the shared permanent session fence;
join cancellation and drop owned resources before returning worker credit.

Validate 296 publication and nine real startup/workspace lifecycle tests,
all-target workspace Clippy with warnings denied, server build and format.
The production cutover and full-history/team capacity gates remain open.
---
 .../src/packs/publication/session.rs          |  13 +
 .../src/packs/publication/staging_service.rs  | 106 +++-
 .../publication/staging_service/bound.rs      |  13 +-
 .../publication/staging_service/restore.rs    | 155 ++++++
 .../publication/tests/staging_service.rs      |   1 +
 .../tests/staging_service/restore.rs          | 490 ++++++++++++++++++
 docs/design/bound-preparation-lifecycle.md    |   4 +-
 docs/design/staging-service-lifecycle.md      |  12 +
 .../large-repository-implementation-status.md |   4 +-
 9 files changed, 774 insertions(+), 24 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/staging_service/restore.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs

diff --git a/crates/canopy-server/src/packs/publication/session.rs b/crates/canopy-server/src/packs/publication/session.rs
index 08c10e4f..df62d76e 100644
--- a/crates/canopy-server/src/packs/publication/session.rs
+++ b/crates/canopy-server/src/packs/publication/session.rs
@@ -20,6 +20,7 @@ pub struct PreparationSession {
     pub(super) deadline: Arc<Mutex<Instant>>,
     pub(super) ceiling: Option<Instant>,
     pub(super) fenced: Arc<AtomicBool>,
+    fence_changed: tokio::sync::watch::Sender<bool>,
 }
 impl PreparationSession {
     pub async fn open(
@@ -50,6 +51,7 @@ impl PreparationSession {
             deadline: Arc::new(Mutex::new(deadline)),
             ceiling: None,
             fenced: Arc::new(AtomicBool::new(false)),
+            fence_changed: tokio::sync::watch::channel(false).0,
         })
     }
     pub(super) fn capability(&self) -> (&CellClient, &CellTarget, &LeaseCheck) {
@@ -78,6 +80,17 @@ impl PreparationSession {
     }
     pub(super) fn fence(&self) {
         self.fenced.store(true, Ordering::Release);
+        // Retain the terminal value even with no observers. A worker subscribing
+        // after a fence must not wait for another notification.
+        self.fence_changed.send_replace(true);
+    }
+    pub(super) async fn wait_fenced(&self) {
+        let mut changed = self.fence_changed.subscribe();
+        while !*changed.borrow_and_update() {
+            if changed.changed().await.is_err() {
+                return;
+            }
+        }
     }
     pub(super) async fn refresh(&self, minimum: Receipt) -> Result<(), PreparationBaseError> {
         let result = self.refresh_inner(minimum).await;
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index 5e1768a1..f83c72a7 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -21,6 +21,7 @@ use tokio::{
 mod bound;
 use bound::accept_bound;
 mod publication;
+mod restore;
 pub use publication::{StagedPublicationFailure, StagedPublicationTicket};
 
 const COMMAND_BYTES: u32 = 4096;
@@ -109,6 +110,8 @@ pub enum StagingError {
     BoundRenew(#[source] Box<InvocationError<PreparationReply>>),
     #[error("bound preparation claim failed")]
     BoundClaim(#[source] Box<InvocationError<PreparationReply>>),
+    #[error("restored staging custody command failed")]
+    Restoration(#[source] Box<InvocationError<CustodyReply>>),
     #[error("staging bind failed")]
     Bind(#[source] Box<InvocationError<PreparationReply>>),
     #[error("staging custody preparation failed")]
@@ -143,6 +146,7 @@ impl StagingError {
         match self {
             Self::Begin(e) | Self::Renew(e) | Self::Claim(e) | Self::Checkpoint(e) => unknown(e),
             Self::Bind(e) | Self::BoundRenew(e) | Self::BoundClaim(e) => unknown(e),
+            Self::Restoration(e) => unknown(e),
             Self::Custody { source, .. } => source.uncertain(),
             _ => false,
         }
@@ -339,6 +343,7 @@ struct Local {
     bound_started: Option<Instant>,
     bound_result: Option<Arc<StagingBound>>,
     bound_renewal: Option<Committed<PreparationReply>>,
+    restored_outcome: Option<Arc<Committed<CustodyReply>>>,
     policy_receipt: Option<Receipt>,
     finishing: bool,
     deadline: Instant,
@@ -365,6 +370,7 @@ struct Job {
     target: CellTarget,
     actor: String,
     operation: [u8; 16],
+    restored_evidence: Option<cellule_runtime::PendingMutation>,
     actor_workers: Arc<Semaphore>,
     local: Mutex<Local>,
     work: Mutex<WorkSlots>,
@@ -376,6 +382,7 @@ struct Job {
 }
 #[derive(Clone)]
 enum Exact {
+    Restored(OwnedCustody),
     Begin(OwnedCustody),
     Claim(OwnedCustody),
     Checkpoint(PreparedCommand<RegisterStagedInputs>),
@@ -386,6 +393,7 @@ enum Exact {
     BoundRenew(OwnedCustody),
 }
 enum Outcome {
+    Restored(Box<Committed<CustodyReply>>),
     Stage(Committed<StagingReply>),
     Bound(Committed<PreparationReply>),
     BoundClaim(Committed<PreparationReply>),
@@ -393,9 +401,27 @@ enum Outcome {
     Checkpoint(Committed<StagingReply>),
     BoundCheckpoint(Committed<StagingReply>),
 }
+fn custody_guard(job: &Job) -> Result<(), Error> {
+    let local = job
+        .local
+        .lock()
+        .map_err(|_| Error::Command("staging custody poisoned"))?;
+    let now = Instant::now();
+    if local.fenced
+        || now >= local.lifetime
+        || ((local.lease.is_some() || local.bound.is_some()) && now >= local.deadline)
+    {
+        return Err(Error::Command("staging custody inactive"));
+    }
+    Ok(())
+}
+
 impl Exact {
     fn pending(&self) -> StagingError {
         match self {
+            Self::Restored(c) => StagingError::Restoration(Box::new(InvocationError::Pending(
+                Box::new(c.evidence().clone()),
+            ))),
             Self::Begin(c) => StagingError::Begin(Box::new(InvocationError::Pending(Box::new(
                 c.evidence().clone(),
             )))),
@@ -429,20 +455,7 @@ impl Exact {
         role: fn(Box<InvocationError<T>>) -> StagingError,
     ) -> Result<Committed<T>, StagingError> {
         let result = command
-            .invoke(client, recover, fault, || {
-                let local = job
-                    .local
-                    .lock()
-                    .map_err(|_| Error::Command("staging custody poisoned"))?;
-                let now = Instant::now();
-                if local.fenced
-                    || now >= local.lifetime
-                    || ((local.lease.is_some() || local.bound.is_some()) && now >= local.deadline)
-                {
-                    return Err(Error::Command("staging custody inactive"));
-                }
-                Ok(())
-            })
+            .invoke(client, recover, fault, || custody_guard(job))
             .await
             .map_err(|source| StagingError::Custody {
                 evidence: Box::new(command.evidence().clone()),
@@ -470,6 +483,7 @@ impl Exact {
             }
         }
         match self {
+            Self::Restored(c) => restore::dispatch(c, &client, &job, recover, fault).await,
             Self::Begin(c) => {
                 Self::custody(c, &client, recover, fault, &job, stage, StagingError::Begin)
                     .await
@@ -586,7 +600,9 @@ impl StagingCoordinator {
             Some(StagingError::Foreign)
         } else if admission.closed {
             Some(StagingError::Closed)
-        } else if ready.inner.request.lease_ms != self.inner.limits.lease_ms {
+        } else if !matches!(ready.inner.command, Exact::Restored(_))
+            && ready.inner.request.lease_ms != self.inner.limits.lease_ms
+        {
             Some(StagingError::Context)
         } else if admission.jobs.contains_key(&ready.inner.request.operation) {
             Some(StagingError::Duplicate)
@@ -615,20 +631,28 @@ impl StagingCoordinator {
         actor.operations += 1;
         let actor_workers = Arc::clone(&actor.workers);
         let now = Instant::now();
+        let restored_evidence = match &ready.inner.command {
+            Exact::Restored(command) => Some(command.evidence().clone()),
+            _ => None,
+        };
         let job = Arc::new(Job {
             authority: self.inner.authority.clone(),
             client: ready.inner.client,
             target: ready.inner.target,
             actor: ready.inner.request.actor,
             operation: ready.inner.request.operation,
+            restored_evidence,
             actor_workers,
             local: Mutex::new(Local {
                 lease: None,
                 bound: None,
                 bound_source: ready.inner.bound_source.clone(),
-                bound_started: ready.inner.bound_source.as_ref().map(|_| now),
+                bound_started: (ready.inner.bound_source.is_some()
+                    || matches!(ready.inner.command, Exact::Restored(_)))
+                .then_some(now),
                 bound_result: None,
                 bound_renewal: None,
+                restored_outcome: None,
                 policy_receipt: None,
                 finishing: false,
                 deadline: now,
@@ -799,7 +823,8 @@ impl StagingTicket {
     )> {
         let exact = self.job.exact.lock().expect("staging exact");
         let command = match exact.as_ref()? {
-            Exact::Begin(command)
+            Exact::Restored(command)
+            | Exact::Begin(command)
             | Exact::Claim(command)
             | Exact::Renew(command)
             | Exact::Bind(command)
@@ -983,6 +1008,20 @@ impl StagingTicket {
             .bound_result
             .clone()
     }
+    /// Original registered identity retained even when fresh custody fails.
+    /// This is historical evidence, never upload or preparation permission.
+    pub fn restored_evidence(&self) -> Option<&cellule_runtime::PendingMutation> {
+        self.job.restored_evidence.as_ref()
+    }
+    /// Original positive or negative outcome, retained before fresh probes.
+    pub fn restored_outcome(&self) -> Option<Arc<Committed<CustodyReply>>> {
+        self.job
+            .local
+            .lock()
+            .expect("staging local")
+            .restored_outcome
+            .clone()
+    }
     pub fn bound_renewal(&self) -> Option<Committed<PreparationReply>> {
         self.job
             .local
@@ -1189,6 +1228,9 @@ impl StagingContext {
         let l = self.job.local.lock().expect("staging local");
         if l.fenced
             || l.bound.is_some() != self.bound
+            || l.bound
+                .as_ref()
+                .is_some_and(|session| session.live_lease().is_err())
             || l.deadline <= Instant::now()
             || l.lifetime <= Instant::now()
         {
@@ -1200,17 +1242,33 @@ impl StagingContext {
     async fn fenced(&self) {
         let mut status = self.job.status.subscribe();
         loop {
-            let deadline = {
+            let (deadline, session) = {
                 let l = self.job.local.lock().expect("staging local");
                 if l.fenced || l.bound.is_some() != self.bound {
                     return;
                 }
-                l.deadline.min(l.lifetime)
+                let mut deadline = l.deadline.min(l.lifetime);
+                if let Some(session) = &l.bound {
+                    let Ok((_, usable_until)) = session.live_lease() else {
+                        return;
+                    };
+                    deadline = deadline.min(usable_until);
+                }
+                (deadline, l.bound.clone())
             };
             if Instant::now() >= deadline {
                 return;
             }
-            tokio::select! { _ = sleep_until(deadline) => {}, result = status.changed() => { if result.is_err() { return; } } }
+            tokio::select! {
+                _ = sleep_until(deadline) => {},
+                _ = async {
+                    match session {
+                        Some(session) => session.wait_fenced().await,
+                        None => std::future::pending::<()>().await,
+                    }
+                } => return,
+                result = status.changed() => { if result.is_err() { return; } }
+            }
         }
     }
 }
@@ -1402,6 +1460,13 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
                     .await
                     .unwrap_or(Err(pending));
             match result {
+                Ok(Outcome::Restored(value)) => {
+                    job.exact.lock().expect("staging exact").take();
+                    if !restore::accept(&inner, &job, *value).await {
+                        return;
+                    }
+                    recover = false;
+                }
                 Err(error) if error.uncertain() => {
                     job.status
                         .send_replace(StagingState::Uncertain(Arc::new(error)));
@@ -1506,6 +1571,7 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
                         | Outcome::BoundCheckpoint(_) => {
                             unreachable!()
                         }
+                        Outcome::Restored(_) => unreachable!("restored outcome handled above"),
                     };
                     let StagingReply::Granted(lease) = value.output else {
                         job.exact.lock().expect("staging exact").take();
diff --git a/crates/canopy-server/src/packs/publication/staging_service/bound.rs b/crates/canopy-server/src/packs/publication/staging_service/bound.rs
index d7b19f01..13d81a62 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/bound.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/bound.rs
@@ -47,6 +47,17 @@ pub(super) async fn accept_bound(
         fence_and_drain(inner, job, StagingError::Context).await;
         return false;
     }
+    open_bound(inner, job, original, ceiling).await
+}
+
+/// Shared fresh session installation after authenticating a bound outcome.
+pub(super) async fn open_bound(
+    inner: &Inner,
+    job: &Job,
+    original: Arc<StagingBound>,
+    ceiling: Instant,
+) -> bool {
+    let lease = original.lease;
     let session = PreparationSession::open(
         job.client.clone(),
         job.target.clone(),
@@ -54,7 +65,7 @@ pub(super) async fn accept_bound(
             token: lease.token,
             actor: job.actor.clone(),
         },
-        Some(value.receipt),
+        Some(original.receipt),
         job.authority.clone(),
     )
     .await;
diff --git a/crates/canopy-server/src/packs/publication/staging_service/restore.rs b/crates/canopy-server/src/packs/publication/staging_service/restore.rs
new file mode 100644
index 00000000..ed8dadc5
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/staging_service/restore.rs
@@ -0,0 +1,155 @@
+//! Reconstruct only an authenticated registered original, never a new retry.
+use super::*;
+
+impl ReadyStaging {
+    /// Load the exact latest registered custody head after process loss.
+    /// No recorded clock grants work; the service resolves original knowledge
+    /// before independently acquiring current lease/owner custody.
+    pub async fn restore(
+        client: CellClient,
+        target: CellTarget,
+        operation: [u8; 16],
+    ) -> Result<Self, StagingError> {
+        let command = OwnedCustody::restore(&client, &target, operation).await?;
+        let request = match command.action().map_err(|_| StagingError::Context)? {
+            CustodyAction::BeginPreparation(request) | CustodyAction::BeginStaging(request) => {
+                request
+            }
+            CustodyAction::ClaimPreparation(request)
+            | CustodyAction::RenewPreparation(request)
+            | CustodyAction::ClaimStaging(request)
+            | CustodyAction::RenewStaging(request) => context(request.check, request.lease_ms),
+            // Bind has no requested renewal duration. This synthetic value is
+            // admission metadata only, never execution bytes or a lease clock.
+            CustodyAction::BindStaging(check) => context(check, DEFAULT_LEASE_MS),
+        };
+        if request.operation != operation
+            || crate::repository_target(target.tenant(), target.application(), request.repository)
+                .map_err(|_| StagingError::Context)?
+                != target
+        {
+            return Err(StagingError::Context);
+        }
+        request
+            .encode(&mut BoundedEncoder::new(COMMAND_BYTES).map_err(|_| StagingError::Context)?)
+            .map_err(|_| StagingError::Context)?;
+        Ok(Self {
+            inner: Box::new(StagingRequest {
+                client,
+                target,
+                request,
+                command: Exact::Restored(command),
+                bound_source: None,
+            }),
+        })
+    }
+}
+fn context(check: LeaseCheck, lease_ms: u64) -> BeginRequest {
+    BeginRequest {
+        repository: check.token.repository,
+        operation: check.token.operation,
+        request_digest: check.token.request_digest,
+        actor: check.actor,
+        lease_ms,
+    }
+}
+
+pub(super) async fn dispatch(
+    command: OwnedCustody,
+    client: &CellClient,
+    job: &Job,
+    recover: bool,
+    fault: u8,
+) -> Result<Outcome, StagingError> {
+    // Only frozen command execution occurs here, not new native work. Known
+    // phases precede the local guard. On proven SDK absence the original
+    // receiver checks live custody and actual ownership atomically; successful
+    // execution still cannot grant a worker before the fresh post-result probe.
+    let result = command
+        .invoke(client, recover, fault, || custody_guard(job))
+        .await
+        .map_err(|source| StagingError::Custody {
+            evidence: Box::new(command.evidence().clone()),
+            source: Box::new(source),
+        })?;
+    let value = match result {
+        Ok(value) => value,
+        Err(InvocationError::Rejected(value)) => *value,
+        Err(error) => return Err(StagingError::Restoration(Box::new(error))),
+    };
+    Ok(Outcome::Restored(Box::new(value)))
+}
+
+pub(super) async fn accept(inner: &Inner, job: &Job, value: Committed<CustodyReply>) -> bool {
+    // Preserve positive AND negative knowledge before any current authority,
+    // lease query, scope ceiling or newly configured duration can refuse work.
+    let value = Arc::new(value);
+    job.local.lock().expect("staging local").restored_outcome = Some(value.clone());
+    match &value.output {
+        CustodyReply::Staging(StagingReply::Granted(recorded)) => {
+            job.local.lock().expect("staging local").lease = Some(**recorded);
+            match probe(job, value.receipt).await {
+                Ok((lease, deadline))
+                    if lease.token == recorded.token && lease.format == recorded.format =>
+                {
+                    let active = {
+                        let mut local = job.local.lock().expect("staging local");
+                        if local.fenced || Instant::now() >= deadline.min(local.lifetime) {
+                            false
+                        } else {
+                            local.lease = Some(lease);
+                            local.deadline = deadline;
+                            job.status.send_replace(if local.stop {
+                                StagingState::Draining(lease)
+                            } else {
+                                StagingState::Active(lease)
+                            });
+                            true
+                        }
+                    };
+                    if !active {
+                        fence_and_drain(inner, job, StagingError::Inactive).await;
+                    }
+                    active
+                }
+                Ok(_) => {
+                    fence_and_drain(inner, job, StagingError::Context).await;
+                    false
+                }
+                Err(error) => {
+                    fence_and_drain(inner, job, error).await;
+                    false
+                }
+            }
+        }
+        CustodyReply::Preparation(PreparationReply::Granted(lease)) => {
+            let original = Arc::new(StagingBound {
+                lease: **lease,
+                receipt: value.receipt,
+            });
+            let ceiling = {
+                let mut local = job.local.lock().expect("staging local");
+                local.bound_result = Some(original.clone());
+                let started = local
+                    .bound_started
+                    .expect("restored custody admission time");
+                let ceiling = (started + Duration::from_millis(inner.limits.bound_lifetime_ms))
+                    .min(local.lifetime);
+                local.lifetime = ceiling;
+                (!local.fenced && Instant::now() < ceiling).then_some(ceiling)
+            };
+            match ceiling {
+                Some(ceiling) => bound::open_bound(inner, job, original, ceiling).await,
+                None => {
+                    fence_and_drain(inner, job, StagingError::Inactive).await;
+                    false
+                }
+            }
+        }
+        CustodyReply::Staging(StagingReply::Denied(_))
+        | CustodyReply::Preparation(PreparationReply::Denied(_)) => {
+            fence_and_drain(inner, job, StagingError::Context).await;
+            false
+        }
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index ebb11810..fc650437 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -1,5 +1,6 @@
 mod bound;
 mod publication;
+mod restore;
 use super::*;
 use tokio::{
     sync::oneshot,
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
new file mode 100644
index 00000000..3bae01da
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
@@ -0,0 +1,490 @@
+//! Real durable command/owner recovery; no old coordinator or usable session.
+use super::*;
+use cellule_runtime::{Committed, PendingMutation, Resolution};
+
+async fn execute(f: &Fixture, action: CustodyAction) -> Result<Committed<CustodyReply>> {
+    let ready = PreparedCustody::prepare(&f.client(), &f.target, action, identity()?).await?;
+    Ok(ready
+        .register(&f.client(), identity()?)
+        .await?
+        .recover(&f.client())
+        .await?)
+}
+fn granted_token(value: &CustodyReply) -> Result<PreparationToken> {
+    match value {
+        CustodyReply::Preparation(PreparationReply::Granted(lease)) => Ok(lease.token),
+        CustodyReply::Staging(StagingReply::Granted(lease)) => Ok(lease.token),
+        _ => Err("custody grant missing".into()),
+    }
+}
+async fn head(
+    f: &Fixture,
+    kind: u8,
+    execute_original: bool,
+) -> Result<(PendingMutation, Option<Committed<CustodyReply>>)> {
+    head_expiring(f, kind, execute_original, execute_original).await
+}
+async fn head_expiring(
+    f: &Fixture,
+    kind: u8,
+    execute_original: bool,
+    short_expiry: bool,
+) -> Result<(PendingMutation, Option<Committed<CustodyReply>>)> {
+    let input = f.begin([230 + kind; 16]);
+    let action = match kind {
+        0 => CustodyAction::BeginStaging(input),
+        4 => CustodyAction::BeginPreparation(input),
+        _ => {
+            let source = if kind < 4 {
+                CustodyAction::BeginStaging(input)
+            } else {
+                CustodyAction::BeginPreparation(input)
+            };
+            let previous = granted_token(&execute(f, source).await?.output)?;
+            let lease = LeaseRequest {
+                check: check(previous),
+                lease_ms: DEFAULT_LEASE_MS,
+            };
+            match kind {
+                1 => CustodyAction::ClaimStaging(lease),
+                2 => CustodyAction::RenewStaging(lease),
+                3 => CustodyAction::BindStaging(lease.check),
+                5 => CustodyAction::ClaimPreparation(lease),
+                6 => CustodyAction::RenewPreparation(lease),
+                _ => return Err("unknown fixture kind".into()),
+            }
+        }
+    };
+    let mut mutation = identity()?;
+    if short_expiry {
+        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+    }
+    let command = PreparedCustody::prepare(&f.client(), &f.target, action, mutation).await?;
+    let original = command.evidence().clone();
+    let registered = command.register(&f.client(), identity()?).await?;
+    let committed = if execute_original {
+        Some(registered.recover(&f.client()).await?)
+    } else {
+        None
+    };
+    Ok((original, committed))
+}
+async fn restore(
+    f: &Fixture,
+    client: CellClient,
+    kind: u8,
+    limits: StagingLimits,
+) -> Result<(StagingCoordinator, StagingTicket)> {
+    let service = StagingCoordinator::new(f.target.clone(), limits, f.authority())?;
+    let ready = ReadyStaging::restore(client, f.target.clone(), [230 + kind; 16]).await?;
+    let ticket = service.submit(ready).map_err(|(error, _)| error)?;
+    Ok((service, ticket))
+}
+async fn settle(ticket: &StagingTicket) -> Result<StagingState> {
+    Ok(timeout(Duration::from_secs(10), ticket.wait()).await?)
+}
+async fn expired(evidence: &PendingMutation) -> Result {
+    let until = evidence.identity().expires_at_ms;
+    let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
+    if now <= until {
+        tokio::time::sleep(Duration::from_millis((until - now + 1) as u64)).await;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_staging_reconstructs_all_seven_heads_without_replacing_originals_or_clocks() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in 0..7 {
+            let f = Fixture::new(format).await?;
+            let (evidence, expected) = head(&f, kind, true).await?;
+            let expected = expected.ok_or("original not executed")?;
+            // A changed restart profile must not hide original knowledge or
+            // rewrite its command duration. New renewals use the new profile.
+            let limits = StagingLimits {
+                lease_ms: 10_000,
+                renew_before_ms: 5_000,
+                ..StagingLimits::default()
+            };
+            let (service, ticket) = restore(&f, f.client(), kind, limits).await?;
+            let state = settle(&ticket).await?;
+            if kind < 3 {
+                assert!(
+                    matches!(state, StagingState::Active(_)),
+                    "kind {kind}: {state:?}"
+                );
+            } else {
+                assert!(
+                    matches!(state, StagingState::Bound(_)),
+                    "kind {kind}: {state:?}"
+                );
+                assert_eq!(
+                    ticket.bound_session()?.lease.token,
+                    granted_token(&expected.output)?
+                );
+            }
+            assert_eq!(ticket.restored_evidence(), Some(&evidence));
+            assert_eq!(
+                *ticket.restored_outcome().ok_or("original reply lost")?,
+                expected
+            );
+            let saved = RegisteredCustody::load_latest(&f.client(), &f.target, [230 + kind; 16])
+                .await?
+                .ok_or("head missing")?;
+            assert_eq!(saved.evidence(), &evidence);
+            assert!(service.close_and_drain().await.is_empty());
+            assert!(ticket.spawn(|_| async { Ok(()) }).is_err());
+            assert_eq!(
+                *ticket.restored_outcome().ok_or("closed history lost")?,
+                expected
+            );
+            assert_eq!(service.stats().admitted, 0);
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_staging_keeps_all_original_receipts_after_sdk_expiry_and_actual_owner_restore()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in 0..7 {
+            let f = Fixture::new(format).await?;
+            let (evidence, expected) = head(&f, kind, true).await?;
+            let expected = expected.ok_or("original not executed")?;
+            let old = granted_token(&expected.output)?;
+            let (runtime, handle, client) =
+                super::super::durable_recovery::restore_owner(&f, &check(old)).await?;
+            assert_ne!(handle.owner_fence(), old.owner);
+            expired(&evidence).await?;
+            assert!(matches!(
+                client.resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            let (service, ticket) =
+                restore(&f, client.clone(), kind, StagingLimits::default()).await?;
+            assert!(matches!(settle(&ticket).await?, StagingState::Fenced(_)));
+            assert_eq!(ticket.restored_evidence(), Some(&evidence));
+            assert_eq!(
+                *ticket.restored_outcome().ok_or("old-owner history lost")?,
+                expected
+            );
+            assert!(ticket.bound_session().is_err());
+            assert!(ticket.spawn(|_| async { Ok(()) }).is_err());
+            assert!(service.close_and_drain().await.is_empty());
+            let saved = RegisteredCustody::load_latest(&client, &f.target, [230 + kind; 16])
+                .await?
+                .ok_or("old head missing")?;
+            assert_eq!(saved.evidence(), &evidence);
+            assert_eq!(saved.recover(&client).await?, expected);
+            runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_staging_absent_originals_execute_or_fence_under_actual_new_owner_without_new_identity()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in 0..7 {
+            let f = Fixture::new(format).await?;
+            let (evidence, expected) = head(&f, kind, false).await?;
+            assert!(expected.is_none());
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Absent
+            ));
+            let (runtime, handle, client) =
+                super::super::durable_recovery::restore_owner_fence(&f, f.handle.owner_fence())
+                    .await?;
+            let (service, ticket) =
+                restore(&f, client.clone(), kind, StagingLimits::default()).await?;
+            let state = settle(&ticket).await?;
+            assert_eq!(ticket.restored_evidence(), Some(&evidence));
+            let saved = RegisteredCustody::load_latest(&client, &f.target, [230 + kind; 16])
+                .await?
+                .ok_or("registered original lost")?;
+            assert_eq!(saved.evidence(), &evidence);
+            if matches!(kind, 2 | 3 | 6) {
+                assert!(
+                    matches!(state, StagingState::Fenced(_)),
+                    "old-token kind {kind}: {state:?}"
+                );
+                let outcome = ticket.restored_outcome().ok_or("stale denial lost")?;
+                assert!(
+                    matches!(
+                        &outcome.output,
+                        CustodyReply::Preparation(PreparationReply::Denied(
+                            PreparationDenial::Stale
+                        )) | CustodyReply::Staging(StagingReply::Denied(PreparationDenial::Stale))
+                    ),
+                    "kind {kind}: {outcome:?}"
+                );
+                assert!(saved.settled());
+                assert!(
+                    matches!(saved.recover(&client).await, Err(InvocationError::Rejected(value)) if *value == *outcome)
+                );
+                assert!(matches!(
+                    client.resolve(&evidence).await?,
+                    Resolution::Committed(_)
+                ));
+            } else {
+                let outcome = ticket
+                    .restored_outcome()
+                    .ok_or("absent original reply lost")?;
+                assert_eq!(granted_token(&outcome.output)?.owner, handle.owner_fence());
+                assert_eq!(saved.recover(&client).await?, *outcome);
+                assert!(
+                    matches!(state, StagingState::Active(_) | StagingState::Bound(_)),
+                    "kind {kind}: {state:?}"
+                );
+            }
+            assert!(service.close_and_drain().await.is_empty());
+            runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_staging_denials_remain_original_after_authority_is_repaired() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in [0, 4] {
+            let f = Fixture::new(format).await?;
+            let action = if kind == 0 {
+                CustodyAction::BeginStaging(f.begin([230 + kind; 16]))
+            } else {
+                CustodyAction::BeginPreparation(f.begin([230 + kind; 16]))
+            };
+            let prepared =
+                PreparedCustody::prepare(&f.client(), &f.target, action, identity()?).await?;
+            let evidence = prepared.evidence().clone();
+            let registered = prepared.register(&f.client(), identity()?).await?;
+            super::super::publishing::edit(&f, "UPDATE repository_identity SET owner='other'")
+                .await?;
+            let expected = match registered.recover(&f.client()).await {
+                Err(InvocationError::Rejected(value)) => *value,
+                value => return Err(format!("expected original denial: {value:?}").into()),
+            };
+            super::super::publishing::edit(&f, "UPDATE repository_identity SET owner='owner'")
+                .await?;
+            let (service, ticket) = restore(&f, f.client(), kind, StagingLimits::default()).await?;
+            assert!(matches!(settle(&ticket).await?, StagingState::Fenced(_)));
+            assert_eq!(ticket.restored_evidence(), Some(&evidence));
+            assert_eq!(
+                *ticket.restored_outcome().ok_or("original denial missing")?,
+                expected
+            );
+            assert!(ticket.spawn(|_| async { Ok(()) }).is_err());
+            assert!(ticket.bound_session().is_err());
+            assert_eq!(f.counts().await?, (0, 0));
+            assert!(service.close_and_drain().await.is_empty());
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_staging_reply_loss_and_query_failures_retain_originals_through_closed_recovery()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in [0, 3, 6] {
+            for fault in 0..4 {
+                let f = Fixture::new(format).await?;
+                let (evidence, _) = head(&f, kind, false).await?;
+                let ready =
+                    ReadyStaging::restore(f.client(), f.target.clone(), [230 + kind; 16]).await?;
+                let service = StagingCoordinator::new(
+                    f.target.clone(),
+                    StagingLimits::default(),
+                    f.authority(),
+                )?;
+                if fault == 0 {
+                    // The ready capability has the authentic original bytes,
+                    // but a failed phase read still cannot authorize execution.
+                    super::super::publishing::edit(
+                        &f,
+                        "ALTER TABLE catalog_custody_commands RENAME TO custody_query_fault",
+                    )
+                    .await?;
+                } else {
+                    service.fault_for_test(fault);
+                }
+                let ticket = service.submit(ready).map_err(|(error, _)| error)?;
+                assert!(matches!(
+                    terminal(&ticket).await?,
+                    StagingState::Uncertain(_)
+                ));
+                assert_eq!(ticket.restored_evidence(), Some(&evidence));
+                assert!(ticket.restored_outcome().is_none());
+                assert_eq!(
+                    service.stats().command_bytes,
+                    super::super::super::custody::RESERVATION
+                );
+                drop(ticket);
+                let ticket = service
+                    .pending([230 + kind; 16])
+                    .ok_or("dropped observer lost original")?;
+                assert_eq!(service.close_and_drain().await.len(), 1);
+                if fault == 0 {
+                    assert!(matches!(
+                        f.client().resolve(&evidence).await?,
+                        Resolution::Absent
+                    ));
+                    super::super::publishing::edit(
+                        &f,
+                        "ALTER TABLE custody_query_fault RENAME TO catalog_custody_commands",
+                    )
+                    .await?;
+                }
+                service.recover(&ticket)?;
+                assert!(matches!(
+                    terminal(&ticket).await?,
+                    StagingState::Stopped | StagingState::Bound(_) | StagingState::Fenced(_)
+                ));
+                let original = ticket
+                    .restored_outcome()
+                    .ok_or("closed recovery lost original reply")?;
+                let saved =
+                    RegisteredCustody::load_latest(&f.client(), &f.target, [230 + kind; 16])
+                        .await?
+                        .ok_or("original disappeared")?;
+                assert_eq!(saved.evidence(), &evidence);
+                assert_eq!(saved.recover(&f.client()).await?, *original);
+                assert!(ticket.bound_session().is_err());
+                assert!(ticket.spawn(|_| async { Ok(()) }).is_err());
+                assert!(service.close_and_drain().await.is_empty());
+                assert_eq!(service.stats().command_bytes, 0);
+                f.runtime.shutdown().await?;
+            }
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_bound_owner_loss_cancels_workers_before_releasing_resource_credit() -> Result {
+    use std::sync::atomic::{AtomicBool, Ordering};
+    struct Resource {
+        service: StagingCoordinator,
+        dropped: Arc<AtomicBool>,
+        wrong_order: Arc<AtomicBool>,
+    }
+    impl Drop for Resource {
+        fn drop(&mut self) {
+            if self.service.stats().workers != 1 {
+                self.wrong_order.store(true, Ordering::Release);
+            }
+            self.dropped.store(true, Ordering::Release);
+        }
+    }
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in [3, 4, 6] {
+            let f = Fixture::new(format).await?;
+            let (evidence, expected) = head(&f, kind, true).await?;
+            let expected = expected.ok_or("original missing")?;
+            let (service, ticket) = restore(&f, f.client(), kind, StagingLimits::default()).await?;
+            assert!(matches!(settle(&ticket).await?, StagingState::Bound(_)));
+            let session = ticket.bound_session()?;
+            let dropped = Arc::new(AtomicBool::new(false));
+            let wrong_order = Arc::new(AtomicBool::new(false));
+            let resource = Resource {
+                service: service.clone(),
+                dropped: dropped.clone(),
+                wrong_order: wrong_order.clone(),
+            };
+            let (entered, running) = oneshot::channel();
+            let worker = ticket.spawn_bound(move |_| async move {
+                let _resource = resource;
+                let _ = entered.send(());
+                std::future::pending::<std::result::Result<(), StagingError>>().await
+            })?;
+            timeout(Duration::from_secs(10), running).await??;
+            let (runtime, handle, _) =
+                super::super::durable_recovery::restore_owner(&f, &session.check).await?;
+            assert_ne!(handle.owner_fence(), session.lease.token.owner);
+            assert!(session.check_owner().await.is_err());
+            // A clone observing the fence after it fired must also wake.
+            timeout(Duration::from_secs(2), session.clone().wait_fenced()).await?;
+            // No manual renewal, clock advance, coordinator stop or job-state
+            // mutation: the session's permanent shared fence must wake work.
+            assert!(
+                timeout(Duration::from_secs(2), worker.wait())
+                    .await?
+                    .is_err()
+            );
+            assert!(session.live_lease().is_err());
+            assert!(dropped.load(Ordering::Acquire));
+            assert!(!wrong_order.load(Ordering::Acquire));
+            assert_eq!(service.stats().workers, 0);
+            assert!(ticket.spawn_bound(|_| async { Ok(()) }).is_err());
+            assert_eq!(ticket.restored_evidence(), Some(&evidence));
+            assert_eq!(
+                *ticket.restored_outcome().ok_or("historical outcome lost")?,
+                expected
+            );
+            assert!(service.close_and_drain().await.is_empty());
+            runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_staging_unsettled_expired_originals_keep_exact_evidence_and_never_execute() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in 0..7 {
+            let f = Fixture::new(format).await?;
+            let (evidence, expected) = head_expiring(&f, kind, false, true).await?;
+            assert!(expected.is_none());
+            let (runtime, _, client) =
+                super::super::durable_recovery::restore_owner_fence(&f, f.handle.owner_fence())
+                    .await?;
+            expired(&evidence).await?;
+            assert!(matches!(
+                client.resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            let (service, ticket) =
+                restore(&f, client.clone(), kind, StagingLimits::default()).await?;
+            assert!(matches!(
+                terminal(&ticket).await?,
+                StagingState::Uncertain(_)
+            ));
+            assert_eq!(ticket.restored_evidence(), Some(&evidence));
+            assert!(ticket.restored_outcome().is_none());
+            assert!(ticket.spawn(|_| async { Ok(()) }).is_err());
+            assert!(ticket.spawn_bound(|_| async { Ok(()) }).is_err());
+            assert_eq!(
+                service.stats().command_bytes,
+                super::super::super::custody::RESERVATION
+            );
+            assert_eq!(service.close_and_drain().await.len(), 1);
+            service.recover(&ticket)?;
+            assert!(matches!(
+                terminal(&ticket).await?,
+                StagingState::Uncertain(_)
+            ));
+            let saved = RegisteredCustody::load_latest(&client, &f.target, [230 + kind; 16])
+                .await?
+                .ok_or("expired head lost")?;
+            assert_eq!(saved.evidence(), &evidence);
+            assert!(!saved.settled());
+            assert!(
+                matches!(saved.recover(&client).await, Err(InvocationError::Pending(value)) if *value == evidence)
+            );
+            assert!(matches!(
+                client.resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            assert_eq!(service.close_and_drain().await.len(), 1);
+            runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
diff --git a/docs/design/bound-preparation-lifecycle.md b/docs/design/bound-preparation-lifecycle.md
index 1eb28e56..a033bef2 100644
--- a/docs/design/bound-preparation-lifecycle.md
+++ b/docs/design/bound-preparation-lifecycle.md
@@ -8,7 +8,7 @@ Seal drains staged workers/results before Bind as before. A known Bind or bound
 
 bound_session returns a locally live shared session only in the usable bound phase. open_base refreshes at the original bound receipt and constructs the existing PreparationBaseResolver with that session's deadline/fence. Base reads, reconciliation and private proof factories observe the same session. spawn_bound admits a callback into the existing global/actor worker slots and typed StagingTask handoff. Dropped callers retain execution/results in service ownership. Retrieved results transfer once; failed/expired results drop before their credits. Use the existing admitted native/disk/reader primitives inside callbacks; these worker counters do not account for arbitrary heap, unjoined descendants or detached I/O.
 
-A public Bound result remains recoverable after graceful stop and failed fresh custody. It is not usable authority. bound_session/open_base reject stopped or fenced jobs. Previously opened bases and session clones observe the shared permanent fence and residence ceiling.
+A public Bound result remains recoverable after graceful stop and failed fresh custody. It is not usable authority. bound_session/open_base reject stopped or fenced jobs. Previously opened bases and session clones observe the shared permanent fence and residence ceiling. The session also retains a terminal fence notification: in-flight bound callbacks wake without waiting for a renewal or a coordinator status change, and late subscribers see the existing fence. Cancellation aborts and joins the callback before resource credit returns.
 
 ## Renewal and residence
 
@@ -20,7 +20,7 @@ The local ceiling does not shorten or remove the independent SQL pin. Already ad
 
 ## Adopted checkpoint and shutdown
 
-A bound Claim may adopt its authenticated retained input root through the shared session. register_inputs now accepts that matching adopted certificate in the bound phase and uses the existing single 4 KiB checkpoint/result slot, adding it to the 8 KiB command-copy reservation. Due renewal precedes queued registration. RegisterStagedInputs shares the exact slot with renewal; its original receipt is stored before fresh checkpoint-digest and bound-session queries. Fresh custody failure fences the job while the committed registration remains observable through pending_inputs. The original creating namespace and input root are reused; no nodes or native pairs are copied. A staged checkpoint already consumes that operation's single slot.
+A bound Claim may adopt its authenticated retained input root through the shared session. register_inputs now accepts that matching adopted certificate in the bound phase and uses the existing single 4 KiB checkpoint/result slot, adding it to the 28 KiB registered-custody command-wire reservation. Due renewal precedes queued registration. RegisterStagedInputs shares the exact slot with renewal; its original receipt is stored before fresh checkpoint-digest and bound-session queries. Fresh custody failure fences the job while the committed registration remains observable through pending_inputs. The original creating namespace and input root are reused; no nodes or native pairs are copied. A staged checkpoint already consumes that operation's single slot.
 
 stop/close refuse new staged or bound workers, keep renewing while accepted tasks and retained results drain, and retain uncertain exact evidence/credits. Service consumers must retrieve completed results to finish graceful drain. Once drained, the shared bound session is fenced before operation admission is returned. Reached residence, worker error/panic or lost custody aborts and joins outstanding callbacks and discards untransferred results before credit release. SQL pins and remote artifacts remain independently retained.
 
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index f7c6eaaa..9333457c 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -62,6 +62,18 @@ Uncertain stops new producer admission. Existing work can continue only through
 
 This service map is process-local. Registered custody intents preserve original command knowledge across process loss, but they do not reconstruct local worker ownership, a fresh current-owner lease or an authenticated physical input inventory. Owner takeover must resolve exact/logical outcomes and reconstruct or adopt retained physical inputs under the new admitted namespace through the [authenticated input checkpoint protocol](native-input-checkpoint.md). ReadyStaging::claim now retains/resolves the exact Claim command and supplies a fresh staging context. Staging checkpoint supervision now exists; exact checkpoint supervision after bound Claim now uses the publication dispatcher. Production producer wiring, durable takeover reconstruction and complete wire-plan/response recovery remain required. Final publication now uses the existing fair coordinator through an observation-only lifecycle ticket; accepted final intent continues through close, while a pre-activation fence discards only proven unexecuted work. Neither local completion nor SQL reaping authorizes remote deletion.
 
+## Cold custody reconstruction
+
+`ReadyStaging::restore(client, target, operation)` authenticates and loads the latest registered original without preparing a new original or registrar identity. It supports all seven custody actions: staging and preparation Begin/Claim/Renew, plus Bind. The coordinator resolves the original phase and receipt before checking fresh lease and actual-owner authority. `StagingTicket::restored_evidence` and `restored_outcome` expose historical knowledge, including denials, after local fencing or shutdown; they do not authorize work. Changed restart lease profiles cannot rewrite or hide the original command's duration or result.
+
+Known staging grants acquire fresh staging custody. Known preparation grants use the same fresh bound-session opener as warm Bind/Claim. Recorded clocks never establish a local deadline. Authenticated frozen commands execute only after authoritative SDK absence; the existing receiver atomically enforces current authorization, token and actual ownership. Old-owner Renew/Bind can settle their original stale denial under the new owner without granting custody. Unknown/expired resolution, unavailable queries and lost replies preserve exact evidence and admission for explicit recovery, including on a closed coordinator. Expired unresolved commands cannot become synthetic denials or fresh retries.
+
+The shared preparation fence now retains a terminal watch value. A bound worker observes that signal independently of coordinator status changes or renewal timers, aborts and joins its callback, and drops owned results/resources before releasing credit. Late subscribers observe the already-fired fence. Bound context checks and cancellation deadlines include the shared session's live lease and ceiling. This qualifies callback ownership; it does not establish OS containment for arbitrary detached subprocesses or I/O.
+
+The command-wire reservation remains 28 KiB, or 32 KiB with a checkpoint, and operation/actor/worker admission caps are unchanged. These bounds do not claim total resident heap or Control/advertisement I/O accounting. Cold restore does not resurrect old workers, authenticate a new physical inventory, reconstruct an unregistered registrar, or resolve an expired unresolved original. Bounded unresolved-head stop/scan, settled-history archival, retained-input adoption and production takeover wiring remain required.
+
+Seven regression families cover both object formats and all seven command kinds; actual durable owner restore after local SQLite removal; original positive/negative receipts; changed restart profiles; authoritative absence; lost replies/panics/private-query failure; closed-service recovery; expired unresolved originals; and resource drop before credit release when a shared session fences. Their native workers and histories are small fixtures, not a large-team capacity result.
+
 ## Evidence and remaining work
 
 Nine service tests cover canceled observers and single typed handoff; operation/account/global and actor worker admission; rejected ready-command reuse; automatic renewal without a waiter or manual tick; Begin/Renew/Bind absent, lost-acknowledgement and post-execution panic recovery with original bind receipts; close/drain retaining uncertainty; fresh renewal queries after revocation; producer error/panic fencing; completed-resource drop before credit release with a live observer; and native SHA-1/SHA-256 physical verification followed by late binding, the existing private catalog proof and durable attestation.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index e1151c82..7af53fd0 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -12,7 +12,9 @@ The local staging service now prepares both the exact custody original and its e
 
 Custody reservation is 28 KiB; an admitted staging checkpoint raises it to 32 KiB. Existing operation, worker, actor, class and global byte caps have not increased. Twenty-seven staging service tests pass, including original reply loss/expiry, renewal/revocation, actual owner Claim, registrar loss before submission/after acceptance/panic, canceled observers and closed-service recovery in both formats. At checkpoint `1a11162`, final-source macOS/Rust 1.98.0 checks passed: 286 publication cases in 214.01 seconds and nine real startup/workspace lifecycle cases in 5.17 seconds, totaling 295 unique focused Rust tests. All-target workspace Clippy passes with warnings denied, the server binary builds, formatting/diff checks pass, and 423 Rust source hashes plus 90 local documentation links and the unchanged protected checkout/SDK pins are verified. The proof is `/tmp/canopy-registered-services-validation.json`. These checks qualify this local service checkpoint, not the whole production cutover or team capacity.
 
-Cold session construction now carries mandatory `PreparationAuthority`, bound to the exact Cell target and backed in production by startup's validated Cell Control/live node advertisement. It checks actual incarnation/epoch before and after the lease query; staging probes, bound handoff, base catalog/frontier loading and standalone positive recovery share this source. An owner observation failure permanently fences existing shared sessions, while original known outcomes remain recoverable. New registered Claim can restore current-owner custody. The regression set includes prior-owner cold restore, genuine current-owner takeover and missing/corrupt Control records in both formats. Final-source macOS/Rust 1.98.0 qualification passes 289 publication cases in 176.00 seconds and nine real startup/workspace lifecycle cases in 3.61 seconds, totaling 298 unique focused Rust tests. All-target workspace Clippy with warnings denied, the server build, formatting/diff checks, 424 frozen Rust-source hashes, 134 local documentation links, the five manifest/six lockfile SDK pins and protected index/archive checks pass. Evidence is `/tmp/canopy-owner-validation.json`; the original failing regression is retained in `/tmp/canopy-cold-owner-red.log`. These checks do not establish the full hard cutover or large-team capacity. The next custody priorities are complete staging reconstruction, owner-loss worker drain qualification and bounded unresolved-head stop/scan plus settled-history archival. The full producer/reader/final-schema cutover, serving retention, typed collection/backup/restore, resource containment, maintenance/acceleration and full-history/team capacity gates remain open.
+Cold session construction now carries mandatory `PreparationAuthority`, bound to the exact Cell target and backed in production by startup's validated Cell Control/live node advertisement. It checks actual incarnation/epoch before and after the lease query; staging probes, bound handoff, base catalog/frontier loading and standalone positive recovery share this source. An owner observation failure permanently fences existing shared sessions, while original known outcomes remain recoverable. New registered Claim can restore current-owner custody. The regression set includes prior-owner cold restore, genuine current-owner takeover and missing/corrupt Control records in both formats. Final-source macOS/Rust 1.98.0 qualification passes 289 publication cases in 176.00 seconds and nine real startup/workspace lifecycle cases in 3.61 seconds, totaling 298 unique focused Rust tests. All-target workspace Clippy with warnings denied, the server build, formatting/diff checks, 424 frozen Rust-source hashes, 134 local documentation links, the five manifest/six lockfile SDK pins and protected index/archive checks pass. Evidence is `/tmp/canopy-owner-validation.json`; the original failing regression is retained in `/tmp/canopy-cold-owner-red.log`. These checks do not establish the full hard cutover or large-team capacity. The following cold-staging increment reconstructs registered custody heads and qualifies shared-fence callback drain. The next custody priorities are bounded unresolved-head stop/scan, settled-history archival and production takeover/input adoption. The full producer/reader/final-schema cutover, serving retention, typed collection/backup/restore, resource containment, maintenance/acceleration and full-history/team capacity gates remain open.
+
+Cold staging now reconstructs the latest authentic registered custody head through `ReadyStaging::restore` for every staging/preparation Begin/Claim/Renew and Bind. Original evidence and positive/negative receipts remain observable before fresh owner/lease probes and after fencing or shutdown. Native work requires fresh custody; old clocks cannot open sessions. Absent old-token Renew/Bind settle their exact original stale denial under a new owner; expired unresolved originals remain uncertain and charged instead of being replaced. The shared session now signals its permanent fence to in-flight bound callbacks and late subscribers. Cancellation joins callbacks and drops resources before returning their existing worker credits. Seven SHA-1/SHA-256 regression families pass in the focused run (17.88 seconds); the real owner-loss worker test failed before the signal was added (`/tmp/canopy-cold-staging-worker-red-fixed.log`). Final-source macOS/Rust 1.98.0 qualification passes 296 publication tests in 181.99 seconds plus nine real startup/workspace lifecycle tests in 3.16 seconds: 305 unique focused Rust tests. Workspace/all-target Clippy with warnings denied, the server build, formatting/diff checks, 426 frozen Rust-source hashes, 134 local documentation links, the five manifest/six lockfile SDK pins and unchanged protected index/archive checks pass. Evidence is `/tmp/canopy-cold-staging-validation.json`. These results qualify the local recovery/callback checkpoint, not the full cutover or large-team capacity. The 28 KiB custody/32 KiB checkpoint command-wire reservations and existing operation/actor/worker caps are unchanged; whole-process resident use and native OS containment are not qualified. This checkpoint does not reconstruct input inventories or production producers/readers. Bounded unresolved-head stop/scan and settled-history archival remain the immediate custody priorities.
 
 The proposed [directory file attribution](design/file-attribution.md) uses commit-pinned asynchronous page batches and bounded history caching, with an optional shared immutable index. Its native experiment passes 101 path comparisons across 17 commit states. Its production endpoint, UI, cache/index and load qualification remain unimplemented.
 

From 29e785d0c64beaf8727cacb7b5b7301e194ad36b Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 02:51:16 -0700
Subject: [PATCH 11/55] Retire expired custody originals through bounded fair
 maintenance

Preserve exact original execution uncertainty in a separate authenticated stop fact. Reuse dispatcher admission for bounded keyset discovery and exact retirement recovery, and allow a stop beside its own pending preparation so its shared session can fence and drain.

All 307 publication and nine real lifecycle tests pass, with workspace all-target Clippy, build, format and frozen-source/static checks. Full library qualification passes 585 of 590 cases; five legacy consumers still query the already-removed objects table. Production lifecycle wiring, reader/producer cutover and capacity qualification remain open. This is an unpublished implementation checkpoint, not a release.
---
 .../src/packs/publication/coordinator.rs      |  86 +-
 .../publication/coordinator/preparation.rs    |  23 +-
 .../src/packs/publication/coordinator/work.rs |  50 +-
 .../src/packs/publication/custody/commands.rs |   8 +-
 .../src/packs/publication/custody/dispatch.rs |   3 +
 .../src/packs/publication/custody/mod.rs      |  53 +-
 .../src/packs/publication/custody/scan.rs     | 195 +++++
 .../src/packs/publication/custody/stop.rs     | 449 +++++++++++
 .../src/packs/publication/mod.rs              |   7 +-
 .../src/packs/publication/owner.rs            |  14 +-
 .../packs/publication/recovery/supervisor.rs  |   2 +-
 .../src/packs/publication/registry.rs         |   8 +-
 .../src/packs/publication/schema.sql          |   9 +-
 .../src/packs/publication/tests.rs            |   1 +
 .../src/packs/publication/tests/custody.rs    |   2 +-
 .../packs/publication/tests/custody_stop.rs   | 753 ++++++++++++++++++
 .../publication/tests/staging_service.rs      |   2 +-
 .../tests/staging_service/restore.rs          |   2 +-
 .../design/durable-custody-command-intents.md |  22 +-
 docs/design/staging-service-lifecycle.md      |   2 +-
 .../large-repository-implementation-status.md |   8 +-
 21 files changed, 1636 insertions(+), 63 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/custody/scan.rs
 create mode 100644 crates/canopy-server/src/packs/publication/custody/stop.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/custody_stop.rs

diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index bb2bc2de..4f19787f 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -237,6 +237,7 @@ struct ReadContext {
 }
 struct Job {
     operation: [u8; 16],
+    custody_stop: bool,
     actor: String,
     // Removed before terminal notification; tickets never retain command
     // payloads or local inventory after the admission charge is released.
@@ -328,7 +329,7 @@ impl<T> ClassQueue<T> {
 }
 #[derive(Default)]
 struct State {
-    jobs: HashMap<[u8; 16], Arc<Job>>,
+    jobs: HashMap<([u8; 16], bool), Arc<Job>>,
     actors: HashMap<String, [usize; 2]>,
     queue: ClassQueue<Work>,
     counts: [usize; 2],
@@ -381,6 +382,9 @@ pub struct PublicationStats {
     pub maintenance: usize,
 }
 impl PublicationCoordinator {
+    pub(in crate::packs::publication) fn target(&self) -> &CellTarget {
+        &self.inner.target
+    }
     pub fn new(
         target: CellTarget,
         limits: PublicationLimits,
@@ -438,7 +442,8 @@ impl PublicationCoordinator {
         let class = ready.class();
         let reservation = ready.reservation();
         let at = class.index();
-        let (client, target, check) = ready.capability();
+        let (client, target, request) = ready.context();
+        let custody_stop = ready.is_custody_stop();
         let limits = self.inner.limits;
         let (operation_limit, byte_limit) = match class {
             PublicationClass::Foreground => (
@@ -455,12 +460,12 @@ impl PublicationCoordinator {
             Some(PublicationScheduleError::Foreign)
         } else if state.closed {
             Some(PublicationScheduleError::Closed)
-        } else if state.jobs.contains_key(&check.token.operation) {
+        } else if state.jobs.contains_key(&(request.operation, custody_stop)) {
             Some(PublicationScheduleError::Duplicate)
         } else if state.counts[at] >= operation_limit
             || state
                 .actors
-                .get(&check.actor)
+                .get(&request.actor)
                 .map_or(0, |counts| counts[at])
                 >= limits.per_actor
             || state.bytes[at] > byte_limit - reservation
@@ -475,17 +480,12 @@ impl PublicationCoordinator {
         let read = ReadContext {
             client: client.clone(),
             target: target.clone(),
-            request: BeginRequest {
-                repository: check.token.repository,
-                operation: check.token.operation,
-                request_digest: check.token.request_digest,
-                actor: check.actor.clone(),
-                lease_ms: DEFAULT_LEASE_MS,
-            },
+            request: request.clone(),
         };
         let job = Arc::new(Job {
-            operation: check.token.operation,
-            actor: check.actor.clone(),
+            operation: request.operation,
+            custody_stop,
+            actor: request.actor.clone(),
             class,
             reservation,
             policy_page: ready.is_policy_page(),
@@ -503,7 +503,9 @@ impl PublicationCoordinator {
         state.actors.entry(job.actor.clone()).or_default()[at] += 1;
         state.counts[at] += 1;
         state.bytes[at] += job.reservation;
-        state.jobs.insert(job.operation, Arc::clone(&job));
+        state
+            .jobs
+            .insert((job.operation, job.custody_stop), Arc::clone(&job));
         if !held {
             enqueue(state, &job, false);
             self.start(state);
@@ -527,7 +529,7 @@ impl PublicationCoordinator {
         let mut state = self.inner.state.lock().await;
         if !state
             .jobs
-            .get(&ticket.job.operation)
+            .get(&(ticket.job.operation, ticket.job.custody_stop))
             .is_some_and(|job| Arc::ptr_eq(job, &ticket.job))
             || !matches!(*ticket.job.status.borrow(), PublicationState::Uncertain(_))
         {
@@ -551,6 +553,14 @@ impl PublicationCoordinator {
     pub(in crate::packs::publication) async fn recover_terminal_releases(
         &self,
     ) -> Result<u64, PublicationScheduleError> {
+        self.recover_retirements(false).await
+    }
+    pub(in crate::packs::publication) async fn recover_custody_stops(
+        &self,
+    ) -> Result<u64, PublicationScheduleError> {
+        self.recover_retirements(true).await
+    }
+    async fn recover_retirements(&self, custody: bool) -> Result<u64, PublicationScheduleError> {
         let jobs: Vec<_> = {
             let state = self.inner.state.lock().await;
             state
@@ -567,10 +577,13 @@ impl PublicationCoordinator {
         // retain a command-body copy, replace an identity or retry compaction.
         let mut recovered = 0;
         for job in jobs {
-            let release = matches!(
-                &*job.ready.lock().await,
-                Some(ReadyPublication::TerminalRelease(_))
-            );
+            let ready = job.ready.lock().await;
+            let release = if custody {
+                matches!(&*ready, Some(ReadyPublication::CustodyStop(_)))
+            } else {
+                matches!(&*ready, Some(ReadyPublication::TerminalRelease(_)))
+            };
+            drop(ready);
             if !release {
                 continue;
             }
@@ -616,12 +629,23 @@ impl PublicationCoordinator {
     /// Service-internal lookup after its caller loses a ticket. This is not an
     /// externally authorized product query; use completed-request replay there.
     pub async fn pending(&self, operation: [u8; 16]) -> Option<PublicationTicket> {
+        self.pending_kind(operation, false).await
+    }
+    /// Retirement has a separate bounded key kind, never a fabricated operation.
+    pub async fn pending_custody_stop(&self, operation: [u8; 16]) -> Option<PublicationTicket> {
+        self.pending_kind(operation, true).await
+    }
+    async fn pending_kind(
+        &self,
+        operation: [u8; 16],
+        custody_stop: bool,
+    ) -> Option<PublicationTicket> {
         self.inner
             .state
             .lock()
             .await
             .jobs
-            .get(&operation)
+            .get(&(operation, custody_stop))
             .map(|job| PublicationTicket {
                 inner: Arc::clone(&self.inner),
                 job: Arc::clone(job),
@@ -852,7 +876,7 @@ fn enqueue(state: &mut State, job: &Arc<Job>, recover: bool) {
     );
 }
 fn release(state: &mut State, job: &Job) {
-    state.jobs.remove(&job.operation);
+    state.jobs.remove(&(job.operation, job.custody_stop));
     let count = state
         .actors
         .get_mut(&job.actor)
@@ -988,6 +1012,26 @@ async fn finish(inner: &Inner, job: &Job, outcome: DispatchResult) {
         job.ready.lock().await.take();
         let mut state = inner.state.lock().await;
         release(&mut state, job);
+        // A retired original may itself occupy a foreground uncertainty slot.
+        // Resume only that exact preparation evidence, never unrelated work.
+        if let Ok(PublicationOutcome::CustodyStop(value)) = &outcome
+            && value.stop.is_some()
+            && let Some(original) = state.jobs.get(&(job.operation, false)).cloned()
+            && matches!(*original.status.borrow(), PublicationState::Uncertain(_))
+        {
+            let matches = original
+                .ready
+                .lock()
+                .await
+                .as_ref()
+                .and_then(ReadyPublication::preparation_original)
+                .is_some_and(|evidence| *evidence == value.original);
+            if matches {
+                original.status.send_replace(PublicationState::Queued);
+                enqueue(&mut state, &original, true);
+                inner.changed.notify_one();
+            }
+        }
         job.status
             .send_replace(PublicationState::Finished(outcome.map_err(Arc::new)));
     }
diff --git a/crates/canopy-server/src/packs/publication/coordinator/preparation.rs b/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
index f8e1141c..74454485 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/preparation.rs
@@ -147,12 +147,14 @@ impl ReadyPreparation {
     pub(super) fn capability(&self) -> (&CellClient, &CellTarget, &LeaseCheck) {
         (&self.inner.client, &self.inner.target, &self.inner.check)
     }
-    pub(super) fn pending(&self) -> PublicationError {
-        let evidence = match &self.inner.exact {
+    pub(super) fn evidence(&self) -> &cellule_runtime::PendingMutation {
+        match &self.inner.exact {
             ExactPreparation::Claim(command) => command.evidence(),
             ExactPreparation::Renew { command, .. } => command.evidence(),
-        };
-        PublicationError::Preparation(InvocationError::Pending(Box::new(evidence.clone())))
+        }
+    }
+    pub(super) fn pending(&self) -> PublicationError {
+        PublicationError::Preparation(InvocationError::Pending(Box::new(self.evidence().clone())))
     }
     pub(super) async fn dispatch(self, recover: bool, fault: u8) -> DispatchResult {
         let inner = *self.inner;
@@ -173,9 +175,16 @@ impl ReadyPreparation {
                 Ok(())
             })
             .await
-            .map_err(|source| PublicationError::Custody {
-                evidence: Box::new(command.evidence().clone()),
-                source: Box::new(source),
+            .map_err(|source| {
+                if matches!(&source, CustodyError::Stopped(_))
+                    && let Some(session) = &existing
+                {
+                    session.fence();
+                }
+                PublicationError::Custody {
+                    evidence: Box::new(command.evidence().clone()),
+                    source: Box::new(source),
+                }
             })?;
         let result = super::super::custody::project(result, |reply| match reply {
             CustodyReply::Preparation(reply) => Some(reply),
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index 904faa4a..4fffa660 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -71,11 +71,17 @@ pub enum ReadyPublication {
     Push(ReadyCatalogPush),
     RootRecovery(ReadyRootRecovery),
     TerminalRelease(Box<ReadyTerminalRelease>),
+    CustodyStop(Box<ReadyCustodyStop>),
     BoundRecovery(ReadyBoundRecovery),
     Compaction(ReadyCatalogCompaction),
     Inputs(ReadyNativeInputs),
     Preparation(ReadyPreparation),
 }
+impl From<ReadyCustodyStop> for ReadyPublication {
+    fn from(ready: ReadyCustodyStop) -> Self {
+        Self::CustodyStop(Box::new(ready))
+    }
+}
 impl From<ReadyTerminalRelease> for ReadyPublication {
     fn from(ready: ReadyTerminalRelease) -> Self {
         Self::TerminalRelease(Box::new(ready))
@@ -112,6 +118,15 @@ impl From<ReadyPreparation> for ReadyPublication {
     }
 }
 impl ReadyPublication {
+    pub(super) fn is_custody_stop(&self) -> bool {
+        matches!(self, Self::CustodyStop(_))
+    }
+    pub(super) fn preparation_original(&self) -> Option<&cellule_runtime::PendingMutation> {
+        match self {
+            Self::Preparation(ready) => Some(ready.evidence()),
+            _ => None,
+        }
+    }
     pub(in crate::packs::publication) fn is_policy_page(&self) -> bool {
         matches!(self, Self::BoundRecovery(ready) if ready.ready.is_policy_page())
     }
@@ -128,7 +143,8 @@ impl ReadyPublication {
             Self::Inputs(_)
             | Self::Preparation(_)
             | Self::RootRecovery(_)
-            | Self::TerminalRelease(_) => return false,
+            | Self::TerminalRelease(_)
+            | Self::CustodyStop(_) => return false,
         };
         source.target == session.target
             && source.check == session.check
@@ -150,6 +166,7 @@ impl ReadyPublication {
             Self::Preparation(ready) => Self::Preparation(ready.dispatch_copy()),
             Self::RootRecovery(ready) => Self::RootRecovery(ready.clone()),
             Self::TerminalRelease(ready) => Self::TerminalRelease(ready.clone()),
+            Self::CustodyStop(ready) => Self::CustodyStop(ready.clone()),
             Self::BoundRecovery(ready) => Self::BoundRecovery(ready.clone()),
             Self::Push(ready) => Self::Push(ReadyCatalogPush {
                 owner: ready.owner.clone(),
@@ -173,11 +190,14 @@ impl ReadyPublication {
             | Self::BoundRecovery(_)
             | Self::Inputs(_)
             | Self::Preparation(_) => PublicationClass::Foreground,
-            Self::Compaction(_) | Self::TerminalRelease(_) => PublicationClass::Maintenance,
+            Self::Compaction(_) | Self::TerminalRelease(_) | Self::CustodyStop(_) => {
+                PublicationClass::Maintenance
+            }
         }
     }
-    pub(super) fn capability(&self) -> (&CellClient, &CellTarget, &LeaseCheck) {
-        match self {
+    pub(super) fn context(&self) -> (&CellClient, &CellTarget, BeginRequest) {
+        let (client, target, check) = match self {
+            Self::CustodyStop(ready) => return ready.context(),
             Self::Push(ready) => ready.owner.capability(),
             Self::RootRecovery(ready) => ready.capability(),
             Self::TerminalRelease(ready) => ready.capability(),
@@ -185,13 +205,25 @@ impl ReadyPublication {
             Self::Inputs(ready) => ready.session.capability(),
             Self::Preparation(ready) => ready.capability(),
             Self::Compaction(ready) => ready.prepared.preparation_base().capability(),
-        }
+        };
+        (
+            client,
+            target,
+            BeginRequest {
+                repository: check.token.repository,
+                operation: check.token.operation,
+                request_digest: check.token.request_digest,
+                actor: check.actor.clone(),
+                lease_ms: DEFAULT_LEASE_MS,
+            },
+        )
     }
     pub(super) fn pending(&self) -> PublicationError {
         match self {
             Self::Preparation(ready) => ready.pending(),
             Self::RootRecovery(ready) => ready.pending(),
             Self::TerminalRelease(ready) => ready.pending(),
+            Self::CustodyStop(ready) => ready.pending(),
             Self::BoundRecovery(ready) => ready.ready.pending(),
             Self::Push(ready) => PublicationError::Push(InvocationError::Pending(Box::new(
                 ready.command.evidence().clone(),
@@ -205,12 +237,13 @@ impl ReadyPublication {
         }
     }
     pub(super) async fn dispatch(self, recover: bool, fault: u8) -> DispatchResult {
-        let client = self.capability().0.clone();
+        let client = self.context().0.clone();
         match self {
             Self::Inputs(ready) => ready.dispatch(recover, fault).await,
             Self::Preparation(ready) => ready.dispatch(recover, fault).await,
             Self::RootRecovery(ready) => ready.dispatch(fault).await,
             Self::TerminalRelease(ready) => ready.dispatch(recover, fault).await,
+            Self::CustodyStop(ready) => ready.dispatch(recover, fault).await,
             Self::BoundRecovery(ready) => ready.dispatch(fault).await,
             Self::Push(ready) => super::super::exact::invoke_guarded(
                 &client,
@@ -262,6 +295,7 @@ pub enum PublicationOutcome {
     Compaction(Committed<CompactionReply>),
     Inputs(RegisteredNativeInputs),
     TerminalRelease(Committed<TerminalReleaseReply>),
+    CustodyStop(Box<CustodyStopOutcome>),
     Preparation(PreparationCommandOutcome),
 }
 #[derive(Debug, thiserror::Error)]
@@ -273,6 +307,8 @@ pub enum PublicationError {
     },
     #[error("repository initialization publication: {0}")]
     Initialization(#[source] InvocationError<InitializationReply>),
+    #[error("custody retirement: {0}")]
+    CustodyStop(#[source] InvocationError<CustodyStopReply>),
     #[error("terminal recovery release: {0}")]
     TerminalRelease(#[source] InvocationError<TerminalReleaseReply>),
     #[error("durable publication phase could not be observed: {source}")]
@@ -316,6 +352,7 @@ impl PublicationError {
             Self::Inputs(error) => kind(error),
             Self::Compaction(error) => kind(error),
             Self::TerminalRelease(error) => kind(error),
+            Self::CustodyStop(error) => kind(error),
         }
     }
     pub(super) fn uncertain(&self) -> bool {
@@ -336,6 +373,7 @@ impl PublicationError {
             Self::Inputs(error) => unknown(error),
             Self::Compaction(error) => unknown(error),
             Self::TerminalRelease(error) => unknown(error),
+            Self::CustodyStop(error) => unknown(error),
         }
     }
 }
diff --git a/crates/canopy-server/src/packs/publication/custody/commands.rs b/crates/canopy-server/src/packs/publication/custody/commands.rs
index f14b164d..62687fc7 100644
--- a/crates/canopy-server/src/packs/publication/custody/commands.rs
+++ b/crates/canopy-server/src/packs/publication/custody/commands.rs
@@ -30,7 +30,7 @@ impl Command for RegisterCustodyIntent {
             }
             let old = previous.intent.header()?;
             if old.step >= header.step
-                || previous.phase.is_none()
+                || !previous.closed()
                 || old.step.checked_add(1) != Some(header.step)
                 || header.previous != Some(*blake3::hash(&previous.intent.encoded()?).as_bytes())
                 || old.actor != header.actor
@@ -59,7 +59,7 @@ impl Command for RegisterCustodyIntent {
             return deny(PreparationDenial::Unauthorized);
         }
         let pending = context.sql(&statement(
-            "SELECT count(*) FROM (SELECT operation FROM catalog_custody_commands WHERE phase IS NULL LIMIT ?1)",
+            "SELECT count(*) FROM (SELECT operation FROM catalog_custody_commands WHERE phase IS NULL AND stopped IS NULL LIMIT ?1)",
             vec![number(MAX_OPERATIONS)?],
         ))?;
         let Some([SqlValue::Integer(pending)]) = rows(&pending)?.first().map(Vec::as_slice) else {
@@ -106,7 +106,7 @@ impl Command for ExecuteCustody {
         if header.stamp != Stamp::of(&evidence)
             || header.incarnation != evidence.incarnation()
             || saved.intent.request()? != request
-            || saved.phase.is_some()
+            || saved.closed()
         {
             return Err(Error::Command(
                 "custody command differs from its original intent",
@@ -142,7 +142,7 @@ impl Command for ExecuteCustody {
             .transpose()?
             .unwrap_or(SqlValue::Null);
         super::super::publish::changed(context.sql(&statement(
-            "UPDATE catalog_custody_commands SET phase=?1,granted_incarnation=?5,granted_attempt=?6 WHERE operation=?2 AND step=?3 AND intent=?4 AND phase IS NULL",
+            "UPDATE catalog_custody_commands SET phase=?1,granted_incarnation=?5,granted_attempt=?6 WHERE operation=?2 AND step=?3 AND intent=?4 AND phase IS NULL AND stopped IS NULL",
             vec![SqlValue::Blob(encode(&phase, 1024)?),blob(operation),number(u64::from(request.step))?,SqlValue::Blob(saved.intent.encoded()?),grant_incarnation,grant_attempt],
         ))?)?;
         // Trusted denials commit the original phase alongside SDK acceptance;
diff --git a/crates/canopy-server/src/packs/publication/custody/dispatch.rs b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
index 98cc05ba..2c6fd95c 100644
--- a/crates/canopy-server/src/packs/publication/custody/dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
@@ -70,6 +70,9 @@ impl OwnedCustody {
         let target = self.evidence().target();
         if let Some(saved) = load(client, target, header.operation, Some(header.step)).await? {
             return if saved.intent == self.prepared.intent {
+                if let Some(fact) = saved.stop_fact() {
+                    return Err(CustodyError::Stopped(Box::new(fact)));
+                }
                 Ok(saved)
             } else {
                 Err(CustodyError::Context)
diff --git a/crates/canopy-server/src/packs/publication/custody/mod.rs b/crates/canopy-server/src/packs/publication/custody/mod.rs
index cf19af9c..b920a53f 100644
--- a/crates/canopy-server/src/packs/publication/custody/mod.rs
+++ b/crates/canopy-server/src/packs/publication/custody/mod.rs
@@ -13,8 +13,15 @@ use cellule_runtime::{
 mod codec;
 mod commands;
 mod dispatch;
+mod scan;
+mod stop;
 pub use commands::{ExecuteCustody, RegisterCustodyIntent};
 pub(super) use dispatch::{OwnedCustody, RESERVATION};
+pub use scan::{CustodyScanStats, CustodySupervisor};
+pub use stop::{
+    CustodyStopFact, CustodyStopInput, CustodyStopOutcome, CustodyStopReply, ReadyCustodyStop,
+    StopCustodyIntent,
+};
 
 const INPUT_BYTES: u32 = 1024;
 const INTENT_BYTES: u32 = 4096;
@@ -160,6 +167,14 @@ pub enum CustodyError {
     Unsettled(Box<PendingMutation>),
     #[error("custody command head differs")]
     Context,
+    #[error("custody original was retired without an execution result")]
+    Stopped(Box<CustodyStopFact>),
+    #[error("custody owner observation failed")]
+    Owner(#[source] Box<PreparationBaseError>),
+    #[error("custody stop preparation failed")]
+    StopPreparation(#[source] Box<InvocationError<CustodyStopReply>>),
+    #[error("invalid custody scan limits")]
+    InvalidScanLimits,
 }
 
 impl CustodyError {
@@ -173,7 +188,11 @@ impl CustodyError {
                 &**error,
                 InvocationError::Pending(_) | InvocationError::InvalidPublishedResult { .. }
             ),
-            Self::Clock(_) => false,
+            Self::Clock(_)
+            | Self::Stopped(_)
+            | Self::Owner(_)
+            | Self::InvalidScanLimits
+            | Self::StopPreparation(_) => false,
             // Failure to authenticate or observe metadata is never proof of
             // absence. Keep the owned original until its disposition is known.
             Self::Query(_)
@@ -196,6 +215,7 @@ pub struct PreparedCustody {
 pub struct RegisteredCustody {
     intent: CustodyIntent,
     phase: Option<Recorded>,
+    stopped: Option<stop::StopRecord>,
 }
 
 fn encode(value: &impl WireValue, limit: u32) -> Result<Vec<u8>, CodecError> {
@@ -228,11 +248,11 @@ fn seed_statement() -> SqlStatement {
 fn row_statement(operation: [u8; 16], step: Option<u32>) -> SqlStatement {
     match step {
         Some(step) => SqlStatement {
-            sql: "SELECT step,incarnation,request_id,intent,phase FROM catalog_custody_commands WHERE operation=?1 AND step=?2".into(),
+            sql: "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands WHERE operation=?1 AND step=?2".into(),
             parameters: vec![blob(operation), SqlValue::Integer(i64::from(step))],
         },
         None => SqlStatement {
-            sql: "SELECT step,incarnation,request_id,intent,phase FROM catalog_custody_commands WHERE operation=?1 ORDER BY step DESC LIMIT 1".into(),
+            sql: "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands WHERE operation=?1 ORDER BY step DESC LIMIT 1".into(),
             parameters: vec![blob(operation)],
         },
     }
@@ -251,6 +271,7 @@ fn from_sets(
         request_id,
         SqlValue::Blob(bytes),
         phase,
+        stopped,
     ] = row.as_slice()
     else {
         return Err(Error::Command("invalid custody command row"));
@@ -274,7 +295,15 @@ fn from_sets(
     if let Some(phase) = &phase {
         codec::validate_phase(phase, &intent.request()?)?;
     }
-    Ok(Some(RegisteredCustody { intent, phase }))
+    let stopped = stop::record(stopped, &intent, &seed)?;
+    if phase.is_some() && stopped.is_some() {
+        return Err(Error::Command("custody execution and retirement coexist"));
+    }
+    Ok(Some(RegisteredCustody {
+        intent,
+        phase,
+        stopped,
+    }))
 }
 async fn load(
     client: &CellClient,
@@ -314,7 +343,7 @@ impl PreparedCustody {
             {
                 return Err(CustodyError::Context);
             }
-            if head.phase.is_none() {
+            if !head.closed() {
                 return Err(CustodyError::Unsettled(Box::new(head.evidence().clone())));
             }
             (
@@ -436,6 +465,15 @@ impl RegisteredCustody {
     pub fn settled(&self) -> bool {
         self.phase.is_some()
     }
+    /// Logical closure is separate from an original execution result.
+    pub fn closed(&self) -> bool {
+        self.phase.is_some() || self.stopped.is_some()
+    }
+    pub fn stop_fact(&self) -> Option<CustodyStopFact> {
+        self.stopped
+            .as_ref()
+            .map(|record| record.fact(self.evidence().target()))
+    }
     pub async fn recover_preparation(
         &self,
         client: &CellClient,
@@ -480,6 +518,9 @@ impl RegisteredCustody {
             if current.intent != self.intent {
                 return Err(Error::Command("custody recovery binding differs"));
             }
+            if current.stopped.is_some() {
+                return Err(Error::Command("custody original retired without execution"));
+            }
             if let Some(phase) = current.phase {
                 return Ok(Some(phase.committed(evidence)?));
             }
@@ -555,7 +596,7 @@ pub(super) fn restart_matches(
     staging: bool,
 ) -> cellule_runtime::Result<bool> {
     let sets = context.sql(&SqlBatch { statements: vec![SqlStatement {
-        sql: "SELECT step,incarnation,request_id,intent,phase FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE operation=?1 AND granted_incarnation=?2 AND granted_attempt=?3 ORDER BY step DESC LIMIT 1".into(),
+        sql: "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE operation=?1 AND granted_incarnation=?2 AND granted_attempt=?3 ORDER BY step DESC LIMIT 1".into(),
         parameters: vec![blob(check.token.operation), blob(check.token.owner.incarnation.as_bytes()), number(check.token.attempt)?],
     }, seed_statement()] })?;
     let Some(saved) = from_sets(&sets, context.target(), check.token.operation)? else {
diff --git a/crates/canopy-server/src/packs/publication/custody/scan.rs b/crates/canopy-server/src/packs/publication/custody/scan.rs
new file mode 100644
index 00000000..5b2044b8
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/custody/scan.rs
@@ -0,0 +1,195 @@
+//! Bounded keyset discovery; existing maintenance admission owns exact stops.
+use super::*;
+use std::sync::Arc;
+use tokio::{sync::watch, task::JoinHandle};
+
+const SEEK: &str = "SELECT operation FROM catalog_custody_commands INDEXED BY catalog_custody_pending WHERE phase IS NULL AND stopped IS NULL AND operation>?1 ORDER BY operation LIMIT ?2";
+#[derive(Clone, Debug, Default)]
+pub struct CustodyScanStats {
+    pub passes: u64,
+    pub scanned: u64,
+    pub submitted: u64,
+    pub recovered: u64,
+    pub deferred: u64,
+    pub failures: u64,
+    pub last_error: Option<Arc<CustodyError>>,
+}
+impl CustodyScanStats {
+    fn failed(&mut self, error: CustodyError) {
+        self.failures = self.failures.saturating_add(1);
+        self.last_error = Some(Arc::new(error));
+    }
+}
+#[must_use]
+pub struct CustodySupervisor {
+    stop: watch::Sender<bool>,
+    stats: watch::Receiver<CustodyScanStats>,
+    task: Option<JoinHandle<CustodyScanStats>>,
+}
+impl CustodySupervisor {
+    pub fn start(
+        client: CellClient,
+        target: CellTarget,
+        coordinator: PublicationCoordinator,
+        limits: RecoveryScanLimits,
+        authority: PreparationAuthority,
+    ) -> Result<Self, CustodyError> {
+        if limits.validate().is_err() {
+            return Err(CustodyError::InvalidScanLimits);
+        }
+        if !authority.matches(&target) || coordinator.target() != &target {
+            return Err(CustodyError::Context);
+        }
+        let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
+        let (stop, stopping) = watch::channel(false);
+        let (updates, stats) = watch::channel(CustodyScanStats::default());
+        let scan = Scan {
+            client,
+            target,
+            coordinator,
+            authority,
+        };
+        let task = tokio::spawn(run(scan, sql, limits, stopping, updates));
+        Ok(Self {
+            stop,
+            stats,
+            task: Some(task),
+        })
+    }
+    pub fn stats(&self) -> CustodyScanStats {
+        self.stats.borrow().clone()
+    }
+    pub async fn shutdown(mut self) -> Result<CustodyScanStats, tokio::task::JoinError> {
+        self.stop.send_replace(true);
+        self.task.take().expect("custody scan owner").await
+    }
+}
+impl Drop for CustodySupervisor {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+    }
+}
+struct Scan {
+    client: CellClient,
+    target: CellTarget,
+    coordinator: PublicationCoordinator,
+    authority: PreparationAuthority,
+}
+impl Scan {
+    async fn visit(
+        &self,
+        operation: [u8; 16],
+        stats: &mut CustodyScanStats,
+    ) -> Result<(), CustodyError> {
+        // The coordinator owns accepted uncertainty even if its SQL key vanished.
+        // Do not create a second retirement identity for an admitted operation.
+        if self
+            .coordinator
+            .pending_custody_stop(operation)
+            .await
+            .is_some()
+        {
+            stats.deferred = stats.deferred.saturating_add(1);
+            return Ok(());
+        }
+        let Some(saved) = load(&self.client, &self.target, operation, None).await? else {
+            return Ok(());
+        };
+        if saved.closed() || saved.evidence().identity().expires_at_ms > now(0)? {
+            stats.deferred = stats.deferred.saturating_add(1);
+            return Ok(());
+        }
+        let identity = crate::server::mutation_identity()
+            .map_err(|source| CustodyError::Clock(Box::new(source)))?;
+        let ready = saved
+            .ready_stop(self.client.clone(), identity, &self.authority)
+            .await?;
+        match self.coordinator.submit(ready).await {
+            Ok(_) => stats.submitted = stats.submitted.saturating_add(1),
+            Err(failure) => match failure.reason {
+                PublicationScheduleError::Capacity
+                | PublicationScheduleError::Duplicate
+                | PublicationScheduleError::Closed => {
+                    stats.deferred = stats.deferred.saturating_add(1);
+                }
+                _ => return Err(CustodyError::Context),
+            },
+        }
+        Ok(())
+    }
+}
+async fn page(
+    sql: &SqlCell<RepositoryModule>,
+    after: [u8; 16],
+    count: u16,
+) -> Result<Vec<[u8; 16]>, CustodyError> {
+    let result = sql
+        .query(
+            None,
+            statement(SEEK, vec![blob(after), number(u64::from(count))?]),
+        )
+        .await
+        .map_err(|error| CustodyError::Query(Box::new(error)))?;
+    let rows = rows(&result.output)?;
+    if rows.len() > count as usize {
+        return Err(CustodyError::Context);
+    }
+    let mut keys = Vec::with_capacity(rows.len());
+    let mut previous = after;
+    for row in rows {
+        let [key] = row.as_slice() else {
+            return Err(CustodyError::Context);
+        };
+        let key = fixed::<16>(key)?;
+        if key <= previous {
+            return Err(CustodyError::Context);
+        }
+        keys.push(key);
+        previous = key;
+    }
+    Ok(keys)
+}
+async fn run(
+    scan: Scan,
+    sql: SqlCell<RepositoryModule>,
+    limits: RecoveryScanLimits,
+    mut stopping: watch::Receiver<bool>,
+    updates: watch::Sender<CustodyScanStats>,
+) -> CustodyScanStats {
+    let mut stats = CustodyScanStats::default();
+    let mut after = [0; 16];
+    loop {
+        if *stopping.borrow() {
+            return stats;
+        }
+        match scan.coordinator.recover_custody_stops().await {
+            Ok(recovered) => stats.recovered = stats.recovered.saturating_add(recovered),
+            Err(_) => stats.failed(CustodyError::Context),
+        }
+        match page(&sql, after, limits.page).await {
+            Ok(keys) => {
+                if keys.is_empty() {
+                    after = [0; 16];
+                    stats.passes = stats.passes.saturating_add(1);
+                }
+                for key in keys {
+                    if *stopping.borrow() {
+                        break;
+                    }
+                    stats.scanned = stats.scanned.saturating_add(1);
+                    if let Err(error) = scan.visit(key, &mut stats).await {
+                        stats.failed(error);
+                    }
+                    // Advance even for corrupt heads; revisit on the next pass.
+                    after = key;
+                }
+            }
+            Err(error) => stats.failed(error),
+        }
+        updates.send_replace(stats.clone());
+        tokio::select! {
+            _ = tokio::time::sleep(limits.interval) => {},
+            changed = stopping.changed() => { if changed.is_err() || *stopping.borrow() { return stats; } }
+        }
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/custody/stop.rs b/crates/canopy-server/src/packs/publication/custody/stop.rs
new file mode 100644
index 00000000..9ab06360
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/custody/stop.rs
@@ -0,0 +1,449 @@
+//! Retire an expired original without inventing its execution result or receipt.
+use super::*;
+use cellule_runtime::{PreparedCommand, Receipt};
+
+const DOMAIN: &[u8] = b"canopy.custody-retirement.v1\0";
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct StopData {
+    tenant: [u8; 16],
+    application: [u8; 16],
+    operation: [u8; 16],
+    step: u32,
+    intent_digest: [u8; 32],
+    owner: OwnerFence,
+}
+impl WireValue for StopData {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.operation == [0; 16] || self.step > MAX_STEPS || self.owner.epoch == 0 {
+            return Err(CodecError::Invalid("custody retirement context"));
+        }
+        e.write_bytes(DOMAIN)?;
+        e.write_bytes(&self.tenant)?;
+        e.write_bytes(&self.application)?;
+        e.write_bytes(&self.operation)?;
+        e.write_u32(self.step)?;
+        e.write_bytes(&self.intent_digest)?;
+        e.write_bytes(self.owner.incarnation.as_bytes())?;
+        e.write_u64(self.owner.epoch)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != DOMAIN {
+            return Err(CodecError::Invalid("custody retirement purpose"));
+        }
+        let value = Self {
+            tenant: crate::packs::directory::index::codec::fixed(d)?,
+            application: crate::packs::directory::index::codec::fixed(d)?,
+            operation: crate::packs::directory::index::codec::fixed(d)?,
+            step: d.read_u32()?,
+            intent_digest: crate::packs::directory::index::codec::fixed(d)?,
+            owner: OwnerFence {
+                incarnation: IncarnationId::from_bytes(
+                    crate::packs::directory::index::codec::fixed(d)?,
+                ),
+                epoch: d.read_u64()?,
+            },
+        };
+        value.encode(&mut BoundedEncoder::new(512)?)?;
+        Ok(value)
+    }
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CustodyStopInput {
+    certificate: CertificateEnvelope,
+}
+impl WireValue for CustodyStopInput {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.certificate.data::<StopData>()?;
+        self.certificate.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            certificate: CertificateEnvelope::decode(d)?,
+        };
+        value.encode(&mut BoundedEncoder::new(1024)?)?;
+        Ok(value)
+    }
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CustodyStopReply {
+    Stopped,
+    Settled,
+    Denied(PreparationDenial),
+}
+impl WireValue for CustodyStopReply {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        match self {
+            Self::Stopped => e.write_u8(0),
+            Self::Settled => e.write_u8(1),
+            Self::Denied(reason) => {
+                e.write_u8(2)?;
+                PreparationReply::Denied(*reason).encode(e)
+            }
+        }
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        match d.read_u8()? {
+            0 => Ok(Self::Stopped),
+            1 => Ok(Self::Settled),
+            2 => match PreparationReply::decode(d)? {
+                PreparationReply::Denied(reason) => Ok(Self::Denied(reason)),
+                _ => Err(CodecError::Invalid("grant in custody retirement denial")),
+            },
+            _ => Err(CodecError::Invalid("custody retirement reply")),
+        }
+    }
+}
+/// Logical closure of an original, never that original's SDK outcome.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CustodyStopFact {
+    pub receipt: Receipt,
+    pub owner: OwnerFence,
+    pub stopped_at_ms: i64,
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct StopRecord {
+    data: StopData,
+    stamp: Stamp,
+    stopped_at_ms: i64,
+    result: Recorded,
+}
+impl WireValue for StopRecord {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.stopped_at_ms < 0
+            || self.result.rejected()
+            || self.result.decode_reply::<CustodyStopReply>()? != CustodyStopReply::Stopped
+        {
+            return Err(CodecError::Invalid("custody retirement result"));
+        }
+        self.data.encode(e)?;
+        self.stamp.encode(e)?;
+        e.write_i64(self.stopped_at_ms)?;
+        self.result.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            data: StopData::decode(d)?,
+            stamp: Stamp::decode(d)?,
+            stopped_at_ms: d.read_i64()?,
+            result: Recorded::decode(d)?,
+        };
+        value.encode(&mut BoundedEncoder::new(960)?)?;
+        Ok(value)
+    }
+}
+impl StopRecord {
+    pub(super) fn fact(&self, target: &CellTarget) -> CustodyStopFact {
+        CustodyStopFact {
+            receipt: Receipt {
+                cell: target.cell_id(),
+                incarnation: self.data.owner.incarnation,
+                commit_sequence: self.result.sequence(),
+            },
+            owner: self.data.owner,
+            stopped_at_ms: self.stopped_at_ms,
+        }
+    }
+}
+pub(super) fn record(
+    value: &SqlValue,
+    intent: &CustodyIntent,
+    seed: &[u8; 32],
+) -> cellule_runtime::Result<Option<StopRecord>> {
+    let bytes = match value {
+        SqlValue::Null => return Ok(None),
+        SqlValue::Blob(bytes) => bytes,
+        _ => return Err(Error::Command("custody retirement row")),
+    };
+    let certificate: CertificateEnvelope = decode(bytes, 1024)?;
+    if !certificate.authenticated(seed) {
+        return Err(Error::Command("custody retirement authentication"));
+    }
+    let value: StopRecord = certificate.data()?;
+    let header = intent.header()?;
+    if value.data.tenant != header.tenant
+        || value.data.application != header.application
+        || value.data.operation != header.operation
+        || value.data.step != header.step
+        || value.data.intent_digest != *blake3::hash(&intent.encoded()?).as_bytes()
+        || value.stopped_at_ms < intent.snapshot.evidence().identity().expires_at_ms
+    {
+        return Err(Error::Command("custody retirement binding"));
+    }
+    Ok(Some(value))
+}
+
+pub struct StopCustodyIntent;
+impl Command for StopCustodyIntent {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 43;
+    const CODEC_VERSION: u32 = 1;
+    type Input = CustodyStopInput;
+    type Output = CustodyStopReply;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        let deny = |reason| Ok(CommandResult::Rejected(CustodyStopReply::Denied(reason)));
+        let data: StopData = input.certificate.data()?;
+        let sets = context.sql(&SqlBatch {
+            statements: vec![
+                row_statement(data.operation, Some(data.step)),
+                seed_statement(),
+            ],
+        })?;
+        let seed = super::super::attestation::seed(&sets[1..])?;
+        if !input.certificate.authenticated(&seed)
+            || data.tenant != *context.target().tenant().as_bytes()
+            || data.application != *context.target().application().as_bytes()
+        {
+            return deny(PreparationDenial::Unauthorized);
+        }
+        let Some(saved) = from_sets(&sets, context.target(), data.operation)? else {
+            return deny(PreparationDenial::Missing);
+        };
+        if data.intent_digest != *blake3::hash(&saved.intent.encoded()?).as_bytes() {
+            return deny(PreparationDenial::Conflict);
+        }
+        // These are logical observations, not grants, and precede current owner
+        // checks. Neither an accepted original nor an existing stop is rewritten.
+        if saved.settled() {
+            return Ok(CommandResult::Success(CustodyStopReply::Settled));
+        }
+        if saved.stopped.is_some() {
+            return Ok(CommandResult::Success(CustodyStopReply::Stopped));
+        }
+        if data.owner != context.owner_fence() {
+            return deny(PreparationDenial::Stale);
+        }
+        let stopped_at_ms = now(context.now_ms())?;
+        if saved.evidence().identity().expires_at_ms > stopped_at_ms {
+            return deny(PreparationDenial::Conflict);
+        }
+        let evidence = context
+            .mutation_evidence()
+            .ok_or(Error::Command("custody retirement evidence absent"))?;
+        let result = Recorded::new(
+            context.sequence(),
+            false,
+            encode(&CustodyStopReply::Stopped, 128)?,
+        )?;
+        let record = StopRecord {
+            data,
+            stamp: Stamp::of(&evidence),
+            stopped_at_ms,
+            result,
+        };
+        let bytes = encode(&CertificateEnvelope::seal(&record, &seed)?, 1024)?;
+        super::super::publish::changed(context.sql(&statement(
+            "UPDATE catalog_custody_commands SET stopped=?1 WHERE operation=?2 AND step=?3 AND intent=?4 AND phase IS NULL AND stopped IS NULL",
+            vec![SqlValue::Blob(bytes),blob(record.data.operation), number(u64::from(record.data.step))?,SqlValue::Blob(saved.intent.encoded()?)],
+        ))?)?;
+        Ok(CommandResult::Success(CustodyStopReply::Stopped))
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct CustodyStopOutcome {
+    pub original: PendingMutation,
+    pub invocation: PendingMutation,
+    pub stop: Option<CustodyStopFact>,
+    /// None when a different first-writer stop proves logical closure. This
+    /// deliberately makes no execution claim about this invocation identity.
+    pub committed: Option<Committed<CustodyStopReply>>,
+}
+#[derive(Clone)]
+#[must_use]
+pub struct ReadyCustodyStop {
+    client: CellClient,
+    target: CellTarget,
+    request: BeginRequest,
+    step: u32,
+    intent_digest: [u8; 32],
+    original: PendingMutation,
+    command: PreparedCommand<StopCustodyIntent>,
+}
+impl RegisteredCustody {
+    pub async fn ready_stop(
+        &self,
+        client: CellClient,
+        identity: MutationIdentity,
+        authority: &PreparationAuthority,
+    ) -> Result<ReadyCustodyStop, CustodyError> {
+        let target = self.evidence().target().clone();
+        let header = self.intent.header()?;
+        let current = load(&client, &target, header.operation, Some(header.step))
+            .await?
+            .ok_or(CustodyError::Context)?;
+        if current.intent != self.intent {
+            return Err(CustodyError::Context);
+        }
+        if let Some(fact) = current.stop_fact() {
+            return Err(CustodyError::Stopped(Box::new(fact)));
+        }
+        if current.settled() {
+            return Err(CustodyError::Context);
+        }
+        let owner = authority
+            .observe(&target)
+            .await
+            .map_err(|error| CustodyError::Owner(Box::new(error)))?;
+        let seed = super::super::attestation::seed(
+            &SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?
+                .query(
+                    None,
+                    statement(
+                        "SELECT push_cert_seed FROM repository_identity WHERE singleton=1",
+                        vec![],
+                    ),
+                )
+                .await
+                .map_err(|error| CustodyError::Query(Box::new(error)))?
+                .output,
+        )?;
+        let intent_digest = *blake3::hash(&self.intent.encoded()?).as_bytes();
+        let data = StopData {
+            tenant: header.tenant,
+            application: header.application,
+            operation: header.operation,
+            step: header.step,
+            intent_digest,
+            owner,
+        };
+        let input = CustodyStopInput {
+            certificate: CertificateEnvelope::seal(&data, &seed)?,
+        };
+        input.encode(&mut BoundedEncoder::new(1024)?)?;
+        let command = client
+            .prepare_command::<StopCustodyIntent>(&target, identity, input)
+            .await
+            .map_err(|error| CustodyError::StopPreparation(Box::new(error)))?;
+        authority
+            .check(&target, owner)
+            .await
+            .map_err(|error| CustodyError::Owner(Box::new(error)))?;
+        Ok(ReadyCustodyStop {
+            client,
+            target,
+            request: BeginRequest {
+                repository: header.repository,
+                operation: header.operation,
+                request_digest: header.request_digest,
+                actor: header.actor,
+                lease_ms: DEFAULT_LEASE_MS,
+            },
+            step: header.step,
+            intent_digest,
+            original: self.evidence().clone(),
+            command,
+        })
+    }
+}
+impl ReadyCustodyStop {
+    pub fn evidence(&self) -> &PendingMutation {
+        self.command.evidence()
+    }
+    pub fn original(&self) -> &PendingMutation {
+        &self.original
+    }
+    pub(in crate::packs::publication) fn context(
+        &self,
+    ) -> (&CellClient, &CellTarget, BeginRequest) {
+        (&self.client, &self.target, self.request.clone())
+    }
+    pub(in crate::packs::publication) fn pending(&self) -> PublicationError {
+        PublicationError::CustodyStop(InvocationError::Pending(Box::new(self.evidence().clone())))
+    }
+    async fn recorded(&self) -> Result<Option<StopRecord>, CustodyError> {
+        let saved = load(
+            &self.client,
+            &self.target,
+            self.request.operation,
+            Some(self.step),
+        )
+        .await?
+        .ok_or(CustodyError::Context)?;
+        if *blake3::hash(&saved.intent.encoded()?).as_bytes() != self.intent_digest {
+            return Err(CustodyError::Context);
+        }
+        Ok(saved.stopped)
+    }
+    pub(in crate::packs::publication) async fn dispatch(
+        self,
+        recover: bool,
+        fault: u8,
+    ) -> Result<PublicationOutcome, PublicationError> {
+        let saved = self
+            .recorded()
+            .await
+            .map_err(|source| PublicationError::Custody {
+                evidence: Box::new(self.evidence().clone()),
+                source: Box::new(source),
+            })?;
+        let invocation = self.evidence().clone();
+        let (stop, committed) = if let Some(saved) = saved {
+            let committed = if saved.stamp == Stamp::of(&invocation)
+                && saved.data.owner.incarnation == invocation.incarnation()
+            {
+                Some(saved.result.committed(&invocation).map_err(|source| {
+                    PublicationError::Custody {
+                        evidence: Box::new(invocation.clone()),
+                        source: Box::new(source.into()),
+                    }
+                })?)
+            } else {
+                None
+            };
+            (Some(saved.fact(&self.target)), committed)
+        } else {
+            let committed = super::super::exact::invoke(
+                &self.client,
+                self.command.clone(),
+                recover,
+                128,
+                fault,
+            )
+            .await
+            .map_err(PublicationError::CustodyStop)?;
+            let saved = self
+                .recorded()
+                .await
+                .map_err(|source| PublicationError::Custody {
+                    evidence: Box::new(invocation.clone()),
+                    source: Box::new(source),
+                })?;
+            if committed.output == CustodyStopReply::Stopped && saved.is_none() {
+                return Err(self.pending());
+            }
+            (saved.map(|value| value.fact(&self.target)), Some(committed))
+        };
+        Ok(PublicationOutcome::CustodyStop(Box::new(
+            CustodyStopOutcome {
+                original: self.original,
+                invocation,
+                stop,
+                committed,
+            },
+        )))
+    }
+    #[cfg(test)]
+    pub(in crate::packs::publication) fn input_for_test(
+        &self,
+    ) -> Result<CustodyStopInput, CodecError> {
+        decode(self.command.input_bytes(), 1024)
+    }
+    #[cfg(test)]
+    pub(in crate::packs::publication) fn command_for_test(
+        &self,
+    ) -> PreparedCommand<StopCustodyIntent> {
+        self.command.clone()
+    }
+}
+
+#[cfg(test)]
+impl CustodyStopInput {
+    pub(in crate::packs::publication) fn tamper_for_test(mut self) -> Self {
+        let last = self.certificate.body.len() - 1;
+        self.certificate.body[last] ^= 2;
+        self
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index bec5e93f..4058eca8 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -103,8 +103,10 @@ pub use root_completion::{
 mod admission_receipt;
 mod custody;
 pub use custody::{
-    CustodyAction, CustodyError, CustodyIntent, CustodyReply, CustodyRequest, ExecuteCustody,
-    PreparedCustody, RegisterCustodyIntent, RegisteredCustody,
+    CustodyAction, CustodyError, CustodyIntent, CustodyReply, CustodyRequest, CustodyScanStats,
+    CustodyStopFact, CustodyStopInput, CustodyStopOutcome, CustodyStopReply, CustodySupervisor,
+    ExecuteCustody, PreparedCustody, ReadyCustodyStop, RegisterCustodyIntent, RegisteredCustody,
+    StopCustodyIntent,
 };
 mod preparation_receipt;
 pub use preparation_receipt::{PreparationAdmission, PreparationReceiptError};
@@ -231,6 +233,7 @@ pub struct MaintenanceRequest {
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_command::<RegisterCustodyIntent>()?;
     registry.bind_command::<ExecuteCustody>()?;
+    registry.bind_command::<StopCustodyIntent>()?;
     registry.bind_command::<RegisterStagedInputs>()?;
     registry.bind_query::<CheckStagedInputs>()?;
     registry.bind_query::<CheckStaging>()?;
diff --git a/crates/canopy-server/src/packs/publication/owner.rs b/crates/canopy-server/src/packs/publication/owner.rs
index b440acc0..b4c3c581 100644
--- a/crates/canopy-server/src/packs/publication/owner.rs
+++ b/crates/canopy-server/src/packs/publication/owner.rs
@@ -41,6 +41,15 @@ impl PreparationAuthority {
         target: &CellTarget,
         expected: OwnerFence,
     ) -> Result<(), PreparationBaseError> {
+        if self.observe(target).await? != expected {
+            return Err(PreparationBaseError::Inactive);
+        }
+        Ok(())
+    }
+    pub(super) async fn observe(
+        &self,
+        target: &CellTarget,
+    ) -> Result<OwnerFence, PreparationBaseError> {
         if !self.matches(target) {
             return Err(PreparationBaseError::Context);
         }
@@ -62,9 +71,6 @@ impl PreparationAuthority {
                 control.value().owner_fence()
             }
         };
-        if actual != expected {
-            return Err(PreparationBaseError::Inactive);
-        }
-        Ok(())
+        Ok(actual)
     }
 }
diff --git a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
index 0db27223..4d7bccaf 100644
--- a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
@@ -24,7 +24,7 @@ impl Default for RecoveryScanLimits {
     }
 }
 impl RecoveryScanLimits {
-    fn validate(self) -> Result<(), RootRecoveryError> {
+    pub(in crate::packs::publication) fn validate(self) -> Result<(), RootRecoveryError> {
         if self.page == 0
             || self.page > MAX_PAGE
             || self.interval < Duration::from_millis(10)
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 29d56c17..72c81c43 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,7 +23,7 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 15] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 16] = [
     crate::operation(1),
     command::<AbortPreparation>(4096, 4096),
     command::<ReapPreparation>(4096, 4096),
@@ -39,6 +39,7 @@ pub(crate) const COMMANDS: [OperationDescriptor; 15] = [
     command::<ReleaseTerminalRecovery>(4096, 128),
     command::<RegisterCustodyIntent>(4096, 4096),
     command::<ExecuteCustody>(1024, 512),
+    command::<StopCustodyIntent>(1024, 128),
 ];
 pub(crate) const QUERIES: [OperationDescriptor; 9] = [
     crate::operation(2),
@@ -79,7 +80,9 @@ mod tests {
             .collect();
         assert_eq!(
             ids,
-            vec![1, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42]
+            vec![
+                1, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43
+            ]
         );
         assert_eq!(
             descriptor
@@ -112,6 +115,7 @@ mod tests {
             (40, ReleaseTerminalRecovery::CODEC_VERSION, 4096, 128),
             (41, RegisterCustodyIntent::CODEC_VERSION, 4096, 4096),
             (42, ExecuteCustody::CODEC_VERSION, 1024, 512),
+            (43, StopCustodyIntent::CODEC_VERSION, 1024, 128),
         ] {
             let operation = descriptor
                 .commands
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index 553c0d48..e091cffb 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -556,15 +556,18 @@ CREATE TABLE catalog_custody_commands (
     request_id BLOB NOT NULL CHECK(typeof(request_id)='blob' AND length(request_id)=16),
     intent BLOB NOT NULL CHECK(typeof(intent)='blob' AND length(intent) BETWEEN 1 AND 4096),
     phase BLOB CHECK(phase IS NULL OR (typeof(phase)='blob' AND length(phase) BETWEEN 1 AND 1024)),
+    stopped BLOB CHECK(stopped IS NULL OR (typeof(stopped)='blob' AND length(stopped) BETWEEN 1 AND 1024)),
     granted_incarnation BLOB CHECK(granted_incarnation IS NULL OR (typeof(granted_incarnation)='blob' AND length(granted_incarnation)=16)),
     granted_attempt INTEGER CHECK(granted_attempt IS NULL OR (typeof(granted_attempt)='integer' AND granted_attempt>0)),
+    CHECK(phase IS NULL OR stopped IS NULL),
+    CHECK(stopped IS NULL OR granted_attempt IS NULL),
     CHECK((granted_incarnation IS NULL)=(granted_attempt IS NULL)),
     CHECK(phase IS NOT NULL OR granted_attempt IS NULL),
     PRIMARY KEY(operation,step),
     UNIQUE(incarnation,request_id)
 ) WITHOUT ROWID;
 CREATE INDEX catalog_custody_grants ON catalog_custody_commands(operation,granted_incarnation,granted_attempt,step DESC) WHERE granted_attempt IS NOT NULL;
-CREATE UNIQUE INDEX catalog_custody_pending ON catalog_custody_commands(operation) WHERE phase IS NULL;
+CREATE UNIQUE INDEX catalog_custody_pending ON catalog_custody_commands(operation) WHERE phase IS NULL AND stopped IS NULL;
 CREATE TRIGGER catalog_custody_identity_immutable BEFORE UPDATE OF operation,step,incarnation,request_id,intent ON catalog_custody_commands
 WHEN NEW.operation IS NOT OLD.operation OR NEW.step IS NOT OLD.step
   OR NEW.incarnation IS NOT OLD.incarnation OR NEW.request_id IS NOT OLD.request_id OR NEW.intent IS NOT OLD.intent
@@ -578,3 +581,7 @@ WHEN EXISTS(SELECT 1 FROM catalog_custody_commands WHERE operation=NEW.operation
 BEGIN SELECT RAISE(ABORT, 'custody command cannot be replaced'); END;
 CREATE TRIGGER catalog_custody_retained BEFORE DELETE ON catalog_custody_commands
 BEGIN SELECT RAISE(ABORT, 'custody command must be retained'); END;
+
+CREATE TRIGGER catalog_custody_stop_immutable BEFORE UPDATE OF stopped ON catalog_custody_commands
+WHEN OLD.stopped IS NOT NULL AND NEW.stopped IS NOT OLD.stopped
+BEGIN SELECT RAISE(ABORT, 'custody retirement is immutable'); END;
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index b5dccc0f..9d2ad18f 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -4,6 +4,7 @@ mod compaction;
 mod completion;
 mod coordinator;
 mod custody;
+mod custody_stop;
 mod durable_policy;
 mod durable_recovery;
 mod frontier;
diff --git a/crates/canopy-server/src/packs/publication/tests/custody.rs b/crates/canopy-server/src/packs/publication/tests/custody.rs
index c0f8f8c6..cf9a89f8 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody.rs
@@ -508,7 +508,7 @@ async fn corrupted_metadata_blocks_sdk_fallback_and_journal_queries_are_indexed(
             let mut all = String::new();
             for sql in [
                 "EXPLAIN QUERY PLAN SELECT intent,phase FROM catalog_custody_commands WHERE operation=zeroblob(16) ORDER BY step DESC LIMIT 1",
-                "EXPLAIN QUERY PLAN SELECT operation FROM catalog_custody_commands WHERE phase IS NULL LIMIT 1024",
+                "EXPLAIN QUERY PLAN SELECT operation FROM catalog_custody_commands WHERE phase IS NULL AND stopped IS NULL LIMIT 1024",
                 "EXPLAIN QUERY PLAN SELECT intent,phase FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE operation=zeroblob(16) AND granted_incarnation=zeroblob(16) AND granted_attempt=1 ORDER BY step DESC LIMIT 1",
             ] {
                 let mut statement = db.prepare(sql)?;
diff --git a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
new file mode 100644
index 00000000..8add5271
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
@@ -0,0 +1,753 @@
+//! Separate logical retirement, actual receiver races and bounded maintenance.
+use super::{publishing::edit, staging_service::restore::head_expiring, *};
+use cellule_runtime::Resolution;
+use tokio::time::{Duration, timeout};
+
+async fn expired(value: &cellule_runtime::PendingMutation) -> Result {
+    let now = sql::now(0)?;
+    if now <= value.identity().expires_at_ms {
+        tokio::time::sleep(Duration::from_millis(
+            (value.identity().expires_at_ms - now + 1) as u64,
+        ))
+        .await;
+    }
+    Ok(())
+}
+async fn registered(f: &Fixture, kind: u8) -> Result<RegisteredCustody> {
+    Ok(
+        RegisteredCustody::load_latest(&f.client(), &f.target, [230 + kind; 16])
+            .await?
+            .ok_or("original missing")?,
+    )
+}
+fn stopped(state: PublicationState) -> Result<CustodyStopOutcome> {
+    match state {
+        PublicationState::Finished(Ok(PublicationOutcome::CustodyStop(value))) => Ok(*value),
+        other => Err(format!("stop outcome: {other:?}").into()),
+    }
+}
+async fn observed(ticket: &PublicationTicket) -> Result<PublicationState> {
+    Ok(timeout(Duration::from_secs(10), ticket.wait()).await?)
+}
+
+#[tokio::test]
+async fn stop_all_seven_expired_originals_preserves_unknown_outcomes_and_allows_explicit_successors()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in 0..7 {
+            let f = Fixture::new(format).await?;
+            let (evidence, _) = head_expiring(&f, kind, false, true).await?;
+            expired(&evidence).await?;
+            let original = registered(&f, kind).await?;
+            let counts = f.counts().await?;
+            let ready = original
+                .ready_stop(f.client(), identity()?, &f.authority())
+                .await?;
+            let stop_evidence = ready.evidence().clone();
+            let queue =
+                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            let ticket = queue.submit(ready).await?;
+            let outcome = stopped(observed(&ticket).await?)?;
+            assert_eq!(outcome.original, evidence);
+            assert_eq!(outcome.invocation, stop_evidence);
+            assert_eq!(
+                outcome
+                    .committed
+                    .as_ref()
+                    .ok_or("stop invocation lost")?
+                    .output,
+                CustodyStopReply::Stopped
+            );
+            let fact = outcome.stop.ok_or("stop fact missing")?;
+            assert_eq!(
+                fact.receipt,
+                outcome.committed.ok_or("stop receipt missing")?.receipt
+            );
+            assert_eq!(fact.owner, f.handle.owner_fence());
+            assert_eq!(f.counts().await?, counts);
+            let loaded = registered(&f, kind).await?;
+            assert_eq!(loaded.evidence(), &evidence);
+            assert!(loaded.closed());
+            assert!(!loaded.settled());
+            assert_eq!(loaded.stop_fact(), Some(fact.clone()));
+            assert!(
+                matches!(loaded.recover(&f.client()).await, Err(InvocationError::Pending(value)) if *value == evidence)
+            );
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            assert!(
+                matches!(loaded.ready_stop(f.client(), identity()?, &f.authority()).await, Err(CustodyError::Stopped(value)) if *value == fact)
+            );
+            let staging =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+            let cold = staging
+                .submit(
+                    ReadyStaging::restore(f.client(), f.target.clone(), [230 + kind; 16]).await?,
+                )
+                .map_err(|(error, _)| error)?;
+            let StagingState::Fenced(error) =
+                timeout(Duration::from_secs(10), cold.wait_terminal()).await?
+            else {
+                return Err("stopped cold stage not fenced".into());
+            };
+            assert!(
+                matches!(&*error, StagingError::Custody { source, .. } if matches!(&**source, CustodyError::Stopped(_)))
+            );
+            assert_eq!(cold.restored_evidence(), Some(&evidence));
+            assert!(cold.restored_outcome().is_none());
+            assert_eq!(staging.stats().command_bytes, 0);
+            assert!(staging.close_and_drain().await.is_empty());
+            // A deliberate successor keeps logical actor/digest continuity and
+            // does not erase or assign an invented result to the stopped original.
+            let next =
+                PreparedCustody::prepare(&f.client(), &f.target, loaded.action()?, identity()?)
+                    .await?;
+            assert_ne!(next.evidence(), &evidence);
+            let next = next.register(&f.client(), identity()?).await?;
+            assert!(!next.closed());
+            assert_eq!(original.stop_fact(), None); // Old DTO is not fresh state.
+            assert!(queue.close_and_drain().await.is_empty());
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn stop_receiver_refuses_live_forged_and_stale_owner_proofs_and_preserves_accepted_originals()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (evidence, _) = head_expiring(&f, 0, false, false).await?;
+        let original = registered(&f, 0).await?;
+        let ready = original
+            .ready_stop(f.client(), identity()?, &f.authority())
+            .await?;
+        assert!(matches!(ready.command_for_test().execute().await,
+            Err(InvocationError::Rejected(value)) if value.output == CustodyStopReply::Denied(PreparationDenial::Conflict)));
+        assert!(!registered(&f, 0).await?.closed());
+        let forged = f
+            .client()
+            .prepare_command::<StopCustodyIntent>(
+                &f.target,
+                identity()?,
+                ready.input_for_test()?.tamper_for_test(),
+            )
+            .await?;
+        assert!(matches!(forged.execute().await,
+            Err(InvocationError::Rejected(value)) if value.output == CustodyStopReply::Denied(PreparationDenial::Unauthorized)));
+        let ready = original
+            .ready_stop(f.client(), identity()?, &f.authority())
+            .await?;
+        let expected = original.recover(&f.client()).await?;
+        // Execute won before stop. Even revoked access must not rewrite history.
+        edit(&f, "UPDATE repository_identity SET owner='other'").await?;
+        let command = ready.command_for_test();
+        assert_eq!(command.execute().await?.output, CustodyStopReply::Settled);
+        assert_eq!(
+            registered(&f, 0).await?.recover(&f.client()).await?,
+            expected
+        );
+        assert!(registered(&f, 0).await?.stop_fact().is_none());
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Committed(_)
+        ));
+        f.runtime.shutdown().await?;
+
+        let f = Fixture::new(format).await?;
+        let (evidence, _) = head_expiring(&f, 0, false, true).await?;
+        let original = registered(&f, 0).await?;
+        let ready = original
+            .ready_stop(f.client(), identity()?, &f.authority())
+            .await?;
+        let input = ready.input_for_test()?;
+        let (runtime, handle, client) =
+            super::durable_recovery::restore_owner_fence(&f, f.handle.owner_fence()).await?;
+        expired(&evidence).await?;
+        let stale = client
+            .prepare_command::<StopCustodyIntent>(&f.target, identity()?, input)
+            .await?;
+        assert!(matches!(stale.execute().await,
+            Err(InvocationError::Rejected(value)) if value.output == CustodyStopReply::Denied(PreparationDenial::Stale)));
+        let original = RegisteredCustody::load_latest(&client, &f.target, [230; 16])
+            .await?
+            .ok_or("restored head")?;
+        assert!(!original.closed());
+        let fresh = original
+            .ready_stop(client.clone(), identity()?, &f.authority())
+            .await?;
+        assert_eq!(
+            fresh.command_for_test().execute().await?.output,
+            CustodyStopReply::Stopped
+        );
+        assert_eq!(
+            RegisteredCustody::load_latest(&client, &f.target, [230; 16])
+                .await?
+                .ok_or("stopped head")?
+                .stop_fact()
+                .ok_or("actual stop")?
+                .owner,
+            handle.owner_fence()
+        );
+        runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn stop_first_writer_fact_is_immutable_and_is_not_an_unexecuted_invocations_receipt() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (evidence, _) = head_expiring(&f, 4, false, true).await?;
+        expired(&evidence).await?;
+        let original = registered(&f, 4).await?;
+        let first = original
+            .ready_stop(f.client(), identity()?, &f.authority())
+            .await?;
+        let second = original
+            .ready_stop(f.client(), identity()?, &f.authority())
+            .await?;
+        let first_receipt = first.command_for_test().execute().await?.receipt;
+        let invocation = second.evidence().clone();
+        let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let outcome = stopped(observed(&queue.submit(second).await?).await?)?;
+        assert_eq!(outcome.invocation, invocation);
+        assert!(outcome.committed.is_none());
+        assert_eq!(
+            outcome.stop.ok_or("first writer fact")?.receipt,
+            first_receipt
+        );
+        assert!(matches!(
+            f.client().resolve(&invocation).await?,
+            Resolution::Absent
+        ));
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Expired
+        ));
+        for sql in [
+            "UPDATE catalog_custody_commands SET stopped=NULL",
+            "UPDATE catalog_custody_commands SET stopped=x'01'",
+            "UPDATE catalog_custody_commands SET phase=x'01'",
+            "DELETE FROM catalog_custody_commands",
+        ] {
+            assert!(edit(&f, sql).await.is_err(), "{sql}");
+        }
+        assert!(queue.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn stop_late_failure_and_ignored_write_rollback_marker_and_sdk_acceptance_before_exact_retry()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for ignored in [false, true] {
+            let f = Fixture::new(format).await?;
+            let (evidence, _) = head_expiring(&f, 0, false, true).await?;
+            expired(&evidence).await?;
+            let original = registered(&f, 0).await?;
+            let ready = original
+                .ready_stop(f.client(), identity()?, &f.authority())
+                .await?;
+            let command = ready.command_for_test();
+            let action = if ignored {
+                "RAISE(IGNORE)"
+            } else {
+                "RAISE(ABORT,'late stop fault')"
+            };
+            edit(&f, &format!("CREATE TRIGGER stop_fault BEFORE UPDATE OF stopped ON catalog_custody_commands BEGIN SELECT {action}; END")).await?;
+            assert!(matches!(
+                command.clone().execute().await,
+                Err(InvocationError::NotStarted(_))
+            ));
+            assert!(matches!(
+                f.client().resolve(command.evidence()).await?,
+                Resolution::Absent
+            ));
+            assert!(!registered(&f, 0).await?.closed());
+            edit(&f, "DROP TRIGGER stop_fault").await?;
+            let result = command.clone().execute().await?;
+            assert_eq!(result.output, CustodyStopReply::Stopped);
+            assert_eq!(
+                registered(&f, 0)
+                    .await?
+                    .stop_fact()
+                    .ok_or("stop missing")?
+                    .receipt,
+                result.receipt
+            );
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn stop_service_reply_loss_and_panic_keep_bounded_originals_through_closed_recovery() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in 0..=3 {
+            let f = Fixture::new(format).await?;
+            let (evidence, _) = head_expiring(&f, 0, false, true).await?;
+            expired(&evidence).await?;
+            let mut invocation_identity = identity()?;
+            if fault > 1 {
+                invocation_identity.expires_at_ms = invocation_identity.issued_at_ms + 1_000;
+            }
+            let ready = registered(&f, 0)
+                .await?
+                .ready_stop(f.client(), invocation_identity, &f.authority())
+                .await?;
+            let invocation = ready.evidence().clone();
+            let queue =
+                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            if fault == 0 {
+                edit(
+                    &f,
+                    "ALTER TABLE catalog_custody_commands RENAME TO custody_stop_query_fault",
+                )
+                .await?;
+            } else {
+                queue.fault_for_test(fault);
+            }
+            let ticket = queue.submit(ready).await?;
+            assert!(matches!(
+                observed(&ticket).await?,
+                PublicationState::Uncertain(_)
+            ));
+            let stats = queue.stats().await;
+            assert_eq!(stats.maintenance, 1);
+            assert_eq!(stats.foreground, 0);
+            assert_eq!(stats.command_bytes, 8 << 10);
+            drop(ticket);
+            let ticket = queue
+                .pending_custody_stop([230; 16])
+                .await
+                .ok_or("lost observer")?;
+            assert_eq!(queue.close_and_drain().await.len(), 1);
+            if fault == 0 {
+                assert!(matches!(
+                    f.client().resolve(&invocation).await?,
+                    Resolution::Absent
+                ));
+                edit(
+                    &f,
+                    "ALTER TABLE custody_stop_query_fault RENAME TO catalog_custody_commands",
+                )
+                .await?;
+            }
+            if fault > 1 {
+                expired(&invocation).await?;
+                edit(&f, "UPDATE repository_identity SET owner='other'").await?;
+                assert!(matches!(
+                    f.client().resolve(&invocation).await?,
+                    Resolution::Expired
+                ));
+            }
+            queue.recover(&ticket).await?;
+            let outcome = stopped(observed(&ticket).await?)?;
+            assert_eq!(outcome.original, evidence);
+            assert_eq!(outcome.invocation, invocation);
+            assert_eq!(
+                outcome.committed.ok_or("stop result lost")?.output,
+                CustodyStopReply::Stopped
+            );
+            assert!(outcome.stop.is_some());
+            assert_eq!(queue.stats().await.command_bytes, 0);
+            assert!(queue.close_and_drain().await.is_empty());
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+async fn junk(f: &Fixture, count: usize) -> Result {
+    edit(f, &format!("WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<{count}) INSERT INTO catalog_custody_commands(operation,step,incarnation,request_id,intent) SELECT CAST(printf('%016d',x) AS BLOB),0,zeroblob(16),CAST(printf('%016d',x) AS BLOB),x'01' FROM n")).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn stop_reclaims_only_pending_quota_and_retains_original_history() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let (evidence, _) = head_expiring(&f, 0, false, true).await?;
+    junk(&f, 1023).await?;
+    let next = PreparedCustody::prepare(
+        &f.client(),
+        &f.target,
+        CustodyAction::BeginPreparation(f.begin([248; 16])),
+        identity()?,
+    )
+    .await?;
+    assert!(next.register(&f.client(), identity()?).await.is_err());
+    expired(&evidence).await?;
+    let ready = registered(&f, 0)
+        .await?
+        .ready_stop(f.client(), identity()?, &f.authority())
+        .await?;
+    ready.command_for_test().execute().await?;
+    next.register(&f.client(), identity()?).await?;
+    f.handle.query(0, 4096, |db| {
+        assert_eq!(db.query_row("SELECT count(*) FROM catalog_custody_commands WHERE phase IS NULL AND stopped IS NULL", [], |r| r.get::<_,i64>(0))?,1024);
+        assert_eq!(db.query_row("SELECT count(*) FROM catalog_custody_commands", [], |r| r.get::<_,i64>(0))?,1025);
+        Ok(Vec::new())
+    }).await?;
+    assert_eq!(registered(&f, 0).await?.evidence(), &evidence);
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn custody_scan_uses_bounded_indexed_pages_and_revisits_corruption_without_starving_tail_heads()
+-> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    junk(&f, 300).await?;
+    let (evidence, _) = head_expiring(&f, 0, false, true).await?;
+    expired(&evidence).await?;
+    f.handle.query(0,4096,|db| {
+        let mut query = db.prepare("EXPLAIN QUERY PLAN SELECT operation FROM catalog_custody_commands INDEXED BY catalog_custody_pending WHERE phase IS NULL AND stopped IS NULL AND operation>?1 ORDER BY operation LIMIT ?2")?;
+        let details: Vec<String> = query.query_map(rusqlite::params![vec![0u8;16],17], |r| r.get(3))?.collect::<std::result::Result<_,_>>()?;
+        assert!(details.iter().any(|v|v.contains("SEARCH") && v.contains("catalog_custody_pending")),"{details:?}");
+        assert!(details.iter().all(|v|!v.contains("TEMP B-TREE")),"{details:?}");
+        Ok(Vec::new())
+    }).await?;
+    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let limits = RecoveryScanLimits {
+        page: 17,
+        interval: Duration::from_millis(10),
+    };
+    let service = CustodySupervisor::start(
+        f.client(),
+        f.target.clone(),
+        queue.clone(),
+        limits,
+        f.authority(),
+    )?;
+    timeout(Duration::from_secs(10), async {
+        loop {
+            if service.stats().passes >= 2 && registered(&f, 0).await?.stop_fact().is_some() {
+                return Ok::<_, Box<dyn std::error::Error>>(());
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await??;
+    let stats = service.stats();
+    assert!(stats.failures >= 600);
+    assert!(stats.last_error.is_some());
+    assert_eq!(stats.submitted, 1);
+    // A head behind the current cursor must be revisited on a later pass.
+    let next = PreparedCustody::prepare(
+        &f.client(),
+        &f.target,
+        CustodyAction::BeginStaging(f.begin([1; 16])),
+        identity()?,
+    )
+    .await?;
+    next.register(&f.client(), identity()?).await?;
+    let passes = service.stats().passes;
+    timeout(Duration::from_secs(10), async {
+        while service.stats().passes < passes + 3 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await?;
+    assert!(service.stats().deferred >= 1);
+    service.shutdown().await?;
+    assert!(queue.close_and_drain().await.is_empty());
+    assert_eq!(queue.stats().await.command_bytes, 0);
+    for invalid in [0, 129] {
+        assert!(
+            CustodySupervisor::start(
+                f.client(),
+                f.target.clone(),
+                queue.clone(),
+                RecoveryScanLimits {
+                    page: invalid,
+                    ..limits
+                },
+                f.authority()
+            )
+            .is_err()
+        );
+    }
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn stopped_originals_survive_real_owner_restore_and_stop_sdk_expiry_without_current_permission()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (evidence, _) = head_expiring(&f, 4, false, true).await?;
+        expired(&evidence).await?;
+        let original = registered(&f, 4).await?;
+        let mut mutation = identity()?;
+        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+        let ready = original
+            .ready_stop(f.client(), mutation, &f.authority())
+            .await?;
+        let invocation = ready.evidence().clone();
+        let accepted = ready.command_for_test().execute().await?;
+        let expected = registered(&f, 4)
+            .await?
+            .stop_fact()
+            .ok_or("durable retirement")?;
+        assert_eq!(expected.receipt, accepted.receipt);
+        drop(ready);
+        drop(original);
+        edit(&f, "UPDATE repository_identity SET owner='other'").await?;
+        let (runtime, handle, client) =
+            super::durable_recovery::restore_owner_fence(&f, f.handle.owner_fence()).await?;
+        assert_ne!(handle.owner_fence(), expected.owner);
+        expired(&invocation).await?;
+        assert!(matches!(
+            client.resolve(&invocation).await?,
+            Resolution::Expired
+        ));
+        let loaded = RegisteredCustody::load_latest(&client, &f.target, [234; 16])
+            .await?
+            .ok_or("restored original")?;
+        assert_eq!(loaded.evidence(), &evidence);
+        assert!(!loaded.settled());
+        assert!(loaded.closed());
+        assert_eq!(loaded.stop_fact(), Some(expected));
+        assert!(
+            matches!(loaded.recover(&client).await,Err(InvocationError::Pending(value)) if *value==evidence)
+        );
+        let stage =
+            StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        let ticket = stage
+            .submit(ReadyStaging::restore(client, f.target.clone(), [234; 16]).await?)
+            .map_err(|(error, _)| error)?;
+        assert!(matches!(
+            timeout(Duration::from_secs(10), ticket.wait_terminal()).await?,
+            StagingState::Fenced(_)
+        ));
+        assert_eq!(ticket.restored_evidence(), Some(&evidence));
+        assert!(ticket.restored_outcome().is_none());
+        assert_eq!(stage.stats().command_bytes, 0);
+        assert!(stage.close_and_drain().await.is_empty());
+        runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn custody_scan_recovers_exact_maintenance_commands_after_their_pending_keys_disappear()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in 1..=3 {
+            let f = Fixture::new(format).await?;
+            let (evidence, _) = head_expiring(&f, 0, false, true).await?;
+            expired(&evidence).await?;
+            let staging =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+            let stage = staging
+                .submit(ReadyStaging::restore(f.client(), f.target.clone(), [230; 16]).await?)
+                .map_err(|(error, _)| error)?;
+            assert!(matches!(
+                timeout(Duration::from_secs(10), stage.wait_terminal()).await?,
+                StagingState::Uncertain(_)
+            ));
+            let queue =
+                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            queue.fault_for_test(fault);
+            let service = CustodySupervisor::start(
+                f.client(),
+                f.target.clone(),
+                queue.clone(),
+                RecoveryScanLimits {
+                    page: 1,
+                    interval: Duration::from_millis(100),
+                },
+                f.authority(),
+            )?;
+            let invocation = timeout(Duration::from_secs(10), async {
+                loop {
+                    if let Some(ticket) = queue.pending_custody_stop([230; 16]).await
+                        && let PublicationState::Uncertain(error) = ticket.state()
+                        && let PublicationError::CustodyStop(InvocationError::Pending(value)) =
+                            &*error
+                    {
+                        return Ok::<_, Box<dyn std::error::Error>>((**value).clone());
+                    }
+                    tokio::task::yield_now().await;
+                }
+            })
+            .await??;
+            timeout(Duration::from_secs(10), async {
+                loop {
+                    if registered(&f, 0).await?.stop_fact().is_some()
+                        && queue.stats().await.command_bytes == 0
+                    {
+                        return Ok::<_, Box<dyn std::error::Error>>(());
+                    }
+                    tokio::task::yield_now().await;
+                }
+            })
+            .await??;
+            let stats = service.shutdown().await?;
+            assert_eq!(stats.submitted, 1);
+            assert!(stats.recovered >= 1);
+            assert!(matches!(
+                f.client().resolve(&invocation).await?,
+                Resolution::Committed(_)
+            ));
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            let fact = registered(&f, 0)
+                .await?
+                .stop_fact()
+                .ok_or("stopped original")?;
+            assert!(fact.receipt.commit_sequence > 0);
+            // An already admitted uncertain staging owner observes typed closure
+            // on explicit recovery; it never receives a fabricated original reply.
+            staging.recover(&stage)?;
+            assert!(matches!(
+                timeout(Duration::from_secs(10), stage.wait_terminal()).await?,
+                StagingState::Fenced(_)
+            ));
+            assert_eq!(stage.restored_evidence(), Some(&evidence));
+            assert!(stage.restored_outcome().is_none());
+            assert_eq!(staging.stats().command_bytes, 0);
+            assert!(staging.close_and_drain().await.is_empty());
+            assert!(queue.close_and_drain().await.is_empty());
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn authenticated_stop_records_cannot_be_transplanted_to_another_original() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (evidence, _) = head_expiring(&f, 0, false, true).await?;
+        let (other, _) = head_expiring(&f, 4, false, true).await?;
+        expired(&evidence).await?;
+        expired(&other).await?;
+        let old = registered(&f, 0).await?;
+        for kind in [0, 4] {
+            registered(&f, kind)
+                .await?
+                .ready_stop(f.client(), identity()?, &f.authority())
+                .await?
+                .command_for_test()
+                .execute()
+                .await?;
+        }
+        edit(&f, "DROP TRIGGER catalog_custody_stop_immutable").await?;
+        edit(&f, "UPDATE catalog_custody_commands SET stopped=(SELECT stopped FROM catalog_custody_commands WHERE operation=x'eaeaeaeaeaeaeaeaeaeaeaeaeaeaeaea') WHERE operation=x'e6e6e6e6e6e6e6e6e6e6e6e6e6e6e6e6'").await?;
+        assert!(
+            RegisteredCustody::load_latest(&f.client(), &f.target, [230; 16])
+                .await
+                .is_err()
+        );
+        assert!(
+            matches!(old.recover(&f.client()).await, Err(InvocationError::Pending(value)) if *value==evidence)
+        );
+        assert!(
+            ReadyStaging::restore(f.client(), f.target.clone(), [230; 16])
+                .await
+                .is_err()
+        );
+        assert!(registered(&f, 4).await?.stop_fact().is_some());
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Expired
+        ));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn custody_stop_cannot_be_blocked_by_its_own_uncertain_preparation_and_fences_the_shared_session()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let operation = [230; 16];
+        let begin = PreparedCustody::prepare(
+            &f.client(),
+            &f.target,
+            CustodyAction::BeginPreparation(f.begin(operation)),
+            identity()?,
+        )
+        .await?
+        .register(&f.client(), identity()?)
+        .await?
+        .recover_preparation(&f.client())
+        .await?;
+        let lease = lease(begin.output)?;
+        let session = Arc::new(
+            PreparationSession::open(
+                f.client(),
+                f.target.clone(),
+                check(lease.token),
+                Some(begin.receipt),
+                f.authority(),
+            )
+            .await?,
+        );
+        let mut mutation = identity()?;
+        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+        let ready = session.ready_renew(mutation, DEFAULT_LEASE_MS).await?;
+        let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        queue.fault_for_test(1);
+        let renewal = queue.submit(ready).await?;
+        assert!(matches!(
+            observed(&renewal).await?,
+            PublicationState::Uncertain(_)
+        ));
+        let original = registered(&f, 0).await?;
+        expired(original.evidence()).await?;
+        assert!(session.live_lease().is_ok());
+        let service = CustodySupervisor::start(
+            f.client(),
+            f.target.clone(),
+            queue.clone(),
+            RecoveryScanLimits {
+                page: 1,
+                interval: Duration::from_millis(10),
+            },
+            f.authority(),
+        )?;
+        timeout(Duration::from_secs(10), async {
+            while queue.stats().await.command_bytes != 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        let stats = service.shutdown().await?;
+        assert_eq!(stats.submitted, 1);
+        let PublicationState::Finished(Err(error)) = renewal.state() else {
+            return Err("renewal not closed by its own stop".into());
+        };
+        assert!(
+            matches!(&*error, PublicationError::Custody { evidence, source } if **evidence==*original.evidence() && matches!(&**source,CustodyError::Stopped(_)))
+        );
+        assert!(session.live_lease().is_err());
+        assert!(registered(&f, 0).await?.closed());
+        assert!(!registered(&f, 0).await?.settled());
+        assert!(matches!(
+            f.client().resolve(original.evidence()).await?,
+            Resolution::Expired
+        ));
+        assert!(queue.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index fc650437..2e02a24c 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -1,6 +1,6 @@
 mod bound;
 mod publication;
-mod restore;
+pub(super) mod restore;
 use super::*;
 use tokio::{
     sync::oneshot,
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
index 3bae01da..c6065524 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
@@ -24,7 +24,7 @@ async fn head(
 ) -> Result<(PendingMutation, Option<Committed<CustodyReply>>)> {
     head_expiring(f, kind, execute_original, execute_original).await
 }
-async fn head_expiring(
+pub(in crate::packs::publication::tests) async fn head_expiring(
     f: &Fixture,
     kind: u8,
     execute_original: bool,
diff --git a/docs/design/durable-custody-command-intents.md b/docs/design/durable-custody-command-intents.md
index 34eeef3e..7a9e4a37 100644
--- a/docs/design/durable-custody-command-intents.md
+++ b/docs/design/durable-custody-command-intents.md
@@ -12,11 +12,11 @@ Each row is keyed by logical operation and ordinal. A separate unique key binds
 
 The input is bounded to 1 KiB, SDK snapshot to its existing 2 KiB ceiling, authenticated carrier to 1 KiB, complete stored intent to 4 KiB and recorded phase to 1 KiB with a 512-byte typed reply. Every factory and receiver applies its complete encoded limit; individual ceilings do not authorize a sum exceeding the complete limit. Factory encoding fails before registration or allocation if the combined representation exceeds it. Actor identifiers retain their existing 64-byte limit. Ordinals use the existing recovery protocol's 65,535 ceiling; exhaustion refuses preparation rather than replacing history.
 
-At most one unresolved row exists per logical operation. Indexed admission counts at most 1,024 pending heads; settled history does not consume this unresolved-work quota. A partial index serves that count. The primary key serves latest-head and exact-ordinal discovery. An explicit indexed lookup on operation/incarnation/admission sequence discovers an authentic historical grant for restart Claim without scanning the operation's renewal history. SQL guards prevent changing or replacing an intent, changing a settled phase or its grant identity, and deleting retained knowledge.
+At most one unresolved, unretired row exists per logical operation. Indexed admission counts at most 1,024 pending heads; settled history does not consume this unresolved-work quota. A partial index serves that count. The primary key serves latest-head and exact-ordinal discovery. An explicit indexed lookup on operation/incarnation/admission sequence discovers an authentic historical grant for restart Claim without scanning the operation's renewal history. SQL guards prevent changing or replacing an intent, changing a settled phase or its grant identity, and deleting retained knowledge.
 
 ## Registration and execution
 
-Command 41 registers the authenticated exact intent. The first matching ordinal wins. Advancing requires a settled predecessor, its exact encoded digest and matching logical actor/digest. Unknown work cannot be skipped. A new registration checks current Write, the actual incarnation and original command expiry. Exact existing knowledge remains discoverable after permission or owner loss; this grants no execution or upload permission.
+Command 41 registers the authenticated exact intent. The first matching ordinal wins. Advancing requires a settled or explicitly retired predecessor, its exact encoded digest and matching logical actor/digest. Unknown work cannot be skipped. A new registration checks current Write, the actual incarnation and original command expiry. Exact existing knowledge remains discoverable after permission or owner loss; this grants no execution or upload permission.
 
 The factory retains its original snapshot/body through registration. A private query of the exact row proves registration even after a lost acknowledgement or registrar SDK expiry. It returns an identical winner before issuing another registration mutation. A missing or corrupt row after uncertainty remains an error. A competing candidate cannot dispatch its original command. New registration knowledge is observed through the authoritative Cell query, and execution independently verifies the same pointer.
 
@@ -38,7 +38,21 @@ Session construction now requires a mandatory server-owned `PreparationAuthority
 
 Fresh observations add durable Control/live-advertisement reads at custody and catalog-selection boundaries, rather than per Git object. Their existing bounded readers limit persisted inputs, but those I/O buffers are outside the 28 KiB command-wire reservation. Count their resident memory, I/O and tail latency in mixed-load qualification; an unvalidated owner cache cannot replace them.
 
-A missing, corrupt, unowned or changed authority observation prevents fresh custody. A failed refresh or base observation permanently fences the existing shared session; repairing the durable source cannot un-fence it. Original known outcomes still resolve first and remain recoverable even when no usable session can be returned. Explicit registered Claim under the current owner can allocate and restore a new usable session. An owner observation is not a lease on ownership or an atomic publication check: final receivers retain their actual-owner transaction checks. Complete cold staging lifecycle reconstruction, owner-loss worker drain qualification and bounded orphan handling remain release work.
+A missing, corrupt, unowned or changed authority observation prevents fresh custody. A failed refresh or base observation permanently fences the existing shared session; repairing the durable source cannot un-fence it. Original known outcomes still resolve first and remain recoverable even when no usable session can be returned. Explicit registered Claim under the current owner can allocate and restore a new usable session. An owner observation is not a lease on ownership or an atomic publication check: final receivers retain their actual-owner transaction checks. Cold staging reconstruction and shared-fence callback drain now have focused qualification. Bounded expired-head retirement is described below; production takeover wiring, retained-input adoption and full resource/scale qualification remain release work.
+
+## Separate retirement of expired originals
+
+Command 43 (`StopCustodyIntent`, 1 KiB input / 128-byte reply) closes an expired unresolved original without claiming that command 42 executed. Its private factory seals the exact repository-cell tenant/application, operation/ordinal, original intent digest and freshly observed actual owner in the existing `CertificateEnvelope`. The receiver authenticates this purpose-specific carrier, reloads the exact original, and checks expiry using receiver time and the actual executing owner. Current ownership is server authority for metadata retirement; it does not depend on the original actor retaining Write. A live original is refused. An original that committed first remains settled, and an earlier stop remains immutable.
+
+A separate, authenticated `stopped` record binds the original intent and contains the stopping owner's fence, timestamp, stop command stamp and the shared `Recorded` result/sequence. It is at most 1 KiB, cannot coexist with an execution phase or grant identity, and cannot be replaced or cleared. This record removes only pending-head quota. It neither deletes the original bytes nor releases an artifact namespace, independent generation pin or remote object. SDK expiry remains expiry; original execution recovery remains pending when no original result exists. `RegisteredCustody::closed` and `stop_fact` expose logical closure separately from `settled`. Frozen original command 42 cannot execute after a stop, and `OwnedCustody` reports the typed stop fact so exact staging recovery can fence/drain and return local admission without inventing an original reply.
+
+`CustodyStopOutcome` retains the original custody evidence and the separate retirement invocation evidence. A matching recorded stamp recovers that retirement invocation's original receipt before SDK expiry or current authorization checks. If a competing stop won, it returns that first-writer stop fact with `committed=None`; it never attaches the winner's receipt to an unexecuted or unresolved losing SDK identity. Exact absent/lost/panicked retirement invocations stay owned by the existing dispatcher through observer cancellation and closure. Marker-query failure cannot authorize dispatch. A later explicit custody successor may advance from closed history while preserving the prior original's identity and lack of result; the domain receiver still decides whether its requested Begin/Claim/Renew is valid.
+
+`CustodySupervisor` reuses `RecoveryScanLimits`: pages contain at most 128 operation keys, with a bounded 10 ms–60 s interval. The partial `catalog_custody_pending` index seeks byte-ordered keys where both phase and stop are absent. Each original is authenticated separately. Bad heads consume a bounded failure observation and advance the cursor, so later heads remain visitable; wrapping revisits bad heads and newly registered keys behind the cursor. Only expired unresolved heads are eligible. The existing account/class-fair `PublicationCoordinator` owns each ready stop under its reserved maintenance slots and 8 KiB command-wire reservation. A separate dispatcher key kind for retirement preserves the real operation ID and allows a stop alongside its own pending preparation. Duplicate stop work defers admission. Existing operation/account/class byte and worker caps still bound both jobs. Known closure requeues only a preparation whose exact original evidence matches, and that preparation's shared session is fenced before admission returns. Recovery sweeps only uncertain stop jobs in that bounded queue, including accepted stops whose keys have disappeared from the SQL scan. No new unbounded local outbox or fabricated artifact namespace is introduced.
+
+Dropping or shutting down discovery stops between visits and joins its current scan, without canceling already admitted retirement commands. Close/drain the dispatcher separately; unresolved commands retain their original evidence and reservation. Production repository lifecycle wiring, automatic resumption of stopped staging/startup consumers outside the preparation dispatcher and full mixed-load qualification remain required. After process loss, an existing marker proves logical retirement. Without a marker, a new idempotent retirement request may compete for first-writer closure, but cannot rewrite the original custody command or turn its unknown outcome into a result. Durable exact recovery of the retirement transport itself is distinct from that logical first-writer fact.
+
+Eleven regression families cover both object formats and all seven custody kinds; real owner restore after local SQLite removal and retirement SDK expiry; immutable first-writer records; live/forged/stale-owner refusal and accepted-original races; ignored/aborted late-write rollback; absent/lost/panicked/private-query-failed dispatcher recovery through closure; reclaiming exactly one pending slot at the 1,024-head limit; bounded indexed scans past 300 corrupt heads and revisiting earlier keys; accepted-stop recovery after scan-key removal; existing uncertain staging recovery; rejection of an authenticated marker transplanted to a different original; and stopping an expired renewal held in the same dispatcher while fencing its still-live shared session. These are small protocol/capacity-boundary fixtures, not repository or team throughput results.
 
 ## Startup integration
 
@@ -52,7 +66,7 @@ Each new custody transition currently adds one registration mutation plus one ex
 
 Inline command metadata closes the pre-namespace correctness gap, but retaining one SQL row per renewal forever is not the intended final storage strategy. Before release, compact settled per-operation history into bounded immutable frames in a genuinely admitted namespace, reusing the existing saved-command/root/frame codecs and indexed immutable storage. Keep an authenticated discoverable SQL head and retain exact historical lookup; denied pre-admission work cannot depend on a fabricated namespace. Include this history in typed collection, backup and isolated restore, without treating the historical grant's base descriptors as new live roots. The current implementation conservatively retains rows and does not claim repository/team capacity.
 
-The staging and preparation factories now retain this protocol through admission, cancellation and service closure. Complete cold service reconstruction and owner-loss worker lifecycle qualification before release. Remove raw custody bindings from production; domain methods remain callable inside the registered receiver and explicit qualification fixtures only. Remove redundant first-admission columns after their consumers and restart proofs use this journal. Complete foreground producers/readers, final schema removal, serving-generation retention, typed collection/backup, OS resource containment, continuous maintenance, physical rewriting and full-history mixed load before publishing the hard cutover.
+The staging and preparation factories now retain this protocol through admission, cancellation and service closure. Cold registered-head reconstruction and shared-fence callback drain have focused qualification; complete production reconstruction/adoption and OS resource ownership before release. Remove raw custody bindings from production; domain methods remain callable inside the registered receiver and explicit qualification fixtures only. Remove redundant first-admission columns after their consumers and restart proofs use this journal. Complete foreground producers/readers, final schema removal, serving-generation retention, typed collection/backup, OS resource containment, continuous maintenance, physical rewriting and full-history mixed load before publishing the hard cutover.
 
 Qualification covers SHA-1/SHA-256 first-writer races, pre-namespace persistence/discovery, unregistered and losing identities, late registration/phase rollback with SDK absence and exact retry, immutable metadata, all seven transitions, historical receipts after successors, original denied Begin/Renew after real SDK expiry, cold SQLite removal and owner restore, reaped successor Claim, forged tokens, corrupt metadata and bounded indexed lookup. A joint initialized catalog/ref base is tested against the reply ceiling. Real workspace tests check certified repository creation and identical custody metadata after fresh-disk restore. These are focused correctness checks, not a full-history or 10,000-developer capacity claim.
 
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index 9333457c..341ae3f8 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -70,7 +70,7 @@ Known staging grants acquire fresh staging custody. Known preparation grants use
 
 The shared preparation fence now retains a terminal watch value. A bound worker observes that signal independently of coordinator status changes or renewal timers, aborts and joins its callback, and drops owned results/resources before releasing credit. Late subscribers observe the already-fired fence. Bound context checks and cancellation deadlines include the shared session's live lease and ceiling. This qualifies callback ownership; it does not establish OS containment for arbitrary detached subprocesses or I/O.
 
-The command-wire reservation remains 28 KiB, or 32 KiB with a checkpoint, and operation/actor/worker admission caps are unchanged. These bounds do not claim total resident heap or Control/advertisement I/O accounting. Cold restore does not resurrect old workers, authenticate a new physical inventory, reconstruct an unregistered registrar, or resolve an expired unresolved original. Bounded unresolved-head stop/scan, settled-history archival, retained-input adoption and production takeover wiring remain required.
+The command-wire reservation remains 28 KiB, or 32 KiB with a checkpoint, and operation/actor/worker admission caps are unchanged. These bounds do not claim total resident heap or Control/advertisement I/O accounting. Cold restore does not resurrect old workers, authenticate a new physical inventory, reconstruct an unregistered registrar, or resolve an expired unresolved original. The [custody retirement service](durable-custody-command-intents.md#separate-retirement-of-expired-originals) now records a separate stop for expired unresolved heads. Explicit exact recovery observes that typed fact, fences/drains and returns local admission while retaining original evidence without an execution reply. Automatic production resumption, settled-history archival, retained-input adoption and takeover wiring remain required.
 
 Seven regression families cover both object formats and all seven command kinds; actual durable owner restore after local SQLite removal; original positive/negative receipts; changed restart profiles; authoritative absence; lost replies/panics/private-query failure; closed-service recovery; expired unresolved originals; and resource drop before credit release when a shared session fences. Their native workers and histories are small fixtures, not a large-team capacity result.
 
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 7af53fd0..b145e1ff 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -18,11 +18,17 @@ Cold staging now reconstructs the latest authentic registered custody head throu
 
 The proposed [directory file attribution](design/file-attribution.md) uses commit-pinned asynchronous page batches and bounded history caching, with an optional shared immutable index. Its native experiment passes 101 path comparisons across 17 commit states. Its production endpoint, UI, cache/index and load qualification remain unimplemented.
 
+## Bounded expired-custody retirement in progress
+
+The local cutover now has a separate authenticated stop record for expired unresolved custody originals. It preserves the original command identity, bytes, SDK expiry and absence of an execution result while freeing pending-head quota; it grants no native work, generation retention or remote deletion. Command 43 rechecks the exact intent, receiver expiry and actual owner atomically. Known original results and first-writer stops remain immutable. An explicit successor can advance from logical closure without rewriting old history. The typed stop outcome distinguishes the original custody evidence, retirement invocation, first-writer fact and any genuinely known invocation receipt.
+
+`CustodySupervisor` reuses bounded recovery limits and seeks only operation keys through the existing partial pending index. It advances past corrupt heads and wraps for new/failed keys, using the existing account-fair maintenance dispatcher rather than a second outbox. Existing maintenance slots/worker shares and the 8 KiB wire reservation are unchanged. Exact uncertain retirement commands are recovered even when their accepted marker removes the key from discovery. Existing staging recovery observes a typed stop and drains without a fabricated original reply. Eleven focused families pass (19.77 seconds), including authenticated-record transplant rejection and retirement alongside its own pending preparation. The dispatcher uses a distinct retirement key kind with the same real operation ID; it resumes only a preparation whose exact original evidence matches the stop, fencing that shared session before releasing admission. Final-source macOS/Rust 1.98.0 qualification passes all 307 publication tests (191.91 seconds), nine real startup/workspace lifecycle tests (3.24 seconds), warnings-denied workspace/all-target Clippy, the server build and formatting. The full workspace library run passes 585 cases and fails five (590 unique cases; nested subprocess runs excluded): four legacy object-read tests and one fetch-reachability test query the removed `objects` table. That table was already absent from the preceding checkpoint schema; these consumers still require the planned authoritative-reader conversion. The failure is retained in `/tmp/canopy-custody-stop-workspace-library-final.log`; no legacy schema fallback has been added. The 307 focused publication cases are contained in the library run and are not added to its total. Static qualification verifies 441 frozen source/schema/manifest files including 429 Rust files, 135 local documentation links, the exact SDK pins and the unchanged protected index/archive. Evidence is `/tmp/canopy-custody-stop-validation.json`. Production lifecycle wiring and automatic staging/startup resumption outside the preparation dispatcher, settled-history archival and removal of redundant first-admission columns remain required. The full producer/reader/schema, retention/GC/backup/restore, OS containment, maintenance/acceleration, attribution and full-history/team capacity gates remain open.
+
 ## Durable custody command journal started locally
 
 The production cutover now registers exact custody metadata before an upload namespace exists. The journal reuses the SDK snapshot/body contract, authenticated carrier, `Stamp`, `Recorded`, domain admission logic and namespace/pin allocator. Command 41 first-writer registration and command 42 exact execution cover preparation/staging Begin, Claim and Renew plus Bind. Positive and denied results share domain writes and SDK acceptance atomically. Late errors or ignored SQL writes leave SDK resolution absent; exact retry preserves the original identity. Corrupt metadata, `Unknown` and `Expired` are never treated as absence. Historical grants do not grant current custody or become new generation-retention roots. See the [durable custody contract](design/durable-custody-command-intents.md).
 
-Actual repository startup now discovers its latest custody head before preparing another original identity, including lost Begin and successor Claim results. It requires the current owner and a fresh custody query before using a historical grant; known denied final attempts require explicit registered Claim. Indexed authenticated historical grants allow fresh allocation after successor reaping without restoring an old namespace/pin. Production unbinds raw custody commands 11–13, 24–26 and 28; their domain methods are reused inside command 42 and explicit qualification fixtures. The production registry has 15 commands and nine queries. No old custody contract is retained as a production fallback.
+Actual repository startup now discovers its latest custody head before preparing another original identity, including lost Begin and successor Claim results. It requires the current owner and a fresh custody query before using a historical grant; known denied final attempts require explicit registered Claim. Indexed authenticated historical grants allow fresh allocation after successor reaping without restoring an old namespace/pin. Production unbinds raw custody commands 11–13, 24–26 and 28; their domain methods are reused inside command 42 and explicit qualification fixtures. The production registry now has 16 commands and nine queries, including separate expired-custody retirement command 43. No old custody contract is retained as a production fallback.
 
 The journal uses a bounded command relation rather than per-object metadata: 4 KiB intents, 1 KiB phases with 512-byte replies, at most one unresolved head per operation, 1,024 pending heads and a 65,535 ordinal ceiling. Primary/partial grant indexes bound discovery. Registering every custody transition currently adds a mutation before execution. This local append history remains conservatively retained; before release, compact settled metadata into immutable per-operation frames with exact historical lookup. Count actual commands and metadata growth in capacity gates. Do not publish this partial cutover merely because primitive tests pass.
 

From da0bde9a58a913139d74937de6b0da8023b50fc5 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 03:23:30 -0700
Subject: [PATCH 12/55] Recover production initialization after expired custody
 retirement

Retire only the tracked transition's expired unresolved initialization head using the existing authenticated stop factory and exact completion. Preserve original outcomes and SDK identities; choose an explicit successor from a receipt-watermarked indexed observation and reject inconsistent state instead of treating it as absence.

Seven new production-registry/schema regression families cover both object formats, real owner restoration after SQLite deletion, original history, automatic retirement, and authority/purpose/context refusal. Full library:592pass/5fail; the same five legacy readers still query the removed objects table. Nine real lifecycle cases, Clippy, build, fmt and frozen/static checks pass. The cutover remains unpublished and incomplete.
---
 .../src/packs/publication/custody/stop.rs     |  29 +-
 .../src/packs/publication/owner.rs            |   2 +-
 .../src/server/catalog_initialization.rs      | 157 +++++-
 .../server/catalog_initialization/tests.rs    | 526 ++++++++++++++++++
 .../design/durable-custody-command-intents.md |  15 +-
 .../mandatory-publication-registration.md     |   2 +-
 docs/design/staging-service-lifecycle.md      |   2 +-
 .../large-repository-implementation-status.md |   6 +
 8 files changed, 711 insertions(+), 28 deletions(-)
 create mode 100644 crates/canopy-server/src/server/catalog_initialization/tests.rs

diff --git a/crates/canopy-server/src/packs/publication/custody/stop.rs b/crates/canopy-server/src/packs/publication/custody/stop.rs
index 9ab06360..55bfe75a 100644
--- a/crates/canopy-server/src/packs/publication/custody/stop.rs
+++ b/crates/canopy-server/src/packs/publication/custody/stop.rs
@@ -367,11 +367,26 @@ impl ReadyCustodyStop {
         }
         Ok(saved.stopped)
     }
+    /// The repository's admitted, cancellation-owned cold transition may retire
+    /// its one initialization head without starting a separate discovery task.
+    /// This does not authorize native work or discard the original's evidence.
+    pub(crate) async fn complete_tracked(self) -> Result<CustodyStopOutcome, PublicationError> {
+        self.complete_exact(false, 0).await
+    }
     pub(in crate::packs::publication) async fn dispatch(
         self,
         recover: bool,
         fault: u8,
     ) -> Result<PublicationOutcome, PublicationError> {
+        self.complete_exact(recover, fault)
+            .await
+            .map(|outcome| PublicationOutcome::CustodyStop(Box::new(outcome)))
+    }
+    async fn complete_exact(
+        self,
+        recover: bool,
+        fault: u8,
+    ) -> Result<CustodyStopOutcome, PublicationError> {
         let saved = self
             .recorded()
             .await
@@ -416,14 +431,12 @@ impl ReadyCustodyStop {
             }
             (saved.map(|value| value.fact(&self.target)), Some(committed))
         };
-        Ok(PublicationOutcome::CustodyStop(Box::new(
-            CustodyStopOutcome {
-                original: self.original,
-                invocation,
-                stop,
-                committed,
-            },
-        )))
+        Ok(CustodyStopOutcome {
+            original: self.original,
+            invocation,
+            stop,
+            committed,
+        })
     }
     #[cfg(test)]
     pub(in crate::packs::publication) fn input_for_test(
diff --git a/crates/canopy-server/src/packs/publication/owner.rs b/crates/canopy-server/src/packs/publication/owner.rs
index b4c3c581..2270aeee 100644
--- a/crates/canopy-server/src/packs/publication/owner.rs
+++ b/crates/canopy-server/src/packs/publication/owner.rs
@@ -25,7 +25,7 @@ impl PreparationAuthority {
         }
     }
     #[cfg(test)]
-    pub(super) fn local(layout: cellule_ltx::CellStorageLayout, target: CellTarget) -> Self {
+    pub(crate) fn local(layout: cellule_ltx::CellStorageLayout, target: CellTarget) -> Self {
         Self {
             target,
             source: Source::Local(std::sync::Arc::new(
diff --git a/crates/canopy-server/src/server/catalog_initialization.rs b/crates/canopy-server/src/server/catalog_initialization.rs
index caf664c7..d4cc3b5f 100644
--- a/crates/canopy-server/src/server/catalog_initialization.rs
+++ b/crates/canopy-server/src/server/catalog_initialization.rs
@@ -6,10 +6,11 @@ use crate::{
         metadata::MetadataLimits,
         publication::{
             BeginRequest, CatalogPreparation, CheckInitializedCatalog, CheckPreparation,
-            CustodyAction, DEFAULT_LEASE_MS, GenerationFact, InitializationReply, LeaseCheck,
-            LeaseRequest, MaintenanceRequest, PreparationAuthority, PreparationBaseResolver,
-            PreparationDenial, PreparationReply, PreparationToken, PreparedCustody,
-            PublicationError, RegisteredCustody, RegisteredRootRecovery, TerminalReleaseReply,
+            CustodyAction, CustodyError, DEFAULT_LEASE_MS, GenerationFact, InitializationReply,
+            LeaseCheck, LeaseRequest, MaintenanceRequest, PreparationAuthority,
+            PreparationBaseResolver, PreparationDenial, PreparationReply, PreparationToken,
+            PreparedCustody, PublicationError, RegisteredCustody, RegisteredRootRecovery,
+            TerminalReleaseReply,
         },
     },
 };
@@ -158,7 +159,7 @@ pub(super) async fn ensure(
     };
     // Discover the exact latest custody phase before constructing another SDK
     // identity. Both accepted and denied Begin/Claim/Renew survive process loss.
-    let custody = RegisteredCustody::load_latest(&client, target, input.operation).await?;
+    let custody = startup_head(&client, target, &input, &authority).await?;
     let refused_attempt = claim.as_ref().map(|check| check.token);
     let action = if let Some(check) = claim {
         CustodyAction::ClaimPreparation(LeaseRequest {
@@ -168,10 +169,28 @@ pub(super) async fn ensure(
     } else {
         CustodyAction::BeginPreparation(input.clone())
     };
-    let result = if let Some(ref custody) = custody {
-        if !initialization_custody(&custody.action()?, &input) {
-            return Err(Error::Command("initialization custody context differs").into());
+    if let Some(ref custody) = custody
+        && !initialization_custody(&custody.action()?, &input)
+    {
+        return Err(Error::Command("initialization custody context differs").into());
+    }
+    // A stop closes registration, not execution: never manufacture a receipt or
+    // denial for the original. Observe the current operation after the separate
+    // authenticated stop receipt, then let the new receiver authorize a successor.
+    let stopped = custody.as_ref().and_then(RegisteredCustody::stop_fact);
+    let action = if let Some(stopped) = stopped {
+        match observed_attempt(&client, repository, &input, stopped.receipt).await? {
+            Some(check) => CustodyAction::ClaimPreparation(LeaseRequest {
+                check,
+                lease_ms: DEFAULT_LEASE_MS,
+            }),
+            None => CustodyAction::BeginPreparation(input.clone()),
         }
+    } else {
+        action
+    };
+    let replay = custody.as_ref().filter(|saved| saved.stop_fact().is_none());
+    let result = if let Some(custody) = replay {
         custody
             .recover_preparation(&client)
             .await
@@ -192,8 +211,7 @@ pub(super) async fn ensure(
                     PreparationReply::Denied(PreparationDenial::Stale | PreparationDenial::Expired)
                 )
             {
-                let prior = custody
-                    .as_ref()
+                let prior = replay
                     .map(RegisteredCustody::action)
                     .transpose()?
                     .unwrap_or(action);
@@ -331,6 +349,55 @@ pub(super) async fn ensure(
     Ok(())
 }
 
+/// Already owned by the account-bounded, tracked cold transition. No background
+/// outbox or new native work is introduced; ambiguous original outcomes retain
+/// their exact identity, and only receiver-accepted closure permits a successor.
+async fn startup_head(
+    client: &CellClient,
+    target: &cellule_runtime::CellTarget,
+    input: &BeginRequest,
+    authority: &PreparationAuthority,
+) -> Result<Option<RegisteredCustody>, Failure> {
+    let Some(saved) = RegisteredCustody::load_latest(client, target, input.operation).await? else {
+        return Ok(None);
+    };
+    if !initialization_custody(&saved.action()?, input) {
+        return Err(Error::Command("initialization custody context differs").into());
+    }
+    if saved.closed() || saved.evidence().identity().expires_at_ms >= super::unix_now_ms()? {
+        return Ok(Some(saved));
+    }
+    // Journal knowledge precedes SDK expiry. Never retire an already known
+    // grant/denial merely because this previously loaded DTO has no phase.
+    if !matches!(saved.recover_preparation(client).await,
+        Err(InvocationError::Pending(ref evidence)) if **evidence == *saved.evidence())
+    {
+        return Ok(Some(saved));
+    }
+    match saved
+        .ready_stop(client.clone(), super::mutation_identity()?, authority)
+        .await
+    {
+        Ok(ready) => {
+            let outcome = ready.complete_tracked().await?;
+            if outcome.original != *saved.evidence() {
+                return Err(Error::Command("initialization retirement original differs").into());
+            }
+        }
+        Err(CustodyError::Stopped(_)) => {} // Another helper already recorded closure.
+        Err(error) => return Err(error.into()),
+    }
+    let current = RegisteredCustody::load_latest(client, target, input.operation)
+        .await?
+        .ok_or(Error::Command("initialization custody disappeared"))?;
+    if !initialization_custody(&current.action()?, input)
+        || (current.evidence() == saved.evidence() && !current.closed())
+    {
+        return Err(Error::Command("initialization retirement not established").into());
+    }
+    Ok(Some(current))
+}
+
 async fn verify_and_retire(
     repository: &RepositoryCell,
     client: &CellClient,
@@ -386,25 +453,80 @@ async fn prior_attempt(
     input: &BeginRequest,
     minimum: Receipt,
 ) -> Result<LeaseCheck, Failure> {
+    observed_attempt(client, repository, input, minimum)
+        .await?
+        .ok_or_else(|| Error::Command("prior initialization attempt absent").into())
+}
+async fn observed_attempt(
+    client: &CellClient,
+    repository: &RepositoryCell,
+    input: &BeginRequest,
+    minimum: Receipt,
+) -> Result<Option<LeaseCheck>, Failure> {
     let sql = SqlCell::<RepositoryModule>::new(client.clone(), repository.target.clone())?;
     let observed = sql.query(Some(minimum), SqlBatch { statements: vec![SqlStatement {
-        sql: "SELECT o.incarnation,o.owner_epoch,o.admission_sequence,o.artifact_operation FROM catalog_operations o JOIN repository_identity r ON r.singleton=1 WHERE o.id=?1 AND o.actor=?2 AND o.request_digest=?3 AND o.generation=0 AND r.owner=?2 AND r.repository_id=?4 AND r.object_format=?5".into(),
-        parameters: vec![SqlValue::Blob(input.operation.to_vec()), SqlValue::Text(input.actor.clone()), SqlValue::Blob(input.request_digest.to_vec()), SqlValue::Blob(repository.id.to_vec()), SqlValue::Text(repository.object_format.as_str().into())],
+        sql: "SELECT r.repository_id,r.object_format,r.owner,o.actor,o.request_digest,o.generation,o.incarnation,o.owner_epoch,o.admission_sequence,o.artifact_operation FROM repository_identity r LEFT JOIN catalog_operations o ON o.id=?1 WHERE r.singleton=1".into(),
+        parameters: vec![SqlValue::Blob(input.operation.to_vec())],
     }] }).await?;
-    let Some([incarnation, epoch, SqlValue::Integer(sequence), operation]) = observed
+    let Some(
+        [
+            SqlValue::Blob(id),
+            SqlValue::Text(format),
+            SqlValue::Text(owner),
+            actor,
+            digest,
+            generation,
+            incarnation,
+            epoch,
+            sequence,
+            operation,
+        ],
+    ) = observed
         .output
         .first()
         .and_then(|set| set.rows.first())
         .map(Vec::as_slice)
     else {
-        return Err(Error::Command("prior initialization attempt absent").into());
+        return Err(Error::Command("initialization identity absent or malformed").into());
     };
+    if id.as_slice() != repository.id
+        || format != repository.object_format.as_str()
+        || owner != &input.actor
+    {
+        return Err(Error::Command("initialization identity differs").into());
+    }
+    if [
+        actor,
+        digest,
+        generation,
+        incarnation,
+        epoch,
+        sequence,
+        operation,
+    ]
+    .iter()
+    .all(|value| matches!(value, SqlValue::Null))
+    {
+        return Ok(None);
+    }
+    let (
+        SqlValue::Text(actor),
+        SqlValue::Blob(digest),
+        SqlValue::Integer(0),
+        SqlValue::Integer(sequence),
+    ) = (actor, digest, generation, sequence)
+    else {
+        return Err(Error::Command("prior initialization binding malformed").into());
+    };
+    if actor != &input.actor || digest.as_slice() != input.request_digest {
+        return Err(Error::Command("prior initialization binding differs").into());
+    }
     let attempt = u64::try_from(*sequence)
         .map_err(|_| Error::Command("invalid prior initialization sequence"))?;
     if attempt == 0 {
         return Err(Error::Command("invalid prior initialization sequence").into());
     }
-    Ok(LeaseCheck {
+    Ok(Some(LeaseCheck {
         actor: input.actor.clone(),
         token: PreparationToken {
             repository: repository.id,
@@ -417,5 +539,8 @@ async fn prior_attempt(
             attempt,
             artifact_operation: fixed(operation)?,
         },
-    })
+    }))
 }
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/canopy-server/src/server/catalog_initialization/tests.rs b/crates/canopy-server/src/server/catalog_initialization/tests.rs
new file mode 100644
index 00000000..e0ad3728
--- /dev/null
+++ b/crates/canopy-server/src/server/catalog_initialization/tests.rs
@@ -0,0 +1,526 @@
+use super::*;
+use crate::packs::publication::{
+    PublicationCoordinator, PublicationLimits, PublicationOutcome, PublicationState,
+};
+use crate::{CanopyApplication, build_descriptor, repository_target};
+use cellule_app::{ApplicationHandle, CellApplication, CompiledApplication};
+use cellule_ltx::{CellReplica, Limits};
+use cellule_runtime::{
+    ApplicationId, CellModule, CellRuntime, Resolution, SessionId, TenantId,
+    cell::{
+        actor::CellHandle,
+        catalog::{CatalogEntry, CatalogRole, CellCatalog},
+        worker::SqlWorkerPool,
+    },
+    control::{Owner, authority::CellAuthority},
+    ltx::CellStorageLayout,
+};
+use cellule_store::Store;
+use object_store::{memory::InMemory, path::Path as StorePath};
+use tokio::time::{Duration, timeout};
+
+type TestResult<T = ()> = Result<T, Failure>;
+async fn expire(original: &RegisteredCustody) -> TestResult {
+    loop {
+        let expiry = original.evidence().identity().expires_at_ms;
+        let now = super::super::unix_now_ms()?;
+        if now > expiry {
+            return Ok(());
+        }
+        tokio::time::sleep(Duration::from_millis(u64::try_from(expiry - now + 1)?)).await;
+    }
+}
+struct Fixture {
+    files: tempfile::TempDir,
+    repository: RepositoryCell,
+    client: CellClient,
+    runtime: CellRuntime,
+    handle: CellHandle,
+    authority: PreparationAuthority,
+    provider: Arc<dyn ObjectStore>,
+    layout: CellStorageLayout,
+    replica: CellReplica,
+    application: Arc<CompiledApplication>,
+}
+impl Fixture {
+    async fn new(format: ObjectFormat) -> TestResult<Self> {
+        let application = Arc::new(CanopyApplication::compile(build_descriptor(
+            include_bytes!("../../../Cargo.toml"),
+            "startup-custody-test",
+        ))?);
+        let tenant = TenantId::from_bytes([91; 16]);
+        let application_id = ApplicationId::from_bytes([92; 16]);
+        let id = *uuid::Uuid::new_v4().as_bytes();
+        let target = repository_target(tenant, application_id, id)?;
+        let provider: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+        let layout = CellStorageLayout::new(
+            Store::new(Arc::clone(&provider)),
+            StorePath::from("startup-custody"),
+            *application_id.as_bytes(),
+        );
+        let registry = application.registry();
+        let proof = CellCatalog::new(layout.clone(), tenant)
+            .provision(CatalogEntry::new(
+                &target,
+                CatalogRole::Sql,
+                registry
+                    .module_code(RepositoryModule::NAME)
+                    .ok_or("module")?,
+                1,
+            )?)
+            .await?;
+        let incarnation = IncarnationId::from_bytes([93; 16]);
+        let session = SessionId::from_bytes([94; 16]);
+        let control_authority = CellAuthority::new(layout.clone());
+        let control = control_authority
+            .create_initial(
+                &proof,
+                incarnation,
+                Owner {
+                    session,
+                    endpoint: "https://startup-custody.invalid".into(),
+                },
+            )
+            .await?;
+        let replica = CellReplica::new(
+            layout.clone(),
+            *target.cell_id().as_bytes(),
+            *incarnation.as_bytes(),
+            Limits::default(),
+        )?;
+        let files = tempfile::TempDir::new()?;
+        let runtime = CellRuntime::new(SqlWorkerPool::new(1, 4)?, 64 << 20, session)?;
+        let handle = runtime
+            .bootstrap(
+                proof,
+                replica.clone(),
+                control_authority,
+                control,
+                files.path().join("repository.sqlite"),
+                |tx| {
+                    tx.execute_batch(crate::REPOSITORY_SCHEMA)?;
+                    Ok(())
+                },
+            )
+            .await?;
+        let client = CellClient::local(registry.clone(), handle.clone());
+        let app =
+            ApplicationHandle::new(client.clone(), application.clone(), tenant, application_id)?;
+        let repository = RepositoryCell::new(&app, target.clone(), id, format)?;
+        repository
+            .ensure_owner(super::super::mutation_identity()?, "owner")
+            .await?;
+        Ok(Self {
+            files,
+            repository,
+            client,
+            runtime,
+            handle,
+            authority: PreparationAuthority::local(layout.clone(), target),
+            provider,
+            layout,
+            replica,
+            application,
+        })
+    }
+    fn input(&self) -> BeginRequest {
+        request(&self.repository, "owner")
+    }
+    async fn boot(&self) -> TestResult {
+        ensure(
+            InitializationCustody {
+                authority: self.authority.clone(),
+                maintenance: MaintenanceRequest {
+                    repository: self.repository.id,
+                    actor: "owner".into(),
+                    owner: self.handle.owner_fence(),
+                },
+            },
+            &self.repository,
+            self.client.clone(),
+            Arc::clone(&self.provider),
+            self.files.path(),
+            DiskBudget::new(64 << 20),
+            true,
+        )
+        .await
+    }
+    async fn register(&self, action: CustodyAction, short: bool) -> TestResult<RegisteredCustody> {
+        let mut identity = super::super::mutation_identity()?;
+        if short {
+            identity.expires_at_ms = identity.issued_at_ms + 1_000;
+        }
+        let ready =
+            PreparedCustody::prepare(&self.client, &self.repository.target, action, identity)
+                .await?;
+        Ok(ready
+            .register(&self.client, super::super::mutation_identity()?)
+            .await?)
+    }
+    async fn stop(&self, original: &RegisteredCustody) -> TestResult {
+        expire(original).await?;
+        let queue = PublicationCoordinator::new(
+            self.repository.target.clone(),
+            PublicationLimits::default(),
+        )?;
+        let ready = original
+            .ready_stop(
+                self.client.clone(),
+                super::super::mutation_identity()?,
+                &self.authority,
+            )
+            .await?;
+        let ticket = queue.submit(ready).await?;
+        let PublicationState::Finished(Ok(PublicationOutcome::CustodyStop(outcome))) =
+            timeout(Duration::from_secs(10), ticket.wait()).await?
+        else {
+            return Err("wrong stop outcome".into());
+        };
+        assert!(outcome.stop.is_some());
+        assert!(queue.close_and_drain().await.is_empty());
+        Ok(())
+    }
+    async fn restore(&mut self) -> TestResult {
+        let old = self.handle.owner_fence();
+        self.handle.drain().await?;
+        self.runtime.shutdown().await?;
+        std::fs::remove_file(self.files.path().join("repository.sqlite"))?;
+        for name in ["repository.sqlite-wal", "repository.sqlite-shm"] {
+            let path = self.files.path().join(name);
+            if path.exists() {
+                std::fs::remove_file(path)?;
+            }
+        }
+        let session = SessionId::from_bytes([95; 16]);
+        let runtime = CellRuntime::new(SqlWorkerPool::new(1, 4)?, 64 << 20, session)?;
+        let authority = CellAuthority::new(self.layout.clone());
+        let target = &self.repository.target;
+        let idle = authority.load(target.cell_id()).await?.ok_or("idle")?;
+        let proof = CellCatalog::new(self.layout.clone(), target.tenant())
+            .lookup(target.cell_id())
+            .await?
+            .ok_or("provision")?;
+        let handle = runtime
+            .acquire_idle_restored(
+                proof,
+                self.replica.clone(),
+                authority,
+                idle,
+                self.files.path().join("restored.sqlite"),
+                Owner {
+                    session,
+                    endpoint: "https://startup-restored.invalid".into(),
+                },
+            )
+            .await?;
+        assert!(handle.owner_fence().epoch > old.epoch);
+        self.client = CellClient::local(self.application.registry(), handle.clone());
+        let app = ApplicationHandle::new(
+            self.client.clone(),
+            self.application.clone(),
+            target.tenant(),
+            target.application(),
+        )?;
+        self.repository = RepositoryCell::new(
+            &app,
+            target.clone(),
+            self.repository.id,
+            self.repository.object_format,
+        )?;
+        self.runtime = runtime;
+        self.handle = handle;
+        Ok(())
+    }
+    async fn edit(&self, sql: &'static str) -> TestResult {
+        self.handle
+            .execute(
+                super::super::mutation_identity()?,
+                cellule_runtime::Digest::from_bytes(*blake3::hash(sql.as_bytes()).as_bytes()),
+                super::super::unix_now_ms()?,
+                sql.len(),
+                0,
+                move |tx| {
+                    tx.execute_batch(sql)?;
+                    Ok(cellule_runtime::cell::executor::HandlerOutcome::Success(
+                        Vec::new(),
+                    ))
+                },
+            )
+            .await?;
+        Ok(())
+    }
+    async fn assert_original_preserved(&self, original: &RegisteredCustody) -> TestResult {
+        assert!(
+            matches!(original.recover_preparation(&self.client).await, Err(InvocationError::Pending(value)) if *value == *original.evidence())
+        );
+        assert!(matches!(
+            self.client.resolve(original.evidence()).await?,
+            Resolution::Expired
+        ));
+        let history = self.handle.query(0, 8, |c| Ok(c.query_row("SELECT count(*) FROM catalog_custody_commands WHERE phase IS NULL AND stopped IS NOT NULL", [], |r| r.get::<_, u64>(0))?.to_be_bytes().to_vec())).await?;
+        assert_eq!(
+            u64::from_be_bytes(history.try_into().map_err(|_| "count")?),
+            1
+        );
+        Ok(())
+    }
+}
+
+#[tokio::test]
+async fn stopped_startup_begin_can_initialize_without_inventing_an_original_result() -> TestResult {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let original = f
+            .register(CustodyAction::BeginPreparation(f.input()), true)
+            .await?;
+        f.stop(&original).await?;
+        f.boot().await?;
+        f.assert_original_preserved(&original).await?;
+        let head =
+            RegisteredCustody::load_latest(&f.client, &f.repository.target, f.input().operation)
+                .await?
+                .ok_or("head")?;
+        assert_ne!(head.evidence(), original.evidence());
+        assert!(matches!(head.action()?, CustodyAction::BeginPreparation(_)));
+        assert!(head.settled());
+        f.boot().await?;
+        assert_eq!(
+            RegisteredCustody::load_latest(&f.client, &f.repository.target, f.input().operation)
+                .await?
+                .ok_or("head")?
+                .evidence(),
+            head.evidence()
+        );
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn expired_unexecuted_startup_begin_is_retired_by_the_admitted_transition() -> TestResult {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let original = f
+            .register(CustodyAction::BeginPreparation(f.input()), true)
+            .await?;
+        expire(&original).await?;
+        f.boot().await?;
+        f.assert_original_preserved(&original).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn stopped_startup_claim_and_renew_use_current_attempt_after_real_owner_restore() -> TestResult
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for renew in [false, true] {
+            for stop_before_restore in [false, true] {
+                let mut f = Fixture::new(format).await?;
+                let begin = f
+                    .register(CustodyAction::BeginPreparation(f.input()), false)
+                    .await?;
+                let committed = begin.recover_preparation(&f.client).await?;
+                let PreparationReply::Granted(lease) = committed.output else {
+                    return Err("begin grant".into());
+                };
+                let prior = lease.token;
+                let request = LeaseRequest {
+                    check: LeaseCheck {
+                        token: prior,
+                        actor: "owner".into(),
+                    },
+                    lease_ms: DEFAULT_LEASE_MS,
+                };
+                let action = if renew {
+                    CustodyAction::RenewPreparation(request)
+                } else {
+                    CustodyAction::ClaimPreparation(request)
+                };
+                let original = f.register(action, true).await?;
+                if stop_before_restore {
+                    f.stop(&original).await?;
+                } else {
+                    expire(&original).await?;
+                }
+                f.restore().await?;
+                f.boot().await?;
+                f.assert_original_preserved(&original).await?;
+                let head = RegisteredCustody::load_latest(
+                    &f.client,
+                    &f.repository.target,
+                    f.input().operation,
+                )
+                .await?
+                .ok_or("head")?;
+                let CustodyAction::ClaimPreparation(request) = head.action()? else {
+                    return Err("successor must claim observed attempt".into());
+                };
+                assert_eq!(request.check.token, prior);
+                let PreparationReply::Granted(next) =
+                    head.recover_preparation(&f.client).await?.output
+                else {
+                    return Err("successor grant".into());
+                };
+                assert_eq!(next.token.owner, f.handle.owner_fence());
+                assert_ne!(next.token, prior);
+                f.runtime.shutdown().await?;
+            }
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn known_startup_result_precedes_sdk_expiry_and_unexpired_absence_reuses_original()
+-> TestResult {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for execute in [false, true] {
+            let f = Fixture::new(format).await?;
+            let original = f
+                .register(CustodyAction::BeginPreparation(f.input()), execute)
+                .await?;
+            let prior = if execute {
+                Some(original.recover_preparation(&f.client).await?)
+            } else {
+                None
+            };
+            if execute {
+                expire(&original).await?;
+            }
+            f.boot().await?;
+            let head = RegisteredCustody::load_latest(
+                &f.client,
+                &f.repository.target,
+                f.input().operation,
+            )
+            .await?
+            .ok_or("head")?;
+            assert_eq!(head.evidence(), original.evidence());
+            assert!(head.stop_fact().is_none());
+            let result = head.recover_preparation(&f.client).await?;
+            if let Some(prior) = prior {
+                assert_eq!(result.receipt, prior.receipt);
+            }
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn stopped_startup_cannot_turn_inconsistent_binding_into_absence() -> TestResult {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for sql in [
+            "UPDATE catalog_operations SET actor='other'",
+            "UPDATE catalog_operations SET request_digest=zeroblob(32)",
+            "UPDATE repository_identity SET owner='other'",
+        ] {
+            let f = Fixture::new(format).await?;
+            let begin = f
+                .register(CustodyAction::BeginPreparation(f.input()), false)
+                .await?;
+            let PreparationReply::Granted(lease) =
+                begin.recover_preparation(&f.client).await?.output
+            else {
+                return Err("begin grant".into());
+            };
+            let original = f
+                .register(
+                    CustodyAction::RenewPreparation(LeaseRequest {
+                        check: LeaseCheck {
+                            token: lease.token,
+                            actor: "owner".into(),
+                        },
+                        lease_ms: DEFAULT_LEASE_MS,
+                    }),
+                    true,
+                )
+                .await?;
+            f.stop(&original).await?;
+            f.edit(sql).await?;
+            assert!(f.boot().await.is_err());
+            let latest = RegisteredCustody::load_latest(
+                &f.client,
+                &f.repository.target,
+                f.input().operation,
+            )
+            .await?
+            .ok_or("head")?;
+            assert_eq!(latest.evidence(), original.evidence());
+            assert!(!latest.settled());
+            f.assert_original_preserved(&original).await?;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn unavailable_owner_keeps_expired_startup_original_unretired_until_authority_returns()
+-> TestResult {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for corrupt in [false, true] {
+            let f = Fixture::new(format).await?;
+            let original = f
+                .register(CustodyAction::BeginPreparation(f.input()), true)
+                .await?;
+            expire(&original).await?;
+            let path = f
+                .layout
+                .control_path(f.repository.target.cell_id().as_bytes());
+            let (control, _) = f.layout.store().get_with_etag(&path).await?;
+            if corrupt {
+                f.layout
+                    .store()
+                    .put_overwrite(&path, bytes::Bytes::from_static(b"invalid control"))
+                    .await?;
+            } else {
+                f.layout.store().delete(&path).await?;
+            }
+            let error = f
+                .boot()
+                .await
+                .expect_err("missing owner must refuse retirement");
+            assert!(matches!(
+                error.downcast_ref::<CustodyError>(),
+                Some(CustodyError::Owner(_))
+            ));
+            let head = RegisteredCustody::load_latest(
+                &f.client,
+                &f.repository.target,
+                f.input().operation,
+            )
+            .await?
+            .ok_or("head")?;
+            assert_eq!(head.evidence(), original.evidence());
+            assert!(!head.closed());
+            f.layout.store().put_overwrite(&path, control).await?;
+            f.boot().await?;
+            f.assert_original_preserved(&original).await?;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn startup_does_not_retire_another_purpose_at_its_logical_operation() -> TestResult {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let original = f
+            .register(CustodyAction::BeginStaging(f.input()), true)
+            .await?;
+        expire(&original).await?;
+        assert!(f.boot().await.is_err());
+        let head =
+            RegisteredCustody::load_latest(&f.client, &f.repository.target, f.input().operation)
+                .await?
+                .ok_or("head")?;
+        assert_eq!(head.evidence(), original.evidence());
+        assert!(!head.closed());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/docs/design/durable-custody-command-intents.md b/docs/design/durable-custody-command-intents.md
index 7a9e4a37..4123c86f 100644
--- a/docs/design/durable-custody-command-intents.md
+++ b/docs/design/durable-custody-command-intents.md
@@ -50,7 +50,7 @@ A separate, authenticated `stopped` record binds the original intent and contain
 
 `CustodySupervisor` reuses `RecoveryScanLimits`: pages contain at most 128 operation keys, with a bounded 10 ms–60 s interval. The partial `catalog_custody_pending` index seeks byte-ordered keys where both phase and stop are absent. Each original is authenticated separately. Bad heads consume a bounded failure observation and advance the cursor, so later heads remain visitable; wrapping revisits bad heads and newly registered keys behind the cursor. Only expired unresolved heads are eligible. The existing account/class-fair `PublicationCoordinator` owns each ready stop under its reserved maintenance slots and 8 KiB command-wire reservation. A separate dispatcher key kind for retirement preserves the real operation ID and allows a stop alongside its own pending preparation. Duplicate stop work defers admission. Existing operation/account/class byte and worker caps still bound both jobs. Known closure requeues only a preparation whose exact original evidence matches, and that preparation's shared session is fenced before admission returns. Recovery sweeps only uncertain stop jobs in that bounded queue, including accepted stops whose keys have disappeared from the SQL scan. No new unbounded local outbox or fabricated artifact namespace is introduced.
 
-Dropping or shutting down discovery stops between visits and joins its current scan, without canceling already admitted retirement commands. Close/drain the dispatcher separately; unresolved commands retain their original evidence and reservation. Production repository lifecycle wiring, automatic resumption of stopped staging/startup consumers outside the preparation dispatcher and full mixed-load qualification remain required. After process loss, an existing marker proves logical retirement. Without a marker, a new idempotent retirement request may compete for first-writer closure, but cannot rewrite the original custody command or turn its unknown outcome into a result. Durable exact recovery of the retirement transport itself is distinct from that logical first-writer fact.
+Dropping or shutting down discovery stops between visits and joins its current scan, without canceling already admitted retirement commands. Close/drain the dispatcher separately; unresolved commands retain their original evidence and reservation. General production repository scanner lifecycle wiring, automatic resumption of stopped staging consumers and full mixed-load qualification remain required. The production initializer now handles its one admitted head as described below. After process loss, an existing marker proves logical retirement. Without a marker, a new idempotent retirement request may compete for first-writer closure, but cannot rewrite the original custody command or turn its unknown outcome into a result. Durable exact recovery of the retirement transport itself is distinct from that logical first-writer fact.
 
 Eleven regression families cover both object formats and all seven custody kinds; real owner restore after local SQLite removal and retirement SDK expiry; immutable first-writer records; live/forged/stale-owner refusal and accepted-original races; ignored/aborted late-write rollback; absent/lost/panicked/private-query-failed dispatcher recovery through closure; reclaiming exactly one pending slot at the 1,024-head limit; bounded indexed scans past 300 corrupt heads and revisiting earlier keys; accepted-stop recovery after scan-key removal; existing uncertain staging recovery; rejection of an authenticated marker transplanted to a different original; and stopping an expired renewal held in the same dispatcher while fencing its still-live shared session. These are small protocol/capacity-boundary fixtures, not repository or team throughput results.
 
@@ -60,6 +60,18 @@ Pending repository initialization discovers its latest registered custody head b
 
 The certified final initializer, its immutable root graph and [terminal retirement](terminal-publication-retention.md) remain the authority before repository Ready. The existing tracked repository transition owns startup through cancellation. Ready restore observes the immutable initialization and preserves the original intent/phase bytes without allocating another namespace. There is no new product API or permission granted by these private metadata queries.
 
+## Production initialization after logical retirement
+
+The production repository transition now discovers its one deterministic initialization head before new custody registration. It validates initialization purpose and logical context. A settled phase remains execution knowledge, including after SDK expiry. An expired unresolved original is first recovered exactly; only the same original's unresolved evidence allows preparing retirement. The authenticated stop receiver independently checks actual ownership and its clock. Missing/corrupt current-owner authority refuses retirement and retains the original. Unexpired absent originals continue through their existing exact execution path.
+
+Startup reuses the same retirement factory, sealed input, first-writer record and exact-result logic as the maintenance dispatcher. Its crate-private `complete_tracked` entry point runs inside the existing account-bounded repository transition, which the manager's task tracker owns through HTTP observer cancellation. It visits only that initialization head and does not create a background scanner, dispatcher job or outbox. The maintenance dispatcher's 8 KiB reservation describes its own service path, not this transition's total resident memory. Native preparation cannot begin until closure is observed and a separate newly registered custody receiver grants fresh authority.
+
+After authenticated closure, startup reads the current operation at or after the stop's receipt. The indexed singleton/operation lookup validates repository ID, object format, owner, actor, digest, preparation generation and token fields. A wholly absent operation permits Begin; a matching current initialization attempt selects Claim. Mismatched or malformed state is an error rather than absence. The original stopped command keeps its bytes, identity and unresolved SDK result; startup never fabricates an original denial or receipt. The successor is explicit journal history and still undergoes current Write, actual owner, token/pin, namespace and quota checks. A newer failure is handled using that successor's action, not attributed to the old stopped action.
+
+Registered final initialization is resolved before this path. Unknown final publication cannot be skipped using an unrelated custody stop. Ready repositories still require their retained certified initialization and never create an empty catalog in response to missing metadata. General resident-repository scanner ownership/drain, automatic stopped staging resumption, retained-input adoption and settled-history archival remain required.
+
+Seven regression families exercise both object formats through the production registry/schema and actual initializer. They cover manual closure and automatic retirement, preserving unknown original results, live absence and known grants after SDK expiry, stopped Claim/Renew with genuine owner restoration after deleting local SQLite (including retirement under the restored owner), wrong purpose, inconsistent actor/digest/identity, and missing/corrupt durable Control. The final focused run passes in 16.12 seconds. The full frozen-source workspace library run passes 592 cases and fails only the same five unconverted legacy-reader cases; all 307 publication and seven startup cases pass within that run. Nine real startup/workspace lifecycle cases additionally pass in 3.48 seconds. Workspace/all-target Clippy with warnings denied, the server build, formatting and static protection checks pass. These results qualify this startup increment, not the full producer/reader cutover or large-team capacity. Evidence is `/tmp/canopy-startup-stop-validation.json`.
+
 ## Cost and release work
 
 Each new custody transition currently adds one registration mutation plus one execution mutation. Exact known lookup/replay adds no execution mutation; already registered retries avoid another registration mutation. Count these phases, policy/native checkpoints, final registration and completion in serialized service-time and fairness budgets. The earlier two-command illustration is not this protocol's total push cost.
@@ -74,6 +86,7 @@ Reproduce the focused checks with the pinned SDK dependencies and Rust 1.98.0:
 
 ```sh
 cargo +1.98.0 test -p canopy-server --lib packs::publication --locked -- --test-threads=4
+cargo +1.98.0 test -p canopy-server --lib server::catalog_initialization::tests --locked -- --test-threads=2
 cargo +1.98.0 test -p canopy-server --test multi_server workspace --locked -- --test-threads=4
 cargo +1.98.0 clippy --workspace --all-targets --locked -- -D warnings
 cargo +1.98.0 build -p canopy-server --bin canopy --locked
diff --git a/docs/design/mandatory-publication-registration.md b/docs/design/mandatory-publication-registration.md
index c1a05179..5eb6f150 100644
--- a/docs/design/mandatory-publication-registration.md
+++ b/docs/design/mandatory-publication-registration.md
@@ -35,7 +35,7 @@ Live factories persist their exact bundle, then bind it into `ReadyBoundRecovery
 
 `ReadyInitialization` derives the private empty proof from its retained `PreparedCatalog`, freezes command 31 and persists the same exact SDK snapshot/body/header before dispatch. Registration command 39 pins `Kind::Initialization` in the existing attempt namespace. Matching original capabilities can bind into the existing fair publication queue. Production repository startup instead retains this same owner through its already admitted, tracked repository transition. Unknown registration never authorizes final execution.
 
-Pending startup discovers the latest authenticated custody command before constructing another Begin identity, then queries the current indexed operation/pin binding separately. A recovered positive verifies the original empty catalog/directory/ref roots. Only a known original Stale/Expired final denial permits Claim of that observed attempt; other uncertainty propagates. Ready restoration observes the retained initialization fact without creating a new attempt.
+Pending startup discovers the latest authenticated custody command before constructing another Begin identity, then queries the current indexed operation/pin binding separately. Its tracked transition can now retire its expired unresolved initialization head through the separate authenticated stop receiver. An observed stop permits a new registered Begin for a wholly absent operation, or Claim of the matching current initialization attempt, without inventing an outcome for the original. See [production initialization after logical retirement](durable-custody-command-intents.md#production-initialization-after-logical-retirement). A recovered positive verifies the original empty catalog/directory/ref roots. Only a known original Stale/Expired final denial permits Claim of that observed attempt; other uncertainty propagates. Ready restoration observes the retained initialization fact without creating a new attempt.
 
 The preceding first-admission increment recovered the [first accepted preparation admission](initial-preparation-receipts.md) before another Begin. Its original receipt is durable independently of SDK expiry, while current owner/custody are checked separately. The later local [custody intent protocol](durable-custody-command-intents.md) supersedes this startup lookup with a registered original snapshot and positive/negative phase journal. The first-admission carrier remains in domain/qualification consumers pending their conversion.
 
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index 341ae3f8..2871cb6d 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -70,7 +70,7 @@ Known staging grants acquire fresh staging custody. Known preparation grants use
 
 The shared preparation fence now retains a terminal watch value. A bound worker observes that signal independently of coordinator status changes or renewal timers, aborts and joins its callback, and drops owned results/resources before releasing credit. Late subscribers observe the already-fired fence. Bound context checks and cancellation deadlines include the shared session's live lease and ceiling. This qualifies callback ownership; it does not establish OS containment for arbitrary detached subprocesses or I/O.
 
-The command-wire reservation remains 28 KiB, or 32 KiB with a checkpoint, and operation/actor/worker admission caps are unchanged. These bounds do not claim total resident heap or Control/advertisement I/O accounting. Cold restore does not resurrect old workers, authenticate a new physical inventory, reconstruct an unregistered registrar, or resolve an expired unresolved original. The [custody retirement service](durable-custody-command-intents.md#separate-retirement-of-expired-originals) now records a separate stop for expired unresolved heads. Explicit exact recovery observes that typed fact, fences/drains and returns local admission while retaining original evidence without an execution reply. Automatic production resumption, settled-history archival, retained-input adoption and takeover wiring remain required.
+The command-wire reservation remains 28 KiB, or 32 KiB with a checkpoint, and operation/actor/worker admission caps are unchanged. These bounds do not claim total resident heap or Control/advertisement I/O accounting. Cold restore does not resurrect old workers, authenticate a new physical inventory, reconstruct an unregistered registrar, or resolve an expired unresolved original. The [custody retirement service](durable-custody-command-intents.md#separate-retirement-of-expired-originals) now records a separate stop for expired unresolved heads. Explicit exact recovery observes that typed fact, fences/drains and returns local admission while retaining original evidence without an execution reply. Automatic production staging resumption, settled-history archival, retained-input adoption and takeover wiring remain required. The separate [production initialization transition](durable-custody-command-intents.md#production-initialization-after-logical-retirement) now retires its own expired unresolved head and chooses an explicit successor; it does not instantiate the general staging scanner lifecycle.
 
 Seven regression families cover both object formats and all seven command kinds; actual durable owner restore after local SQLite removal; original positive/negative receipts; changed restart profiles; authoritative absence; lost replies/panics/private-query failure; closed-service recovery; expired unresolved originals; and resource drop before credit release when a shared session fences. Their native workers and histories are small fixtures, not a large-team capacity result.
 
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index b145e1ff..485bf4ba 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -24,6 +24,12 @@ The local cutover now has a separate authenticated stop record for expired unres
 
 `CustodySupervisor` reuses bounded recovery limits and seeks only operation keys through the existing partial pending index. It advances past corrupt heads and wraps for new/failed keys, using the existing account-fair maintenance dispatcher rather than a second outbox. Existing maintenance slots/worker shares and the 8 KiB wire reservation are unchanged. Exact uncertain retirement commands are recovered even when their accepted marker removes the key from discovery. Existing staging recovery observes a typed stop and drains without a fabricated original reply. Eleven focused families pass (19.77 seconds), including authenticated-record transplant rejection and retirement alongside its own pending preparation. The dispatcher uses a distinct retirement key kind with the same real operation ID; it resumes only a preparation whose exact original evidence matches the stop, fencing that shared session before releasing admission. Final-source macOS/Rust 1.98.0 qualification passes all 307 publication tests (191.91 seconds), nine real startup/workspace lifecycle tests (3.24 seconds), warnings-denied workspace/all-target Clippy, the server build and formatting. The full workspace library run passes 585 cases and fails five (590 unique cases; nested subprocess runs excluded): four legacy object-read tests and one fetch-reachability test query the removed `objects` table. That table was already absent from the preceding checkpoint schema; these consumers still require the planned authoritative-reader conversion. The failure is retained in `/tmp/canopy-custody-stop-workspace-library-final.log`; no legacy schema fallback has been added. The 307 focused publication cases are contained in the library run and are not added to its total. Static qualification verifies 441 frozen source/schema/manifest files including 429 Rust files, 135 local documentation links, the exact SDK pins and the unchanged protected index/archive. Evidence is `/tmp/canopy-custody-stop-validation.json`. Production lifecycle wiring and automatic staging/startup resumption outside the preparation dispatcher, settled-history archival and removal of redundant first-admission columns remain required. The full producer/reader/schema, retention/GC/backup/restore, OS containment, maintenance/acceleration, attribution and full-history/team capacity gates remain open.
 
+## Production startup retirement in progress
+
+The production initializer now recognizes authenticated stopped originals and chooses an explicit successor from a receipt-watermarked indexed observation of the current operation. It distinguishes a wholly absent operation from inconsistent repository identity, actor, digest, generation or token metadata. Its existing tracked/account-bounded transition can retire its own expired unresolved head through the shared private stop factory/exact completion; known original grants/denials still take precedence over SDK expiry. This does not instantiate general resident-repository discovery or automatic staging recovery. No new native authority comes from retirement, and no compatibility schema or synthetic original result is introduced.
+
+The original regression returns `InvocationError::Pending` after an authentic manual stop against the preceding initializer (`/tmp/canopy-startup-stop-red-fixed-fixture.log`). The first composed four-family run passes in 11.77 seconds. The subsequent expanded run passes six and fails one fixture setup because its injected SQL edit reserved zero mailbox bytes; the fixture now charges its actual SQL bytes using the existing SDK admission contract. Final-source macOS/Rust 1.98.0 qualification passes all seven startup families in 16.12 seconds, including automatic retirement after real owner restoration. The full workspace library run passes 592 cases and fails only the same five unconverted readers (597 unique library cases; two nested subprocess results excluded). All 307 publication and seven new startup cases are contained in that run and are not added again. Nine real startup/workspace lifecycle cases pass in 3.48 seconds: 606 unique cases executed, 601 passed and five failed. Workspace/all-target Clippy with warnings denied (30.31 seconds), the server build (34.58 seconds), formatting, diff checks, 442 frozen source/schema/manifest files including 430 Rust files, 137 local documentation links, exact SDK pins and protected index/archive checks pass. The proof is `/tmp/canopy-startup-stop-validation.json`. General production scanner ownership/drain, stopped staging resumption, retained-input adoption and admitted history archival remain immediate custody work. The five legacy reader failures from the previous full library run still require the planned reader conversion. All remaining full producer/reader/final-schema, serving retention, typed GC/backup/isolated restore, OS containment, maintenance/acceleration, file attribution and full-history/team capacity gates remain open.
+
 ## Durable custody command journal started locally
 
 The production cutover now registers exact custody metadata before an upload namespace exists. The journal reuses the SDK snapshot/body contract, authenticated carrier, `Stamp`, `Recorded`, domain admission logic and namespace/pin allocator. Command 41 first-writer registration and command 42 exact execution cover preparation/staging Begin, Claim and Renew plus Bind. Positive and denied results share domain writes and SDK acceptance atomically. Late errors or ignored SQL writes leave SDK resolution absent; exact retry preserves the original identity. Corrupt metadata, `Unknown` and `Expired` are never treated as absence. Historical grants do not grant current custody or become new generation-retention roots. See the [durable custody contract](design/durable-custody-command-intents.md).

From b768e2bfdb5e82b1997f0bbed464d6221c15f2d4 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 04:16:13 -0700
Subject: [PATCH 13/55] Automatically drain staging after authenticated custody
 retirement

---
 .../src/packs/publication/custody/dispatch.rs |  41 ++
 .../src/packs/publication/staging_service.rs  |  76 +++
 .../publication/staging_service/retirement.rs | 150 ++++++
 .../packs/publication/tests/custody_stop.rs   |  21 +-
 .../publication/tests/staging_service.rs      |   1 +
 .../tests/staging_service/retirement.rs       | 508 ++++++++++++++++++
 .../design/durable-custody-command-intents.md |   6 +-
 docs/design/staging-service-lifecycle.md      |  18 +-
 .../large-repository-implementation-status.md |   8 +
 9 files changed, 819 insertions(+), 10 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/staging_service/retirement.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs

diff --git a/crates/canopy-server/src/packs/publication/custody/dispatch.rs b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
index 2c6fd95c..80f4a7c0 100644
--- a/crates/canopy-server/src/packs/publication/custody/dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
@@ -13,7 +13,48 @@ pub(in crate::packs::publication) struct OwnedCustody {
     prepared: PreparedCustody,
     registration: Option<PreparedCommand<RegisterCustodyIntent>>,
 }
+/// A read probe retains no original command body or registrar. Its exact
+/// fingerprint prevents a later logical successor from hiding this ordinal.
+#[derive(Clone)]
+pub(in crate::packs::publication) struct CustodyStopProbe {
+    target: CellTarget,
+    operation: [u8; 16],
+    step: u32,
+    digest: [u8; 32],
+    evidence: PendingMutation,
+}
+impl CustodyStopProbe {
+    pub(in crate::packs::publication) fn evidence(&self) -> &PendingMutation {
+        &self.evidence
+    }
+    pub(in crate::packs::publication) async fn observed(
+        &self,
+        client: &CellClient,
+    ) -> Result<bool, CustodyError> {
+        let Some(saved) = load(client, &self.target, self.operation, Some(self.step)).await? else {
+            return Ok(false);
+        };
+        if *blake3::hash(&saved.intent.encoded()?).as_bytes() != self.digest
+            || saved.evidence() != &self.evidence
+        {
+            return Err(CustodyError::Context);
+        }
+        Ok(saved.stop_fact().is_some())
+    }
+}
 impl OwnedCustody {
+    pub(in crate::packs::publication) fn stop_probe(
+        &self,
+    ) -> Result<CustodyStopProbe, CustodyError> {
+        let header = self.prepared.intent.header()?;
+        Ok(CustodyStopProbe {
+            target: self.evidence().target().clone(),
+            operation: header.operation,
+            step: header.step,
+            digest: *blake3::hash(&self.prepared.intent.encoded()?).as_bytes(),
+            evidence: self.evidence().clone(),
+        })
+    }
     pub(in crate::packs::publication) async fn prepare(
         client: &CellClient,
         target: &CellTarget,
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index f83c72a7..be65295c 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -22,6 +22,7 @@ mod bound;
 use bound::accept_bound;
 mod publication;
 mod restore;
+mod retirement;
 pub use publication::{StagedPublicationFailure, StagedPublicationTicket};
 
 const COMMAND_BYTES: u32 = 4096;
@@ -323,6 +324,11 @@ struct ActorAdmission {
 #[derive(Default)]
 struct Admission {
     closed: bool,
+    retirement_probe: bool,
+    retirement_probes: u64,
+    retirement_failures: u64,
+    retirement_recoveries: u64,
+    retirement_restarts: u64,
     jobs: HashMap<[u8; 16], Arc<Job>>,
     actors: HashMap<String, ActorAdmission>,
 }
@@ -417,6 +423,18 @@ fn custody_guard(job: &Job) -> Result<(), Error> {
 }
 
 impl Exact {
+    fn custody_original(&self) -> Option<&OwnedCustody> {
+        match self {
+            Self::Restored(c)
+            | Self::Begin(c)
+            | Self::Claim(c)
+            | Self::Renew(c)
+            | Self::Bind(c)
+            | Self::BoundClaim(c)
+            | Self::BoundRenew(c) => Some(c),
+            Self::Checkpoint(_) | Self::BoundCheckpoint(_) => None,
+        }
+    }
     fn pending(&self) -> StagingError {
         match self {
             Self::Restored(c) => StagingError::Restoration(Box::new(InvocationError::Pending(
@@ -566,6 +584,12 @@ pub struct StagingStats {
     pub uncertain: usize,
     pub command_bytes: u64,
     pub closed: bool,
+    /// Read-only exact-original probes, outside the command wire reservation.
+    pub retirement_probes: u64,
+    pub retirement_failures: u64,
+    pub retirement_recoveries: u64,
+    pub retirement_restarts: u64,
+    pub retirement_running: bool,
 }
 impl StagingCoordinator {
     pub fn new(
@@ -723,6 +747,11 @@ impl StagingCoordinator {
                 })
                 .sum(),
             closed: a.closed,
+            retirement_probes: a.retirement_probes,
+            retirement_failures: a.retirement_failures,
+            retirement_recoveries: a.retirement_recoveries,
+            retirement_restarts: a.retirement_restarts,
+            retirement_running: a.retirement_probe,
         }
     }
     /// Stop admission and renew while accepted workers drain. Uncertain exact
@@ -1179,6 +1208,46 @@ impl StagingTicket {
         })
     }
     #[cfg(test)]
+    pub(super) async fn renew_with_identity_for_test(
+        &self,
+        identity: MutationIdentity,
+    ) -> Result<(), StagingError> {
+        let (token, bound) = {
+            let local = self.job.local.lock().expect("staging local");
+            if local.fenced {
+                return Err(StagingError::Inactive);
+            }
+            match &local.bound {
+                Some(session) => (session.live_lease()?.0.token, true),
+                None => (local.lease.ok_or(StagingError::NotReady)?.token, false),
+            }
+        };
+        let lease = LeaseRequest {
+            check: LeaseCheck {
+                token,
+                actor: self.job.actor.clone(),
+            },
+            lease_ms: self.inner.limits.lease_ms,
+        };
+        let action = if bound {
+            CustodyAction::RenewPreparation(lease)
+        } else {
+            CustodyAction::RenewStaging(lease)
+        };
+        let command =
+            OwnedCustody::prepare(&self.job.client, &self.job.target, action, identity).await?;
+        let mut exact = self.job.exact.lock().expect("staging exact");
+        assert!(exact.is_none(), "test renewal replaced an original");
+        *exact = Some(if bound {
+            Exact::BoundRenew(command)
+        } else {
+            Exact::Renew(command)
+        });
+        drop(exact);
+        self.job.changed.notify_one();
+        Ok(())
+    }
+    #[cfg(test)]
     pub(super) fn renew_for_test(&self) {
         self.job.local.lock().expect("staging local").renew = true;
         self.job.changed.notify_one();
@@ -1404,6 +1473,9 @@ async fn supervise(inner: Arc<Inner>, job: Arc<Job>) {
         job.status
             .send_replace(StagingState::Uncertain(Arc::new(exact.pending())));
         inner.drained.notify_waiters();
+        if exact.custody_original().is_some() {
+            retirement::start(Arc::clone(&inner));
+        }
         await_recovery(&job).await;
         recover = true;
     }
@@ -1454,6 +1526,7 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
             let fault = inner.fault.swap(0, std::sync::atomic::Ordering::AcqRel);
             #[cfg(not(test))]
             let fault = 0;
+            let custody = command.custody_original().is_some();
             let pending = command.pending();
             let result =
                 tokio::spawn(command.execute(job.client.clone(), Arc::clone(&job), recover, fault))
@@ -1471,6 +1544,9 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
                     job.status
                         .send_replace(StagingState::Uncertain(Arc::new(error)));
                     inner.drained.notify_waiters();
+                    if custody {
+                        retirement::start(Arc::clone(&inner));
+                    }
                     await_recovery(&job).await;
                     recover = true;
                     continue;
diff --git a/crates/canopy-server/src/packs/publication/staging_service/retirement.rs b/crates/canopy-server/src/packs/publication/staging_service/retirement.rs
new file mode 100644
index 00000000..84c36342
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/staging_service/retirement.rs
@@ -0,0 +1,150 @@
+//! One read-only sweeper per service, over existing bounded admitted jobs.
+use super::*;
+use std::collections::BinaryHeap;
+
+pub(super) fn start(inner: Arc<Inner>) {
+    let mut admission = inner.admission.lock().expect("staging admission");
+    if admission.retirement_probe {
+        return;
+    }
+    admission.retirement_probe = true;
+    drop(admission);
+    tokio::spawn(async move {
+        loop {
+            if tokio::spawn(run(Arc::clone(&inner))).await.is_ok() {
+                return;
+            }
+            {
+                let mut admission = inner.admission.lock().expect("staging admission");
+                admission.retirement_restarts = admission.retirement_restarts.saturating_add(1);
+            }
+            tracing::error!("staging retirement probe failed; retaining exact jobs and restarting");
+            tokio::time::sleep(RecoveryScanLimits::default().interval).await;
+        }
+    });
+}
+fn eligible(job: &Job) -> bool {
+    matches!(*job.status.borrow(), StagingState::Uncertain(_))
+        && job
+            .exact
+            .lock()
+            .expect("staging exact")
+            .as_ref()
+            .is_some_and(|exact| exact.custody_original().is_some())
+}
+fn page(inner: &Inner, after: &mut Option<[u8; 16]>, limit: usize) -> Option<Vec<Arc<Job>>> {
+    let mut admission = inner.admission.lock().expect("staging admission");
+    let mut keys = BinaryHeap::with_capacity(limit + 1);
+    for pass in 0..2 {
+        for (operation, job) in &admission.jobs {
+            if after.is_none_or(|cursor| *operation > cursor) && eligible(job) {
+                keys.push(*operation);
+                if keys.len() > limit {
+                    keys.pop();
+                }
+            }
+        }
+        if !keys.is_empty() {
+            break;
+        }
+        if pass == 0 {
+            *after = None;
+        }
+    }
+    if keys.is_empty() {
+        // The same lock covers start/exit, so a newly uncertain job cannot lose
+        // its wakeup between observing an empty page and relinquishing ownership.
+        admission.retirement_probe = false;
+        return None;
+    }
+    Some(
+        keys.into_sorted_vec()
+            .into_iter()
+            .map(|key| Arc::clone(&admission.jobs[&key]))
+            .collect(),
+    )
+}
+async fn visit(inner: &Arc<Inner>, job: &Arc<Job>) {
+    let probe = {
+        let exact = job.exact.lock().expect("staging exact");
+        exact
+            .as_ref()
+            .and_then(Exact::custody_original)
+            .map(OwnedCustody::stop_probe)
+    };
+    let Some(probe) = probe else {
+        return;
+    };
+    let probe = match probe {
+        Ok(probe) => probe,
+        Err(error) => {
+            failed(inner, &error);
+            return;
+        }
+    };
+    // No ready command/body is cloned across this await. This independent read
+    // uses SDK query admission, and never performs registration or execution.
+    let stopped = probe.observed(&job.client).await;
+    {
+        let mut admission = inner.admission.lock().expect("staging admission");
+        admission.retirement_probes = admission.retirement_probes.saturating_add(1);
+    }
+    match stopped {
+        Ok(true) => {}
+        Ok(false) => return,
+        Err(error) => {
+            failed(inner, &error);
+            return;
+        }
+    }
+    let same_original = job
+        .exact
+        .lock()
+        .expect("staging exact")
+        .as_ref()
+        .and_then(Exact::custody_original)
+        .is_some_and(|current| current.evidence() == probe.evidence());
+    if !same_original {
+        return;
+    }
+    let ticket = StagingTicket {
+        inner: Arc::clone(inner),
+        job: Arc::clone(job),
+    };
+    // Exact recovery reauthenticates closure, fences the shared session and
+    // drains resources before returning admission. Closure never becomes a reply.
+    if (StagingCoordinator {
+        inner: Arc::clone(inner),
+    })
+    .recover(&ticket)
+    .is_ok()
+    {
+        let mut admission = inner.admission.lock().expect("staging admission");
+        admission.retirement_recoveries = admission.retirement_recoveries.saturating_add(1);
+    }
+}
+fn failed(inner: &Inner, error: &CustodyError) {
+    let mut admission = inner.admission.lock().expect("staging admission");
+    admission.retirement_failures = admission.retirement_failures.saturating_add(1);
+    tracing::debug!(%error, "staging retirement probe unavailable; retaining original");
+}
+async fn run(inner: Arc<Inner>) {
+    let limits = RecoveryScanLimits::default();
+    let mut after = None;
+    loop {
+        let Some(jobs) = page(&inner, &mut after, usize::from(limits.page)) else {
+            return;
+        };
+        let deadline = Instant::now() + limits.interval;
+        for job in jobs {
+            after = Some(job.operation);
+            visit(&inner, &job).await;
+            // A slow failed head advances the cursor without consuming the rest
+            // of this round. Keep the read owner until its query finishes.
+            if Instant::now() >= deadline {
+                break;
+            }
+        }
+        tokio::time::sleep(limits.interval).await;
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
index 8add5271..de321237 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
@@ -613,13 +613,20 @@ async fn custody_scan_recovers_exact_maintenance_commands_after_their_pending_ke
                 .stop_fact()
                 .ok_or("stopped original")?;
             assert!(fact.receipt.commit_sequence > 0);
-            // An already admitted uncertain staging owner observes typed closure
-            // on explicit recovery; it never receives a fabricated original reply.
-            staging.recover(&stage)?;
-            assert!(matches!(
-                timeout(Duration::from_secs(10), stage.wait_terminal()).await?,
-                StagingState::Fenced(_)
-            ));
+            // No waiter or manual recovery is needed to observe logical closure.
+            timeout(Duration::from_secs(5), async {
+                while !matches!(stage.state(), StagingState::Fenced(_)) {
+                    tokio::time::sleep(Duration::from_millis(10)).await;
+                }
+            })
+            .await?;
+            let StagingState::Fenced(error) = stage.state() else {
+                return Err("retired stage not fenced".into());
+            };
+            assert!(
+                matches!(&*error, StagingError::Custody { evidence: original, source }
+                if **original == evidence && matches!(&**source, CustodyError::Stopped(_)))
+            );
             assert_eq!(stage.restored_evidence(), Some(&evidence));
             assert!(stage.restored_outcome().is_none());
             assert_eq!(staging.stats().command_bytes, 0);
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index 2e02a24c..e9ca6399 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -1,6 +1,7 @@
 mod bound;
 mod publication;
 pub(super) mod restore;
+mod retirement;
 use super::*;
 use tokio::{
     sync::oneshot,
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs
new file mode 100644
index 00000000..6482325f
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs
@@ -0,0 +1,508 @@
+//! Automatic closure must preserve original knowledge and resource ownership.
+use super::super::publishing::edit;
+use super::*;
+use cellule_runtime::{PendingMutation, Resolution};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+
+async fn expired(evidence: &PendingMutation) -> Result {
+    let now = crate::packs::publication::sql::now(0)?;
+    if now <= evidence.identity().expires_at_ms {
+        tokio::time::sleep(Duration::from_millis(
+            (evidence.identity().expires_at_ms - now + 1) as u64,
+        ))
+        .await;
+    }
+    Ok(())
+}
+async fn until(c: &StagingCoordinator, predicate: impl Fn(StagingStats) -> bool) -> Result {
+    timeout(Duration::from_secs(10), async {
+        while !predicate(c.stats()) {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
+    Ok(())
+}
+async fn head(f: &Fixture, operation: [u8; 16]) -> Result<RegisteredCustody> {
+    Ok(
+        RegisteredCustody::load_latest(&f.client(), &f.target, operation)
+            .await?
+            .ok_or("custody head missing")?,
+    )
+}
+async fn stop(f: &Fixture, original: &RegisteredCustody) -> Result {
+    let ready = original
+        .ready_stop(f.client(), identity()?, &f.authority())
+        .await?;
+    assert_eq!(
+        ready.command_for_test().execute().await?.output,
+        CustodyStopReply::Stopped
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn automatic_retirement_closes_all_seven_cold_originals_after_observer_drop_and_service_close()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for kind in 0..7 {
+            let f = Fixture::new(format).await?;
+            let (evidence, _) = restore::head_expiring(&f, kind, false, true).await?;
+            expired(&evidence).await?;
+            let c =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+            let ticket = c
+                .submit(
+                    ReadyStaging::restore(f.client(), f.target.clone(), [230 + kind; 16]).await?,
+                )
+                .map_err(|(error, _)| error)?;
+            assert!(matches!(
+                terminal(&ticket).await?,
+                StagingState::Uncertain(_)
+            ));
+            assert_eq!(c.close_and_drain().await.len(), 1);
+            drop(ticket);
+            let original = head(&f, [230 + kind; 16]).await?;
+            let counts = f.counts().await?;
+            stop(&f, &original).await?;
+            until(&c, |s| s.admitted == 0 && !s.retirement_running).await?;
+            assert!(c.pending([230 + kind; 16]).is_none());
+            assert_eq!(c.stats().command_bytes, 0);
+            assert_eq!(c.stats().retirement_recoveries, 1);
+            assert_eq!(f.counts().await?, counts);
+            let saved = head(&f, [230 + kind; 16]).await?;
+            assert_eq!(saved.evidence(), &evidence);
+            assert!(saved.closed());
+            assert!(!saved.settled());
+            assert!(matches!(saved.recover(&f.client()).await,
+                Err(InvocationError::Pending(value)) if *value == evidence));
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            assert!(c.close_and_drain().await.is_empty());
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+struct Owned {
+    coordinator: StagingCoordinator,
+    dropped: Arc<AtomicUsize>,
+    wrong: Arc<AtomicBool>,
+}
+impl Drop for Owned {
+    fn drop(&mut self) {
+        let stats = self.coordinator.stats();
+        if stats.workers == 0 || stats.admitted == 0 || stats.command_bytes == 0 {
+            self.wrong.store(true, Ordering::Release);
+        }
+        self.dropped.fetch_add(1, Ordering::AcqRel);
+    }
+}
+
+#[tokio::test]
+async fn automatic_retirement_joins_live_callbacks_and_drops_retained_results_before_releasing_credits()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for bound in [false, true] {
+            let f = Fixture::new(format).await?;
+            let c =
+                StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+            let operation = [220; 16];
+            let ticket = if bound {
+                bound::bind(&f, &c, operation, "owner").await?
+            } else {
+                let t = submit(&f, &c, operation, "owner").await?;
+                active(&t).await?;
+                t
+            };
+            let session = if bound {
+                Some(ticket.bound_session()?)
+            } else {
+                None
+            };
+            let dropped = Arc::new(AtomicUsize::new(0));
+            let wrong = Arc::new(AtomicBool::new(false));
+            let owned = || Owned {
+                coordinator: c.clone(),
+                dropped: dropped.clone(),
+                wrong: wrong.clone(),
+            };
+            let finished = owned();
+            let completed = if bound {
+                ticket.spawn_bound(move |_| async move { Ok(finished) })?
+            } else {
+                ticket.spawn(move |_| async move { Ok(finished) })?
+            };
+            let running = owned();
+            let (entered, start) = oneshot::channel();
+            let worker = if bound {
+                ticket.spawn_bound(move |_| async move {
+                    let _ = entered.send(());
+                    std::future::pending::<()>().await;
+                    drop(running);
+                    Ok(())
+                })?
+            } else {
+                ticket.spawn(move |_| async move {
+                    let _ = entered.send(());
+                    std::future::pending::<()>().await;
+                    drop(running);
+                    Ok(())
+                })?
+            };
+            timeout(Duration::from_secs(10), start).await??;
+            let mut mutation = identity()?;
+            mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+            c.fault_for_test(1); // Registered original, execution never started.
+            ticket.renew_with_identity_for_test(mutation).await?;
+            until(&c, |s| s.uncertain == 1).await?;
+            assert!(matches!(ticket.state(), StagingState::Uncertain(_)));
+            let original = head(&f, operation).await?;
+            let evidence = original.evidence().clone();
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Absent
+            ));
+            expired(&evidence).await?;
+            assert_eq!(c.stats().workers, 2); // Includes the untransferred completed result.
+            assert_eq!(dropped.load(Ordering::Acquire), 0);
+            if let Some(session) = &session {
+                assert!(session.live_lease().is_ok());
+            }
+            drop(completed);
+            drop(worker);
+            drop(ticket);
+            stop(&f, &original).await?;
+            until(&c, |s| s.admitted == 0 && !s.retirement_running).await?;
+            assert_eq!(dropped.load(Ordering::Acquire), 2);
+            assert!(!wrong.load(Ordering::Acquire));
+            assert_eq!(c.stats().workers, 0);
+            assert_eq!(c.stats().command_bytes, 0);
+            assert_eq!(c.stats().retirement_recoveries, 1);
+            if let Some(session) = session {
+                assert!(session.live_lease().is_err());
+            }
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Expired
+            ));
+            assert!(!head(&f, operation).await?.settled());
+            assert!(c.close_and_drain().await.is_empty());
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn automatic_retirement_does_not_execute_absent_commands_or_retry_known_phases_without_a_stop()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (evidence, _) = restore::head_expiring(&f, 0, false, false).await?;
+        let ready = ReadyStaging::restore(f.client(), f.target.clone(), [230; 16]).await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        edit(
+            &f,
+            "ALTER TABLE catalog_custody_commands RENAME TO private_query_unavailable",
+        )
+        .await?;
+        let ticket = c.submit(ready).map_err(|(error, _)| error)?;
+        assert!(matches!(
+            terminal(&ticket).await?,
+            StagingState::Uncertain(_)
+        ));
+        until(&c, |s| s.retirement_failures >= 2).await?;
+        assert_eq!(f.counts().await?, (0, 0));
+        assert_eq!(c.stats().admitted, 1);
+        assert_eq!(c.stats().retirement_recoveries, 0);
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Absent
+        ));
+        edit(
+            &f,
+            "ALTER TABLE private_query_unavailable RENAME TO catalog_custody_commands",
+        )
+        .await?;
+        let known = head(&f, [230; 16]).await?.recover(&f.client()).await?;
+        let probes = c.stats().retirement_probes;
+        until(&c, |s| s.retirement_probes >= probes + 2).await?;
+        assert!(matches!(ticket.state(), StagingState::Uncertain(_)));
+        assert_eq!(c.stats().retirement_recoveries, 0);
+        assert!(ticket.restored_outcome().is_none());
+        assert_eq!(c.close_and_drain().await.len(), 1);
+        c.recover(&ticket)?;
+        until(&c, |s| s.admitted == 0 && !s.retirement_running).await?;
+        assert_eq!(
+            *ticket.restored_outcome().ok_or("known outcome lost")?,
+            known
+        );
+        assert!(c.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn exact_retirement_probe_keeps_old_ordinal_after_successor_and_rejects_corrupt_facts()
+-> Result {
+    use crate::packs::publication::custody::OwnedCustody;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (evidence, _) = restore::head_expiring(&f, 0, false, true).await?;
+        let probe = OwnedCustody::restore(&f.client(), &f.target, [230; 16])
+            .await?
+            .stop_probe()?;
+        assert!(!probe.observed(&f.client()).await?);
+        expired(&evidence).await?;
+        let original = head(&f, [230; 16]).await?;
+        stop(&f, &original).await?;
+        let successor =
+            PreparedCustody::prepare(&f.client(), &f.target, original.action()?, identity()?)
+                .await?
+                .register(&f.client(), identity()?)
+                .await?;
+        assert_ne!(head(&f, [230; 16]).await?.evidence(), &evidence);
+        assert_eq!(head(&f, [230; 16]).await?.evidence(), successor.evidence());
+        assert!(probe.observed(&f.client()).await?);
+        let fact = f
+            .handle
+            .query(0, 4096, |db| {
+                Ok(db.query_row(
+                    "SELECT stopped FROM catalog_custody_commands WHERE operation=?1 AND step=0",
+                    [vec![230u8; 16]],
+                    |row| row.get::<_, Vec<u8>>(0),
+                )?)
+            })
+            .await?;
+        edit(&f, "DROP TRIGGER catalog_custody_stop_immutable").await?;
+        edit(
+            &f,
+            "UPDATE catalog_custody_commands SET stopped=x'01' WHERE step=0",
+        )
+        .await?;
+        assert!(probe.observed(&f.client()).await.is_err());
+        edit(
+            &f,
+            &format!(
+                "UPDATE catalog_custody_commands SET stopped=x'{}' WHERE step=0",
+                hex::encode(fact)
+            ),
+        )
+        .await?;
+        assert!(probe.observed(&f.client()).await?);
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Expired
+        ));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn automatic_retirement_skips_bad_heads_and_revisits_them_after_repair() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (bad, _) = restore::head_expiring(&f, 0, false, true).await?;
+        let (good, _) = restore::head_expiring(&f, 4, false, true).await?;
+        expired(&bad).await?;
+        expired(&good).await?;
+        let bad_ready = ReadyStaging::restore(f.client(), f.target.clone(), [230; 16]).await?;
+        let good_ready = ReadyStaging::restore(f.client(), f.target.clone(), [234; 16]).await?;
+        let bad_original = head(&f, [230; 16]).await?;
+        let good_original = head(&f, [234; 16]).await?;
+        let intent = f
+            .handle
+            .query(0, 4096, |db| {
+                Ok(db.query_row(
+                    "SELECT intent FROM catalog_custody_commands WHERE operation=?1 AND step=0",
+                    [vec![230u8; 16]],
+                    |row| row.get::<_, Vec<u8>>(0),
+                )?)
+            })
+            .await?;
+        edit(&f, "DROP TRIGGER catalog_custody_identity_immutable").await?;
+        edit(&f, "UPDATE catalog_custody_commands SET intent=x'01' WHERE operation=x'e6e6e6e6e6e6e6e6e6e6e6e6e6e6e6e6'").await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        let bad_ticket = c.submit(bad_ready).map_err(|(error, _)| error)?;
+        let good_ticket = c.submit(good_ready).map_err(|(error, _)| error)?;
+        assert!(matches!(
+            terminal(&bad_ticket).await?,
+            StagingState::Uncertain(_)
+        ));
+        assert!(matches!(
+            terminal(&good_ticket).await?,
+            StagingState::Uncertain(_)
+        ));
+        until(&c, |s| s.retirement_failures > 0).await?;
+        stop(&f, &good_original).await?;
+        until(&c, |s| s.admitted == 1 && s.retirement_recoveries == 1).await?;
+        assert!(matches!(good_ticket.state(), StagingState::Fenced(_)));
+        assert!(matches!(bad_ticket.state(), StagingState::Uncertain(_)));
+        assert_eq!(
+            c.stats().command_bytes,
+            crate::packs::publication::custody::RESERVATION
+        );
+        edit(&f, &format!("UPDATE catalog_custody_commands SET intent=x'{}' WHERE operation=x'e6e6e6e6e6e6e6e6e6e6e6e6e6e6e6e6'", hex::encode(intent))).await?;
+        stop(&f, &bad_original).await?;
+        until(&c, |s| s.admitted == 0 && !s.retirement_running).await?;
+        assert_eq!(c.stats().retirement_recoveries, 2);
+        assert!(bad_ticket.restored_outcome().is_none());
+        assert!(good_ticket.restored_outcome().is_none());
+        assert!(matches!(
+            f.client().resolve(&bad).await?,
+            Resolution::Expired
+        ));
+        assert!(matches!(
+            f.client().resolve(&good).await?,
+            Resolution::Expired
+        ));
+        assert!(c.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn automatic_retirement_does_not_apply_old_custody_closure_to_an_input_checkpoint() -> Result
+{
+    use canopy_object_storage::artifact::ArtifactStore;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (old, _) = restore::head_expiring(&f, 0, false, true).await?;
+        expired(&old).await?;
+        stop(&f, &head(&f, [230; 16]).await?).await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        PreparedCustody::prepare(
+            &f.client(),
+            &f.target,
+            CustodyAction::BeginStaging(f.begin([230; 16])),
+            identity()?,
+        )
+        .await?
+        .register(&f.client(), identity()?)
+        .await?;
+        let ticket = c
+            .submit(ReadyStaging::restore(f.client(), f.target.clone(), [230; 16]).await?)
+            .map_err(|(e, _)| e)?;
+        active(&ticket).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let proof = super::super::inputs::seal(&f, &ticket, store, 2).await?;
+        c.fault_for_test(1);
+        let checkpoint = ticket
+            .register_inputs(proof, identity()?)
+            .map_err(|(e, _)| e)?;
+        assert!(matches!(
+            terminal(&ticket).await?,
+            StagingState::Uncertain(_)
+        ));
+        let (other, _) = restore::head_expiring(&f, 4, false, true).await?;
+        expired(&other).await?;
+        let other_ticket = c
+            .submit(ReadyStaging::restore(f.client(), f.target.clone(), [234; 16]).await?)
+            .map_err(|(e, _)| e)?;
+        assert!(matches!(
+            terminal(&other_ticket).await?,
+            StagingState::Uncertain(_)
+        ));
+        until(&c, |s| s.retirement_probes >= 2).await?;
+        stop(&f, &head(&f, [234; 16]).await?).await?;
+        until(&c, |s| s.admitted == 1 && !s.retirement_running).await?;
+        assert!(matches!(ticket.state(), StagingState::Uncertain(_)));
+        assert_eq!(c.stats().retirement_recoveries, 1);
+        assert_eq!(
+            c.stats().command_bytes,
+            crate::packs::publication::custody::RESERVATION + 4096
+        );
+        assert!(checkpoint.wait().await.is_err());
+        c.recover(&ticket)?;
+        checkpoint.wait().await.map_err(|e| e.to_string())?;
+        assert!(c.close_and_drain().await.is_empty());
+        assert!(matches!(
+            f.client().resolve(&old).await?,
+            Resolution::Expired
+        ));
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn automatic_retirement_spans_more_than_one_page_and_restarts_at_earlier_keys_after_idle()
+-> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let c = StagingCoordinator::new(
+        f.target.clone(),
+        StagingLimits {
+            operations: 256,
+            per_actor: 192,
+            ..StagingLimits::default()
+        },
+        f.authority(),
+    )?;
+    let mut originals = Vec::new();
+    for n in 1u16..=130 {
+        let mut operation = [0; 16];
+        operation[14..].copy_from_slice(&n.to_be_bytes());
+        let mut mutation = identity()?;
+        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+        let saved = PreparedCustody::prepare(
+            &f.client(),
+            &f.target,
+            CustodyAction::BeginStaging(f.begin(operation)),
+            mutation,
+        )
+        .await?
+        .register(&f.client(), identity()?)
+        .await?;
+        originals.push((operation, saved));
+    }
+    expired(originals.last().ok_or("no originals")?.1.evidence()).await?;
+    for (operation, _) in &originals {
+        drop(
+            c.submit(ReadyStaging::restore(f.client(), f.target.clone(), *operation).await?)
+                .map_err(|(error, _)| error)?,
+        );
+    }
+    until(&c, |s| s.uncertain == 130).await?;
+    for (_, saved) in &originals {
+        stop(&f, saved).await?;
+    }
+    until(&c, |s| s.admitted == 0 && !s.retirement_running).await?;
+    assert_eq!(c.stats().retirement_recoveries, 130);
+    assert_eq!(c.stats().command_bytes, 0);
+    assert_eq!(f.counts().await?, (0, 0));
+    // A new unknown original below the previous cursor starts a fresh singleton.
+    let mut mutation = identity()?;
+    mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+    let operation = originals[0].0;
+    let saved = PreparedCustody::prepare(
+        &f.client(),
+        &f.target,
+        CustodyAction::BeginStaging(f.begin(operation)),
+        mutation,
+    )
+    .await?
+    .register(&f.client(), identity()?)
+    .await?;
+    expired(saved.evidence()).await?;
+    let ticket = c
+        .submit(ReadyStaging::restore(f.client(), f.target.clone(), operation).await?)
+        .map_err(|(error, _)| error)?;
+    assert!(matches!(
+        terminal(&ticket).await?,
+        StagingState::Uncertain(_)
+    ));
+    drop(ticket);
+    stop(&f, &saved).await?;
+    until(&c, |s| s.admitted == 0 && !s.retirement_running).await?;
+    assert_eq!(c.stats().retirement_recoveries, 131);
+    assert!(c.close_and_drain().await.is_empty());
+    f.runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/docs/design/durable-custody-command-intents.md b/docs/design/durable-custody-command-intents.md
index 4123c86f..f0a2f201 100644
--- a/docs/design/durable-custody-command-intents.md
+++ b/docs/design/durable-custody-command-intents.md
@@ -68,10 +68,14 @@ Startup reuses the same retirement factory, sealed input, first-writer record an
 
 After authenticated closure, startup reads the current operation at or after the stop's receipt. The indexed singleton/operation lookup validates repository ID, object format, owner, actor, digest, preparation generation and token fields. A wholly absent operation permits Begin; a matching current initialization attempt selects Claim. Mismatched or malformed state is an error rather than absence. The original stopped command keeps its bytes, identity and unresolved SDK result; startup never fabricates an original denial or receipt. The successor is explicit journal history and still undergoes current Write, actual owner, token/pin, namespace and quota checks. A newer failure is handled using that successor's action, not attributed to the old stopped action.
 
-Registered final initialization is resolved before this path. Unknown final publication cannot be skipped using an unrelated custody stop. Ready repositories still require their retained certified initialization and never create an empty catalog in response to missing metadata. General resident-repository scanner ownership/drain, automatic stopped staging resumption, retained-input adoption and settled-history archival remain required.
+Registered final initialization is resolved before this path. Unknown final publication cannot be skipped using an unrelated custody stop. Ready repositories still require their retained certified initialization and never create an empty catalog in response to missing metadata. The local staging service now observes exact stopped ordinals automatically through its [bounded retirement probe](staging-service-lifecycle.md#automatic-observation-of-custody-retirement). General resident-repository scanner ownership/drain, retained-input adoption and settled-history archival remain required.
 
 Seven regression families exercise both object formats through the production registry/schema and actual initializer. They cover manual closure and automatic retirement, preserving unknown original results, live absence and known grants after SDK expiry, stopped Claim/Renew with genuine owner restoration after deleting local SQLite (including retirement under the restored owner), wrong purpose, inconsistent actor/digest/identity, and missing/corrupt durable Control. The final focused run passes in 16.12 seconds. The full frozen-source workspace library run passes 592 cases and fails only the same five unconverted legacy-reader cases; all 307 publication and seven startup cases pass within that run. Nine real startup/workspace lifecycle cases additionally pass in 3.48 seconds. Workspace/all-target Clippy with warnings denied, the server build, formatting and static protection checks pass. These results qualify this startup increment, not the full producer/reader cutover or large-team capacity. Evidence is `/tmp/canopy-startup-stop-validation.json`.
 
+## Automatic local staging closure qualification
+
+The existing staging coordinator now observes authenticated stops for each exact admitted original through one read-only bounded probe. It reuses indexed exact lookup and the existing recovery/fence/drain path, preserves unknown command-42 evidence after expiry, and excludes checkpoint/final owners. See the [staging lifecycle contract](staging-service-lifecycle.md#automatic-observation-of-custody-retirement). Seven added regression families and the previously failing automatic-closure regression pass. Final frozen-source qualification passes all 314 publication and seven startup cases within the full workspace library; that broader suite still fails only the five known unconverted legacy readers (599 pass, five fail). Nine real workspace/lifecycle cases, warnings-denied Clippy, the server build, formatting and static protection checks pass. These are local protocol/lifecycle results, not full-history or team-capacity proof. Evidence is `/tmp/canopy-stage-stop-validation.json`.
+
 ## Cost and release work
 
 Each new custody transition currently adds one registration mutation plus one execution mutation. Exact known lookup/replay adds no execution mutation; already registered retries avoid another registration mutation. Count these phases, policy/native checkpoints, final registration and completion in serialized service-time and fairness budgets. The earlier two-command illustration is not this protocol's total push cost.
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index 2871cb6d..aac56deb 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -56,7 +56,7 @@ Bound preparation is now automatically renewed by this service, and spawn_bound
 
 Staging and bound Begin/Claim/Renew/Bind retain both original command 42 and registrar 41 through the [custody intent protocol](durable-custody-command-intents.md). Registration must be known before original execution; metadata results are observed before SDK expiry or local execution guards. RegisterStagedInputs retains its separate original checkpoint command and exact SDK invocation/resolution path. Resolution of authoritative absence permits execution of the retained exact command only while the local fence, deadline and residence ceiling allow new execution. Known outcomes are returned before that guard. A committed outcome decodes with its original receipt; it never reruns the handler. Unknown, expired, unreachable, changed-incarnation and malformed published results retain evidence and reservation.
 
-Uncertain stops new producer admission. Existing work can continue only through its previously established deadline. `recover(ticket)` resumes the exact retained command; it cannot replace its identity or bytes. No new renewal, registration or bind is issued while an earlier command remains ambiguous. Panicked command tasks retain pending evidence. Unexpected service-worker failure fences local work and requires explicit exact recovery before restarting supervision.
+Uncertain stops new producer admission. Existing work can continue only through its previously established deadline. `recover(ticket)` resumes the exact retained command; it cannot replace its identity or bytes. No new renewal, registration or bind is issued while an earlier command remains ambiguous. Panicked command tasks retain pending evidence. Unexpected service-worker failure fences local work and waits for exact recovery before restarting supervision; authenticated retirement can schedule that recovery automatically.
 
 `stop` prevents new workers and waits for accepted input tasks/results to drain while renewal continues. It does not retract an independent SQL pin. `close_and_drain` closes all admission, stops jobs and returns still-charged uncertain tickets once running commands and input slots have drained. Service consumers must take retained completed results before a graceful stop can finish; retrieve lost observers through pending_task. Recovery remains possible after closing. A reached lifetime or lost authority fences and discards untransferred results conservatively.
 
@@ -70,7 +70,7 @@ Known staging grants acquire fresh staging custody. Known preparation grants use
 
 The shared preparation fence now retains a terminal watch value. A bound worker observes that signal independently of coordinator status changes or renewal timers, aborts and joins its callback, and drops owned results/resources before releasing credit. Late subscribers observe the already-fired fence. Bound context checks and cancellation deadlines include the shared session's live lease and ceiling. This qualifies callback ownership; it does not establish OS containment for arbitrary detached subprocesses or I/O.
 
-The command-wire reservation remains 28 KiB, or 32 KiB with a checkpoint, and operation/actor/worker admission caps are unchanged. These bounds do not claim total resident heap or Control/advertisement I/O accounting. Cold restore does not resurrect old workers, authenticate a new physical inventory, reconstruct an unregistered registrar, or resolve an expired unresolved original. The [custody retirement service](durable-custody-command-intents.md#separate-retirement-of-expired-originals) now records a separate stop for expired unresolved heads. Explicit exact recovery observes that typed fact, fences/drains and returns local admission while retaining original evidence without an execution reply. Automatic production staging resumption, settled-history archival, retained-input adoption and takeover wiring remain required. The separate [production initialization transition](durable-custody-command-intents.md#production-initialization-after-logical-retirement) now retires its own expired unresolved head and chooses an explicit successor; it does not instantiate the general staging scanner lifecycle.
+The command-wire reservation remains 28 KiB, or 32 KiB with a checkpoint, and operation/actor/worker admission caps are unchanged. These bounds do not claim total resident heap or Control/advertisement I/O accounting. Cold restore does not resurrect old workers, authenticate a new physical inventory, reconstruct an unregistered registrar, or resolve an expired unresolved original. The [custody retirement service](durable-custody-command-intents.md#separate-retirement-of-expired-originals) now records a separate stop for expired unresolved heads. Explicit exact recovery observes that typed fact, fences/drains and returns local admission while retaining original evidence without an execution reply. The local staging service now automatically observes authenticated retirement as described below. General production scanner ownership/drain, settled-history archival, retained-input adoption and takeover wiring remain required. The separate [production initialization transition](durable-custody-command-intents.md#production-initialization-after-logical-retirement) now retires its own expired unresolved head and chooses an explicit successor; it does not instantiate the general staging scanner lifecycle.
 
 Seven regression families cover both object formats and all seven command kinds; actual durable owner restore after local SQLite removal; original positive/negative receipts; changed restart profiles; authoritative absence; lost replies/panics/private-query failure; closed-service recovery; expired unresolved originals; and resource drop before credit release when a shared session fences. Their native workers and histories are small fixtures, not a large-team capacity result.
 
@@ -81,3 +81,17 @@ Nine service tests cover canceled observers and single typed handoff; operation/
 Five additional checkpoint service tests cover canceled observers; absent, lost-reply and panicked exact dispatch in both OID formats; registration-before-Bind ordering and original receipt replay; one-slot and foreign/duplicate/closed refusal without execution; committed recovery followed by current-access revocation; and authoritative expiry after absence. The real receive/publication/cold-clone fixture uses service-owned registration in both formats.
 
 These tests establish protocol composition and ownership on small fixtures. They do not establish four-hour full-history throughput, stable maintenance under peak traffic, source-independent restore or capacity for 10,000 engineers. Production producer wiring, complete resource/descendant admission, authenticated durable input inventories and owner-loss adoption, remaining-floor configuration, complete retained-root reclamation, accelerated readers and mandatory mixed-load/recovery campaigns remain release gates.
+
+
+## Automatic observation of custody retirement
+
+An uncertain registered custody command starts one shared read-only retirement probe for its existing StagingCoordinator. It scans the already admitted map; it creates neither another durable outbox nor one polling task per operation. Default rounds retain at most 128 operation keys/job references and issue one private metadata query at a time. Byte-ordered keyset rotation uses an explicit beginning-of-pass cursor, advances past unavailable/malformed heads and wraps to revisit earlier keys. A round stops selecting further work after its one-second budget elapses, retains ownership until a slow query completes, then waits one second. This budget is not a query deadline or a cold-storage latency guarantee. Unexpected probe-worker failure retains the original jobs and restarts the single probe after the same delay.
+
+The probe takes a thin exact fingerprint under the job's command lock: target, operation/ordinal, intent digest and original PendingMutation. It does not clone the original command/registrar bodies across its independent query await. Loading uses the existing indexed exact-ordinal lookup and authenticated codec, so a later registered successor cannot hide the old original. Only a valid stop fact for that original schedules existing exact recovery. A missing/private/malformed observation retains admission. A known original execution phase alone does not trigger automatic execution/retry. Checkpoint command 29 and final publication remain under their distinct exact owners and are excluded from custody probing.
+
+Exact recovery independently reloads/authenticates closure, reports typed Stopped with the original evidence, fences the shared session and joins/cancels callbacks. It drops untransferred completed resources before their worker credit and removes the staging operation only after all workers drain. A stop is logical closure, never a fabricated command-42 execution receipt or denial. This continues after observer drop or coordinator closure. The probe relinquishes ownership when no eligible jobs remain; admission and that ownership change use the same mutex to avoid a lost new-job wakeup.
+
+StagingStats exposes completed probe queries, failed observations/fingerprint construction, scheduled exact recoveries, worker restarts and whether a probe is running. Counters saturate and remain bounded. The existing 28/32 KiB command-wire reservation and operation/actor/worker caps are unchanged. Private query transport/decode is independently admitted by the SDK; these counters and wire reservations are not total heap, RSS, provider-I/O or latency qualification. This mechanism observes existing authenticated stops; production repository lifecycle ownership of the stop scanner, physical input adoption and cold producer takeover remain required.
+
+
+Seven additional regression families exercise all seven original custody actions in SHA-1/SHA-256, closed coordinators and dropped observers, stopped staging/bound renewals with live callbacks and retained completed resources, unavailable private queries without absent-command execution or known-phase retries, an old ordinal after an explicit successor, malformed stop rejection, a corrupt head followed by a valid head and later repair, exclusion of input checkpoints despite an older stop, and 130 admitted operations spanning multiple probe pages plus restart at an earlier key after idle. The native/domain codecs reject the all-zero operation ID; the multi-page fixture uses valid nonzero IDs rather than weakening that invariant. The initial warm fixture observed the preceding binding before the renewal; it now waits for the actual uncertain renewal. The checkpoint fixture now registers an explicit successor instead of using the fresh-operation factory against an existing journal. Final frozen-source evidence is recorded in the implementation status.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 485bf4ba..fc622496 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -6,6 +6,14 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Automatic staging retirement in progress
+
+The local staging coordinator now owns one bounded read-only probe over its admitted uncertain custody commands. Exact ordinal plus authenticated intent fingerprint finds an old stopped original even after a successor becomes the latest head. Only authenticated logical stop schedules existing exact recovery; absent commands, unavailable/corrupt private metadata and known execution phases alone retain their original reservations. Checkpoint/final commands keep separate owners. The existing fence/drain path joins running callbacks and drops retained resources before returning worker and operation admission. Observer drop and service closure do not discard this ownership. Probe failures/restarts/recovery scheduling are visible in bounded service counters. See the [lifecycle contract](design/staging-service-lifecycle.md#automatic-observation-of-custody-retirement).
+
+The original regression timed out after a genuine stop because manual staging recovery was still required (`/tmp/canopy-stage-stop-red.log`). The first draft compile caught a changed helper signature used by publication observation; the signature is preserved and probing starts only for custody uncertainty. The corrected regression passes. Seven added regression families now pass, including all seven custody actions in both formats, closed-service observer loss, staging/bound callbacks and retained-result drop ordering, private-query failure and known-phase non-retry, exact old-ordinal lookup after a successor, malformed facts and bad-head repair/fair progress, checkpoint exclusion, and 130 admitted operations over multiple pages plus restart at an earlier key after idle. Initial extended fixture failures are retained: the warm test observed the previous binding; the checkpoint test assumed a nonexistent result accessor and tried the fresh-operation factory against an existing journal; the page test used a forbidden all-zero operation ID. The fixtures now wait for the actual uncertain renewal, use the existing checkpoint wait API and an explicit registered successor, and use valid nonzero keys without changing production guards.
+
+Final-source macOS/Rust 1.98.0 checks pass the seven-family focused run in 46.08 seconds and all 314 publication plus seven startup cases within the full library run. The full library remains **failed** (exit 101): 599 pass and the same five unconverted legacy readers fail, out of 604 unique cases; two nested subprocess results are excluded. Nine real workspace/lifecycle cases pass in 3.35 seconds, including the prebound-listener regression. This is 613 unique Rust cases executed, 608 pass and five fail; focused cases are not counted twice. Workspace/all-target Clippy with warnings denied (24.38 seconds), server build (29.14 seconds), formatting/diff, 444 frozen source/schema/manifest files including 432 Rust files, 140 local documentation links, exact SDK pins and protected index/archive checks pass. Evidence is `/tmp/canopy-stage-stop-validation.json`. This is not production HTTP/SSH producer conversion, general repository scanner lifecycle wiring, whole-process memory/I/O qualification or large-team capacity. Those gates and the five known unconverted legacy-reader failures remain open.
+
 ## Owned staging and preparation conversion in progress
 
 The local staging service now prepares both the exact custody original and its exact registrar for all seven custody actions. The fair preparation dispatcher uses the same owner for Claim/Renew, including original-head reconstruction. Direct caller-owned raw session/base renewal APIs have been removed; base renewals prepare a ready command for transfer to the service. Jobs retain both originals through uncertainty, observer cancellation and closure. Recorded phase knowledge precedes SDK expiry and local guards. Restored renewals on an existing session/base retain the original shared fence; a failed fresh query fences all of its existing resolvers. New execution after authoritative absence checks the local fence, deadline and residence ceiling.

From 4d6729496867433781f8f9fb74f558131f80a47d Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 04:57:13 -0700
Subject: [PATCH 14/55] Bound publication admission and dispatch across
 repositories

---
 .../src/packs/publication/coordinator.rs      |  33 ++-
 .../packs/publication/coordinator/budget.rs   | 202 ++++++++++++++
 .../publication/coordinator/budget/tests.rs   | 264 ++++++++++++++++++
 .../src/packs/publication/mod.rs              |  13 +-
 .../src/packs/publication/tests.rs            |  17 +-
 .../tests/compaction/coordinator.rs           |  23 +-
 .../publication/tests/compaction/schedule.rs  |   7 +-
 .../publication/tests/completion/outcome.rs   |   7 +-
 .../packs/publication/tests/coordinator.rs    |  51 +++-
 .../publication/tests/coordinator/budget.rs   | 225 +++++++++++++++
 .../publication/tests/coordinator/held.rs     |  42 ++-
 .../tests/coordinator/preparation.rs          |  73 +++--
 .../packs/publication/tests/custody_stop.rs   |  39 ++-
 .../packs/publication/tests/durable_policy.rs |   3 +
 .../publication/tests/durable_recovery.rs     |   6 +-
 .../tests/initialization_recovery.rs          |  12 +-
 .../tests/initialization_retirement.rs        |  12 +-
 .../src/packs/publication/tests/inputs.rs     |   7 +-
 .../packs/publication/tests/inputs/bound.rs   |  14 +-
 .../tests/inputs/requests/results.rs          |   2 +
 .../packs/publication/tests/native_capture.rs |   7 +-
 .../publication/tests/policy_dispatch.rs      |   6 +-
 .../packs/publication/tests/policy_refusal.rs |  12 +-
 .../publication/tests/preparation_receipt.rs  |   7 +-
 .../publication/tests/recovery_discovery.rs   |  24 +-
 .../packs/publication/tests/root_dispatch.rs  |   7 +-
 .../packs/publication/tests/root_outcome.rs   |   6 +-
 .../packs/publication/tests/staged_durable.rs |  18 +-
 .../tests/staging_service/publication.rs      |  44 ++-
 .../publication/tests/terminal_retention.rs   |   6 +-
 .../server/catalog_initialization/tests.rs    |   6 +-
 docs/design/shared-publication-dispatch.md    |  53 +++-
 .../large-repository-implementation-status.md |  53 ++++
 33 files changed, 1200 insertions(+), 101 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/coordinator/budget.rs
 create mode 100644 crates/canopy-server/src/packs/publication/coordinator/budget/tests.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/coordinator/budget.rs

diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index 4f19787f..a4777f7b 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -36,6 +36,8 @@ mod preparation;
 pub use preparation::{
     PreparationCommandKind, PreparationCommandOutcome, PreparationReadyError, ReadyPreparation,
 };
+mod budget;
+pub use budget::{PublicationBudget, PublicationBudgetStats};
 mod work;
 use work::MAINTENANCE_RESERVATION;
 pub use work::{
@@ -103,6 +105,14 @@ pub struct ReadyCatalogPush {
     owner: PushPreparation,
     command: PreparedCommand<CompleteCatalogPush>,
 }
+#[cfg(test)]
+impl ReadyCatalogPush {
+    pub(in crate::packs::publication) fn evidence_for_test(
+        &self,
+    ) -> cellule_runtime::PendingMutation {
+        self.command.evidence().clone()
+    }
+}
 #[derive(Clone)]
 enum PushPreparation {
     Catalog(Arc<PreparedCatalog>),
@@ -249,6 +259,7 @@ struct Job {
     status: watch::Sender<PublicationState>,
     read: ReadContext,
     admitted: Instant,
+    budget: std::sync::Mutex<Option<budget::BudgetPermit>>,
 }
 struct Work {
     job: Arc<Job>,
@@ -340,6 +351,7 @@ struct State {
 struct Inner {
     target: CellTarget,
     limits: PublicationLimits,
+    budget: PublicationBudget,
     state: Mutex<State>,
     drained: Notify,
     changed: Notify,
@@ -385,15 +397,19 @@ impl PublicationCoordinator {
     pub(in crate::packs::publication) fn target(&self) -> &CellTarget {
         &self.inner.target
     }
+    /// Every repository dispatcher on a node must receive the same budget.
+    /// Repository limits remain additional caps, not independent node shares.
     pub fn new(
         target: CellTarget,
         limits: PublicationLimits,
+        budget: PublicationBudget,
     ) -> Result<Self, PublicationScheduleError> {
         limits.validate()?;
         Ok(Self {
             inner: Arc::new(Inner {
                 target,
                 limits,
+                budget,
                 state: Mutex::new(State::default()),
                 drained: Notify::new(),
                 changed: Notify::new(),
@@ -468,7 +484,9 @@ impl PublicationCoordinator {
                 .get(&request.actor)
                 .map_or(0, |counts| counts[at])
                 >= limits.per_actor
-            || state.bytes[at] > byte_limit - reservation
+            || byte_limit
+                .checked_sub(reservation)
+                .is_none_or(|remaining| state.bytes[at] > remaining)
         {
             Some(PublicationScheduleError::Capacity)
         } else {
@@ -477,6 +495,14 @@ impl PublicationCoordinator {
         if let Some(reason) = reason {
             return Err(Box::new(PublicationAdmissionFailure { reason, ready }));
         }
+        let budget = match self
+            .inner
+            .budget
+            .reserve(class, &request.actor, reservation)
+        {
+            Ok(permit) => permit,
+            Err(reason) => return Err(Box::new(PublicationAdmissionFailure { reason, ready })),
+        };
         let read = ReadContext {
             client: client.clone(),
             target: target.clone(),
@@ -499,6 +525,7 @@ impl PublicationCoordinator {
             .0,
             read,
             admitted: Instant::now(),
+            budget: std::sync::Mutex::new(Some(budget)),
         });
         state.actors.entry(job.actor.clone()).or_default()[at] += 1;
         state.counts[at] += 1;
@@ -876,6 +903,9 @@ fn enqueue(state: &mut State, job: &Arc<Job>, recover: bool) {
     );
 }
 fn release(state: &mut State, job: &Job) {
+    // Both callers drop retained proof/body ownership before making either
+    // the repository or node reservation reusable. Ticket DTOs may survive.
+    job.budget.lock().expect("publication budget permit").take();
     state.jobs.remove(&(job.operation, job.custody_stop));
     let count = state
         .actors
@@ -967,6 +997,7 @@ async fn run(inner: Arc<Inner>) {
     }
 }
 async fn dispatch(inner: Arc<Inner>, work: Work) -> DispatchResult {
+    let _dispatch = inner.budget.dispatch(work.job.class, &work.job.actor).await;
     #[cfg(test)]
     {
         // Do not hold the hook's mutex across a wait: other dispatched jobs
diff --git a/crates/canopy-server/src/packs/publication/coordinator/budget.rs b/crates/canopy-server/src/packs/publication/coordinator/budget.rs
new file mode 100644
index 00000000..9ed87f5c
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/coordinator/budget.rs
@@ -0,0 +1,202 @@
+//! One shared budget for every repository dispatcher on a node. Command credits
+//! cover retained originals through uncertainty; transport slots cover dispatch.
+use super::*;
+use std::sync::Mutex as LedgerMutex;
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
+
+#[derive(Clone)]
+pub struct PublicationBudget {
+    inner: Arc<BudgetInner>,
+}
+struct BudgetInner {
+    limits: PublicationLimits,
+    ledger: LedgerMutex<Ledger>,
+    dispatch: [Arc<Semaphore>; 2],
+}
+#[derive(Default)]
+struct Ledger {
+    counts: [usize; 2],
+    bytes: [u64; 2],
+    actors: HashMap<String, ActorBudget>,
+    closed: bool,
+}
+struct ActorBudget {
+    counts: [usize; 2],
+    dispatch: [Arc<Semaphore>; 2],
+}
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct PublicationBudgetStats {
+    pub foreground: usize,
+    pub maintenance: usize,
+    pub accounts: usize,
+    pub command_bytes: u64,
+    pub foreground_dispatch: usize,
+    pub maintenance_dispatch: usize,
+    pub closed: bool,
+}
+impl PublicationBudget {
+    /// Reuse the dispatcher profile; foreground_burst remains a repository
+    /// scheduling setting. This budget reserves independent class shares.
+    pub fn new(limits: PublicationLimits) -> Result<Self, PublicationScheduleError> {
+        limits.validate()?;
+        if limits.maintenance_operations < 2
+            || limits.maintenance_in_flight < 2
+            || limits.in_flight - limits.maintenance_in_flight < 2
+        {
+            return Err(PublicationScheduleError::InvalidLimits);
+        }
+        Ok(Self {
+            inner: Arc::new(BudgetInner {
+                limits,
+                ledger: LedgerMutex::new(Ledger::default()),
+                dispatch: [
+                    Arc::new(Semaphore::new(
+                        limits.in_flight - limits.maintenance_in_flight,
+                    )),
+                    Arc::new(Semaphore::new(limits.maintenance_in_flight)),
+                ],
+            }),
+        })
+    }
+    /// Stop new reservations without cancelling admitted dispatch or recovery.
+    pub fn close(&self) {
+        self.inner.ledger.lock().expect("publication budget").closed = true;
+    }
+    pub fn stats(&self) -> PublicationBudgetStats {
+        let ledger = self.inner.ledger.lock().expect("publication budget");
+        let limits = self.inner.limits;
+        PublicationBudgetStats {
+            foreground: ledger.counts[0],
+            maintenance: ledger.counts[1],
+            accounts: ledger.actors.len(),
+            command_bytes: ledger.bytes.iter().sum(),
+            foreground_dispatch: limits.in_flight
+                - limits.maintenance_in_flight
+                - self.inner.dispatch[0].available_permits(),
+            maintenance_dispatch: limits.maintenance_in_flight
+                - self.inner.dispatch[1].available_permits(),
+            closed: ledger.closed,
+        }
+    }
+    pub(super) fn reserve(
+        &self,
+        class: PublicationClass,
+        actor: &str,
+        bytes: u64,
+    ) -> Result<BudgetPermit, PublicationScheduleError> {
+        let mut ledger = self.inner.ledger.lock().expect("publication budget");
+        if ledger.closed {
+            return Err(PublicationScheduleError::Closed);
+        }
+        let at = class.index();
+        let limits = self.inner.limits;
+        let (operations, ceiling, actor_limit) = match class {
+            PublicationClass::Foreground => (
+                limits.operations - limits.maintenance_operations,
+                limits.command_bytes
+                    - limits.maintenance_operations as u64 * MAINTENANCE_RESERVATION,
+                limits.per_actor,
+            ),
+            PublicationClass::Maintenance => (
+                limits.maintenance_operations,
+                limits.maintenance_operations as u64 * MAINTENANCE_RESERVATION,
+                limits.per_actor.min(limits.maintenance_operations / 2),
+            ),
+        };
+        if bytes == 0
+            || ledger.counts[at] >= operations
+            || ledger
+                .actors
+                .get(actor)
+                .map_or(0, |account| account.counts[at])
+                >= actor_limit
+            || ceiling
+                .checked_sub(bytes)
+                .is_none_or(|remaining| ledger.bytes[at] > remaining)
+        {
+            return Err(PublicationScheduleError::Capacity);
+        }
+        ledger.counts[at] += 1;
+        ledger.bytes[at] += bytes;
+        ledger
+            .actors
+            .entry(actor.to_owned())
+            .or_insert_with(|| ActorBudget {
+                counts: [0; 2],
+                dispatch: [
+                    Arc::new(Semaphore::new(
+                        limits
+                            .per_actor
+                            .min((limits.in_flight - limits.maintenance_in_flight) / 2),
+                    )),
+                    Arc::new(Semaphore::new(
+                        limits.per_actor.min(limits.maintenance_in_flight / 2),
+                    )),
+                ],
+            })
+            .counts[at] += 1;
+        Ok(BudgetPermit {
+            inner: Arc::clone(&self.inner),
+            class,
+            actor: actor.to_owned(),
+            bytes,
+        })
+    }
+    pub(super) async fn dispatch(&self, class: PublicationClass, actor: &str) -> DispatchPermit {
+        // Semaphores are never closed: closing admission must retain exact
+        // recovery after shutdown, including jobs already waiting for a slot.
+        let actor_dispatch = {
+            let ledger = self.inner.ledger.lock().expect("publication budget");
+            Arc::clone(
+                &ledger
+                    .actors
+                    .get(actor)
+                    .expect("admitted publication account")
+                    .dispatch[class.index()],
+            )
+        };
+        // Account waiters must not occupy node slots while waiting for their
+        // account share, including when one account spans many repositories.
+        let actor = actor_dispatch
+            .acquire_owned()
+            .await
+            .expect("owned publication account dispatch budget");
+        let class = Arc::clone(&self.inner.dispatch[class.index()])
+            .acquire_owned()
+            .await
+            .expect("owned publication dispatch budget");
+        DispatchPermit {
+            _actor: actor,
+            _class: class,
+        }
+    }
+}
+pub(super) struct DispatchPermit {
+    _actor: OwnedSemaphorePermit,
+    _class: OwnedSemaphorePermit,
+}
+pub(super) struct BudgetPermit {
+    inner: Arc<BudgetInner>,
+    class: PublicationClass,
+    actor: String,
+    bytes: u64,
+}
+impl Drop for BudgetPermit {
+    fn drop(&mut self) {
+        let mut ledger = self.inner.ledger.lock().expect("publication budget");
+        let at = self.class.index();
+        ledger.counts[at] -= 1;
+        ledger.bytes[at] -= self.bytes;
+        let account = ledger
+            .actors
+            .get_mut(&self.actor)
+            .expect("admitted publication account");
+        account.counts[at] -= 1;
+        if account.counts == [0; 2] {
+            ledger.actors.remove(&self.actor);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/canopy-server/src/packs/publication/coordinator/budget/tests.rs b/crates/canopy-server/src/packs/publication/coordinator/budget/tests.rs
new file mode 100644
index 00000000..5d4f1bb4
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/coordinator/budget/tests.rs
@@ -0,0 +1,264 @@
+use super::*;
+use tokio::time::{Duration, timeout};
+
+fn limits() -> PublicationLimits {
+    PublicationLimits {
+        operations: 8,
+        per_actor: 2,
+        command_bytes: 3 * COMMAND_RESERVATION + 4 * MAINTENANCE_RESERVATION,
+        in_flight: 4,
+        maintenance_operations: 4,
+        maintenance_in_flight: 2,
+        foreground_burst: 3,
+    }
+}
+
+#[test]
+fn aggregate_reservations_keep_class_and_account_headroom() {
+    let budget = PublicationBudget::new(limits()).unwrap();
+    let other_repository = budget.clone();
+    let foreground = PublicationClass::Foreground;
+    let maintenance = PublicationClass::Maintenance;
+    let a = budget
+        .reserve(foreground, "a", COMMAND_RESERVATION)
+        .unwrap();
+    let b = other_repository
+        .reserve(foreground, "a", COMMAND_RESERVATION)
+        .unwrap();
+    assert!(matches!(
+        budget.reserve(foreground, "a", 1),
+        Err(PublicationScheduleError::Capacity)
+    ));
+    let c = budget
+        .reserve(foreground, "b", COMMAND_RESERVATION)
+        .unwrap();
+    assert!(matches!(
+        other_repository.reserve(foreground, "b", 1),
+        Err(PublicationScheduleError::Capacity)
+    ));
+    let m1 = budget
+        .reserve(maintenance, "a", MAINTENANCE_RESERVATION)
+        .unwrap();
+    let m2 = other_repository
+        .reserve(maintenance, "a", MAINTENANCE_RESERVATION)
+        .unwrap();
+    assert!(matches!(
+        budget.reserve(maintenance, "a", 1),
+        Err(PublicationScheduleError::Capacity)
+    ));
+    let m3 = budget
+        .reserve(maintenance, "b", MAINTENANCE_RESERVATION)
+        .unwrap();
+    let m4 = budget
+        .reserve(maintenance, "c", MAINTENANCE_RESERVATION)
+        .unwrap();
+    assert!(matches!(
+        budget.reserve(maintenance, "d", 1),
+        Err(PublicationScheduleError::Capacity)
+    ));
+    let stats = budget.stats();
+    assert_eq!(
+        (stats.foreground, stats.maintenance, stats.accounts),
+        (3, 4, 3)
+    );
+    assert_eq!(stats.command_bytes, limits().command_bytes);
+    drop((a, b, c));
+    let foreground_again = budget
+        .reserve(foreground, "d", COMMAND_RESERVATION)
+        .unwrap();
+    drop((foreground_again, m1, m2, m3, m4));
+    let stats = budget.stats();
+    assert_eq!(
+        (
+            stats.foreground,
+            stats.maintenance,
+            stats.accounts,
+            stats.command_bytes
+        ),
+        (0, 0, 0, 0)
+    );
+}
+
+#[tokio::test]
+async fn account_waiters_leave_node_slots_for_other_accounts_and_maintenance() {
+    let budget = PublicationBudget::new(limits()).unwrap();
+    let mut reservations = Vec::new();
+    for class in [PublicationClass::Foreground, PublicationClass::Maintenance] {
+        for actor in ["a", "a", "b", "c"] {
+            reservations.push(budget.reserve(class, actor, 1).unwrap());
+        }
+    }
+    let foreground = PublicationClass::Foreground;
+    let maintenance = PublicationClass::Maintenance;
+    let a = budget.dispatch(foreground, "a").await;
+    let a_waiter = budget.dispatch(foreground, "a");
+    tokio::pin!(a_waiter);
+    assert!(
+        timeout(Duration::from_millis(20), &mut a_waiter)
+            .await
+            .is_err()
+    );
+    // If the account waiter acquired the node gate first, this would hang.
+    let b = timeout(Duration::from_secs(1), budget.dispatch(foreground, "b"))
+        .await
+        .unwrap();
+    let c_waiter = budget.dispatch(foreground, "c");
+    tokio::pin!(c_waiter);
+    assert!(
+        timeout(Duration::from_millis(20), &mut c_waiter)
+            .await
+            .is_err()
+    );
+    let m_a = timeout(Duration::from_secs(1), budget.dispatch(maintenance, "a"))
+        .await
+        .unwrap();
+    let m_a_waiter = budget.dispatch(maintenance, "a");
+    tokio::pin!(m_a_waiter);
+    assert!(
+        timeout(Duration::from_millis(20), &mut m_a_waiter)
+            .await
+            .is_err()
+    );
+    let m_b = timeout(Duration::from_secs(1), budget.dispatch(maintenance, "b"))
+        .await
+        .unwrap();
+    assert_eq!(
+        (
+            budget.stats().foreground_dispatch,
+            budget.stats().maintenance_dispatch
+        ),
+        (2, 2)
+    );
+    budget.close();
+    assert!(matches!(
+        budget.reserve(foreground, "d", 1),
+        Err(PublicationScheduleError::Closed)
+    ));
+    drop(a);
+    // c already entered the node FIFO while a's second job waited only on
+    // its account gate. c must receive the newly available node slot first.
+    let c = timeout(Duration::from_secs(1), &mut c_waiter)
+        .await
+        .unwrap();
+    assert!(
+        timeout(Duration::from_millis(20), &mut a_waiter)
+            .await
+            .is_err()
+    );
+    drop(b);
+    let a_again = timeout(Duration::from_secs(1), &mut a_waiter)
+        .await
+        .unwrap();
+    drop(m_a);
+    let m_a_again = timeout(Duration::from_secs(1), &mut m_a_waiter)
+        .await
+        .unwrap();
+    drop((a_again, c, m_a_again, m_b));
+    assert_eq!(
+        (
+            budget.stats().foreground_dispatch,
+            budget.stats().maintenance_dispatch
+        ),
+        (0, 0)
+    );
+    drop(reservations);
+    assert_eq!(budget.stats().accounts, 0);
+}
+
+#[tokio::test]
+async fn canceling_dispatch_wait_keeps_command_credit_and_releases_partial_gates() {
+    let budget = PublicationBudget::new(limits()).unwrap();
+    let foreground = PublicationClass::Foreground;
+    let mut reservations = Vec::new();
+    for actor in ["a", "b", "c"] {
+        reservations.push(budget.reserve(foreground, actor, 1).unwrap());
+    }
+    let a = budget.dispatch(foreground, "a").await;
+    let b = budget.dispatch(foreground, "b").await;
+    // c obtains its account gate, then waits for the global gate. Dropping
+    // that future must give c back its account share for exact recovery.
+    assert!(
+        timeout(Duration::from_millis(20), budget.dispatch(foreground, "c"))
+            .await
+            .is_err()
+    );
+    assert_eq!(budget.stats().foreground, 3);
+    assert_eq!(budget.stats().foreground_dispatch, 2);
+    drop(a);
+    let c = timeout(Duration::from_secs(1), budget.dispatch(foreground, "c"))
+        .await
+        .unwrap();
+    drop((b, c, reservations));
+    assert_eq!(
+        (
+            budget.stats().foreground,
+            budget.stats().foreground_dispatch,
+            budget.stats().accounts
+        ),
+        (0, 0, 0)
+    );
+}
+
+#[test]
+fn invalid_profiles_and_oversized_credits_cannot_wrap_or_consume_reservations() {
+    for invalid in [
+        PublicationLimits {
+            maintenance_operations: 1,
+            ..limits()
+        },
+        PublicationLimits {
+            maintenance_in_flight: 1,
+            ..limits()
+        },
+        PublicationLimits {
+            in_flight: 3,
+            ..limits()
+        },
+        PublicationLimits {
+            in_flight: 0,
+            ..limits()
+        },
+        PublicationLimits {
+            command_bytes: 0,
+            ..limits()
+        },
+    ] {
+        assert!(matches!(
+            PublicationBudget::new(invalid),
+            Err(PublicationScheduleError::InvalidLimits)
+        ));
+    }
+    let budget = PublicationBudget::new(limits()).unwrap();
+    for bytes in [0, u64::MAX, limits().command_bytes] {
+        assert!(matches!(
+            budget.reserve(PublicationClass::Foreground, "a", bytes),
+            Err(PublicationScheduleError::Capacity)
+        ));
+    }
+    assert_eq!(
+        (budget.stats().accounts, budget.stats().command_bytes),
+        (0, 0)
+    );
+    let budget = PublicationBudget::new(PublicationLimits {
+        command_bytes: u64::MAX,
+        ..limits()
+    })
+    .unwrap();
+    let bytes = u64::MAX - 4 * MAINTENANCE_RESERVATION;
+    let foreground = budget
+        .reserve(PublicationClass::Foreground, "a", bytes)
+        .unwrap();
+    assert!(matches!(
+        budget.reserve(PublicationClass::Foreground, "b", 1),
+        Err(PublicationScheduleError::Capacity)
+    ));
+    let maintenance = budget
+        .reserve(PublicationClass::Maintenance, "b", MAINTENANCE_RESERVATION)
+        .unwrap();
+    assert_eq!(
+        budget.stats().command_bytes,
+        bytes + MAINTENANCE_RESERVATION
+    );
+    drop((foreground, maintenance));
+    assert_eq!(budget.stats().command_bytes, 0);
+}
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 4058eca8..4c425c0b 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -61,12 +61,13 @@ pub use completion::{
 };
 pub use coordinator::{
     CompactionReadyError, NativeInputReadyError, PreparationCommandKind, PreparationCommandOutcome,
-    PreparationReadyError, PublicationAdmissionFailure, PublicationClass, PublicationCoordinator,
-    PublicationError, PublicationLimits, PublicationOutcome, PublicationScheduleError,
-    PublicationState, PublicationStats, PublicationTicket, ReadyBoundRecovery,
-    ReadyCatalogCompaction, ReadyCatalogPush, ReadyInitialization, ReadyNativeInputs,
-    ReadyPreparation, ReadyPublication, ReadyRefPolicyPage, ReadyRootPush, RecoveryBindingFailure,
-    RefPolicyReadyError, RefPolicyRefusalFailure, RegisteredNativeInputs, RootPushReadyError,
+    PreparationReadyError, PublicationAdmissionFailure, PublicationBudget, PublicationBudgetStats,
+    PublicationClass, PublicationCoordinator, PublicationError, PublicationLimits,
+    PublicationOutcome, PublicationScheduleError, PublicationState, PublicationStats,
+    PublicationTicket, ReadyBoundRecovery, ReadyCatalogCompaction, ReadyCatalogPush,
+    ReadyInitialization, ReadyNativeInputs, ReadyPreparation, ReadyPublication, ReadyRefPolicyPage,
+    ReadyRootPush, RecoveryBindingFailure, RefPolicyReadyError, RefPolicyRefusalFailure,
+    RegisteredNativeInputs, RootPushReadyError,
 };
 mod commands;
 mod compaction;
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 9d2ad18f..ee82c391 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -143,6 +143,7 @@ struct Fixture {
     registry: Arc<Registry>,
     runtime: CellRuntime,
     handle: CellHandle,
+    publication_budget: PublicationBudget,
 }
 impl Fixture {
     fn authority(&self) -> PreparationAuthority {
@@ -211,6 +212,15 @@ impl Fixture {
             registry,
             runtime,
             handle,
+            publication_budget: PublicationBudget::new(PublicationLimits {
+                operations: 128,
+                per_actor: 32,
+                command_bytes: 512 << 20,
+                in_flight: 16,
+                maintenance_operations: 16,
+                maintenance_in_flight: 4,
+                ..PublicationLimits::default()
+            })?,
         })
     }
     fn client(&self) -> CellClient {
@@ -1098,8 +1108,11 @@ async fn authoritative_base_resolution_uses_live_queried_facts_and_fences_failed
             Err(ClosureError::Integrity)
         ));
         let renewal = identity()?;
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let ticket = coordinator
             .submit(resolver.ready_renew(renewal, DEFAULT_LEASE_MS).await?)
             .await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs b/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
index 36ed1fd4..06b82524 100644
--- a/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
@@ -80,8 +80,11 @@ async fn maintenance_final_publication_uses_shared_bound_lifecycle_and_reserved_
             Ok((ready, weak))
         })?;
         let (ready, weak) = work.wait().await.map_err(|e| e.to_string())?;
-        let publications =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let publications = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let (release, entered) = publications.pause_for_test().await;
         let observer = ticket.publish(&publications, ready)?;
         timeout(Duration::from_secs(10), entered).await??;
@@ -128,8 +131,11 @@ async fn uncertain_compaction_retains_exact_command_and_recovers_original_receip
             let compact = Arc::new(prepared.compact);
             let weak = Arc::downgrade(&compact);
             let ready = compact.ready_compaction(identity()?).await?;
-            let coordinator =
-                PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+            let coordinator = PublicationCoordinator::new(
+                fixture.target.clone(),
+                PublicationLimits::default(),
+                fixture.publication_budget.clone(),
+            )?;
             coordinator.fault_for_test(fault);
             let ticket = coordinator.try_reserve(ready)?;
             assert_eq!(ticket.class(), PublicationClass::Maintenance);
@@ -240,6 +246,7 @@ async fn reserved_classes_and_actor_quotas_keep_mixed_admission_bounded() -> Res
             maintenance_in_flight: 1,
             foreground_burst: 3,
         },
+        fixture.publication_budget.clone(),
     )?;
     let (release, entered) = coordinator.pause_for_test().await;
     let mut entered = Some(entered);
@@ -376,8 +383,11 @@ async fn queued_compaction_rechecks_admin_and_canceled_observer_cannot_cancel_pu
         let prepared = prepare_compaction(&fixture, &inventory, 180, &[0, 1]).await?;
         let compact = Arc::new(prepared.compact);
         let weak = Arc::downgrade(&compact);
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let (release, entered) = coordinator.pause_for_test().await;
         let ticket = coordinator
             .submit(compact.ready_compaction(identity()?).await?)
@@ -428,6 +438,7 @@ async fn maintenance_concurrency_cap_keeps_foreground_progressing() -> Result {
             maintenance_in_flight: 1,
             ..PublicationLimits::default()
         },
+        fixture.publication_budget.clone(),
     )?;
     let (release, entered) = coordinator.pause_for_test().await;
     let a = coordinator
diff --git a/crates/canopy-server/src/packs/publication/tests/compaction/schedule.rs b/crates/canopy-server/src/packs/publication/tests/compaction/schedule.rs
index 9170ffc2..9fd2565b 100644
--- a/crates/canopy-server/src/packs/publication/tests/compaction/schedule.rs
+++ b/crates/canopy-server/src/packs/publication/tests/compaction/schedule.rs
@@ -13,8 +13,11 @@ async fn geometric_planner_drains_native_ingress_and_level_debt_without_changing
             urgent_burst: 2,
         };
         let mut planner = CompactionPlanner::new(policy)?;
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let mut expected = None;
         let mut first_catalog = None;
         let mut jobs = 0;
diff --git a/crates/canopy-server/src/packs/publication/tests/completion/outcome.rs b/crates/canopy-server/src/packs/publication/tests/completion/outcome.rs
index 38a49796..6d43c646 100644
--- a/crates/canopy-server/src/packs/publication/tests/completion/outcome.rs
+++ b/crates/canopy-server/src/packs/publication/tests/completion/outcome.rs
@@ -282,8 +282,11 @@ async fn outcome_dispatch_retains_session_and_exact_command_after_observer_cance
         let ready = session
             .ready_outcome(identity()?, native(200, false, &session))
             .await?;
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let (release, entered) = coordinator.pause_for_test().await;
         coordinator.fault_for_test(fault);
         let ticket = coordinator.submit(ready).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/coordinator.rs b/crates/canopy-server/src/packs/publication/tests/coordinator.rs
index fd3041cb..437d9f53 100644
--- a/crates/canopy-server/src/packs/publication/tests/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/tests/coordinator.rs
@@ -1,3 +1,4 @@
+mod budget;
 mod held;
 mod preparation;
 use super::*;
@@ -131,8 +132,11 @@ async fn canceled_observer_does_not_cancel_admitted_native_publication_or_releas
             limits(),
         ))
         .await?;
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let (release, entered) = coordinator.pause_for_test().await;
         let ticket = coordinator.submit(ready).await?;
         timeout(Duration::from_secs(5), entered).await??;
@@ -189,6 +193,7 @@ async fn admission_accounts_for_running_and_queued_work_without_losing_rejected_
             maintenance_in_flight: 1,
             foreground_burst: 3,
         },
+        fixture.publication_budget.clone(),
     )?;
     let (release, entered) = coordinator.pause_for_test().await;
     let mut attempts = Vec::new();
@@ -259,6 +264,7 @@ async fn admission_accounts_for_running_and_queued_work_without_losing_rejected_
             uuid::Uuid::new_v4().into_bytes(),
         )?,
         PublicationLimits::default(),
+        fixture.publication_budget.clone(),
     )?;
     let failure = foreign
         .submit(attempts[2].3.take().ok_or("ready")?)
@@ -311,8 +317,11 @@ async fn unknown_absent_lost_ack_and_worker_panic_recover_exact_native_command()
             limits(),
         ))
         .await?;
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         coordinator.fault_for_test(fault);
         let ticket = coordinator.submit(ready).await?;
         drop(prepared);
@@ -360,6 +369,13 @@ async fn unknown_absent_lost_ack_and_worker_panic_recover_exact_native_command()
             .ok_or("uncertain input lost")?;
         let drained = coordinator.close_and_drain().await;
         assert_eq!(drained.len(), 1);
+        fixture.publication_budget.close();
+        let node = fixture.publication_budget.stats();
+        assert_eq!(
+            (node.foreground, node.command_bytes, node.accounts),
+            (1, 8 << 20, 1)
+        );
+        assert_eq!(node.foreground_dispatch, 0);
         let before = replay_push_response(
             &fixture.client(),
             &fixture.target,
@@ -388,6 +404,17 @@ async fn unknown_absent_lost_ack_and_worker_panic_recover_exact_native_command()
         ));
         assert_eq!(coordinator.reservations_for_test().await, (0, 0, 0));
         assert!(weak.upgrade().is_none());
+        let node = fixture.publication_budget.stats();
+        assert_eq!(
+            (
+                node.foreground,
+                node.command_bytes,
+                node.accounts,
+                node.foreground_dispatch
+            ),
+            (0, 0, 0, 0)
+        );
+        assert!(node.closed);
         assert_eq!(
             coordinator.recover(&retained).await,
             Err(PublicationScheduleError::NotUncertain)
@@ -443,6 +470,7 @@ async fn stale_ready_command_has_durable_conflict_then_reconciliation_can_reente
             maintenance_in_flight: 1,
             ..PublicationLimits::default()
         },
+        fixture.publication_budget.clone(),
     )?;
     let (release, entered) = coordinator.pause_for_test().await;
     let a_ticket = coordinator.submit(a_ready).await?;
@@ -515,8 +543,11 @@ async fn queued_publication_still_evaluates_current_authorization() -> Result {
         limits(),
     ))
     .await?;
-    let coordinator =
-        PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+    let coordinator = PublicationCoordinator::new(
+        fixture.target.clone(),
+        PublicationLimits::default(),
+        fixture.publication_budget.clone(),
+    )?;
     let (release, entered) = coordinator.pause_for_test().await;
     let ticket = coordinator.submit(ready).await?;
     entered.await?;
@@ -551,6 +582,7 @@ async fn bounded_dispatch_allows_another_command_to_progress_before_first_outcom
             maintenance_in_flight: 1,
             ..PublicationLimits::default()
         },
+        fixture.publication_budget.clone(),
     )?;
     let (release, entered) = coordinator.pause_for_test().await;
     let ready = Box::pin(first.0.ready_push(
@@ -622,8 +654,11 @@ async fn oversized_inline_completion_fails_before_dispatch_while_inventory_stays
         limits(),
     ))
     .await?;
-    let coordinator =
-        PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+    let coordinator = PublicationCoordinator::new(
+        fixture.target.clone(),
+        PublicationLimits::default(),
+        fixture.publication_budget.clone(),
+    )?;
     let ticket = coordinator.submit(ready).await?;
     finished(ticket.wait().await)?;
     assert!(coordinator.close_and_drain().await.is_empty());
diff --git a/crates/canopy-server/src/packs/publication/tests/coordinator/budget.rs b/crates/canopy-server/src/packs/publication/tests/coordinator/budget.rs
new file mode 100644
index 00000000..e3b3fb32
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/coordinator/budget.rs
@@ -0,0 +1,225 @@
+use super::*;
+
+fn node_limits() -> PublicationLimits {
+    PublicationLimits {
+        operations: 8,
+        per_actor: 2,
+        command_bytes: (24 << 20) + (32 << 10),
+        in_flight: 4,
+        maintenance_operations: 4,
+        maintenance_in_flight: 2,
+        foreground_burst: 3,
+    }
+}
+
+async fn prepared_outcome(
+    fixture: &Fixture,
+    operation: u8,
+    actor: &str,
+) -> Result<(
+    ReadyCatalogPush,
+    tempfile::TempDir,
+    DiskBudget,
+    std::sync::Weak<PreparationSession>,
+)> {
+    let (prepared, root, disk) = empty(fixture, [operation; 16], actor).await?;
+    let session = Arc::new(prepared.base.session.clone());
+    let weak = Arc::downgrade(&session);
+    let ready = session
+        .ready_outcome(identity()?, request(refused()))
+        .await?;
+    drop((prepared, session));
+    cleaned(root.path(), &disk).await?;
+    Ok((ready, root, disk, weak))
+}
+
+#[tokio::test]
+async fn held_commands_charge_one_node_across_repositories_and_return_exact_refusals() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let first = Fixture::new(format).await?;
+        let second = Fixture::new(format).await?;
+        for fixture in [&first, &second] {
+            edit(
+                fixture,
+                "INSERT INTO repository_members VALUES('writer','write')",
+            )
+            .await?;
+        }
+        let node = PublicationBudget::new(node_limits())?;
+        let a = PublicationCoordinator::new(
+            first.target.clone(),
+            PublicationLimits::default(),
+            node.clone(),
+        )?;
+        let b = PublicationCoordinator::new(
+            second.target.clone(),
+            PublicationLimits::default(),
+            node.clone(),
+        )?;
+        let (ready, root1, disk1, weak1) = prepared_outcome(&first, 51, "owner").await?;
+        let t1 = a.try_reserve(ready)?;
+        let (ready, root2, disk2, weak2) = prepared_outcome(&second, 52, "owner").await?;
+        let t2 = b.try_reserve(ready)?;
+        let (ready, root3, disk3, weak3) = prepared_outcome(&second, 53, "owner").await?;
+        let original = ready.evidence_for_test();
+        let failure = b
+            .try_reserve(ready)
+            .err()
+            .ok_or("aggregate account quota bypassed")?;
+        assert_eq!(failure.reason, PublicationScheduleError::Capacity);
+        let ReadyPublication::Push(ready) = failure.ready else {
+            return Err("ready variant changed".into());
+        };
+        assert_eq!(ready.evidence_for_test(), original);
+        let (writer, root4, disk4, weak4) = prepared_outcome(&second, 54, "writer").await?;
+        let t4 = b.try_reserve(writer)?;
+        let (writer, root5, disk5, weak5) = prepared_outcome(&first, 55, "writer").await?;
+        let writer_original = writer.evidence_for_test();
+        let failure = a
+            .try_reserve(writer)
+            .err()
+            .ok_or("aggregate command bytes bypassed")?;
+        assert_eq!(failure.reason, PublicationScheduleError::Capacity);
+        let ReadyPublication::Push(writer) = failure.ready else {
+            return Err("ready variant changed".into());
+        };
+        assert_eq!(writer.evidence_for_test(), writer_original);
+        let stats = node.stats();
+        assert_eq!(
+            (
+                stats.foreground,
+                stats.command_bytes,
+                stats.accounts,
+                stats.foreground_dispatch
+            ),
+            (3, 24 << 20, 2, 0)
+        );
+        assert!(weak1.upgrade().is_some());
+        // Observer handles survive credit return, but the retained session
+        // must already be gone when that return is observed.
+        t1.discard_held().await?;
+        assert!(weak1.upgrade().is_none());
+        cleaned(root1.path(), &disk1).await?;
+        assert_eq!(node.stats().foreground, 2);
+        let t3 = b.try_reserve(ready)?;
+        assert_eq!(node.stats().foreground, 3);
+        t2.discard_held().await?;
+        let t5 = a.try_reserve(writer)?;
+        node.close();
+        let (ready, root6, disk6, weak6) = prepared_outcome(&first, 56, "writer").await?;
+        let original = ready.evidence_for_test();
+        let failure = a
+            .try_reserve(ready)
+            .err()
+            .ok_or("closed node admitted new work")?;
+        assert_eq!(failure.reason, PublicationScheduleError::Closed);
+        let ReadyPublication::Push(ready) = failure.ready else {
+            return Err("ready variant changed".into());
+        };
+        assert_eq!(ready.evidence_for_test(), original);
+        drop(ready);
+        assert!(weak6.upgrade().is_none());
+        for ticket in [&t3, &t4, &t5] {
+            ticket.discard_held().await?;
+        }
+        assert!(a.close_and_drain().await.is_empty());
+        assert!(b.close_and_drain().await.is_empty());
+        assert!(matches!(t1.state(), PublicationState::Discarded));
+        assert_eq!(
+            (
+                node.stats().foreground,
+                node.stats().accounts,
+                node.stats().command_bytes
+            ),
+            (0, 0, 0)
+        );
+        for (root, disk, weak) in [
+            (root2, disk2, weak2),
+            (root3, disk3, weak3),
+            (root4, disk4, weak4),
+            (root5, disk5, weak5),
+            (root6, disk6, weak6),
+        ] {
+            assert!(weak.upgrade().is_none());
+            cleaned(root.path(), &disk).await?;
+        }
+        first.runtime.shutdown().await?;
+        second.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn account_transport_across_repositories_does_not_block_another_account() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let first = Fixture::new(format).await?;
+        let second = Fixture::new(format).await?;
+        edit(
+            &second,
+            "INSERT INTO repository_members VALUES('writer','write')",
+        )
+        .await?;
+        let node = PublicationBudget::new(node_limits())?;
+        let a = PublicationCoordinator::new(
+            first.target.clone(),
+            PublicationLimits::default(),
+            node.clone(),
+        )?;
+        let b = PublicationCoordinator::new(
+            second.target.clone(),
+            PublicationLimits::default(),
+            node.clone(),
+        )?;
+        let (release, entered) = a.pause_for_test().await;
+        let (ready, root1, disk1, weak1) = prepared_outcome(&first, 61, "owner").await?;
+        let t1 = a.submit(ready).await?;
+        timeout(Duration::from_secs(5), entered).await??;
+        let (ready, root2, disk2, weak2) = prepared_outcome(&second, 62, "owner").await?;
+        let t2 = b.submit(ready).await?;
+        assert!(timeout(Duration::from_millis(30), t2.wait()).await.is_err());
+        assert_eq!(
+            (node.stats().foreground, node.stats().foreground_dispatch),
+            (2, 1)
+        );
+        drop(t2);
+        assert!(weak2.upgrade().is_some());
+        let (ready, root3, disk3, weak3) = prepared_outcome(&second, 63, "writer").await?;
+        let writer = b.submit(ready).await?;
+        finished(timeout(Duration::from_secs(10), writer.wait()).await?)?;
+        assert_eq!(writer.response().await?, refused());
+        assert!(weak3.upgrade().is_none());
+        assert_eq!(
+            (node.stats().foreground, node.stats().foreground_dispatch),
+            (2, 1)
+        );
+        node.close();
+        let t2 = b.pending([62; 16]).await.ok_or("waiting original lost")?;
+        release.send(()).map_err(|_| "paused dispatcher lost")?;
+        for ticket in [&t1, &t2] {
+            finished(timeout(Duration::from_secs(10), ticket.wait()).await?)?;
+            assert_eq!(ticket.response().await?, refused());
+        }
+        assert!(a.close_and_drain().await.is_empty());
+        assert!(b.close_and_drain().await.is_empty());
+        assert_eq!(
+            (
+                node.stats().foreground,
+                node.stats().foreground_dispatch,
+                node.stats().command_bytes,
+                node.stats().accounts
+            ),
+            (0, 0, 0, 0)
+        );
+        for (root, disk, weak) in [
+            (root1, disk1, weak1),
+            (root2, disk2, weak2),
+            (root3, disk3, weak3),
+        ] {
+            assert!(weak.upgrade().is_none());
+            cleaned(root.path(), &disk).await?;
+        }
+        first.runtime.shutdown().await?;
+        second.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/coordinator/held.rs b/crates/canopy-server/src/packs/publication/tests/coordinator/held.rs
index 8b116b76..922f9576 100644
--- a/crates/canopy-server/src/packs/publication/tests/coordinator/held.rs
+++ b/crates/canopy-server/src/packs/publication/tests/coordinator/held.rs
@@ -20,8 +20,11 @@ async fn held_native_proof_survives_canceled_observation_and_closed_activation()
             limits(),
         ))
         .await?;
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let ticket = coordinator.try_reserve(ready)?;
         drop(prepared);
         let observer = ticket.clone();
@@ -102,14 +105,22 @@ async fn held_discard_drops_native_proof_before_credit_and_never_executes() -> R
             limits(),
         ))
         .await?;
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let ticket = coordinator.try_reserve(ready)?;
         drop(prepared);
         assert_eq!(coordinator.close_and_drain().await.len(), 1);
         ticket.discard_held().await?;
         assert!(matches!(ticket.wait().await, PublicationState::Discarded));
         assert!(weak.upgrade().is_none());
+        let node = fixture.publication_budget.stats();
+        assert_eq!(
+            (node.foreground, node.command_bytes, node.accounts),
+            (0, 0, 0)
+        );
         cleaned(graph.root.path(), &graph.budget).await?;
         assert_eq!(coordinator.reservations_for_test().await, (0, 0, 0));
         assert!(coordinator.pending([60; 16]).await.is_none());
@@ -152,6 +163,7 @@ async fn held_admission_uses_existing_account_bytes_and_returns_refused_ready()
             maintenance_in_flight: 1,
             foreground_burst: 3,
         },
+        fixture.publication_budget.clone(),
     )?;
     let mut attempts = Vec::new();
     for (n, actor) in [
@@ -179,6 +191,7 @@ async fn held_admission_uses_existing_account_bytes_and_returns_refused_ready()
             fixture.repository,
         )?,
         PublicationLimits::default(),
+        fixture.publication_budget.clone(),
     )?;
     let failure = foreign
         .try_reserve(attempts[0].3.take().unwrap())
@@ -244,8 +257,11 @@ async fn held_admission_uses_existing_account_bytes_and_returns_refused_ready()
         .err()
         .ok_or("refused admission unexpectedly accepted")?;
     assert_eq!(failure.reason, PublicationScheduleError::Closed);
-    let successor =
-        PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+    let successor = PublicationCoordinator::new(
+        fixture.target.clone(),
+        PublicationLimits::default(),
+        fixture.publication_budget.clone(),
+    )?;
     let ticket = successor.try_reserve(failure.ready)?;
     ticket.activate().await?;
     finished(timeout(Duration::from_secs(10), ticket.wait()).await?)?;
@@ -271,8 +287,11 @@ async fn activated_held_command_recovers_exact_receipt_or_checks_absent_authorit
                 limits(),
             ))
             .await?;
-            let coordinator =
-                PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+            let coordinator = PublicationCoordinator::new(
+                fixture.target.clone(),
+                PublicationLimits::default(),
+                fixture.publication_budget.clone(),
+            )?;
             let ticket = coordinator.try_reserve(ready)?;
             assert!(matches!(ticket.state(), PublicationState::Held));
             coordinator.fault_for_test(fault);
@@ -361,8 +380,11 @@ async fn activated_held_command_recovers_exact_receipt_or_checks_absent_authorit
 #[tokio::test]
 async fn held_activation_and_discard_race_selects_one_exact_disposition() -> Result {
     let fixture = Fixture::new(ObjectFormat::Sha256).await?;
-    let coordinator =
-        PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+    let coordinator = PublicationCoordinator::new(
+        fixture.target.clone(),
+        PublicationLimits::default(),
+        fixture.publication_budget.clone(),
+    )?;
     let mut published = 0;
     for n in 100..108 {
         let (prepared, root, budget) = empty(&fixture, [n; 16], "owner").await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs b/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
index cf930cf7..4a986910 100644
--- a/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
+++ b/crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs
@@ -6,8 +6,11 @@ async fn cold_original_renewal_keeps_history_but_cannot_grant_previous_owner_cus
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let f = Fixture::new(format).await?;
         let original_session = session(&f, [209; 16]).await?;
-        let coordinator =
-            PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         let ticket = coordinator
             .submit(
                 original_session
@@ -31,7 +34,11 @@ async fn cold_original_renewal_keeps_history_but_cannot_grant_previous_owner_cus
             )
             .await?
             .output;
-        let restored = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let restored = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         let ticket = restored
             .submit(
                 ReadyPreparation::restore(client, f.target.clone(), [209; 16], f.authority())
@@ -67,7 +74,11 @@ async fn cold_takeover_fences_shared_old_session_and_restores_current_claim() ->
             shared.live_lease(),
             Err(PreparationBaseError::Inactive)
         ));
-        let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let queue = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         let ready = ReadyPreparation::claim(
             client.clone(),
             f.target.clone(),
@@ -128,8 +139,11 @@ async fn missing_or_corrupt_owner_preserves_original_outcome_and_permanently_fen
         for corrupt in [false, true] {
             let f = Fixture::new(format).await?;
             let original_session = session(&f, [211; 16]).await?;
-            let queue =
-                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            let queue = PublicationCoordinator::new(
+                f.target.clone(),
+                PublicationLimits::default(),
+                f.publication_budget.clone(),
+            )?;
             let original = changed(
                 queue
                     .submit(
@@ -262,8 +276,11 @@ async fn bound_lease_commands_keep_exact_identity_and_original_floor_through_clo
                 let f = Fixture::new(format).await?;
                 let s = session(&f, [196; 16]).await?;
                 f.install_empty_root(1).await?;
-                let coordinator =
-                    PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+                let coordinator = PublicationCoordinator::new(
+                    f.target.clone(),
+                    PublicationLimits::default(),
+                    f.publication_budget.clone(),
+                )?;
                 let mutation = identity()?;
                 coordinator.fault_for_test(fault);
                 let ticket = coordinator
@@ -361,6 +378,7 @@ async fn bound_lease_ready_admission_preserves_command_and_canceled_observer_ses
             uuid::Uuid::new_v4().into_bytes(),
         )?,
         PublicationLimits::default(),
+        f.publication_budget.clone(),
     )?;
     let rejected = foreign
         .submit(prepared)
@@ -368,7 +386,11 @@ async fn bound_lease_ready_admission_preserves_command_and_canceled_observer_ses
         .err()
         .ok_or("foreign admitted")?;
     assert_eq!(rejected.reason, PublicationScheduleError::Foreign);
-    let coordinator = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let coordinator = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let (release, entered) = coordinator.pause_for_test().await;
     let ticket = coordinator.submit(rejected.ready).await?;
     timeout(Duration::from_secs(5), entered).await??;
@@ -401,7 +423,11 @@ async fn bound_lease_ready_admission_preserves_command_and_canceled_observer_ses
         .err()
         .ok_or("closed admitted")?;
     assert_eq!(refused.reason, PublicationScheduleError::Closed);
-    let other = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let other = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let retried = other.submit(refused.ready).await?;
     changed(timeout(Duration::from_secs(10), retried.wait()).await?)?;
     assert!(other.close_and_drain().await.is_empty());
@@ -416,8 +442,11 @@ async fn bound_lease_committed_recovery_keeps_receipt_when_fresh_custody_is_revo
         for mode in [0, 1, 2] {
             let f = Fixture::new(ObjectFormat::Sha256).await?;
             let s = session(&f, [198; 16]).await?;
-            let coordinator =
-                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            let coordinator = PublicationCoordinator::new(
+                f.target.clone(),
+                PublicationLimits::default(),
+                f.publication_budget.clone(),
+            )?;
             let mutation = identity()?;
             coordinator.fault_for_test(2);
             let ticket = coordinator
@@ -455,8 +484,11 @@ async fn bound_lease_absent_recovery_rechecks_authority_and_claim_can_recover_ex
         for mode in [0, 1, 2] {
             let f = Fixture::new(ObjectFormat::Sha1).await?;
             let s = session(&f, [199; 16]).await?;
-            let coordinator =
-                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            let coordinator = PublicationCoordinator::new(
+                f.target.clone(),
+                PublicationLimits::default(),
+                f.publication_budget.clone(),
+            )?;
             coordinator.fault_for_test(1);
             let ticket = coordinator
                 .submit(ready(&f, &s, kind, identity()?).await?)
@@ -542,7 +574,11 @@ async fn bound_lease_ready_rejects_invalid_context_size_duration_and_never_reviv
         .await
         .is_err()
     );
-    let coordinator = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let coordinator = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     coordinator.fault_for_test(2);
     let ticket = coordinator
         .submit(s.ready_renew(identity()?, DEFAULT_LEASE_MS).await?)
@@ -593,8 +629,11 @@ async fn bound_lease_claim_after_actual_owner_restore_uses_new_fence_and_preserv
             )
             .await?;
         let client = CellClient::local(Arc::clone(&f.registry), handle.clone());
-        let coordinator =
-            PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         let mutation = identity()?;
         coordinator.fault_for_test(2);
         let ticket = coordinator
diff --git a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
index de321237..4c030257 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
@@ -44,8 +44,11 @@ async fn stop_all_seven_expired_originals_preserves_unknown_outcomes_and_allows_
                 .ready_stop(f.client(), identity()?, &f.authority())
                 .await?;
             let stop_evidence = ready.evidence().clone();
-            let queue =
-                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            let queue = PublicationCoordinator::new(
+                f.target.clone(),
+                PublicationLimits::default(),
+                f.publication_budget.clone(),
+            )?;
             let ticket = queue.submit(ready).await?;
             let outcome = stopped(observed(&ticket).await?)?;
             assert_eq!(outcome.original, evidence);
@@ -213,7 +216,11 @@ async fn stop_first_writer_fact_is_immutable_and_is_not_an_unexecuted_invocation
             .await?;
         let first_receipt = first.command_for_test().execute().await?.receipt;
         let invocation = second.evidence().clone();
-        let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let queue = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         let outcome = stopped(observed(&queue.submit(second).await?).await?)?;
         assert_eq!(outcome.invocation, invocation);
         assert!(outcome.committed.is_none());
@@ -309,8 +316,11 @@ async fn stop_service_reply_loss_and_panic_keep_bounded_originals_through_closed
                 .ready_stop(f.client(), invocation_identity, &f.authority())
                 .await?;
             let invocation = ready.evidence().clone();
-            let queue =
-                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            let queue = PublicationCoordinator::new(
+                f.target.clone(),
+                PublicationLimits::default(),
+                f.publication_budget.clone(),
+            )?;
             if fault == 0 {
                 edit(
                     &f,
@@ -420,7 +430,11 @@ async fn custody_scan_uses_bounded_indexed_pages_and_revisits_corruption_without
         assert!(details.iter().all(|v|!v.contains("TEMP B-TREE")),"{details:?}");
         Ok(Vec::new())
     }).await?;
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let limits = RecoveryScanLimits {
         page: 17,
         interval: Duration::from_millis(10),
@@ -560,8 +574,11 @@ async fn custody_scan_recovers_exact_maintenance_commands_after_their_pending_ke
                 timeout(Duration::from_secs(10), stage.wait_terminal()).await?,
                 StagingState::Uncertain(_)
             ));
-            let queue =
-                PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+            let queue = PublicationCoordinator::new(
+                f.target.clone(),
+                PublicationLimits::default(),
+                f.publication_budget.clone(),
+            )?;
             queue.fault_for_test(fault);
             let service = CustodySupervisor::start(
                 f.client(),
@@ -712,7 +729,11 @@ async fn custody_stop_cannot_be_blocked_by_its_own_uncertain_preparation_and_fen
         let mut mutation = identity()?;
         mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
         let ready = session.ready_renew(mutation, DEFAULT_LEASE_MS).await?;
-        let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let queue = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         queue.fault_for_test(1);
         let renewal = queue.submit(ready).await?;
         assert!(matches!(
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
index e8ce75c5..b6c0cb8e 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
@@ -295,6 +295,7 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
         store,
         &expected,
         f.authority(),
+        f.publication_budget.clone(),
     ))
     .await?;
     let _released = Box::pin(super::terminal_retention::archive(
@@ -324,6 +325,7 @@ async fn query_failure(
     store: &canopy_object_storage::artifact::ArtifactStore,
     expected: &cellule_runtime::Committed<RootCompletionReply>,
     authority: PreparationAuthority,
+    budget: PublicationBudget,
 ) -> Result {
     // The service is stopped and the original outcome has settled. Hide the
     // phase table to inject a real private-query failure without changing data.
@@ -339,6 +341,7 @@ async fn query_failure(
     let queue = PublicationCoordinator::new(
         loaded.evidence().target().clone(),
         PublicationLimits::default(),
+        budget,
     )?;
     let observer = queue
         .submit(ready)
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
index ed41975e..3fa9c7c9 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
@@ -230,7 +230,11 @@ async fn qualify_ready(
             matches!(&result.output, RootCompletionReply::Completed(value) if value.completion.publication.is_some() == publishing)
         );
         let expected = original_result.ok_or("original outcome missing")?;
-        let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let queue = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         queue.fault_for_test(2);
         let observer = queue
             .submit(
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs b/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
index 56785eff..21b0c942 100644
--- a/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
@@ -225,7 +225,11 @@ async fn original_initialization_receipt_survives_lost_ack_expiry_body_loss_and_
     let original = registered.evidence().clone();
     let check = check(registered.token());
     let bound = ready.bind_recovery(registered.clone(), &store)?;
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     queue.fault_for_test(2);
     let observer = queue
         .submit(bound)
@@ -289,7 +293,11 @@ async fn original_initialization_receipt_survives_lost_ack_expiry_body_loss_and_
         (result.output, result.receipt),
         (expected.output.clone(), expected.receipt)
     );
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let observer = queue
         .submit(loaded.ready(client, (*store).clone(), f.authority())?)
         .await
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs b/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
index 379551a1..6cb7d110 100644
--- a/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
+++ b/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
@@ -258,7 +258,11 @@ async fn denied_initial_attempt_retires_only_after_claim_and_keeps_its_receipt_a
             .await
             .is_err()
     );
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let supervisor = RecoverySupervisor::start_retiring(
         f.client(),
         f.target.clone(),
@@ -448,7 +452,11 @@ async fn automatic_initialization_retirement_recovers_uncertainty_after_pin_disa
     let ready = prepared.ready_initialization(identity()?).await?;
     let saved = ready.persist_recovery(&store, identity()?).await?;
     ready.complete(&saved, &store).await?;
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     queue.fault_for_test(2);
     let scanner = RecoverySupervisor::start_retiring(
         f.client(),
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs.rs b/crates/canopy-server/src/packs/publication/tests/inputs.rs
index 02e04f28..4d6a89a2 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs.rs
@@ -532,8 +532,11 @@ async fn bound_preparation_claim_adopts_exact_input_root_without_copying_nodes()
         adopted.token()?.artifact_operation,
         prior.token()?.artifact_operation
     );
-    let publisher =
-        PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+    let publisher = PublicationCoordinator::new(
+        fixture.target.clone(),
+        PublicationLimits::default(),
+        fixture.publication_budget.clone(),
+    )?;
     let ready = session.ready_inputs(identity()?, adopted.clone()).await?;
     let registered = publisher.submit(ready).await?;
     let PublicationState::Finished(Ok(PublicationOutcome::Inputs(result))) =
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs/bound.rs b/crates/canopy-server/src/packs/publication/tests/inputs/bound.rs
index f6dd43cc..071fc090 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs/bound.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs/bound.rs
@@ -44,8 +44,11 @@ impl Bound {
             return Err("bound source".into());
         };
         assert!(staging.close_and_drain().await.is_empty());
-        let coordinator =
-            PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            fixture.target.clone(),
+            PublicationLimits::default(),
+            fixture.publication_budget.clone(),
+        )?;
         let claimed = coordinator
             .submit(
                 ReadyPreparation::claim(
@@ -194,7 +197,11 @@ async fn bound_checkpoint_canceled_observer_and_foreign_duplicate_closed_admissi
     let mutation = identity()?;
     let ready = session.ready_inputs(mutation, proof.clone()).await?;
     let other = Fixture::new(ObjectFormat::Sha256).await?;
-    let foreign = PublicationCoordinator::new(other.target.clone(), PublicationLimits::default())?;
+    let foreign = PublicationCoordinator::new(
+        other.target.clone(),
+        PublicationLimits::default(),
+        other.publication_budget.clone(),
+    )?;
     let refused = foreign
         .submit(ready)
         .await
@@ -475,6 +482,7 @@ async fn bound_checkpoint_shares_push_actor_quotas_and_exact_mixed_byte_admissio
             maintenance_in_flight: 1,
             foreground_burst: 3,
         },
+        bound.fixture.publication_budget.clone(),
     )?;
     mutate(&bound.fixture.handle, "INSERT INTO repository_members VALUES('writer','write'); INSERT INTO repository_members VALUES('third','write')".into()).await?;
     let (release, entered) = bound.coordinator.pause_for_test().await;
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs b/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
index 880a71b6..e572d0a1 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
@@ -338,6 +338,7 @@ async fn root_outcome_preserves_plain_http_errors_without_verifying_or_publishin
         let p = PublicationCoordinator::new(
             request.fixture.target.clone(),
             PublicationLimits::default(),
+            request.fixture.publication_budget.clone(),
         )?;
         let observer = request.ticket.publish(&p, ready)?;
         let PublicationState::Finished(Ok(PublicationOutcome::RootPush(committed))) =
@@ -413,6 +414,7 @@ async fn root_outcome_exact_recovery_preserves_commits_and_refuses_expired_input
             let p = PublicationCoordinator::new(
                 request.fixture.target.clone(),
                 PublicationLimits::default(),
+                request.fixture.publication_budget.clone(),
             )?;
             p.fault_for_test(fault);
             drop(request.ticket.publish(&p, ready)?);
diff --git a/crates/canopy-server/src/packs/publication/tests/native_capture.rs b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
index c33dabbb..918c1461 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_capture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
@@ -972,8 +972,11 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
         .wait()
         .await
         .map_err(|error| format!("native receive stage: {error:?}"))?;
-    let publications =
-        PublicationCoordinator::new(fixture.target.clone(), PublicationLimits::default())?;
+    let publications = PublicationCoordinator::new(
+        fixture.target.clone(),
+        PublicationLimits::default(),
+        fixture.publication_budget.clone(),
+    )?;
     let observer = ticket.publish(&publications, ready)?;
     let completed =
         super::coordinator::finished(timeout(Duration::from_secs(10), observer.wait()).await?)?;
diff --git a/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs b/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
index 7ea674ba..49254fb6 100644
--- a/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
@@ -66,7 +66,11 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
     );
     let refusal_evidence = refusal.evidence_for_test();
     let operation = prepared.token().operation;
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let before = state(&f.handle).await?;
     let mut head = None;
     let mut offset = 0;
diff --git a/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs b/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
index e40741ff..24f7933e 100644
--- a/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
+++ b/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
@@ -97,7 +97,11 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
     page.refusal_fault_for_test(fault);
     let registered = page.persist_recovery(store, identity()?, None).await?;
     let page = page.bind_recovery(registered, store)?;
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     p.fault_for_test(1);
     drop(ticket.register_policy_page(&p, page)?);
     let StagingState::Uncertain(error) = settled(ticket, true).await? else {
@@ -348,7 +352,11 @@ async fn qualify_live(context: Context<'_>, loss: Loss) -> Result {
             .await?,
     );
     let evidence = refusal.evidence_for_test();
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let mut head = None;
     for offset in [0, 128, 256] {
         let page = pending
diff --git a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
index b39b7fa5..3de5b8d8 100644
--- a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
@@ -205,8 +205,11 @@ async fn initial_preparation_receipt_cold_owner_and_sdk_expiry_preserve_actual_r
                 .await,
             PreparationDenial::Stale,
         );
-        let coordinator =
-            PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let coordinator = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         let ticket = coordinator
             .submit(
                 known
diff --git a/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs b/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
index e14f73a9..b83fe683 100644
--- a/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
@@ -40,7 +40,11 @@ async fn restart_scan_seeks_bounded_keys_and_revisits_corrupt_pins_without_starv
         assert!(details.iter().all(|value| !value.contains("TEMP B-TREE")), "{details:?}");
         Ok(Vec::new())
     }).await?;
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let store = ArtifactStore::new(Arc::new(InMemory::new()), f.repository);
     let service = RecoverySupervisor::start(
         f.client(),
@@ -141,7 +145,11 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
         // identity binding before bundle I/O; the later valid head still runs.
         edit(f, "INSERT INTO catalog_leases(incarnation,admission_sequence,operation,owner_epoch,artifact_operation,expires_at_ms,recovery) SELECT zeroblob(16),1,zeroblob(16),x'0000000000000001',randomblob(16),0,recovery FROM catalog_leases WHERE recovery IS NOT NULL LIMIT 1").await?;
     }
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     queue.fault_for_test(fault);
     let (release, entered) = queue.pause_for_test().await;
     let service = RecoverySupervisor::start(
@@ -215,7 +223,11 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
     // Destroy local SQL and factory state. A new owner's scanner recognizes
     // the settled head without dispatching or claiming an old-owner command.
     let (runtime, _, client) = super::durable_recovery::restore_owner(f, &check).await?;
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let service = RecoverySupervisor::start(
         client.clone(),
         f.target.clone(),
@@ -262,7 +274,11 @@ pub(super) async fn advanced_head(
     original: &RegisteredRootRecovery,
     expected: &cellule_runtime::Committed<RefPolicyReply>,
 ) -> Result {
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     queue.fault_for_test(2);
     let observer = queue
         .submit(
diff --git a/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs b/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
index de57dcc4..838de0b5 100644
--- a/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
@@ -160,6 +160,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
             f.repository,
         )?,
         PublicationLimits::default(),
+        f.publication_budget.clone(),
     )?;
     let failure = ticket
         .publish(&foreign, ready)
@@ -175,7 +176,11 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
     assert_eq!(retained.evidence_for_test(), evidence);
     assert_eq!(foreign.stats().await.admitted, 0);
 
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     p.fault_for_test(fault);
     let (release, wait) = tokio::sync::oneshot::channel();
     let (entered, running) = tokio::sync::oneshot::channel();
diff --git a/crates/canopy-server/src/packs/publication/tests/root_outcome.rs b/crates/canopy-server/src/packs/publication/tests/root_outcome.rs
index 49f6a678..1e45eafd 100644
--- a/crates/canopy-server/src/packs/publication/tests/root_outcome.rs
+++ b/crates/canopy-server/src/packs/publication/tests/root_outcome.rs
@@ -190,7 +190,11 @@ pub(super) async fn qualify(context: Context<'_>, kind: Kind, fault: u8, revoked
         }
     }
     let ready = ready.bind_recovery(registered, store)?;
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     p.fault_for_test(fault);
     let observer = ticket.publish(&p, ready)?;
     drop(observer);
diff --git a/crates/canopy-server/src/packs/publication/tests/staged_durable.rs b/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
index a5f393ab..78201223 100644
--- a/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
@@ -57,7 +57,11 @@ pub(super) async fn qualify(
             .ready_root_refusal(identity()?, store, root, budget.clone(), None)
             .await?,
     );
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let mut head = None;
     let mut terminal = None;
     for offset in [0, 128, 256] {
@@ -389,7 +393,11 @@ pub(super) async fn qualify_fence(context: Context<'_>) -> Result {
     let registered = page.persist_recovery(store, identity()?, None).await?;
     let bound = page.bind_recovery(registered, store)?;
     session.fence();
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let observer = queue
         .submit(bound)
         .await
@@ -436,7 +444,11 @@ pub(super) async fn qualify_revoked(context: Context<'_>, root_case: bool) -> Re
             .ready_root_refusal(identity()?, store, root, budget.clone(), None)
             .await?,
     );
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let mut head = None;
     let mut observer = None;
     for offset in [0, 128, 256] {
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
index 75c7b2b0..6815e23e 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
@@ -35,8 +35,11 @@ async fn bound_final_waits_for_exact_renewal_and_adopted_checkpoint_recovery_bef
                     StagingLimits::default(),
                     f.authority(),
                 )?;
-                let p =
-                    PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+                let p = PublicationCoordinator::new(
+                    f.target.clone(),
+                    PublicationLimits::default(),
+                    f.publication_budget.clone(),
+                )?;
                 let ticket = super::bound::claim(&f, &c, original.lease.token, identity()?).await?;
                 assert!(matches!(terminal(&ticket).await?, StagingState::Bound(_)));
                 let session = ticket.bound_session()?;
@@ -129,7 +132,11 @@ async fn bound_final_publication_drains_retained_work_and_due_renewal_through_cl
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let f = Fixture::new(format).await?;
         let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
-        let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+        let p = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
         let ticket = super::bound::bind(&f, &c, [231; 16], "owner").await?;
         let session = ticket.bound_session()?;
         let input = ready(&session).await?;
@@ -230,7 +237,11 @@ async fn exact_case(format: ObjectFormat, fault: u8, expired: bool) -> Result {
         },
         f.authority(),
     )?;
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let ticket = super::bound::bind(&f, &c, [232; 16], "owner").await?;
     let session = ticket.bound_session()?;
     p.fault_for_test(fault);
@@ -344,7 +355,11 @@ async fn bound_final_ceiling_discards_held_proof_and_drops_result_before_worker_
         },
         f.authority(),
     )?;
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let ticket = super::bound::bind(&f, &c, [233; 16], "owner").await?;
     let session = ticket.bound_session()?;
     let input = ready(&session).await?;
@@ -388,7 +403,11 @@ async fn bound_final_refusals_keep_exact_ready_and_require_shared_session_and_fi
 {
     let f = Fixture::new(ObjectFormat::Sha256).await?;
     let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let ticket = super::bound::bind(&f, &c, [234; 16], "owner").await?;
     let session = ticket.bound_session()?;
     let unrelated = Arc::new(
@@ -422,6 +441,7 @@ async fn bound_final_refusals_keep_exact_ready_and_require_shared_session_and_fi
             f.repository,
         )?,
         PublicationLimits::default(),
+        f.publication_budget.clone(),
     )?;
     let failure = ticket
         .publish(&foreign, ready(&session).await?)
@@ -466,7 +486,11 @@ async fn bound_final_queued_transport_rechecks_ceiling_before_initial_execution(
         },
         f.authority(),
     )?;
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let ticket = super::bound::bind(&f, &c, [236; 16], "owner").await?;
     let session = ticket.bound_session()?;
     let (release, entered) = p.pause_for_test().await;
@@ -499,7 +523,11 @@ async fn bound_final_observes_shared_coordinator_recovery_without_losing_lifecyc
 -> Result {
     let f = Fixture::new(ObjectFormat::Sha256).await?;
     let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
-    let p = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let p = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     let ticket = super::bound::bind(&f, &c, [237; 16], "owner").await?;
     let session = ticket.bound_session()?;
     p.fault_for_test(2);
diff --git a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
index f8c2e765..975ae4b3 100644
--- a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
+++ b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
@@ -387,7 +387,11 @@ pub(super) async fn archive(
         })
         .await?;
     edit_handle(handle, "DROP TRIGGER terminal_release_late_fault").await?;
-    let queue = PublicationCoordinator::new(f.target.clone(), PublicationLimits::default())?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
     queue.fault_for_test(if fault == 4 { 2 } else { fault });
     let limits = RecoveryScanLimits {
         page: 1,
diff --git a/crates/canopy-server/src/server/catalog_initialization/tests.rs b/crates/canopy-server/src/server/catalog_initialization/tests.rs
index e0ad3728..519603ce 100644
--- a/crates/canopy-server/src/server/catalog_initialization/tests.rs
+++ b/crates/canopy-server/src/server/catalog_initialization/tests.rs
@@ -1,6 +1,7 @@
 use super::*;
 use crate::packs::publication::{
-    PublicationCoordinator, PublicationLimits, PublicationOutcome, PublicationState,
+    PublicationBudget, PublicationCoordinator, PublicationLimits, PublicationOutcome,
+    PublicationState,
 };
 use crate::{CanopyApplication, build_descriptor, repository_target};
 use cellule_app::{ApplicationHandle, CellApplication, CompiledApplication};
@@ -41,6 +42,7 @@ struct Fixture {
     layout: CellStorageLayout,
     replica: CellReplica,
     application: Arc<CompiledApplication>,
+    publication_budget: PublicationBudget,
 }
 impl Fixture {
     async fn new(format: ObjectFormat) -> TestResult<Self> {
@@ -121,6 +123,7 @@ impl Fixture {
             layout,
             replica,
             application,
+            publication_budget: PublicationBudget::new(PublicationLimits::default())?,
         })
     }
     fn input(&self) -> BeginRequest {
@@ -162,6 +165,7 @@ impl Fixture {
         let queue = PublicationCoordinator::new(
             self.repository.target.clone(),
             PublicationLimits::default(),
+            self.publication_budget.clone(),
         )?;
         let ready = original
             .ready_stop(
diff --git a/docs/design/shared-publication-dispatch.md b/docs/design/shared-publication-dispatch.md
index b343aa45..9452837f 100644
--- a/docs/design/shared-publication-dispatch.md
+++ b/docs/design/shared-publication-dispatch.md
@@ -20,7 +20,10 @@ ReadyPreparation::claim and PreparationSession::ready_renew retain original type
 
 `PublicationOutcome` distinguishes committed inline push, immutable root push, policy page, compaction, input checkpoint and bound preparation results. RegisteredNativeInputs preserves the original registration outcome and separately reports fresh checkpoint/bound-session custody; a failed observation fences the shared session without erasing a commit. `PublicationError` preserves the corresponding typed Cellule invocation error, evidence and rejected receipt. `PublicationState` includes held, queued, running, uncertain, finished and proven unexecuted discarded states. `ticket.class()` identifies the class. `ticket.response()` accepts only a completed inline push outcome; `ticket.root_response(store)` requires a completed root push and performs a current authorized query at its original receipt before streaming authenticated bytes. Neither a completed DTO nor a caller-supplied root grants access. Other result kinds refuse both response methods; compactions, input checkpoints and bound preparation commands never become HTTP push responses. These APIs replace the previous push-only outcome shape; there is no compatibility adapter.
 
-## Bounded class and account admission
+## Repository class and account admission
+
+These are repository limits. The constructor also requires a shared node budget,
+which applies an additional aggregate cap across repository coordinators.
 
 | Default | Bound |
 | --- | --- |
@@ -40,6 +43,52 @@ Each job records its private factory's reservation; mixed foreground checkpoint/
 
 Configuration requires room for another foreground account, nonzero reserved maintenance slots, checked byte headroom, a burst in 1–32, and a valid maintenance concurrency bound. With multiple durability waits, maintenance cannot use every slot. A one-wait profile permits one maintenance wait; fair class starts then share that serialized dispatch slot. Invalid profiles reject before a coordinator is created.
 
+## Shared node admission and transport
+
+Create one `PublicationBudget` from the existing `PublicationLimits` profile and
+pass clones to every node-local `PublicationCoordinator::new(target, limits,
+budget)`. There is no constructor that supplies an independent budget implicitly.
+The production repository owner must create and retain that shared instance;
+the mandatory argument alone does not prove that production has reused it.
+
+The node ledger charges the private ready value's account, class and exact wire
+reservation after repository admission succeeds. It bounds the sum of held,
+queued, running and uncertain originals across repositories. Any node refusal
+returns the original ready value without consuming repository credits or
+changing the SDK identity. Foreground and maintenance have independent operation
+and byte shares. With the default profile, node foreground admission has 28
+slots and 256 MiB minus 32 KiB; maintenance has four slots and 32 KiB. Node
+foreground account admission is at most eight; maintenance account admission is
+at most two, leaving room for another account even when one actor administers
+many repositories. Account maps exist only while charged jobs exist.
+
+Transport has separate class and account gates. With the default profile, six
+foreground and two maintenance dispatches can be active; an account can occupy
+at most three foreground and one maintenance gate. An account acquires its own
+gate before the node class gate, so its waiting jobs cannot hold global capacity
+needed by another account. Both class lanes must have at least two slots; node
+maintenance admission must also have at least two operations. Repository profiles
+can still serialize local work. Repository FIFO/account rotation and class burst
+scheduling remain in the existing queue; node gates provide bounded concurrency
+and account headroom, not a global class-burst, CPU-time or I/O-fairness promise.
+
+The node transport gate is acquired before making the dispatch body copy and
+held through the exact invocation/recovery future. Returning an uncertain result
+releases transport capacity while keeping original command credits. A known
+terminal result or proven held discard drops retained command/proof resources
+before releasing node and repository credits. Observer cancellation releases
+neither charge. `PublicationBudget::close` refuses new reservations but leaves
+gates usable by already admitted activation and exact recovery; it does not
+cancel or drain repository workers. `stats` exposes charged class/account/byte
+occupancy, acquired class transport gates and admission closure.
+
+This is resource admission, not a durable outcome owner or artifact retention
+authority. The production service must retain coordinators and returned uncertain
+tickets, explicitly stop scanners, drain workers and resolve exact originals
+before releasing the Cell or deleting its workspace. Idle scanners must not
+prevent repository eviction indefinitely. Actual production scanner ownership,
+that shared-instance wiring and shutdown/eviction qualification remain open.
+
 ## Held ownership and fair starts
 
 try_reserve admits a charged Held job synchronously without execution. It returns the original ready value on capacity, contention, duplicate, target or closure refusal. activate joins the existing fair queue once; discard_held succeeds only before activation, dropping resources before credits. Both remain usable after close for existing admission. close_and_drain returns held and uncertain jobs still charged. See the [final lifecycle handoff](final-publication-lifecycle.md) for worker/renewal/checkpoint ordering and observation-only final tickets.
@@ -56,7 +105,7 @@ A terminal result drops dispatch/retained proof ownership before releasing class
 
 ## Integration and evidence
 
-Keep one coordinator and geometric planner per repository. Obtain a fresh admitted query-derived maintenance base, call the [geometric planner](geometric-directory-maintenance.md), wrap the verified result in an Arc and call `ready_compaction`, then `submit`. Observe or recover the exact ticket before releasing uncertain inputs. Obtain a fresh frontier for the next preparation. Integrate process admission, fair CPU/I/O shares, renewal/reaping, owner-loss reconstruction and complete retained-root inventory before selecting production handlers.
+Keep one coordinator and geometric planner per repository, with one shared publication budget owned by the node. Obtain a fresh admitted query-derived maintenance base, call the [geometric planner](geometric-directory-maintenance.md), wrap the verified result in an Arc and call `ready_compaction`, then `submit`. Observe or recover the exact ticket before releasing uncertain inputs. Obtain a fresh frontier for the next preparation. Integrate process admission, fair CPU/I/O shares, renewal/reaping, owner-loss reconstruction and complete retained-root inventory before selecting production handlers.
 
 Tests exercise class/account admission, retained failure values, duplicate logical IDs, maintenance concurrency while foreground completes, canceled observers, current admin revocation, and SHA-1/SHA-256 absent/lost-acknowledgement/panic recovery with original receipts and exactly one logical outcome. The existing push dispatcher tests remain in place with typed-result assertions. The geometric native fixture now prepares and publishes repeatedly through this shared dispatcher until ingress and level debt drain, checking canonical/source/version identity, unchanged refs and old-reader access.
 
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index fc622496..e95b56f5 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -6,6 +6,59 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Shared node publication budget
+
+Repository dispatchers now require an explicit `PublicationBudget`, reusing the
+existing limits profile, private ready values and exact SDK command ownership.
+Clones share operation, command-byte and per-account reservations across
+repositories. Foreground and maintenance retain independent shares; maintenance
+account admission leaves room for another account. Separate account and class
+transport gates are acquired before copying the dispatch body. Account waiters
+cannot consume the node slots needed by another account. Uncertainty releases
+transport capacity but retains command credits; a known result or proven held
+discard drops retained resources before returning credits. Closing the node
+budget rejects new admission and preserves activation/recovery of originals
+already admitted. The repository queues retain their FIFO/account rotation and
+class-burst behavior. See the [dispatch contract](design/shared-publication-dispatch.md#shared-node-admission-and-transport).
+
+Six new regression families cover aggregate account/byte/class admission,
+transport headroom and FIFO progress, partial-gate cancellation, invalid/overflow
+bounds, exact returned ready identities, and actual cross-repository dispatch in
+both object formats. Existing absent/lost-reply/panic recovery now also checks
+that the node budget remains charged through closure and returns credits only
+after exact resolution. The native held-discard regression checks node credit
+return after dropping the verified proof. All 82 constructor call sites now
+supply a budget. The first draft had missing exports and three fixture ownership
+references; the first focused run had a test awaiting a later gate waiter before
+its existing FIFO predecessor. Those diagnostics are retained; the fixture now
+observes the real FIFO order without changing the implementation or capacity.
+
+Final-source macOS/Rust 1.98.0 qualification passes the focused eight-test run
+in 0.91 seconds and all 320 publication plus seven startup cases within the
+full workspace library. The library remains **failed** (exit 101): 605 pass and
+the same five unconverted `objects` readers fail, out of 610 unique cases;
+two nested subprocess summaries are excluded. Nine additional real
+workspace/lifecycle cases pass in 3.36 seconds, including prebound startup.
+The combined result is 619 unique cases executed, 614 pass and five fail;
+focused cases are not counted twice. Warnings-denied workspace/all-target
+Clippy (25.83 seconds), the server build (32.10 seconds), formatting/diff,
+447 unchanged source/schema/manifest hashes including 435 Rust files,
+141 local documentation links, exact SDK pins and protected index/archive
+checks pass. Evidence is `/tmp/canopy-node-publication-validation.json`.
+
+This is a necessary admission primitive, not completed production integration.
+The resident repository manager must own one shared budget and retain/drain its
+recovery services before Cell release or workspace deletion. General scanner
+ownership, query/I/O admission and that production wiring remain open. The wire
+credits do not qualify whole-process heap/RSS, native descendants, provider
+traffic or capacity. The full producer/reader/final-schema cutover, admitted
+history archival/exact lookup, retained-input adoption, certified serving
+ownership, typed GC/backup/isolated restore, OS containment, continuous fair
+maintenance/native acceleration/physical rewrite, signed completion/cold clone,
+file attribution and complete Linux/Kubernetes/Chromium/10,000-developer mixed
+load remain mandatory. This local checkpoint remains unpublished and
+unreleasable.
+
 ## Automatic staging retirement in progress
 
 The local staging coordinator now owns one bounded read-only probe over its admitted uncertain custody commands. Exact ordinal plus authenticated intent fingerprint finds an old stopped original even after a successor becomes the latest head. Only authenticated logical stop schedules existing exact recovery; absent commands, unavailable/corrupt private metadata and known execution phases alone retain their original reservations. Checkpoint/final commands keep separate owners. The existing fence/drain path joins running callbacks and drops retained resources before returning worker and operation admission. Observer drop and service closure do not discard this ownership. Probe failures/restarts/recovery scheduling are visible in bounded service counters. See the [lifecycle contract](design/staging-service-lifecycle.md#automatic-observation-of-custody-retirement).

From c3259833fc41e6b79837a5772401c1221dc5e54f Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 05:52:39 -0700
Subject: [PATCH 15/55] Own resident publication recovery through eviction and
 shutdown

---
 Cargo.lock                                    |   1 +
 crates/canopy-server/Cargo.toml               |   1 +
 crates/canopy-server/src/admission.rs         |   4 +
 crates/canopy-server/src/lib.rs               |   6 +
 .../src/packs/publication/coordinator.rs      |  12 +-
 .../src/packs/publication/custody/scan.rs     |  55 ++-
 .../src/packs/publication/mod.rs              |   2 +
 .../packs/publication/recovery/supervisor.rs  |  77 ++--
 .../src/packs/publication/scan.rs             | 192 +++++++++
 .../src/packs/publication/scan/tests.rs       | 119 ++++++
 .../src/packs/publication/tests.rs            |   5 +
 .../packs/publication/tests/custody_stop.rs   |  14 +-
 .../tests/initialization_retirement.rs        |  12 +-
 .../publication/tests/recovery_discovery.rs   |  92 ++++-
 .../publication/tests/terminal_retention.rs   |   6 +-
 crates/canopy-server/src/server/lifecycle.rs  |   4 +-
 crates/canopy-server/src/server/mod.rs        |  16 +
 .../canopy-server/src/server/residency/mod.rs | 125 +++++-
 .../src/server/residency/recovery.rs          | 139 +++++++
 .../src/server/residency/tests.rs             |   1 +
 .../src/server/residency/tests/recovery.rs    | 384 ++++++++++++++++++
 docs/design/resident-publication-recovery.md  | 137 +++++++
 docs/design/shared-publication-dispatch.md    |  15 +-
 .../large-repository-implementation-status.md |  57 ++-
 24 files changed, 1389 insertions(+), 87 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/scan.rs
 create mode 100644 crates/canopy-server/src/packs/publication/scan/tests.rs
 create mode 100644 crates/canopy-server/src/server/residency/recovery.rs
 create mode 100644 crates/canopy-server/src/server/residency/tests/recovery.rs
 create mode 100644 docs/design/resident-publication-recovery.md

diff --git a/Cargo.lock b/Cargo.lock
index 6db0c65d..35bf2ce2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -399,6 +399,7 @@ dependencies = [
  "ed25519-dalek 2.2.0",
  "flate2",
  "futures-core",
+ "futures-util",
  "hex",
  "http-body",
  "libc",
diff --git a/crates/canopy-server/Cargo.toml b/crates/canopy-server/Cargo.toml
index 93b6e72c..3dbe6650 100644
--- a/crates/canopy-server/Cargo.toml
+++ b/crates/canopy-server/Cargo.toml
@@ -23,6 +23,7 @@ cellule-store = { git = "https://github.com/crabbuild/cellule.git", rev = "16106
 ed25519-dalek = "2"
 flate2 = "1.1"
 futures-core = "0.3"
+futures-util = { version = "0.3", default-features = false, features = ["std"] }
 hex = "0.4"
 http-body = "1"
 object_store = "0.14.1"
diff --git a/crates/canopy-server/src/admission.rs b/crates/canopy-server/src/admission.rs
index 98099407..6afd514d 100644
--- a/crates/canopy-server/src/admission.rs
+++ b/crates/canopy-server/src/admission.rs
@@ -26,6 +26,10 @@ pub(crate) struct AccountAdmission {
 }
 
 impl AccountAdmission {
+    pub(crate) fn available(&self) -> usize {
+        self.total.available_permits()
+    }
+
     pub(crate) fn new(
         limit: usize,
         total_capacity: &'static str,
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index cc001057..5c42b904 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -175,6 +175,8 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("deployment/mod.rs"));
                 source.update(include_bytes!("deployment/root.rs"));
                 source.update(include_bytes!("server/mod.rs"));
+                source.update(include_bytes!("server/lifecycle.rs"));
+                source.update(include_bytes!("admission.rs"));
                 source.update(include_bytes!("server/workspace/mod.rs"));
                 source.update(include_bytes!("../../canopy-git-format/src/lib.rs"));
                 source.update(include_bytes!(
@@ -268,6 +270,9 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/custody/dispatch.rs"));
                 source.update(include_bytes!("packs/publication/preparation_receipt.rs"));
                 source.update(include_bytes!("packs/publication/coordinator.rs"));
+                source.update(include_bytes!("packs/publication/coordinator/budget.rs"));
+                source.update(include_bytes!("packs/publication/scan.rs"));
+                source.update(include_bytes!("packs/publication/custody/scan.rs"));
                 source.update(include_bytes!("packs/publication/coordinator/policy.rs"));
                 source.update(include_bytes!("packs/publication/coordinator/roots.rs"));
                 source.update(include_bytes!("packs/publication/coordinator/work.rs"));
@@ -290,6 +295,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/registry.rs"));
                 source.update(include_bytes!("server/catalog_initialization.rs"));
                 source.update(include_bytes!("server/residency/mod.rs"));
+                source.update(include_bytes!("server/residency/recovery.rs"));
                 source.update(include_bytes!("server/peer.rs"));
                 source.update(include_bytes!("packs/publication/codec.rs"));
                 source.update(include_bytes!("packs/publication/sql.rs"));
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index a4777f7b..c93ddc6a 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -653,6 +653,16 @@ impl PublicationCoordinator {
             wake.await;
         }
     }
+    /// Eviction closes only an already empty queue. Busy/uncertain owners keep
+    /// their admission and may resume discovery without replacing commands.
+    pub(crate) async fn close_if_idle(&self) -> bool {
+        let mut state = self.inner.state.lock().await;
+        if state.worker || !state.jobs.is_empty() {
+            return false;
+        }
+        state.closed = true;
+        true
+    }
     /// Service-internal lookup after its caller loses a ticket. This is not an
     /// externally authorized product query; use completed-request replay there.
     pub async fn pending(&self, operation: [u8; 16]) -> Option<PublicationTicket> {
@@ -719,7 +729,7 @@ impl PublicationCoordinator {
         (release, start)
     }
     #[cfg(test)]
-    pub(super) fn fault_for_test(&self, fault: u8) {
+    pub(crate) fn fault_for_test(&self, fault: u8) {
         self.inner
             .fault
             .store(fault, std::sync::atomic::Ordering::Release);
diff --git a/crates/canopy-server/src/packs/publication/custody/scan.rs b/crates/canopy-server/src/packs/publication/custody/scan.rs
index 5b2044b8..c5a7165a 100644
--- a/crates/canopy-server/src/packs/publication/custody/scan.rs
+++ b/crates/canopy-server/src/packs/publication/custody/scan.rs
@@ -1,4 +1,5 @@
 //! Bounded keyset discovery; existing maintenance admission owns exact stops.
+use super::super::scan::ScanControl;
 use super::*;
 use std::sync::Arc;
 use tokio::{sync::watch, task::JoinHandle};
@@ -22,7 +23,7 @@ impl CustodyScanStats {
 }
 #[must_use]
 pub struct CustodySupervisor {
-    stop: watch::Sender<bool>,
+    control: ScanControl,
     stats: watch::Receiver<CustodyScanStats>,
     task: Option<JoinHandle<CustodyScanStats>>,
 }
@@ -31,17 +32,17 @@ impl CustodySupervisor {
         client: CellClient,
         target: CellTarget,
         coordinator: PublicationCoordinator,
-        limits: RecoveryScanLimits,
+        settings: RecoveryScanSettings,
         authority: PreparationAuthority,
     ) -> Result<Self, CustodyError> {
-        if limits.validate().is_err() {
+        if settings.validate().is_err() {
             return Err(CustodyError::InvalidScanLimits);
         }
         if !authority.matches(&target) || coordinator.target() != &target {
             return Err(CustodyError::Context);
         }
         let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
-        let (stop, stopping) = watch::channel(false);
+        let control = ScanControl::default();
         let (updates, stats) = watch::channel(CustodyScanStats::default());
         let scan = Scan {
             client,
@@ -49,24 +50,30 @@ impl CustodySupervisor {
             coordinator,
             authority,
         };
-        let task = tokio::spawn(run(scan, sql, limits, stopping, updates));
+        let task = settings.spawn(run(scan, sql, settings.clone(), control.clone(), updates));
         Ok(Self {
-            stop,
+            control,
             stats,
             task: Some(task),
         })
     }
+    pub(crate) async fn pause(&self) {
+        self.control.pause().await;
+    }
+    pub(crate) fn resume(&self) {
+        self.control.resume();
+    }
     pub fn stats(&self) -> CustodyScanStats {
         self.stats.borrow().clone()
     }
     pub async fn shutdown(mut self) -> Result<CustodyScanStats, tokio::task::JoinError> {
-        self.stop.send_replace(true);
+        self.control.stop();
         self.task.take().expect("custody scan owner").await
     }
 }
 impl Drop for CustodySupervisor {
     fn drop(&mut self) {
-        self.stop.send_replace(true);
+        self.control.stop();
     }
 }
 struct Scan {
@@ -152,28 +159,42 @@ async fn page(
 async fn run(
     scan: Scan,
     sql: SqlCell<RepositoryModule>,
-    limits: RecoveryScanLimits,
-    mut stopping: watch::Receiver<bool>,
+    settings: RecoveryScanSettings,
+    control: ScanControl,
     updates: watch::Sender<CustodyScanStats>,
 ) -> CustodyScanStats {
     let mut stats = CustodyScanStats::default();
     let mut after = [0; 16];
     loop {
-        if *stopping.borrow() {
+        let Some(round) = control.enter(&settings).await else {
             return stats;
+        };
+        let permit = match settings.acquire().await {
+            Ok(permit) => permit,
+            Err(_) => {
+                stats.deferred = stats.deferred.saturating_add(1);
+                updates.send_replace(stats.clone());
+                drop(round);
+                settings.delay(&control).await;
+                continue;
+            }
+        };
+        if control.interrupted(&settings) {
+            drop((permit, round));
+            continue;
         }
         match scan.coordinator.recover_custody_stops().await {
             Ok(recovered) => stats.recovered = stats.recovered.saturating_add(recovered),
             Err(_) => stats.failed(CustodyError::Context),
         }
-        match page(&sql, after, limits.page).await {
+        match page(&sql, after, settings.limits.page).await {
             Ok(keys) => {
                 if keys.is_empty() {
                     after = [0; 16];
                     stats.passes = stats.passes.saturating_add(1);
                 }
                 for key in keys {
-                    if *stopping.borrow() {
+                    if control.interrupted(&settings) {
                         break;
                     }
                     stats.scanned = stats.scanned.saturating_add(1);
@@ -186,10 +207,10 @@ async fn run(
             }
             Err(error) => stats.failed(error),
         }
+        // Publish the completed round before releasing its quiescence guard:
+        // a successful pause also makes its diagnostics stable.
         updates.send_replace(stats.clone());
-        tokio::select! {
-            _ = tokio::time::sleep(limits.interval) => {},
-            changed = stopping.changed() => { if changed.is_err() || *stopping.borrow() { return stats; } }
-        }
+        drop((permit, round));
+        settings.delay(&control).await;
     }
 }
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 4c425c0b..41a0d91d 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -54,6 +54,7 @@ mod outcome;
 pub use outcome::OutcomeCertificate;
 mod completion;
 mod coordinator;
+mod scan;
 pub use completion::{
     CatalogCompletionReply, CatalogPushCompletion, CatalogPushResponseError, CheckCompletedPush,
     CompleteCatalogPush, CompletedCatalogPush, CompletionCatalogProof, PushCompletionProofError,
@@ -69,6 +70,7 @@ pub use coordinator::{
     ReadyRootPush, RecoveryBindingFailure, RefPolicyReadyError, RefPolicyRefusalFailure,
     RegisteredNativeInputs, RootPushReadyError,
 };
+pub use scan::{RecoveryScanBudget, RecoveryScanSettings};
 mod commands;
 mod compaction;
 pub use compaction::{
diff --git a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
index 4d7bccaf..b54027d0 100644
--- a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
@@ -1,6 +1,7 @@
 //! Service-owned restart discovery over the existing independent attempt pins.
 //! No local outbox, new identity or caller-supplied actor is used. The original
 //! receiver still decides custody; discovery never adopts an old owner fence.
+use super::super::scan::ScanControl;
 use super::*;
 use std::{sync::Arc, time::Duration};
 use tokio::{sync::watch, task::JoinHandle};
@@ -68,7 +69,7 @@ impl RecoveryScanStats {
 /// retain its unresolved tickets and their original admission reservations.
 #[must_use]
 pub struct RecoverySupervisor {
-    stop: watch::Sender<bool>,
+    control: ScanControl,
     stats: watch::Receiver<RecoveryScanStats>,
     task: Option<JoinHandle<RecoveryScanStats>>,
 }
@@ -78,10 +79,18 @@ impl RecoverySupervisor {
         target: CellTarget,
         store: ArtifactStore,
         coordinator: PublicationCoordinator,
-        limits: RecoveryScanLimits,
+        settings: RecoveryScanSettings,
         authority: PreparationAuthority,
     ) -> Result<Self, RootRecoveryError> {
-        Self::start_inner(client, target, store, coordinator, limits, authority, None)
+        Self::start_inner(
+            client,
+            target,
+            store,
+            coordinator,
+            settings,
+            authority,
+            None,
+        )
     }
     /// The service supplies current repository administration and actual owner
     /// custody. Closed attempts release through the same fair maintenance queue;
@@ -91,7 +100,7 @@ impl RecoverySupervisor {
         target: CellTarget,
         store: ArtifactStore,
         coordinator: PublicationCoordinator,
-        limits: RecoveryScanLimits,
+        settings: RecoveryScanSettings,
         authority: PreparationAuthority,
         maintenance: MaintenanceRequest,
     ) -> Result<Self, RootRecoveryError> {
@@ -104,7 +113,7 @@ impl RecoverySupervisor {
             target,
             store,
             coordinator,
-            limits,
+            settings,
             authority,
             Some(maintenance),
         )
@@ -114,11 +123,11 @@ impl RecoverySupervisor {
         target: CellTarget,
         store: ArtifactStore,
         coordinator: PublicationCoordinator,
-        limits: RecoveryScanLimits,
+        settings: RecoveryScanSettings,
         authority: PreparationAuthority,
         maintenance: Option<MaintenanceRequest>,
     ) -> Result<Self, RootRecoveryError> {
-        limits.validate()?;
+        settings.validate()?;
         if !authority.matches(&target)
             || !coordinator.matches_target(&target)
             || crate::repository_target(target.tenant(), target.application(), store.repository())?
@@ -127,9 +136,9 @@ impl RecoverySupervisor {
             return Err(RootRecoveryError::Context);
         }
         let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
-        let (stop, stopping) = watch::channel(false);
+        let control = ScanControl::default();
         let (updates, stats) = watch::channel(RecoveryScanStats::default());
-        let task = tokio::spawn(run(
+        let task = settings.spawn(run(
             Scan {
                 client,
                 target,
@@ -139,27 +148,33 @@ impl RecoverySupervisor {
                 maintenance,
             },
             sql,
-            limits,
-            stopping,
+            settings.clone(),
+            control.clone(),
             updates,
         ));
         Ok(Self {
-            stop,
+            control,
             stats,
             task: Some(task),
         })
     }
+    pub(crate) async fn pause(&self) {
+        self.control.pause().await;
+    }
+    pub(crate) fn resume(&self) {
+        self.control.resume();
+    }
     pub fn stats(&self) -> RecoveryScanStats {
         self.stats.borrow().clone()
     }
     pub async fn shutdown(mut self) -> Result<RecoveryScanStats, tokio::task::JoinError> {
-        self.stop.send_replace(true);
+        self.control.stop();
         self.task.take().expect("owned restart scanner").await
     }
 }
 impl Drop for RecoverySupervisor {
     fn drop(&mut self) {
-        self.stop.send_replace(true);
+        self.control.stop();
     }
 }
 
@@ -339,15 +354,29 @@ impl Scan {
 async fn run(
     scan: Scan,
     sql: SqlCell<RepositoryModule>,
-    limits: RecoveryScanLimits,
-    mut stopping: watch::Receiver<bool>,
+    settings: RecoveryScanSettings,
+    control: ScanControl,
     updates: watch::Sender<RecoveryScanStats>,
 ) -> RecoveryScanStats {
     let mut stats = RecoveryScanStats::default();
     let mut after = Cursor::default();
     loop {
-        if *stopping.borrow() {
+        let Some(round) = control.enter(&settings).await else {
             return stats;
+        };
+        let permit = match settings.acquire().await {
+            Ok(permit) => permit,
+            Err(_) => {
+                stats.deferred = stats.deferred.saturating_add(1);
+                updates.send_replace(stats.clone());
+                drop(round);
+                settings.delay(&control).await;
+                continue;
+            }
+        };
+        if control.interrupted(&settings) {
+            drop((permit, round));
+            continue;
         }
         if scan.maintenance.is_some() {
             match scan.coordinator.recover_terminal_releases().await {
@@ -363,14 +392,14 @@ async fn run(
                 ),
             }
         }
-        match page(&sql, after, limits.page).await {
+        match page(&sql, after, settings.limits.page).await {
             Ok(keys) => {
                 if keys.is_empty() {
                     after = Cursor::default();
                     stats.passes = stats.passes.saturating_add(1);
                 }
                 for key in keys {
-                    if *stopping.borrow() {
+                    if control.interrupted(&settings) {
                         break;
                     }
                     stats.scanned = stats.scanned.saturating_add(1);
@@ -382,13 +411,11 @@ async fn run(
             }
             Err(error) => stats.failed(error),
         }
+        // Publish the completed round before releasing its quiescence guard:
+        // a successful pause also makes its diagnostics stable.
         updates.send_replace(stats.clone());
-        tokio::select! {
-            _ = tokio::time::sleep(limits.interval) => {},
-            changed = stopping.changed() => {
-                if changed.is_err() || *stopping.borrow() { return stats; }
-            }
-        }
+        drop((permit, round));
+        settings.delay(&control).await;
     }
 }
 
diff --git a/crates/canopy-server/src/packs/publication/scan.rs b/crates/canopy-server/src/packs/publication/scan.rs
new file mode 100644
index 00000000..7b47b19c
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/scan.rs
@@ -0,0 +1,192 @@
+//! Shared read-round admission and quiescence for repository recovery owners.
+use super::{RecoveryScanLimits, RootRecoveryError};
+use crate::{AdmissionPermit, ReadIdentity, admission::AccountAdmission};
+use std::sync::{Arc, Mutex};
+use tokio::sync::Notify;
+use tokio_util::{sync::CancellationToken, task::TaskTracker};
+
+#[derive(Clone)]
+pub struct RecoveryScanBudget {
+    inner: Arc<Budget>,
+}
+struct Budget {
+    limit: usize,
+    admission: AccountAdmission,
+    stop: CancellationToken,
+    tasks: TaskTracker,
+}
+impl RecoveryScanBudget {
+    pub fn new(limit: u16, tasks: TaskTracker) -> Result<Self, RootRecoveryError> {
+        if !(2..=64).contains(&limit) {
+            return Err(RootRecoveryError::InvalidScanLimits);
+        }
+        Ok(Self {
+            inner: Arc::new(Budget {
+                limit: usize::from(limit),
+                admission: AccountAdmission::new(
+                    usize::from(limit),
+                    "node recovery reads",
+                    "account recovery reads",
+                ),
+                stop: CancellationToken::new(),
+                tasks,
+            }),
+        })
+    }
+    /// Account comes from trusted repository administration, not a viewer label.
+    pub fn settings(&self, limits: RecoveryScanLimits, account: &str) -> RecoveryScanSettings {
+        RecoveryScanSettings {
+            limits,
+            budget: self.clone(),
+            account: Arc::from(account),
+        }
+    }
+    /// Stop discovery between owned reads; never cancel a current round.
+    pub fn close(&self) {
+        self.inner.stop.cancel();
+    }
+    pub fn in_flight(&self) -> usize {
+        self.inner.limit - self.inner.admission.available()
+    }
+}
+
+#[derive(Clone)]
+pub struct RecoveryScanSettings {
+    pub limits: RecoveryScanLimits,
+    budget: RecoveryScanBudget,
+    account: Arc<str>,
+}
+impl RecoveryScanSettings {
+    pub(super) fn validate(&self) -> Result<(), RootRecoveryError> {
+        self.limits.validate()?;
+        if self.account.is_empty() || self.account.len() > 4096 {
+            return Err(RootRecoveryError::InvalidScanLimits);
+        }
+        Ok(())
+    }
+    pub(super) async fn acquire(&self) -> Result<AdmissionPermit, cellule_runtime::Error> {
+        self.budget
+            .inner
+            .admission
+            .acquire(ReadIdentity::Account(&self.account))
+            .await
+    }
+    pub(super) fn spawn<F>(&self, future: F) -> tokio::task::JoinHandle<F::Output>
+    where
+        F: std::future::Future + Send + 'static,
+        F::Output: Send + 'static,
+    {
+        self.budget.inner.tasks.spawn(future)
+    }
+    pub(super) async fn delay(&self, control: &ScanControl) {
+        let changed = control.inner.changed.notified();
+        tokio::pin!(changed);
+        changed.as_mut().enable();
+        if control.interrupted(self) {
+            return;
+        }
+        tokio::select! {
+            _ = tokio::time::sleep(self.limits.interval) => {},
+            _ = changed => {},
+            _ = self.budget.inner.stop.cancelled() => {},
+        }
+    }
+}
+
+#[derive(Clone, Default)]
+pub(super) struct ScanControl {
+    inner: Arc<Control>,
+}
+#[derive(Default)]
+struct Control {
+    state: Mutex<ControlState>,
+    changed: Notify,
+}
+#[derive(Default)]
+struct ControlState {
+    paused: bool,
+    stopped: bool,
+    active: bool,
+}
+impl ScanControl {
+    pub(super) async fn enter(&self, settings: &RecoveryScanSettings) -> Option<ActiveScan> {
+        loop {
+            let changed = self.inner.changed.notified();
+            tokio::pin!(changed);
+            changed.as_mut().enable();
+            {
+                let mut state = self.inner.state.lock().expect("recovery scan control");
+                if state.stopped || settings.budget.inner.stop.is_cancelled() {
+                    return None;
+                }
+                if !state.paused {
+                    assert!(!state.active, "one owner per recovery scanner");
+                    state.active = true;
+                    return Some(ActiveScan(self.clone()));
+                }
+            }
+            tokio::select! {
+                _ = changed => {},
+                _ = settings.budget.inner.stop.cancelled() => return None,
+            }
+        }
+    }
+    pub(super) fn interrupted(&self, settings: &RecoveryScanSettings) -> bool {
+        let state = self.inner.state.lock().expect("recovery scan control");
+        state.paused || state.stopped || settings.budget.inner.stop.is_cancelled()
+    }
+    pub(super) async fn pause(&self) {
+        self.inner
+            .state
+            .lock()
+            .expect("recovery scan control")
+            .paused = true;
+        self.inner.changed.notify_waiters();
+        loop {
+            let changed = self.inner.changed.notified();
+            tokio::pin!(changed);
+            changed.as_mut().enable();
+            if !self
+                .inner
+                .state
+                .lock()
+                .expect("recovery scan control")
+                .active
+            {
+                return;
+            }
+            changed.await;
+        }
+    }
+    pub(super) fn resume(&self) {
+        self.inner
+            .state
+            .lock()
+            .expect("recovery scan control")
+            .paused = false;
+        self.inner.changed.notify_waiters();
+    }
+    pub(super) fn stop(&self) {
+        self.inner
+            .state
+            .lock()
+            .expect("recovery scan control")
+            .stopped = true;
+        self.inner.changed.notify_waiters();
+    }
+}
+pub(super) struct ActiveScan(ScanControl);
+impl Drop for ActiveScan {
+    fn drop(&mut self) {
+        self.0
+            .inner
+            .state
+            .lock()
+            .expect("recovery scan control")
+            .active = false;
+        self.0.inner.changed.notify_waiters();
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/canopy-server/src/packs/publication/scan/tests.rs b/crates/canopy-server/src/packs/publication/scan/tests.rs
new file mode 100644
index 00000000..90855bd1
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/scan/tests.rs
@@ -0,0 +1,119 @@
+use super::*;
+use tokio::time::{Duration, timeout};
+
+#[tokio::test]
+async fn scan_pause_joins_active_work_and_preserves_resume_and_terminal_stop() {
+    let tasks = TaskTracker::new();
+    let budget = RecoveryScanBudget::new(4, tasks).unwrap();
+    let settings = budget.settings(RecoveryScanLimits::default(), "owner");
+    let control = ScanControl::default();
+    let round = control.enter(&settings).await.unwrap();
+    let pause = control.pause();
+    tokio::pin!(pause);
+    assert!(
+        timeout(Duration::from_millis(20), &mut pause)
+            .await
+            .is_err()
+    );
+    drop(round);
+    timeout(Duration::from_secs(1), &mut pause).await.unwrap();
+    assert!(
+        timeout(Duration::from_millis(20), control.enter(&settings))
+            .await
+            .is_err()
+    );
+    control.resume();
+    let round = control.enter(&settings).await.unwrap();
+    control.stop();
+    let pause = control.pause();
+    tokio::pin!(pause);
+    assert!(
+        timeout(Duration::from_millis(20), &mut pause)
+            .await
+            .is_err()
+    );
+    drop(round);
+    timeout(Duration::from_secs(1), &mut pause).await.unwrap();
+    control.resume();
+    assert!(control.enter(&settings).await.is_none());
+    // A stop observed before interval registration must not wait one interval.
+    timeout(Duration::from_millis(50), settings.delay(&control))
+        .await
+        .unwrap();
+}
+
+#[tokio::test]
+async fn shared_read_budget_bounds_account_rounds_and_tracks_shutdown_without_cancellation() {
+    let tasks = TaskTracker::new();
+    let budget = RecoveryScanBudget::new(4, tasks.clone()).unwrap();
+    let a = budget.settings(RecoveryScanLimits::default(), "a");
+    let another_repository = budget.settings(RecoveryScanLimits::default(), "a");
+    let b = budget.settings(RecoveryScanLimits::default(), "b");
+    let p1 = a.acquire().await.unwrap();
+    let p2 = another_repository.acquire().await.unwrap();
+    assert!(another_repository.acquire().await.is_err());
+    let p3 = b.acquire().await.unwrap();
+    let p4 = b.acquire().await.unwrap();
+    assert_eq!(budget.in_flight(), 4);
+    drop((p2, p3, p4));
+    let (release, waiting) = tokio::sync::oneshot::channel();
+    let (entered, observing) = tokio::sync::oneshot::channel();
+    let scope = a.clone();
+    let task = a.spawn(async move {
+        let control = ScanControl::default();
+        let round = control.enter(&scope).await.unwrap();
+        let _ = entered.send(());
+        let _ = waiting.await;
+        drop((round, p1));
+        assert!(control.enter(&scope).await.is_none());
+    });
+    observing.await.unwrap();
+    budget.close();
+    tasks.close();
+    assert!(
+        timeout(Duration::from_millis(20), tasks.wait())
+            .await
+            .is_err()
+    );
+    assert_eq!(budget.in_flight(), 1);
+    release.send(()).unwrap();
+    timeout(Duration::from_secs(1), tasks.wait()).await.unwrap();
+    task.await.unwrap();
+    assert_eq!(budget.in_flight(), 0);
+    assert!(ScanControl::default().enter(&a).await.is_none());
+}
+
+#[test]
+fn scanner_settings_reject_invalid_rounds_and_account_keys() {
+    for limit in [0, 1, 65, u16::MAX] {
+        assert!(matches!(
+            RecoveryScanBudget::new(limit, TaskTracker::new()),
+            Err(RootRecoveryError::InvalidScanLimits)
+        ));
+    }
+    let budget = RecoveryScanBudget::new(2, TaskTracker::new()).unwrap();
+    assert!(
+        budget
+            .settings(RecoveryScanLimits::default(), "")
+            .validate()
+            .is_err()
+    );
+    assert!(
+        budget
+            .settings(RecoveryScanLimits::default(), &"a".repeat(4097))
+            .validate()
+            .is_err()
+    );
+    assert!(
+        budget
+            .settings(
+                RecoveryScanLimits {
+                    page: 0,
+                    ..RecoveryScanLimits::default()
+                },
+                "a"
+            )
+            .validate()
+            .is_err()
+    );
+}
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index ee82c391..20073872 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -144,8 +144,12 @@ struct Fixture {
     runtime: CellRuntime,
     handle: CellHandle,
     publication_budget: PublicationBudget,
+    scan_budget: RecoveryScanBudget,
 }
 impl Fixture {
+    fn scans(&self, limits: RecoveryScanLimits) -> RecoveryScanSettings {
+        self.scan_budget.settings(limits, "owner")
+    }
     fn authority(&self) -> PreparationAuthority {
         PreparationAuthority::local(self.layout.clone(), self.target.clone())
     }
@@ -221,6 +225,7 @@ impl Fixture {
                 maintenance_in_flight: 4,
                 ..PublicationLimits::default()
             })?,
+            scan_budget: RecoveryScanBudget::new(8, tokio_util::task::TaskTracker::new())?,
         })
     }
     fn client(&self) -> CellClient {
diff --git a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
index 4c030257..4d6fdf70 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
@@ -443,7 +443,7 @@ async fn custody_scan_uses_bounded_indexed_pages_and_revisits_corruption_without
         f.client(),
         f.target.clone(),
         queue.clone(),
-        limits,
+        f.scans(limits),
         f.authority(),
     )?;
     timeout(Duration::from_secs(10), async {
@@ -485,10 +485,10 @@ async fn custody_scan_uses_bounded_indexed_pages_and_revisits_corruption_without
                 f.client(),
                 f.target.clone(),
                 queue.clone(),
-                RecoveryScanLimits {
+                f.scans(RecoveryScanLimits {
                     page: invalid,
                     ..limits
-                },
+                }),
                 f.authority()
             )
             .is_err()
@@ -584,10 +584,10 @@ async fn custody_scan_recovers_exact_maintenance_commands_after_their_pending_ke
                 f.client(),
                 f.target.clone(),
                 queue.clone(),
-                RecoveryScanLimits {
+                f.scans(RecoveryScanLimits {
                     page: 1,
                     interval: Duration::from_millis(100),
-                },
+                }),
                 f.authority(),
             )?;
             let invocation = timeout(Duration::from_secs(10), async {
@@ -747,10 +747,10 @@ async fn custody_stop_cannot_be_blocked_by_its_own_uncertain_preparation_and_fen
             f.client(),
             f.target.clone(),
             queue.clone(),
-            RecoveryScanLimits {
+            f.scans(RecoveryScanLimits {
                 page: 1,
                 interval: Duration::from_millis(10),
-            },
+            }),
             f.authority(),
         )?;
         timeout(Duration::from_secs(10), async {
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs b/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
index 6cb7d110..babd4b7b 100644
--- a/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
+++ b/crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs
@@ -268,10 +268,10 @@ async fn denied_initial_attempt_retires_only_after_claim_and_keeps_its_receipt_a
         f.target.clone(),
         (*store).clone(),
         queue.clone(),
-        RecoveryScanLimits {
+        f.scans(RecoveryScanLimits {
             page: 1,
             interval: Duration::from_secs(1),
-        },
+        }),
         f.authority(),
         admin.clone(),
     )?;
@@ -463,10 +463,10 @@ async fn automatic_initialization_retirement_recovers_uncertainty_after_pin_disa
         f.target.clone(),
         (*store).clone(),
         queue.clone(),
-        RecoveryScanLimits {
+        f.scans(RecoveryScanLimits {
             page: 1,
             interval: Duration::from_secs(1),
-        },
+        }),
         f.authority(),
         maintenance(&f.handle, f.repository).await?,
     )?;
@@ -502,10 +502,10 @@ async fn automatic_initialization_retirement_recovers_uncertainty_after_pin_disa
         f.target.clone(),
         (*store).clone(),
         queue.clone(),
-        RecoveryScanLimits {
+        f.scans(RecoveryScanLimits {
             page: 1,
             interval: Duration::from_secs(1),
-        },
+        }),
         f.authority(),
         maintenance(&f.handle, f.repository).await?,
     )?;
diff --git a/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs b/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
index b83fe683..716cac9c 100644
--- a/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
@@ -51,7 +51,7 @@ async fn restart_scan_seeks_bounded_keys_and_revisits_corrupt_pins_without_starv
         f.target.clone(),
         store.clone(),
         queue.clone(),
-        scan_limits(17),
+        f.scans(scan_limits(17)),
         f.authority(),
     )?;
     let stats = scanned(&service, |stats| stats.passes >= 2).await?;
@@ -81,7 +81,7 @@ async fn restart_scan_seeks_bounded_keys_and_revisits_corrupt_pins_without_starv
             f.target.clone(),
             foreign,
             queue.clone(),
-            scan_limits(1),
+            f.scans(scan_limits(1)),
             f.authority(),
         ),
         Err(RootRecoveryError::Context)
@@ -100,7 +100,7 @@ pub(super) async fn leaves_live_owner(
         f.target.clone(),
         store.clone(),
         queue.clone(),
-        scan_limits(1),
+        f.scans(scan_limits(1)),
         f.authority(),
         super::terminal_retention::maintenance(&f.handle, f.repository).await?,
     )?;
@@ -157,10 +157,10 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
         f.target.clone(),
         store.clone(),
         queue.clone(),
-        RecoveryScanLimits {
+        f.scans(RecoveryScanLimits {
             page: 1,
             interval: Duration::from_secs(1),
-        },
+        }),
         f.authority(),
     )?;
     timeout(Duration::from_secs(10), entered).await??;
@@ -190,10 +190,10 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
             f.target.clone(),
             store.clone(),
             queue.clone(),
-            RecoveryScanLimits {
+            f.scans(RecoveryScanLimits {
                 page: 1,
                 interval: Duration::from_secs(1),
-            },
+            }),
             f.authority(),
         )?
     } else {
@@ -233,7 +233,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8) -> Result {
         f.target.clone(),
         store.clone(),
         queue.clone(),
-        scan_limits(1),
+        f.scans(scan_limits(1)),
         f.authority(),
     )?;
     let stats = scanned(&service, |stats| stats.settled > 0).await?;
@@ -298,7 +298,7 @@ pub(super) async fn advanced_head(
         f.target.clone(),
         store.clone(),
         queue.clone(),
-        scan_limits(1),
+        f.scans(scan_limits(1)),
         f.authority(),
     )?;
     let stats = scanned(&service, |stats| stats.recovered > 0 || stats.deferred > 0).await?;
@@ -339,3 +339,77 @@ pub(super) fn qualify_native<'a>(
         _ => unreachable!("native recovery qualifier role"),
     }
 }
+
+#[tokio::test]
+async fn resident_scanners_pause_independently_and_resume_live_indexed_discovery() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        edit(&f, "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<30) INSERT INTO catalog_leases(incarnation,admission_sequence,operation,owner_epoch,artifact_operation,expires_at_ms,recovery) SELECT zeroblob(16),x,zeroblob(16),x'0000000000000001',randomblob(16),0,x'01' FROM n").await?;
+        edit(&f, "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<30) INSERT INTO catalog_custody_commands(operation,step,incarnation,request_id,intent) SELECT CAST(printf('%016d',x) AS BLOB),0,zeroblob(16),CAST(printf('%016d',x) AS BLOB),x'01' FROM n").await?;
+        let queue = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
+        let roots = RecoverySupervisor::start(
+            f.client(),
+            f.target.clone(),
+            ArtifactStore::new(Arc::new(InMemory::new()), f.repository),
+            queue.clone(),
+            f.scans(scan_limits(1)),
+            f.authority(),
+        )?;
+        let custody = CustodySupervisor::start(
+            f.client(),
+            f.target.clone(),
+            queue.clone(),
+            f.scans(scan_limits(1)),
+            f.authority(),
+        )?;
+        scanned(&roots, |stats| stats.scanned > 0).await?;
+        tokio::join!(roots.pause(), custody.pause());
+        let root_before = roots.stats();
+        let custody_before = custody.stats();
+        assert_eq!(f.scan_budget.in_flight(), 0);
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        assert_eq!(roots.stats().scanned, root_before.scanned);
+        assert_eq!(custody.stats().scanned, custody_before.scanned);
+        assert_eq!(roots.stats().passes, root_before.passes);
+        assert_eq!(custody.stats().passes, custody_before.passes);
+        assert_eq!(queue.stats().await.admitted, 0);
+        // Resuming one owner must not restart its independently paused sibling.
+        roots.resume();
+        scanned(&roots, |stats| stats.scanned > root_before.scanned).await?;
+        assert_eq!(custody.stats().scanned, custody_before.scanned);
+        roots.pause().await;
+        let paused = roots.stats();
+        custody.resume();
+        timeout(Duration::from_secs(10), async {
+            while custody.stats().scanned <= custody_before.scanned {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await?;
+        assert_eq!(roots.stats().scanned, paused.scanned);
+        custody.pause().await;
+        assert_eq!(f.scan_budget.in_flight(), 0);
+        roots.resume();
+        custody.resume();
+        scanned(&roots, |stats| stats.passes > root_before.passes).await?;
+        timeout(Duration::from_secs(10), async {
+            while custody.stats().passes <= custody_before.passes {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await?;
+        let (root_final, custody_final) = tokio::join!(roots.shutdown(), custody.shutdown());
+        let root_final = root_final?;
+        let custody_final = custody_final?;
+        assert_eq!(root_final.scanned, root_final.failures);
+        assert_eq!(custody_final.scanned, custody_final.failures);
+        assert_eq!(f.scan_budget.in_flight(), 0);
+        assert!(queue.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
index 975ae4b3..c2ecf41f 100644
--- a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
+++ b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
@@ -404,7 +404,7 @@ pub(super) async fn archive(
             f.target.clone(),
             store.clone(),
             queue.clone(),
-            limits,
+            f.scans(limits),
             f.authority(),
             admin.clone(),
         )?;
@@ -445,7 +445,7 @@ pub(super) async fn archive(
                 f.target.clone(),
                 store.clone(),
                 queue.clone(),
-                limits,
+                f.scans(limits),
                 f.authority(),
                 admin.clone(),
             )?;
@@ -457,7 +457,7 @@ pub(super) async fn archive(
             f.target.clone(),
             store.clone(),
             queue.clone(),
-            limits,
+            f.scans(limits),
             f.authority(),
             admin.clone(),
         )?;
diff --git a/crates/canopy-server/src/server/lifecycle.rs b/crates/canopy-server/src/server/lifecycle.rs
index 1b81570a..31873ce2 100644
--- a/crates/canopy-server/src/server/lifecycle.rs
+++ b/crates/canopy-server/src/server/lifecycle.rs
@@ -111,9 +111,10 @@ impl CanopyServer {
 }
 
 impl RunningServer {
-    async fn shutdown(mut self) -> Result<(), ServerError> {
+    pub(super) async fn shutdown(mut self) -> Result<(), ServerError> {
         self.native.close();
         self.maintenance_stop.cancel();
+        self.repositories.recovery_scans.close();
         self.ingress_stop.cancel();
         let serving = self.serving.await;
         let ssh_serving = if let Some(task) = self.ssh_serving {
@@ -124,6 +125,7 @@ impl RunningServer {
         self.listeners.stop_ingress();
         self.tasks.close();
         self.tasks.wait().await;
+        self.repositories.drain_recovery().await;
         // Detached native reapers and blocking verifiers outlive their request
         // observers. Keep Cell authority, heartbeat and workspace until every
         // admitted owner releases its claim. Uncertain drain stays pending.
diff --git a/crates/canopy-server/src/server/mod.rs b/crates/canopy-server/src/server/mod.rs
index c1a175ef..9aef8f6e 100644
--- a/crates/canopy-server/src/server/mod.rs
+++ b/crates/canopy-server/src/server/mod.rs
@@ -68,6 +68,8 @@ pub(crate) const RENEW_INTERVAL: Duration = Duration::from_secs(3);
 
 #[derive(Debug, thiserror::Error)]
 pub enum ServerError {
+    #[error("packed repository recovery failed")]
+    CatalogRecovery(#[source] Box<dyn std::error::Error + Send + Sync>),
     #[error("packed repository initialization failed")]
     CatalogInitialization(#[source] Box<dyn std::error::Error + Send + Sync>),
     #[error("invalid SSH host key")]
@@ -175,6 +177,7 @@ struct RunningServer {
     listeners: listeners::ListenerReservations,
     local: Arc<workspace::Workspace>,
     native: crate::native_resources::NativeResources,
+    repositories: Arc<RepositoryManager>,
 }
 
 pub(crate) struct RepositoryManager {
@@ -201,6 +204,8 @@ pub(crate) struct RepositoryManager {
     transfers: AccountAdmission,
     tasks: TaskTracker,
     maintenance_stop: CancellationToken,
+    publication_budget: crate::packs::publication::PublicationBudget,
+    recovery_scans: crate::packs::publication::RecoveryScanBudget,
 }
 
 pub(crate) enum MembershipOutcome {
@@ -643,6 +648,15 @@ impl RunningServer {
                 ),
                 tasks: tasks.clone(),
                 maintenance_stop: maintenance_stop.clone(),
+                publication_budget: crate::packs::publication::PublicationBudget::new(
+                    crate::packs::publication::PublicationLimits::default(),
+                )
+                .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
+                recovery_scans: crate::packs::publication::RecoveryScanBudget::new(
+                    8,
+                    tasks.clone(),
+                )
+                .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
             });
             let api = Arc::new(RepositoryHttp::new(Arc::clone(&manager), tasks.clone()));
             deployment.require_ready().await?;
@@ -677,6 +691,7 @@ impl RunningServer {
         let ingress_stop = CancellationToken::new();
         let ssh_serving = match (ssh_config, ssh_listener) {
             (Some(config), Some(listener)) => {
+                let manager = Arc::clone(&manager);
                 let stop = ingress_stop.clone();
                 let tasks = tasks.clone();
                 let release = release_stop.clone();
@@ -717,6 +732,7 @@ impl RunningServer {
             listeners,
             local,
             native,
+            repositories: manager,
         })
     }
 }
diff --git a/crates/canopy-server/src/server/residency/mod.rs b/crates/canopy-server/src/server/residency/mod.rs
index f22d54cb..81d27aac 100644
--- a/crates/canopy-server/src/server/residency/mod.rs
+++ b/crates/canopy-server/src/server/residency/mod.rs
@@ -28,6 +28,8 @@ use crate::{
     http::GitHttpApi,
     repository_target,
 };
+mod recovery;
+use recovery::RecoveryServices;
 
 pub(super) struct LoadedRepository {
     repository: Arc<RepositoryCell>,
@@ -41,6 +43,20 @@ pub(super) struct LoadedRepository {
     local: bool,
     state: ResidencyState,
     slot: Arc<OwnedSemaphorePermit>,
+    recovery: Option<Arc<RecoveryServices>>,
+    maintenance: Option<MaintenanceWorker>,
+}
+struct MaintenanceWorker {
+    stop: tokio_util::sync::CancellationToken,
+    task: tokio::task::JoinHandle<()>,
+}
+impl MaintenanceWorker {
+    async fn shutdown(self) {
+        self.stop.cancel();
+        if let Err(error) = self.task.await {
+            tracing::error!(?error, "repository Git maintenance failed during drain");
+        }
+    }
 }
 
 enum EvictionAction {
@@ -198,7 +214,12 @@ impl RepositoryManager {
             // Remote cache ownership is disposable. Reacquire idle/expired Cell
             // authority locally before binding a new route after owner loss.
             let removed = self.loaded.lock().await.remove(&entry.repository_id);
-            reclaimed = removed.map(|repository| repository.slot);
+            if let Some(mut repository) = removed {
+                if let Some(maintenance) = repository.maintenance.take() {
+                    maintenance.shutdown().await;
+                }
+                reclaimed = Some(repository.slot);
+            }
         }
         let state = self
             .loaded
@@ -207,6 +228,7 @@ impl RepositoryManager {
             .get(&entry.repository_id)
             .map(|repository| repository.state);
         match state {
+            Some(ResidencyState::Releasing) => return Err(Error::CellDraining.into()),
             Some(ResidencyState::Released) => {
                 reclaimed = Some(self.cleanup_released(entry.repository_id).await?);
             }
@@ -349,6 +371,28 @@ impl RepositoryManager {
             .await
             .map_err(ServerError::CatalogInitialization)?;
         }
+        let start = self
+            .loaded
+            .lock()
+            .await
+            .get(&entry.repository_id)
+            .filter(|repository| repository.local && repository.recovery.is_none())
+            .map(|repository| {
+                (
+                    Arc::clone(&repository.repository),
+                    repository.client.clone(),
+                )
+            });
+        if let Some((repository, client)) = start {
+            let recovery =
+                Arc::new(RecoveryServices::start(self, entry, &repository, client).await?);
+            self.loaded
+                .lock()
+                .await
+                .get_mut(&entry.repository_id)
+                .ok_or(ServerError::Repository("loaded repository is absent"))?
+                .recovery = Some(recovery);
+        }
         let mut loaded = self.loaded.lock().await;
         let existing = loaded
             .get_mut(&entry.repository_id)
@@ -426,7 +470,7 @@ impl RepositoryManager {
                     let Ok(transition) = self.transition_lock(id).await.try_lock_owned() else {
                         continue;
                     };
-                    if matches!(action, EvictionAction::Release { .. }) {
+                    if !matches!(action, EvictionAction::Cleanup) {
                         loaded
                             .get_mut(&id)
                             .ok_or(ServerError::Repository("eviction candidate is absent"))?
@@ -465,7 +509,34 @@ impl RepositoryManager {
                 }
                 .into());
             };
-            let (cell, generation) = match action {
+            let recovery = self
+                .loaded
+                .lock()
+                .await
+                .get(&id)
+                .and_then(|repository| repository.recovery.as_ref().map(Arc::clone));
+            if let Some(recovery) = recovery
+                && !recovery.quiesce().await
+            {
+                self.loaded
+                    .lock()
+                    .await
+                    .get_mut(&id)
+                    .ok_or(ServerError::Repository("eviction candidate is absent"))?
+                    .state = ResidencyState::Serving;
+                rejected.insert(id);
+                continue;
+            }
+            let maintenance = self
+                .loaded
+                .lock()
+                .await
+                .get_mut(&id)
+                .and_then(|repository| repository.maintenance.take());
+            if let Some(maintenance) = maintenance {
+                maintenance.shutdown().await;
+            }
+            let (cell, _) = match action {
                 EvictionAction::DropRemote => {
                     let removed = self.loaded.lock().await.remove(&id);
                     return removed
@@ -475,6 +546,35 @@ impl RepositoryManager {
                 EvictionAction::Cleanup => return self.cleanup_released(id).await,
                 EvictionAction::Release { cell, generation } => (cell, generation),
             };
+            // The quiesced reads may have changed the runtime's idle generation
+            // since candidate selection. Reobserve actual settled authority;
+            // never substitute our earlier inventory or manufacture a handle.
+            let refreshed = match self.node.idle_transfer_candidates().await {
+                Ok(candidates) => candidates,
+                Err(error) => {
+                    self.loaded
+                        .lock()
+                        .await
+                        .get_mut(&id)
+                        .ok_or(ServerError::Repository("eviction candidate is absent"))?
+                        .state = ResidencyState::RefreshHandle;
+                    return Err(error.into());
+                }
+            };
+            let generation = refreshed
+                .into_iter()
+                .find(|(candidate, _, _, _)| *candidate == cell)
+                .map(|(_, generation, _, _)| generation);
+            let Some(generation) = generation else {
+                self.loaded
+                    .lock()
+                    .await
+                    .get_mut(&id)
+                    .ok_or(ServerError::Repository("eviction candidate is absent"))?
+                    .state = ResidencyState::RefreshHandle;
+                rejected.insert(id);
+                continue;
+            };
             let mut result = self
                 .node
                 .release_idle_cell(cell, self.session, generation)
@@ -567,8 +667,9 @@ impl RepositoryManager {
         let pin = Arc::new(());
         let weak_gateway = Arc::downgrade(&gateway);
         let weak_pin = Arc::downgrade(&pin);
-        let stop = self.maintenance_stop.clone();
-        self.tasks.spawn(async move {
+        let stop = self.maintenance_stop.child_token();
+        let maintenance_stop = stop.clone();
+        let task = self.tasks.spawn(async move {
             let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
             interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
             interval.tick().await;
@@ -578,11 +679,10 @@ impl RepositoryManager {
                     _ = interval.tick() => {},
                 }
                 let (Some(gateway), Some(_pin)) = (weak_gateway.upgrade(), weak_pin.upgrade()) else { return; };
-                tokio::select! {
-                    () = stop.cancelled() => return,
-                    result = gateway.maintain() => {
-                        if let Err(error) = result { tracing::warn!(error = ?error, "background Git maintenance failed; previous cache retained"); }
-                    }
+                // Stop between owned rounds. Cancellation does not abandon
+                // cache/provider work after eviction has selected this owner.
+                if let Err(error) = gateway.maintain().await {
+                    tracing::warn!(error = ?error, "background Git maintenance failed; previous cache retained");
                 }
             }
         });
@@ -598,6 +698,11 @@ impl RepositoryManager {
             local,
             state: ResidencyState::Serving,
             slot,
+            recovery: None,
+            maintenance: Some(MaintenanceWorker {
+                stop: maintenance_stop,
+                task,
+            }),
         })
     }
 
diff --git a/crates/canopy-server/src/server/residency/recovery.rs b/crates/canopy-server/src/server/residency/recovery.rs
new file mode 100644
index 00000000..ebd1e3d1
--- /dev/null
+++ b/crates/canopy-server/src/server/residency/recovery.rs
@@ -0,0 +1,139 @@
+//! Resident owners join discovery before release and retain exact uncertain work.
+use super::*;
+use crate::packs::publication::{
+    CustodySupervisor, MaintenanceRequest, PreparationAuthority, PublicationCoordinator,
+    PublicationLimits, PublicationState, RecoveryScanLimits, RecoverySupervisor,
+};
+use canopy_object_storage::artifact::ArtifactStore;
+
+pub(super) struct RecoveryServices {
+    pub(super) coordinator: PublicationCoordinator,
+    workers: Mutex<Option<Workers>>,
+}
+struct Workers {
+    roots: RecoverySupervisor,
+    custody: CustodySupervisor,
+}
+impl RecoveryServices {
+    pub(super) async fn start(
+        manager: &RepositoryManager,
+        entry: &RepositoryEntry,
+        repository: &RepositoryCell,
+        client: CellClient,
+    ) -> Result<Self, ServerError> {
+        let target = repository.target.clone();
+        let authority = PreparationAuthority::node(manager.peer.clone(), target.clone());
+        let maintenance = MaintenanceRequest {
+            repository: entry.repository_id,
+            actor: entry.owner.clone(),
+            owner: manager.peer.current_owner_fence(&target).await?,
+        };
+        let coordinator = PublicationCoordinator::new(
+            target.clone(),
+            PublicationLimits::default(),
+            manager.publication_budget.clone(),
+        )
+        .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?;
+        let settings = manager
+            .recovery_scans
+            .settings(RecoveryScanLimits::default(), &entry.owner);
+        let roots = RecoverySupervisor::start_retiring(
+            client.clone(),
+            target.clone(),
+            ArtifactStore::new(Arc::clone(&manager.external_store), entry.repository_id),
+            coordinator.clone(),
+            settings.clone(),
+            authority.clone(),
+            maintenance,
+        )
+        .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?;
+        let custody = match CustodySupervisor::start(
+            client,
+            target,
+            coordinator.clone(),
+            settings,
+            authority,
+        ) {
+            Ok(custody) => custody,
+            Err(error) => {
+                // A partially constructed owner must join its first worker before
+                // giving up the residency transition or its workspace ownership.
+                let _ = roots.shutdown().await;
+                return Err(ServerError::CatalogRecovery(Box::new(error)));
+            }
+        };
+        Ok(Self {
+            coordinator,
+            workers: Mutex::new(Some(Workers { roots, custody })),
+        })
+    }
+
+    pub(super) async fn quiesce(&self) -> bool {
+        let mut workers = self.workers.lock().await;
+        if let Some(active) = workers.as_ref() {
+            tokio::join!(active.roots.pause(), active.custody.pause());
+        }
+        if !self.coordinator.close_if_idle().await {
+            if let Some(active) = workers.as_ref() {
+                active.roots.resume();
+                active.custody.resume();
+            }
+            return false;
+        }
+        join(workers.take()).await;
+        true
+    }
+
+    async fn drain(&self) {
+        join(self.workers.lock().await.take()).await;
+        loop {
+            let pending = self.coordinator.close_and_drain().await;
+            if pending.is_empty() {
+                return;
+            }
+            for ticket in pending {
+                // Held final work belongs to its producer lifecycle. Do not
+                // activate/discard it or substitute an unknown outcome here.
+                if matches!(ticket.state(), PublicationState::Uncertain(_))
+                    && let Err(error) = ticket.recover().await
+                    && error != crate::packs::publication::PublicationScheduleError::NotUncertain
+                {
+                    tracing::warn!(?error, "exact repository recovery deferred during drain");
+                }
+            }
+            tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+        }
+    }
+}
+async fn join(workers: Option<Workers>) {
+    if let Some(workers) = workers {
+        let (roots, custody) = tokio::join!(workers.roots.shutdown(), workers.custody.shutdown());
+        // A failed discovery task is not evidence about admitted commands.
+        // Its control guard has drained; the coordinator remains owned below.
+        if let Err(error) = roots {
+            tracing::error!(?error, "repository root scanner failed");
+        }
+        if let Err(error) = custody {
+            tracing::error!(?error, "repository custody scanner failed");
+        }
+    }
+}
+impl RepositoryManager {
+    pub(in crate::server) async fn drain_recovery(&self) {
+        self.recovery_scans.close();
+        self.publication_budget.close();
+        // The existing residency cap bounds this inventory. No independent
+        // durable queue or historical-repository registry is introduced.
+        let services: Vec<_> = self
+            .loaded
+            .lock()
+            .await
+            .values()
+            .filter_map(|repository| repository.recovery.as_ref().map(Arc::clone))
+            .collect();
+        // One producer-held command must not prevent other repositories from
+        // resolving their exact originals. All futures remain owned by this
+        // drain; the existing residency cap bounds their concurrent inventory.
+        futures_util::future::join_all(services.iter().map(|service| service.drain())).await;
+    }
+}
diff --git a/crates/canopy-server/src/server/residency/tests.rs b/crates/canopy-server/src/server/residency/tests.rs
index b6e57feb..36b3cc19 100644
--- a/crates/canopy-server/src/server/residency/tests.rs
+++ b/crates/canopy-server/src/server/residency/tests.rs
@@ -1,6 +1,7 @@
 use std::{collections::VecDeque, convert::Infallible, future::poll_fn};
 
 use super::*;
+mod recovery;
 
 struct Frames(VecDeque<Frame<Bytes>>);
 
diff --git a/crates/canopy-server/src/server/residency/tests/recovery.rs b/crates/canopy-server/src/server/residency/tests/recovery.rs
new file mode 100644
index 00000000..e648f267
--- /dev/null
+++ b/crates/canopy-server/src/server/residency/tests/recovery.rs
@@ -0,0 +1,384 @@
+use super::*;
+use crate::packs::publication::{
+    BeginRequest, CustodyAction, DEFAULT_LEASE_MS, LeaseCheck, PreparationAuthority,
+    PreparationReply, PreparationSession, PreparedCustody, PublicationError, PublicationOutcome,
+    PublicationState, RegisteredCustody,
+};
+use crate::{
+    ObjectFormat,
+    server::{RunningServer, ServerConfig, mutation_identity},
+};
+use cellule_runtime::primitives::sql::{SqlBatch, SqlStatement, SqlValue};
+use cellule_runtime::{ApplicationId, SessionId, TenantId, identity::NodeId};
+use ed25519_dalek::SigningKey;
+use object_store::{memory::InMemory, path::Path as StorePath};
+use tokio::time::{Duration, timeout};
+
+type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error + Send + Sync>>;
+
+async fn server() -> Result<(RunningServer, tempfile::TempDir)> {
+    let files = tempfile::TempDir::new()?;
+    let server = RunningServer::start(
+        ServerConfig {
+            tenant: TenantId::from_bytes([71; 16]),
+            application: ApplicationId::from_bytes([72; 16]),
+            node: NodeId::from_bytes([73; 16]),
+            fleet: cellule_runtime::Digest::from_bytes([74; 32]),
+            image: cellule_runtime::Digest::from_bytes([75; 32]),
+            signing_key: SigningKey::from_bytes(&[76; 32]),
+            owner: "canopy".into(),
+            token: "local-recovery-test".into(),
+            public_url: "http://127.0.0.1".into(),
+            peer_endpoint: "https://recovery.test".into(),
+            peer_ca_pem: None,
+            listen: "127.0.0.1:0".parse()?,
+            ssh: None,
+            data_dir: files.path().join("node"),
+            store_prefix: StorePath::from("resident-recovery"),
+            local_disk_limit_bytes: 1 << 30,
+            native_limits: crate::native_resources::NativeLimits::default(),
+            max_active_repositories: 3,
+        },
+        Arc::new(InMemory::new()),
+        None,
+    )
+    .await?;
+    Ok((server, files))
+}
+async fn create(
+    manager: &Arc<RepositoryManager>,
+    name: &str,
+    format: ObjectFormat,
+) -> Result<RepositoryEntry> {
+    Ok(timeout(Duration::from_secs(10), async {
+        loop {
+            match manager.create(name, format).await {
+                Ok(entry) => return Ok(entry),
+                // Settlement/movement admission is transient. Retry the same
+                // directory reservation, never a different logical repository.
+                Err(ServerError::Runtime(Error::CellDraining | Error::Capacity(_))) => {
+                    tokio::time::sleep(Duration::from_millis(20)).await;
+                }
+                Err(error) => return Err(error),
+            }
+        }
+    })
+    .await??)
+}
+async fn loaded(
+    manager: &RepositoryManager,
+    id: [u8; 16],
+) -> Result<(Arc<RepositoryCell>, CellClient, Arc<RecoveryServices>)> {
+    let loaded = manager.loaded.lock().await;
+    let repository = loaded.get(&id).ok_or("repository not resident")?;
+    assert!(repository.local && repository.initialized);
+    Ok((
+        Arc::clone(&repository.repository),
+        repository.client.clone(),
+        Arc::clone(
+            repository
+                .recovery
+                .as_ref()
+                .ok_or("production recovery absent")?,
+        ),
+    ))
+}
+fn request(id: [u8; 16]) -> BeginRequest {
+    BeginRequest {
+        repository: id,
+        operation: [81; 16],
+        request_digest: [82; 32],
+        actor: "canopy".into(),
+        lease_ms: DEFAULT_LEASE_MS,
+    }
+}
+async fn held_renewal(
+    manager: &RepositoryManager,
+    entry: &RepositoryEntry,
+) -> Result<crate::packs::publication::PublicationTicket> {
+    let (repository, client, service) = loaded(manager, entry.repository_id).await?;
+    let prepared = PreparedCustody::prepare(
+        &client,
+        &repository.target,
+        CustodyAction::BeginPreparation(request(entry.repository_id)),
+        mutation_identity()?,
+    )
+    .await?;
+    let saved = prepared.register(&client, mutation_identity()?).await?;
+    let committed = saved.recover_preparation(&client).await?;
+    let PreparationReply::Granted(lease) = committed.output else {
+        return Err("preparation refused".into());
+    };
+    let session = Arc::new(
+        PreparationSession::open(
+            client,
+            repository.target.clone(),
+            LeaseCheck {
+                token: lease.token,
+                actor: "canopy".into(),
+            },
+            Some(committed.receipt),
+            PreparationAuthority::node(manager.peer.clone(), repository.target.clone()),
+        )
+        .await?,
+    );
+    Ok(service.coordinator.try_reserve(
+        session
+            .ready_renew(mutation_identity()?, DEFAULT_LEASE_MS)
+            .await?,
+    )?)
+}
+
+#[tokio::test]
+async fn production_scanner_retires_authentic_orphan_without_inventing_original_execution() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let manager = &server.repositories;
+        let entry = create(manager, "orphan", format).await?;
+        let (repository, client, _service) = loaded(manager, entry.repository_id).await?;
+        let mut identity = mutation_identity()?;
+        identity.expires_at_ms = identity.issued_at_ms + 1000;
+        let prepared = PreparedCustody::prepare(
+            &client,
+            &repository.target,
+            CustodyAction::BeginPreparation(request(entry.repository_id)),
+            identity,
+        )
+        .await?;
+        let original = prepared.evidence().clone();
+        let saved = prepared.register(&client, mutation_identity()?).await?;
+        drop((prepared, saved));
+        let stopped = timeout(Duration::from_secs(10), async {
+            loop {
+                if let Some(saved) =
+                    RegisteredCustody::load_latest(&client, &repository.target, [81; 16]).await?
+                    && saved.stop_fact().is_some()
+                {
+                    return Ok::<_, crate::packs::publication::CustodyError>(saved);
+                }
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await??;
+        assert_eq!(stopped.evidence(), &original);
+        assert!(!stopped.settled());
+        let output = repository
+            .sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "SELECT count(*) FROM catalog_operations WHERE id=?1".into(),
+                        parameters: vec![SqlValue::Blob(vec![81; 16])],
+                    }],
+                },
+            )
+            .await?;
+        assert_eq!(output.output[0].rows[0], vec![SqlValue::Integer(0)]);
+        drop((client, repository, stopped));
+        server.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_eviction_joins_idle_scanners_and_preserves_busy_originals_and_restoration()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let manager = &server.repositories;
+        let one = create(manager, "one", format).await?;
+        let (_, _, service) = loaded(manager, one.repository_id).await?;
+        let held = held_renewal(manager, &one).await?;
+        assert_eq!(manager.publication_budget.stats().foreground, 1);
+        let two = create(manager, "two", format).await?;
+        let three = create(manager, "three", format).await?;
+        let four = create(manager, "four", format).await?;
+        assert_eq!(manager.loaded.lock().await.len(), 3);
+        assert!(manager.loaded.lock().await.contains_key(&one.repository_id));
+        assert!(matches!(held.state(), PublicationState::Held));
+        assert!(!service.coordinator.stats().await.closed);
+        assert_eq!(manager.publication_budget.stats().foreground, 1);
+        held.discard_held().await?;
+        let evicted = {
+            let loaded = manager.loaded.lock().await;
+            [two, three, four]
+                .into_iter()
+                .find(|entry| !loaded.contains_key(&entry.repository_id))
+                .ok_or("no idle repository evicted")?
+        };
+        // Production restores the same certified identity after terminal recovery
+        // retirement; no legacy SQL objects or compatibility decoder is added.
+        timeout(Duration::from_secs(10), async {
+            loop {
+                match manager
+                    .load(ReadIdentity::Account("canopy"), evicted.clone())
+                    .await
+                {
+                    Ok(route) => return Ok(route),
+                    Err(ServerError::Runtime(Error::CellDraining | Error::Capacity(_))) => {
+                        tokio::time::sleep(Duration::from_millis(20)).await
+                    }
+                    Err(error) => return Err(error),
+                }
+            }
+        })
+        .await??;
+        assert!(
+            manager
+                .loaded
+                .lock()
+                .await
+                .contains_key(&evicted.repository_id)
+        );
+        assert_eq!(manager.loaded.lock().await.len(), 3);
+        assert_eq!(manager.publication_budget.stats().foreground, 0);
+        server.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_shutdown_keeps_held_command_cell_heartbeat_and_workspace_until_producer_drains()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, files) = server().await?;
+        let manager = Arc::clone(&server.repositories);
+        let entry = create(&manager, "held", format).await?;
+        let held = held_renewal(&manager, &entry).await?;
+        let node = Arc::clone(&server.node);
+        let directory = server.directory.clone();
+        let session: SessionId = server.advertisement.lock().await.advertisement().session();
+        let mut shutdown = tokio::spawn(server.shutdown());
+        timeout(Duration::from_secs(5), async {
+            while !manager.publication_budget.stats().closed {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert!(
+            timeout(Duration::from_millis(30), &mut shutdown)
+                .await
+                .is_err()
+        );
+        assert!(!node.is_shutting_down());
+        assert!(
+            directory
+                .is_live(session, crate::server::unix_now_ms()?)
+                .await?
+        );
+        assert!(
+            crate::server::workspace::Workspace::open(&files.path().join("node"))
+                .is_err_and(|error| error.kind() == std::io::ErrorKind::WouldBlock)
+        );
+        assert!(matches!(held.state(), PublicationState::Held));
+        assert_eq!(manager.publication_budget.stats().foreground, 1);
+        held.discard_held().await?;
+        timeout(Duration::from_secs(10), shutdown).await???;
+        assert!(node.is_shutting_down());
+        assert!(
+            !directory
+                .is_live(session, crate::server::unix_now_ms()?)
+                .await?
+        );
+        assert_eq!(manager.publication_budget.stats().foreground, 0);
+        drop((manager, held));
+        let _reopened = crate::server::workspace::Workspace::open(&files.path().join("node"))?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_shutdown_recovers_other_repositories_while_one_producer_holds_its_command()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in [1, 2, 3] {
+            let (server, _files) = server().await?;
+            let manager = Arc::clone(&server.repositories);
+            let entries = [
+                create(&manager, "held-first", format).await?,
+                create(&manager, "recover-second", format).await?,
+            ];
+            // Stop automatic discovery without cancelling an owned round. The
+            // test observes recovery performed by the actual shutdown owner.
+            manager.recovery_scans.close();
+            let order: Vec<_> = manager.loaded.lock().await.keys().copied().collect();
+            let first = entries
+                .iter()
+                .find(|entry| entry.repository_id == order[0])
+                .unwrap();
+            let second = entries
+                .iter()
+                .find(|entry| entry.repository_id == order[1])
+                .unwrap();
+            let held = held_renewal(&manager, first).await?;
+            let (repository, client, service) = loaded(&manager, second.repository_id).await?;
+            let uncertain = held_renewal(&manager, second).await?;
+            service.coordinator.fault_for_test(fault);
+            uncertain.activate().await?;
+            let PublicationState::Uncertain(error) =
+                timeout(Duration::from_secs(10), uncertain.wait()).await?
+            else {
+                return Err("fault did not preserve uncertainty".into());
+            };
+            let PublicationError::Preparation(cellule_runtime::InvocationError::Pending(original)) =
+                error.as_ref()
+            else {
+                return Err("exact original evidence absent".into());
+            };
+            let sequence = match client.resolve(original).await? {
+                cellule_runtime::Resolution::Committed(receipt) => Some(receipt.commit_sequence()),
+                cellule_runtime::Resolution::Absent => None,
+                other => return Err(format!("unexpected original resolution {other:?}").into()),
+            };
+            assert_eq!(sequence.is_some(), fault != 1);
+            assert_eq!(manager.publication_budget.stats().foreground, 2);
+            let node = Arc::clone(&server.node);
+            let mut shutdown = tokio::spawn(server.shutdown());
+            // wait() intentionally returns retained uncertainty immediately.
+            // Observe its later terminal state without driving recovery here.
+            let resolved = timeout(Duration::from_secs(10), async {
+                loop {
+                    let state = uncertain.state();
+                    if matches!(
+                        state,
+                        PublicationState::Finished(_) | PublicationState::Discarded
+                    ) {
+                        return state;
+                    }
+                    tokio::time::sleep(Duration::from_millis(5)).await;
+                }
+            })
+            .await?;
+            let PublicationState::Finished(Ok(PublicationOutcome::Preparation(outcome))) = resolved
+            else {
+                return Err(
+                    format!("shutdown did not recover the exact renewal: {resolved:?}").into(),
+                );
+            };
+            let saved = RegisteredCustody::load_latest(&client, &repository.target, [81; 16])
+                .await?
+                .ok_or("renewal registration absent")?;
+            assert_eq!(saved.evidence(), original.as_ref());
+            assert_eq!(outcome.committed, saved.recover_preparation(&client).await?);
+            if let Some(sequence) = sequence {
+                assert_eq!(outcome.committed.receipt.commit_sequence, sequence);
+            }
+            assert!(
+                timeout(Duration::from_millis(30), &mut shutdown)
+                    .await
+                    .is_err()
+            );
+            assert!(!node.is_shutting_down());
+            assert!(matches!(held.state(), PublicationState::Held));
+            assert_eq!(manager.publication_budget.stats().foreground, 1);
+            assert!(service.coordinator.stats().await.closed);
+            held.discard_held().await?;
+            timeout(Duration::from_secs(10), shutdown).await???;
+            assert!(node.is_shutting_down());
+            assert_eq!(manager.publication_budget.stats().foreground, 0);
+        }
+    }
+    Ok(())
+}
diff --git a/docs/design/resident-publication-recovery.md b/docs/design/resident-publication-recovery.md
new file mode 100644
index 00000000..4fc110c1
--- /dev/null
+++ b/docs/design/resident-publication-recovery.md
@@ -0,0 +1,137 @@
+# Resident publication recovery ownership
+
+The selected production repository manager owns recovery services for each locally
+resident, certified repository. One node-wide publication budget and one read-round
+budget are shared across those owners. This connects the existing exact publication
+and retirement primitives to real startup, eviction and shutdown. It is not the
+completed producer/reader storage cutover or a repository/team capacity result.
+
+## Ownership and startup
+
+`RepositoryManager` creates one `PublicationBudget` from the existing default
+publication limits and one `RecoveryScanBudget` with eight read-round permits,
+using the same node `TaskTracker` as admitted requests and residency transitions.
+Every local `RecoveryServices` constructor receives clones of those budgets.
+Scanner constructors require `RecoveryScanSettings`; they cannot create an
+independent read budget implicitly. Settings use the immutable directory owner
+for account bookkeeping, not a caller-supplied viewer identity. Admission is not
+Read, Admin, owner-fence or artifact-retention authority.
+
+Only after identity and certified catalog initialization succeed does the local
+loaded entry start a `RecoverySupervisor::start_retiring` and `CustodySupervisor`
+with the actual repository target, artifact store, node preparation authority and
+fresh owner fence. The loaded entry retains both scanners and their coordinator
+before exposing a serving route. Remote routes do not start recovery scanners.
+If the second constructor fails, startup explicitly joins the first worker before
+returning the error or relinquishing the residency transition.
+
+Discovery reuses indexed keyset paging of independent recovery pins and pending
+custody heads. Root recovery reconstructs registered exact commands. Custody
+retirement marks expired authentic originals logically stopped without inventing
+an execution result. Neither scanner retries arbitrary original mutations from a
+positive execution phase or substitutes a new operation/request identity. See
+[registered recovery](mandatory-publication-registration.md),
+[custody retirement](durable-custody-command-intents.md) and
+[terminal retention](terminal-publication-retention.md).
+
+## Bounded reads and pauses
+
+A read round obtains the shared nonwaiting global/account admission before its
+query, metadata reads and visits. The default node cap is eight rounds and the
+existing account admission grants at most half that cap to one account. Each
+scanner owns at most one round. Refused rounds record a deferral and retry after
+the configured interval; they do not create a semaphore waiter or command copy.
+Production pages contain at most 128 keys and have a one-second delay. Invalid
+page, interval, budget and account bounds reject before task creation.
+
+Round admission bounds concurrent recovery work, not provider bandwidth, whole
+process memory/RSS, native descendants or complete CPU/I/O fairness. Nonwaiting
+account headroom alone does not prove starvation-free service across thousands
+of resident repositories. Fair continuous scheduling and capacity qualification
+remain required.
+
+The common `ScanControl` serializes round entry against pause/stop. Pause marks
+the owner paused, wakes its interval wait and waits for its current round to
+finish. It does not drop a Cell query, authenticated artifact read or visit
+future. A round publishes diagnostics before its RAII guard releases; after
+pause returns those diagnostics are stable. Resume keeps the same worker, cursor
+and cumulative diagnostics. A stop is sticky and cannot be undone by resume.
+Notify registration precedes state observation to avoid losing a pause/stop
+wake-up. Panic/unwind or owned-future cancellation releases the round guard.
+
+Closing the node scan budget prevents another round and wakes idle/paused
+workers. It does not cancel an active round. The node task tracker joins those
+workers during shutdown. Scanner failure is logged on join; it does not establish
+a command result or authorize discarding uncertainty. Automatic restart after a
+scanner panic and process/owner-loss adoption remain separate failure-campaign
+work.
+
+## Eviction and Git maintenance
+
+The existing per-repository transition guard and bounded residency slots own
+release. Candidate selection marks the loaded entry releasing, preventing a
+new local fast-path request. Recovery pauses both scanners before checking the
+coordinator under its admission lock.
+
+`close_if_idle` closes only an empty coordinator with no dispatch worker. If any
+held, queued, running or uncertain original remains, eviction resumes the same
+scanners and restores the serving state. It rejects that candidate and may try
+another resident; it never replaces its coordinator or releases its credits.
+
+An idle owner joins both paused scanners. Its Git maintenance worker has its own
+child stop token and retained join handle; eviction cancels and joins it before
+Cell release or local directory deletion. A started maintenance round finishes
+its owned gateway/provider work rather than being dropped by cancellation.
+Idle maintenance does not hold a request pin.
+
+After those workers quiesce, eviction refreshes the runtime's actual idle Cell
+generation: scan reads can invalidate the generation observed during selection.
+Only confirmed Cell release permits directory deletion and residency-slot
+transfer. Missing/failed release inventory or an ambiguous release retains a
+`RefreshHandle` entry. A later load obtains the runtime's actual resident handle,
+rebinds the route and starts fresh recovery services; no synthetic capability is
+constructed. Cleanup failures retain the released entry and its charged slot.
+
+## Shutdown and independent progress
+
+Shutdown closes native admission, stops maintenance, closes scan discovery and
+stops HTTP/SSH ingress. It joins ingress and the node task tracker, including
+accepted requests, residency transitions and owned scan/maintenance rounds.
+The repository manager then closes publication admission and drains the retained
+coordinators. All per-repository drain futures run together, bounded by the
+existing loaded-residency cap and shared publication/transport budgets.
+A producer-held command in one repository must not prevent exact recovery in
+another repository. The drain owns these futures directly; it does not detach
+another task inventory or invent a durable queue.
+
+Each drain joins its scanners, waits for dispatch workers and schedules recovery
+only for their retained uncertain tickets. Known resolution returns the original
+receipt and releases its existing reservation. A held final proof belongs to its
+producer: shutdown neither activates nor discards it. An unresolvable original
+or held proof keeps shutdown pending, Cell authority, advertisement heartbeat and
+workspace ownership intact. Observation timeouts do not cancel that drain.
+
+Only after repository recovery and native resource ownership drain does shutdown
+call `node.shutdown`, confirm workspace cleanup, stop renewal and withdraw the
+advertisement. There is no timeout that silently releases unresolved authority.
+
+## Qualification and remaining cutover
+
+Regression coverage includes the shared control/admission barrier, tracked
+shutdown with an owned active round, independent pause/resume of real indexed
+root and custody scanners, authentic orphan retirement, production idle eviction
+and certified restoration, preservation of busy held originals, and production
+shutdown with held and absent/lost-reply/panicked exact renewal commands across
+repositories. Both Git object formats are exercised by the production families.
+Final-source totals and retained diagnostic logs are recorded in the
+[implementation status](../large-repository-implementation-status.md).
+
+The current selected packed schema still exposes unconverted legacy consumers.
+Production HTTP/SSH/generated staging, authoritative certified serving retention,
+all object/ref/graph/browser/policy/check/merge consumers and final DDL removal
+must move together. Admitted immutable custody history/exact lookup, retained
+physical input adoption, typed GC/backup/isolated restore, OS resource containment,
+accelerated reads/physical rewrite, fair continuous maintenance, signed native
+completion/cold clone, file attribution and full Linux/Kubernetes/Chromium plus
+10,000-developer mixed-load qualification remain mandatory. This local branch is
+unpublished and unreleasable until those gates are complete.
diff --git a/docs/design/shared-publication-dispatch.md b/docs/design/shared-publication-dispatch.md
index 9452837f..c3824ea0 100644
--- a/docs/design/shared-publication-dispatch.md
+++ b/docs/design/shared-publication-dispatch.md
@@ -48,8 +48,11 @@ Configuration requires room for another foreground account, nonzero reserved mai
 Create one `PublicationBudget` from the existing `PublicationLimits` profile and
 pass clones to every node-local `PublicationCoordinator::new(target, limits,
 budget)`. There is no constructor that supplies an independent budget implicitly.
-The production repository owner must create and retain that shared instance;
-the mandatory argument alone does not prove that production has reused it.
+The selected production repository manager creates and retains that shared
+instance for its resident recovery coordinators. See the
+[resident lifecycle](resident-publication-recovery.md). All remaining producer
+and reader integration must reuse this owner; a mandatory constructor argument
+alone does not establish whole-service integration.
 
 The node ledger charges the private ready value's account, class and exact wire
 reservation after repository admission succeeds. It bounds the sum of held,
@@ -86,8 +89,12 @@ This is resource admission, not a durable outcome owner or artifact retention
 authority. The production service must retain coordinators and returned uncertain
 tickets, explicitly stop scanners, drain workers and resolve exact originals
 before releasing the Cell or deleting its workspace. Idle scanners must not
-prevent repository eviction indefinitely. Actual production scanner ownership,
-that shared-instance wiring and shutdown/eviction qualification remain open.
+prevent repository eviction indefinitely. The selected resident recovery owner
+now pauses/joins scanners and Git maintenance before release, rejects busy
+coordinators without abandoning originals, and drains repository recovery before
+node authority/workspace cleanup. Production startup/eviction/shutdown regression
+evidence and its limits are in the [resident contract](resident-publication-recovery.md).
+The full producer/reader conversion and capacity qualification remain open.
 
 ## Held ownership and fair starts
 
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index e95b56f5..50926b6b 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -6,6 +6,55 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Resident recovery lifecycle under final qualification
+
+The production repository manager now retains one recovery coordinator plus root
+and custody scanners for each initialized local resident, sharing node command
+and read-round budgets. Scans are tracked by the existing server task tracker.
+They pause without abandoning an owned query/artifact read and resume on the same
+cursor when a busy coordinator refuses eviction. Idle coordinators close under
+their admission lock; scans and Git maintenance join before Cell release and
+workspace deletion. Runtime idle generation is refreshed after joining reads.
+Release errors retain the runtime-handle refresh path. Remote routes have no
+local recovery scanner. Partial worker startup explicitly joins its first worker.
+See the [resident contract](design/resident-publication-recovery.md).
+
+Shutdown owns bounded concurrent per-repository drains, so one producer-held
+command cannot delay another repository's exact recovery. Uncertain tickets keep
+their original identity, command, receipt and admission. Held proofs stay owned
+by their producer. Neither an observer timeout nor budget closure permits early
+Cell shutdown, heartbeat withdrawal or workspace cleanup. The new scan, budget
+and server lifecycle source files are included in RepositoryModule's code digest.
+
+The final-source library run executes 618 unique cases: **613 pass and five
+fail**, with exit 101 retained. All 324 publication cases, seven startup cases
+and four real production recovery families pass; two nested subprocess summaries
+are excluded. The failing set remains exactly the five unconverted legacy
+`objects` readers. Warnings-denied workspace/all-target Clippy passes in 28.72
+seconds. Nine additional workspace/lifecycle cases pass in 3.62 seconds,
+including cancelled prebound startup; their command takes 43.49 seconds with
+compilation. Combined coverage is 627 unique cases executed, 622 pass and five
+fail. Focused cases are not counted again. The server build passes in 29.38
+seconds, formatting in 1.14 seconds, and static/diff checks pass with 451 frozen
+source/schema/manifest files including 439 Rust files, 148 local documentation
+links, exact SDK pins and unchanged protected index/archive. Evidence is
+`/tmp/canopy-resident-recovery-validation.json`.
+
+Retained draft diagnostics include sibling-module shutdown/target visibility
+errors, the regression's immediate uncertainty observation, and Clippy's
+`int_plus_one` rejection. The test uses its actual repository target and observes
+the later terminal result without requesting recovery; the comparison now uses
+`>` without addition/overflow. No diagnostic is treated as a passing run. No
+compatibility table or green-result substitution is introduced.
+
+Full producer/reader/final-DDL conversion, admitted custody-history frames/exact
+lookup, certified serving generation ownership, retained-input takeover/adoption,
+scanner panic/restart and provider/owner-loss campaigns, typed GC/backup/isolated
+restore, OS containment, native acceleration/physical rewrite/fair continuous
+maintenance, signed completion/cold clone, file attribution and full-history plus
+10,000-developer capacity qualification remain mandatory. This branch remains
+local, unpublished and unreleasable.
+
 ## Shared node publication budget
 
 Repository dispatchers now require an explicit `PublicationBudget`, reusing the
@@ -46,10 +95,10 @@ Clippy (25.83 seconds), the server build (32.10 seconds), formatting/diff,
 141 local documentation links, exact SDK pins and protected index/archive
 checks pass. Evidence is `/tmp/canopy-node-publication-validation.json`.
 
-This is a necessary admission primitive, not completed production integration.
-The resident repository manager must own one shared budget and retain/drain its
-recovery services before Cell release or workspace deletion. General scanner
-ownership, query/I/O admission and that production wiring remain open. The wire
+At the preceding `4d67294` checkpoint this was an admission primitive without
+production wiring. The resident recovery increment above now supplies the shared
+owner, read-round admission and release/drain lifecycle. Integration of every
+remaining production consumer and provider/resource qualification remain open. The wire
 credits do not qualify whole-process heap/RSS, native descendants, provider
 traffic or capacity. The full producer/reader/final-schema cutover, admitted
 history archival/exact lookup, retained-input adoption, certified serving

From 45ad384f8a7bc8c735bb4957b3915797366a884b Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 06:52:31 -0700
Subject: [PATCH 16/55] Retain certified serving generations through owned read
 drain

---
 crates/canopy-server/src/lib.rs               |   6 +
 .../src/packs/publication/commands.rs         |   2 +-
 .../src/packs/publication/coordinator.rs      |  43 +-
 .../src/packs/publication/coordinator/work.rs |  37 +-
 .../src/packs/publication/mod.rs              |  14 +-
 .../src/packs/publication/registry.rs         |  15 +-
 .../src/packs/publication/schema.sql          |   1 +
 .../src/packs/publication/serving.rs          |  78 +++
 .../src/packs/publication/serving/codec.rs    | 375 ++++++++++++
 .../src/packs/publication/serving/commands.rs | 280 +++++++++
 .../packs/publication/serving/ownership.rs    |  56 ++
 .../src/packs/publication/serving/schema.sql  |  23 +
 .../src/packs/publication/serving/session.rs  | 471 +++++++++++++++
 .../src/packs/publication/tests.rs            |   1 +
 .../src/packs/publication/tests/serving.rs    | 562 ++++++++++++++++++
 .../publication/tests/serving/blocked.rs      | 196 ++++++
 docs/design/certified-serving-pins.md         | 131 ++++
 docs/design/shared-publication-dispatch.md    |  13 +
 .../large-repository-implementation-status.md |  52 +-
 19 files changed, 2326 insertions(+), 30 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/serving.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/codec.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/commands.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/ownership.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/schema.sql
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/blocked.rs
 create mode 100644 docs/design/certified-serving-pins.md

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 5c42b904..a5694922 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -292,6 +292,12 @@ impl CellModule for RepositoryModule {
                 ));
                 source.update(include_bytes!("packs/publication/exact.rs"));
                 source.update(include_bytes!("packs/publication/mod.rs"));
+                source.update(include_bytes!("packs/publication/serving.rs"));
+                source.update(include_bytes!("packs/publication/serving/codec.rs"));
+                source.update(include_bytes!("packs/publication/serving/commands.rs"));
+                source.update(include_bytes!("packs/publication/serving/session.rs"));
+                source.update(include_bytes!("packs/publication/serving/ownership.rs"));
+                source.update(include_bytes!("packs/publication/serving/schema.sql"));
                 source.update(include_bytes!("packs/publication/registry.rs"));
                 source.update(include_bytes!("server/catalog_initialization.rs"));
                 source.update(include_bytes!("server/residency/mod.rs"));
diff --git a/crates/canopy-server/src/packs/publication/commands.rs b/crates/canopy-server/src/packs/publication/commands.rs
index 5ff1d83c..3ebfaacb 100644
--- a/crates/canopy-server/src/packs/publication/commands.rs
+++ b/crates/canopy-server/src/packs/publication/commands.rs
@@ -494,7 +494,7 @@ impl Query for CheckPreparationFrontier {
 }
 
 pub struct ReapPreparation;
-pub(super) const REAP_GENERATIONS: &str = "DELETE FROM catalog_generations WHERE generation IN (SELECT g.generation FROM catalog_generations g WHERE g.generation>0 AND g.generation<(SELECT generation FROM catalog_state WHERE singleton=1) AND g.generation<COALESCE((SELECT min(generation) FROM catalog_leases),9223372036854775807) ORDER BY g.generation LIMIT ?1)";
+pub(super) const REAP_GENERATIONS: &str = "DELETE FROM catalog_generations WHERE generation IN (SELECT g.generation FROM catalog_generations g WHERE g.generation>0 AND g.generation<(SELECT generation FROM catalog_state WHERE singleton=1) AND g.generation<COALESCE((SELECT min(generation) FROM catalog_leases),9223372036854775807) AND NOT EXISTS(SELECT 1 FROM catalog_serving_pins r WHERE r.generation=g.generation) ORDER BY g.generation LIMIT ?1)";
 impl Command for ReapPreparation {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 16;
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index c93ddc6a..8925cbd5 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -245,9 +245,15 @@ struct ReadContext {
     target: CellTarget,
     request: BeginRequest,
 }
+#[derive(Clone, Copy, PartialEq, Eq, Hash)]
+enum JobKind {
+    Publication,
+    CustodyStop,
+    ServingRelease,
+}
 struct Job {
     operation: [u8; 16],
-    custody_stop: bool,
+    kind: JobKind,
     actor: String,
     // Removed before terminal notification; tickets never retain command
     // payloads or local inventory after the admission charge is released.
@@ -340,7 +346,7 @@ impl<T> ClassQueue<T> {
 }
 #[derive(Default)]
 struct State {
-    jobs: HashMap<([u8; 16], bool), Arc<Job>>,
+    jobs: HashMap<([u8; 16], JobKind), Arc<Job>>,
     actors: HashMap<String, [usize; 2]>,
     queue: ClassQueue<Work>,
     counts: [usize; 2],
@@ -459,7 +465,7 @@ impl PublicationCoordinator {
         let reservation = ready.reservation();
         let at = class.index();
         let (client, target, request) = ready.context();
-        let custody_stop = ready.is_custody_stop();
+        let kind = ready.job_kind();
         let limits = self.inner.limits;
         let (operation_limit, byte_limit) = match class {
             PublicationClass::Foreground => (
@@ -476,7 +482,7 @@ impl PublicationCoordinator {
             Some(PublicationScheduleError::Foreign)
         } else if state.closed {
             Some(PublicationScheduleError::Closed)
-        } else if state.jobs.contains_key(&(request.operation, custody_stop)) {
+        } else if state.jobs.contains_key(&(request.operation, kind)) {
             Some(PublicationScheduleError::Duplicate)
         } else if state.counts[at] >= operation_limit
             || state
@@ -510,7 +516,7 @@ impl PublicationCoordinator {
         };
         let job = Arc::new(Job {
             operation: request.operation,
-            custody_stop,
+            kind,
             actor: request.actor.clone(),
             class,
             reservation,
@@ -532,7 +538,7 @@ impl PublicationCoordinator {
         state.bytes[at] += job.reservation;
         state
             .jobs
-            .insert((job.operation, job.custody_stop), Arc::clone(&job));
+            .insert((job.operation, job.kind), Arc::clone(&job));
         if !held {
             enqueue(state, &job, false);
             self.start(state);
@@ -556,7 +562,7 @@ impl PublicationCoordinator {
         let mut state = self.inner.state.lock().await;
         if !state
             .jobs
-            .get(&(ticket.job.operation, ticket.job.custody_stop))
+            .get(&(ticket.job.operation, ticket.job.kind))
             .is_some_and(|job| Arc::ptr_eq(job, &ticket.job))
             || !matches!(*ticket.job.status.borrow(), PublicationState::Uncertain(_))
         {
@@ -666,23 +672,23 @@ impl PublicationCoordinator {
     /// Service-internal lookup after its caller loses a ticket. This is not an
     /// externally authorized product query; use completed-request replay there.
     pub async fn pending(&self, operation: [u8; 16]) -> Option<PublicationTicket> {
-        self.pending_kind(operation, false).await
+        self.pending_kind(operation, JobKind::Publication).await
     }
     /// Retirement has a separate bounded key kind, never a fabricated operation.
     pub async fn pending_custody_stop(&self, operation: [u8; 16]) -> Option<PublicationTicket> {
-        self.pending_kind(operation, true).await
+        self.pending_kind(operation, JobKind::CustodyStop).await
     }
-    async fn pending_kind(
-        &self,
-        operation: [u8; 16],
-        custody_stop: bool,
-    ) -> Option<PublicationTicket> {
+    /// Read-retention release cannot collide with a creating request's ID.
+    pub async fn pending_serving_release(&self, reader: [u8; 16]) -> Option<PublicationTicket> {
+        self.pending_kind(reader, JobKind::ServingRelease).await
+    }
+    async fn pending_kind(&self, operation: [u8; 16], kind: JobKind) -> Option<PublicationTicket> {
         self.inner
             .state
             .lock()
             .await
             .jobs
-            .get(&(operation, custody_stop))
+            .get(&(operation, kind))
             .map(|job| PublicationTicket {
                 inner: Arc::clone(&self.inner),
                 job: Arc::clone(job),
@@ -916,7 +922,7 @@ fn release(state: &mut State, job: &Job) {
     // Both callers drop retained proof/body ownership before making either
     // the repository or node reservation reusable. Ticket DTOs may survive.
     job.budget.lock().expect("publication budget permit").take();
-    state.jobs.remove(&(job.operation, job.custody_stop));
+    state.jobs.remove(&(job.operation, job.kind));
     let count = state
         .actors
         .get_mut(&job.actor)
@@ -1057,7 +1063,10 @@ async fn finish(inner: &Inner, job: &Job, outcome: DispatchResult) {
         // Resume only that exact preparation evidence, never unrelated work.
         if let Ok(PublicationOutcome::CustodyStop(value)) = &outcome
             && value.stop.is_some()
-            && let Some(original) = state.jobs.get(&(job.operation, false)).cloned()
+            && let Some(original) = state
+                .jobs
+                .get(&(job.operation, JobKind::Publication))
+                .cloned()
             && matches!(*original.status.borrow(), PublicationState::Uncertain(_))
         {
             let matches = original
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index 4fffa660..a77cd77b 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -68,6 +68,7 @@ impl PreparedCompaction {
 /// Immutable root completions and policy pages require registered recovery.
 #[must_use]
 pub enum ReadyPublication {
+    ServingRelease(ReadyServingRelease),
     Push(ReadyCatalogPush),
     RootRecovery(ReadyRootRecovery),
     TerminalRelease(Box<ReadyTerminalRelease>),
@@ -77,6 +78,11 @@ pub enum ReadyPublication {
     Inputs(ReadyNativeInputs),
     Preparation(ReadyPreparation),
 }
+impl From<ReadyServingRelease> for ReadyPublication {
+    fn from(ready: ReadyServingRelease) -> Self {
+        Self::ServingRelease(ready)
+    }
+}
 impl From<ReadyCustodyStop> for ReadyPublication {
     fn from(ready: ReadyCustodyStop) -> Self {
         Self::CustodyStop(Box::new(ready))
@@ -118,8 +124,12 @@ impl From<ReadyPreparation> for ReadyPublication {
     }
 }
 impl ReadyPublication {
-    pub(super) fn is_custody_stop(&self) -> bool {
-        matches!(self, Self::CustodyStop(_))
+    pub(super) fn job_kind(&self) -> JobKind {
+        match self {
+            Self::CustodyStop(_) => JobKind::CustodyStop,
+            Self::ServingRelease(_) => JobKind::ServingRelease,
+            _ => JobKind::Publication,
+        }
     }
     pub(super) fn preparation_original(&self) -> Option<&cellule_runtime::PendingMutation> {
         match self {
@@ -144,7 +154,8 @@ impl ReadyPublication {
             | Self::Preparation(_)
             | Self::RootRecovery(_)
             | Self::TerminalRelease(_)
-            | Self::CustodyStop(_) => return false,
+            | Self::CustodyStop(_)
+            | Self::ServingRelease(_) => return false,
         };
         source.target == session.target
             && source.check == session.check
@@ -163,6 +174,7 @@ impl ReadyPublication {
     }
     pub(super) fn dispatch_copy(&self) -> Self {
         match self {
+            Self::ServingRelease(ready) => Self::ServingRelease(ready.dispatch_copy()),
             Self::Preparation(ready) => Self::Preparation(ready.dispatch_copy()),
             Self::RootRecovery(ready) => Self::RootRecovery(ready.clone()),
             Self::TerminalRelease(ready) => Self::TerminalRelease(ready.clone()),
@@ -190,13 +202,15 @@ impl ReadyPublication {
             | Self::BoundRecovery(_)
             | Self::Inputs(_)
             | Self::Preparation(_) => PublicationClass::Foreground,
-            Self::Compaction(_) | Self::TerminalRelease(_) | Self::CustodyStop(_) => {
-                PublicationClass::Maintenance
-            }
+            Self::Compaction(_)
+            | Self::TerminalRelease(_)
+            | Self::CustodyStop(_)
+            | Self::ServingRelease(_) => PublicationClass::Maintenance,
         }
     }
     pub(super) fn context(&self) -> (&CellClient, &CellTarget, BeginRequest) {
         let (client, target, check) = match self {
+            Self::ServingRelease(ready) => return ready.context(),
             Self::CustodyStop(ready) => return ready.context(),
             Self::Push(ready) => ready.owner.capability(),
             Self::RootRecovery(ready) => ready.capability(),
@@ -220,6 +234,7 @@ impl ReadyPublication {
     }
     pub(super) fn pending(&self) -> PublicationError {
         match self {
+            Self::ServingRelease(ready) => ready.pending(),
             Self::Preparation(ready) => ready.pending(),
             Self::RootRecovery(ready) => ready.pending(),
             Self::TerminalRelease(ready) => ready.pending(),
@@ -239,6 +254,11 @@ impl ReadyPublication {
     pub(super) async fn dispatch(self, recover: bool, fault: u8) -> DispatchResult {
         let client = self.context().0.clone();
         match self {
+            Self::ServingRelease(ready) => ready
+                .dispatch(recover, fault)
+                .await
+                .map(PublicationOutcome::ServingRelease)
+                .map_err(PublicationError::ServingRelease),
             Self::Inputs(ready) => ready.dispatch(recover, fault).await,
             Self::Preparation(ready) => ready.dispatch(recover, fault).await,
             Self::RootRecovery(ready) => ready.dispatch(fault).await,
@@ -287,6 +307,7 @@ impl ReadyPublication {
 
 #[derive(Clone, Debug)]
 pub enum PublicationOutcome {
+    ServingRelease(Committed<ServingReleaseReply>),
     Initialization(Committed<InitializationReply>),
     Push(Committed<CatalogCompletionReply>),
     RootPush(Committed<RootCompletionReply>),
@@ -300,6 +321,8 @@ pub enum PublicationOutcome {
 }
 #[derive(Debug, thiserror::Error)]
 pub enum PublicationError {
+    #[error("serving pin release: {0}")]
+    ServingRelease(#[source] InvocationError<ServingReleaseReply>),
     #[error("publication custody intent failed")]
     Custody {
         evidence: Box<cellule_runtime::PendingMutation>,
@@ -344,6 +367,7 @@ impl PublicationError {
             Self::Custody { source, .. } if source.uncertain() => "pending",
             Self::Custody { .. } => "not_started",
             Self::Recovery { .. } => "pending",
+            Self::ServingRelease(error) => kind(error),
             Self::Initialization(error) => kind(error),
             Self::Push(error) => kind(error),
             Self::RootPush(error) => kind(error),
@@ -365,6 +389,7 @@ impl PublicationError {
         match self {
             Self::Custody { source, .. } => source.uncertain(),
             Self::Recovery { .. } => true,
+            Self::ServingRelease(error) => unknown(error),
             Self::Initialization(error) => unknown(error),
             Self::Push(error) => unknown(error),
             Self::RootPush(error) => unknown(error),
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 41a0d91d..c9f1d315 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -14,6 +14,13 @@ use cellule_runtime::{
     primitives::sql::{SqlBatch, SqlResultSet, SqlStatement, SqlValue},
     registry::{CommandContext, CommandResult, OwnerFence, QueryContext},
 };
+mod serving;
+pub use serving::{
+    AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_SERVING_OWNERS,
+    MAX_SERVING_PINS, ReadyServingRelease, ReleaseServingPin, RenewServingPin, RenewServingRequest,
+    ServingCheck, ServingContext, ServingDenial, ServingDrainProof, ServingLease, ServingPin,
+    ServingReadBudget, ServingReadError, ServingReleaseReply, ServingReply, ServingToken,
+};
 mod owner;
 pub(crate) mod registry;
 pub use owner::PreparationAuthority;
@@ -130,7 +137,8 @@ pub use commands::{
 
 pub const SCHEMA: &str = concat!(
     include_str!("schema.sql"),
-    include_str!("ref_policy/schema.sql")
+    include_str!("ref_policy/schema.sql"),
+    include_str!("serving/schema.sql")
 );
 pub const MAX_OPERATIONS: u64 = 1024;
 pub const MAX_GENERATION_LEASES: u64 = 4096;
@@ -234,6 +242,10 @@ pub struct MaintenanceRequest {
 /// Bind the packed production contract. Inline publication/completion adapters
 /// are deliberately excluded; qualification binds its historical fixtures itself.
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
+    registry.bind_command::<AcquireServingPin>()?;
+    registry.bind_command::<RenewServingPin>()?;
+    registry.bind_command::<ReleaseServingPin>()?;
+    registry.bind_query::<CheckServingPin>()?;
     registry.bind_command::<RegisterCustodyIntent>()?;
     registry.bind_command::<ExecuteCustody>()?;
     registry.bind_command::<StopCustodyIntent>()?;
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 72c81c43..8f185781 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,7 +23,7 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 16] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 19] = [
     crate::operation(1),
     command::<AbortPreparation>(4096, 4096),
     command::<ReapPreparation>(4096, 4096),
@@ -40,8 +40,11 @@ pub(crate) const COMMANDS: [OperationDescriptor; 16] = [
     command::<RegisterCustodyIntent>(4096, 4096),
     command::<ExecuteCustody>(1024, 512),
     command::<StopCustodyIntent>(1024, 128),
+    command::<AcquireServingPin>(1024, 1024),
+    command::<RenewServingPin>(1024, 1024),
+    command::<ReleaseServingPin>(1024, 128),
 ];
-pub(crate) const QUERIES: [OperationDescriptor; 9] = [
+pub(crate) const QUERIES: [OperationDescriptor; 10] = [
     crate::operation(2),
     query::<CheckPreparation>(4096, 4096),
     query::<CheckPreparationFrontier>(4096, 4096),
@@ -51,6 +54,7 @@ pub(crate) const QUERIES: [OperationDescriptor; 9] = [
     query::<CheckInitializedCatalog>(4096, 512),
     query::<CheckRefPolicyGuard>(4096, 128),
     query::<CheckCompletedRootPush>(4096, 512),
+    query::<CheckServingPin>(1024, 1024),
 ];
 
 #[cfg(test)]
@@ -81,7 +85,7 @@ mod tests {
         assert_eq!(
             ids,
             vec![
-                1, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43
+                1, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 44, 45, 46
             ]
         );
         assert_eq!(
@@ -90,7 +94,7 @@ mod tests {
                 .iter()
                 .map(|operation| operation.id)
                 .collect::<Vec<_>>(),
-            vec![2, 15, 21, 23, 27, 30, 32, 34, 37]
+            vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47]
         );
         for (id, codec, input, output) in [
             (
@@ -116,6 +120,9 @@ mod tests {
             (41, RegisterCustodyIntent::CODEC_VERSION, 4096, 4096),
             (42, ExecuteCustody::CODEC_VERSION, 1024, 512),
             (43, StopCustodyIntent::CODEC_VERSION, 1024, 128),
+            (44, AcquireServingPin::CODEC_VERSION, 1024, 1024),
+            (45, RenewServingPin::CODEC_VERSION, 1024, 1024),
+            (46, ReleaseServingPin::CODEC_VERSION, 1024, 128),
         ] {
             let operation = descriptor
                 .commands
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index e091cffb..3f79f57a 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -453,6 +453,7 @@ CREATE INDEX catalog_leases_by_expiry ON catalog_leases(expires_at_ms, incarnati
 CREATE INDEX catalog_leases_by_generation ON catalog_leases(generation, expires_at_ms);
 CREATE TRIGGER catalog_generations_retained BEFORE DELETE ON catalog_generations
 WHEN OLD.generation=0 OR OLD.generation >= (SELECT min(generation) FROM catalog_leases)
+  OR EXISTS(SELECT 1 FROM catalog_serving_pins WHERE generation=OLD.generation)
 BEGIN SELECT RAISE(ABORT, 'catalog generation is retained'); END;
 CREATE UNIQUE INDEX catalog_leases_by_artifact ON catalog_leases(artifact_operation);
 CREATE TRIGGER catalog_lease_not_replaced BEFORE INSERT ON catalog_leases
diff --git a/crates/canopy-server/src/packs/publication/serving.rs b/crates/canopy-server/src/packs/publication/serving.rs
new file mode 100644
index 00000000..2041c282
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving.rs
@@ -0,0 +1,78 @@
+//! Certified read generations retained until owned workers have actually drained.
+use super::*;
+use cellule_runtime::{CellClient, CellTarget, MutationIdentity, PreparedCommand};
+use std::sync::Arc;
+mod codec;
+mod commands;
+mod ownership;
+pub use ownership::MAX_SERVING_OWNERS;
+mod session;
+pub use commands::{AcquireServingPin, CheckServingPin, ReleaseServingPin, RenewServingPin};
+pub use session::{
+    ReadyServingRelease, ServingContext, ServingPin, ServingReadBudget, ServingReadError,
+};
+
+pub const MAX_SERVING_PINS: u64 = 4096;
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ServingToken {
+    pub repository: [u8; 16],
+    pub reader: [u8; 16],
+    pub owner: OwnerFence,
+    pub admission_sequence: u64,
+    pub generation: u64,
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AcquireServingRequest {
+    pub repository: [u8; 16],
+    pub reader: [u8; 16],
+    pub actor: Option<String>,
+    pub lease_ms: u64,
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ServingCheck {
+    pub token: ServingToken,
+    pub actor: Option<String>,
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RenewServingRequest {
+    pub check: ServingCheck,
+    pub lease_ms: u64,
+}
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ServingLease {
+    pub token: ServingToken,
+    pub fact: GenerationFact,
+    pub format: ObjectFormat,
+    pub observed_at_ms: i64,
+    pub expires_at_ms: i64,
+}
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ServingDenial {
+    Unauthorized,
+    Conflict,
+    Uninitialized,
+    Stale,
+    Expired,
+    Capacity,
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ServingReply {
+    Granted(Box<ServingLease>),
+    Denied(ServingDenial),
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ServingReleaseReply {
+    Released,
+    Denied(ServingDenial),
+}
+/// Transport is untrusted until its purpose-separated MAC is checked. Only a
+/// private service owner whose workers drained can issue this certificate.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ServingDrainProof(super::certificate::CertificateEnvelope);
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct DrainData {
+    tenant: [u8; 16],
+    application: [u8; 16],
+    token: ServingToken,
+    administrator: String,
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/codec.rs b/crates/canopy-server/src/packs/publication/serving/codec.rs
new file mode 100644
index 00000000..1bee0382
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/codec.rs
@@ -0,0 +1,375 @@
+use super::*;
+use crate::packs::directory::index::codec::fixed;
+const DOMAIN: &[u8] = b"canopy.serving-workers-drained.v1\0";
+fn invalid() -> CodecError {
+    CodecError::Invalid("invalid serving pin")
+}
+fn actor(value: &Option<String>) -> Result<(), CodecError> {
+    if let Some(value) = value {
+        validate_component(value).map_err(|_| invalid())?;
+    }
+    Ok(())
+}
+fn duration(value: u64) -> Result<(), CodecError> {
+    if value == 0 || value > MAX_LEASE_MS {
+        return Err(invalid());
+    }
+    Ok(())
+}
+impl ServingToken {
+    pub(super) fn validate(&self) -> Result<(), CodecError> {
+        crate::validate_repository_id(self.repository).map_err(|_| invalid())?;
+        if self.reader == [0; 16]
+            || self.owner.epoch == 0
+            || self.admission_sequence == 0
+            || self.admission_sequence > i64::MAX as u64
+            || self.generation == 0
+            || self.generation > i64::MAX as u64
+        {
+            return Err(invalid());
+        }
+        Ok(())
+    }
+}
+impl WireValue for ServingToken {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.validate()?;
+        e.write_bytes(&self.repository)?;
+        e.write_bytes(&self.reader)?;
+        e.write_bytes(self.owner.incarnation.as_bytes())?;
+        e.write_u64(self.owner.epoch)?;
+        e.write_u64(self.admission_sequence)?;
+        e.write_u64(self.generation)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            repository: fixed(d)?,
+            reader: fixed(d)?,
+            owner: OwnerFence {
+                incarnation: IncarnationId::from_bytes(fixed(d)?),
+                epoch: d.read_u64()?,
+            },
+            admission_sequence: d.read_u64()?,
+            generation: d.read_u64()?,
+        };
+        value.validate()?;
+        Ok(value)
+    }
+}
+impl WireValue for AcquireServingRequest {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        crate::validate_repository_id(self.repository).map_err(|_| invalid())?;
+        if self.reader == [0; 16] {
+            return Err(invalid());
+        }
+        actor(&self.actor)?;
+        duration(self.lease_ms)?;
+        e.write_bytes(&self.repository)?;
+        e.write_bytes(&self.reader)?;
+        self.actor.encode(e)?;
+        e.write_u64(self.lease_ms)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            repository: fixed(d)?,
+            reader: fixed(d)?,
+            actor: Option::<String>::decode(d)?,
+            lease_ms: d.read_u64()?,
+        };
+        value.encode(&mut BoundedEncoder::new(1024)?)?;
+        Ok(value)
+    }
+}
+impl WireValue for ServingCheck {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        actor(&self.actor)?;
+        self.token.encode(e)?;
+        self.actor.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            token: ServingToken::decode(d)?,
+            actor: Option::<String>::decode(d)?,
+        };
+        actor(&value.actor)?;
+        Ok(value)
+    }
+}
+impl WireValue for RenewServingRequest {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        duration(self.lease_ms)?;
+        self.check.encode(e)?;
+        e.write_u64(self.lease_ms)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            check: ServingCheck::decode(d)?,
+            lease_ms: d.read_u64()?,
+        };
+        duration(value.lease_ms)?;
+        Ok(value)
+    }
+}
+impl ServingLease {
+    pub(super) fn validate(&self) -> Result<(), CodecError> {
+        self.token.validate()?;
+        self.fact.validate()?;
+        if self.fact.generation != self.token.generation
+            || self.fact.refs.is_none()
+            || self.fact.catalog.is_none_or(|catalog| {
+                catalog.repository != self.token.repository || catalog.format != self.format
+            })
+            || self.observed_at_ms < 0
+            || self.expires_at_ms <= self.observed_at_ms
+        {
+            return Err(invalid());
+        }
+        Ok(())
+    }
+}
+impl WireValue for ServingLease {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.validate()?;
+        self.token.encode(e)?;
+        self.fact.encode(e)?;
+        e.write_u8(self.format.bytes() as u8)?;
+        e.write_i64(self.observed_at_ms)?;
+        e.write_i64(self.expires_at_ms)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            token: ServingToken::decode(d)?,
+            fact: GenerationFact::decode(d)?,
+            format: match d.read_u8()? {
+                20 => ObjectFormat::Sha1,
+                32 => ObjectFormat::Sha256,
+                _ => return Err(invalid()),
+            },
+            observed_at_ms: d.read_i64()?,
+            expires_at_ms: d.read_i64()?,
+        };
+        value.validate()?;
+        Ok(value)
+    }
+}
+impl WireValue for ServingDenial {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        e.write_u8(match self {
+            Self::Unauthorized => 0,
+            Self::Conflict => 1,
+            Self::Uninitialized => 2,
+            Self::Stale => 3,
+            Self::Expired => 4,
+            Self::Capacity => 5,
+        })
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        Ok(match d.read_u8()? {
+            0 => Self::Unauthorized,
+            1 => Self::Conflict,
+            2 => Self::Uninitialized,
+            3 => Self::Stale,
+            4 => Self::Expired,
+            5 => Self::Capacity,
+            _ => return Err(invalid()),
+        })
+    }
+}
+impl WireValue for ServingReply {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        match self {
+            Self::Granted(value) => {
+                e.write_u8(0)?;
+                value.encode(e)
+            }
+            Self::Denied(value) => {
+                e.write_u8(1)?;
+                value.encode(e)
+            }
+        }
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        match d.read_u8()? {
+            0 => Ok(Self::Granted(Box::new(ServingLease::decode(d)?))),
+            1 => Ok(Self::Denied(ServingDenial::decode(d)?)),
+            _ => Err(invalid()),
+        }
+    }
+}
+impl WireValue for ServingReleaseReply {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        match self {
+            Self::Released => e.write_u8(0),
+            Self::Denied(value) => {
+                e.write_u8(1)?;
+                value.encode(e)
+            }
+        }
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        match d.read_u8()? {
+            0 => Ok(Self::Released),
+            1 => Ok(Self::Denied(ServingDenial::decode(d)?)),
+            _ => Err(invalid()),
+        }
+    }
+}
+impl WireValue for DrainData {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        validate_component(&self.administrator).map_err(|_| invalid())?;
+        e.write_bytes(DOMAIN)?;
+        e.write_bytes(&self.tenant)?;
+        e.write_bytes(&self.application)?;
+        self.token.encode(e)?;
+        e.write_text(&self.administrator)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != DOMAIN {
+            return Err(invalid());
+        }
+        let value = Self {
+            tenant: fixed(d)?,
+            application: fixed(d)?,
+            token: ServingToken::decode(d)?,
+            administrator: d.read_text()?.into(),
+        };
+        validate_component(&value.administrator).map_err(|_| invalid())?;
+        Ok(value)
+    }
+}
+impl ServingDrainProof {
+    pub(super) fn data(&self) -> Result<DrainData, CodecError> {
+        let mut decoder = BoundedDecoder::new(&self.0.body, 960)?;
+        let data = DrainData::decode(&mut decoder)?;
+        decoder.finish()?;
+        Ok(data)
+    }
+}
+impl WireValue for ServingDrainProof {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.data()?;
+        self.0.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self(super::super::certificate::CertificateEnvelope::decode(d)?);
+        value.data()?;
+        Ok(value)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    type TestResult = Result<(), Box<dyn std::error::Error>>;
+    fn token() -> ServingToken {
+        ServingToken {
+            repository: *uuid::Uuid::new_v4().as_bytes(),
+            reader: [1; 16],
+            owner: OwnerFence {
+                incarnation: IncarnationId::from_bytes([2; 16]),
+                epoch: 1,
+            },
+            admission_sequence: 1,
+            generation: 1,
+        }
+    }
+    fn qualify<T: WireValue + PartialEq + std::fmt::Debug>(value: T) -> TestResult {
+        let mut e = BoundedEncoder::new(1024)?;
+        value.encode(&mut e)?;
+        let bytes = e.finish();
+        let mut d = BoundedDecoder::new(&bytes, 1024)?;
+        assert_eq!(T::decode(&mut d)?, value);
+        d.finish()?;
+        for cut in 0..bytes.len() {
+            let mut d = BoundedDecoder::new(&bytes[..cut], 1024)?;
+            assert!(T::decode(&mut d).is_err());
+        }
+        let mut trailing = bytes;
+        trailing.push(0);
+        let mut d = BoundedDecoder::new(&trailing, 1024)?;
+        T::decode(&mut d)?;
+        assert!(d.finish().is_err());
+        Ok(())
+    }
+    #[test]
+    fn serving_codecs_reject_truncation_trailing_bytes_and_invalid_bounds() -> TestResult {
+        let token = token();
+        qualify(token)?;
+        qualify(ServingCheck { token, actor: None })?;
+        qualify(AcquireServingRequest {
+            repository: token.repository,
+            reader: token.reader,
+            actor: Some("reader".into()),
+            lease_ms: MAX_LEASE_MS,
+        })?;
+        qualify(RenewServingRequest {
+            check: ServingCheck {
+                token,
+                actor: Some("reader".into()),
+            },
+            lease_ms: 1,
+        })?;
+        for denial in [
+            ServingDenial::Unauthorized,
+            ServingDenial::Conflict,
+            ServingDenial::Uninitialized,
+            ServingDenial::Stale,
+            ServingDenial::Expired,
+            ServingDenial::Capacity,
+        ] {
+            qualify(ServingReply::Denied(denial))?;
+            qualify(ServingReleaseReply::Denied(denial))?;
+        }
+        qualify(ServingReleaseReply::Released)?;
+        for lease_ms in [0, MAX_LEASE_MS + 1, u64::MAX] {
+            assert!(
+                AcquireServingRequest {
+                    repository: token.repository,
+                    reader: token.reader,
+                    actor: None,
+                    lease_ms
+                }
+                .encode(&mut BoundedEncoder::new(1024)?)
+                .is_err()
+            );
+        }
+        for field in 0..5 {
+            let mut invalid = token;
+            match field {
+                0 => invalid.reader = [0; 16],
+                1 => invalid.owner.epoch = 0,
+                2 => invalid.admission_sequence = 0,
+                3 => invalid.generation = 0,
+                _ => invalid.generation = u64::MAX,
+            }
+            assert!(invalid.encode(&mut BoundedEncoder::new(1024)?).is_err());
+        }
+        Ok(())
+    }
+    #[test]
+    fn drain_proof_mac_and_domain_bind_scope_and_exact_pin() -> TestResult {
+        let data = DrainData {
+            tenant: [3; 16],
+            application: [4; 16],
+            token: token(),
+            administrator: "owner".into(),
+        };
+        let seed = [5; 32];
+        let proof = ServingDrainProof(super::super::super::certificate::CertificateEnvelope::seal(
+            &data, &seed,
+        )?);
+        qualify(proof.clone())?;
+        assert_eq!(proof.data()?, data);
+        assert!(proof.0.authenticated(&seed));
+        assert!(!proof.0.authenticated(&[6; 32]));
+        let mut tampered = proof.clone();
+        let last = tampered.0.body.len() - 1;
+        tampered.0.body[last] ^= 1;
+        assert!(tampered.data().is_ok());
+        assert!(!tampered.0.authenticated(&seed));
+        let mut other_domain = proof;
+        other_domain.0.body[4] ^= 1;
+        assert!(other_domain.data().is_err());
+        Ok(())
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/commands.rs b/crates/canopy-server/src/packs/publication/serving/commands.rs
new file mode 100644
index 00000000..58f5ad4a
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/commands.rs
@@ -0,0 +1,280 @@
+use super::super::sql::*;
+use super::*;
+use crate::ReadIdentity;
+const ROW: &str = "SELECT incarnation,admission_sequence,owner_epoch,generation,expires_at_ms FROM catalog_serving_pins WHERE reader=?1";
+fn access(actor: &Option<String>) -> cellule_runtime::Result<SqlBatch> {
+    let actor = actor
+        .as_deref()
+        .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+    actor.validate()?;
+    Ok(statement(
+        &format!("SELECT 1 WHERE {}", crate::access::READ_ACCESS),
+        vec![actor.parameter()],
+    ))
+}
+fn context(target: &CellTarget, repository: [u8; 16]) -> cellule_runtime::Result<bool> {
+    Ok(*target == crate::repository_target(target.tenant(), target.application(), repository)?)
+}
+fn row(sets: &[SqlResultSet], token: ServingToken) -> cellule_runtime::Result<Option<i64>> {
+    let Some(
+        [
+            incarnation,
+            sequence,
+            epoch,
+            generation,
+            SqlValue::Integer(expires),
+        ],
+    ) = rows(sets)?.first().map(Vec::as_slice)
+    else {
+        if rows(sets)?.is_empty() {
+            return Ok(None);
+        }
+        return Err(Error::Command("invalid serving pin row"));
+    };
+    if fixed::<16>(incarnation)? != *token.owner.incarnation.as_bytes()
+        || unsigned(sequence)? != token.admission_sequence
+        || u64::from_be_bytes(fixed(epoch)?) != token.owner.epoch
+        || unsigned(generation)? != token.generation
+    {
+        return Ok(None);
+    }
+    Ok(Some(*expires))
+}
+fn grant(
+    token: ServingToken,
+    fact: GenerationFact,
+    format: ObjectFormat,
+    now: i64,
+    expires: i64,
+) -> cellule_runtime::Result<ServingLease> {
+    let value = ServingLease {
+        token,
+        fact,
+        format,
+        observed_at_ms: now,
+        expires_at_ms: expires,
+    };
+    value.validate()?;
+    Ok(value)
+}
+fn denied(reason: ServingDenial) -> CommandResult<ServingReply> {
+    CommandResult::Rejected(ServingReply::Denied(reason))
+}
+pub struct AcquireServingPin;
+impl Command for AcquireServingPin {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 44;
+    const CODEC_VERSION: u32 = 1;
+    type Input = AcquireServingRequest;
+    type Output = ServingReply;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        input.encode(&mut BoundedEncoder::new(1024)?)?;
+        if !self::context(context.target(), input.repository)?
+            || rows(&context.sql(&access(&input.actor)?)?)?.is_empty()
+        {
+            return Ok(denied(ServingDenial::Unauthorized));
+        }
+        let Some(format) = identity(
+            &context.sql(&statement(IDENTITY, vec![]))?,
+            input.repository,
+        )?
+        else {
+            return Ok(denied(ServingDenial::Unauthorized));
+        };
+        let fact = super::super::commands::fact(context, input.repository, format, None)?;
+        if fact.generation == 0 || fact.catalog.is_none() || fact.refs.is_none() {
+            return Ok(denied(ServingDenial::Uninitialized));
+        }
+        if !rows(&context.sql(&statement(ROW, vec![blob(input.reader)]))?)?.is_empty() {
+            return Ok(denied(ServingDenial::Conflict));
+        }
+        let counts = context.sql(&statement(
+            "SELECT count(*) FROM (SELECT reader FROM catalog_serving_pins LIMIT ?1)",
+            vec![number(MAX_SERVING_PINS + 1)?],
+        ))?;
+        let Some([count]) = rows(&counts)?.first().map(Vec::as_slice) else {
+            return Err(Error::Command("missing serving pin count"));
+        };
+        if unsigned(count)? >= MAX_SERVING_PINS {
+            return Ok(denied(ServingDenial::Capacity));
+        }
+        let now = now(context.now_ms())?;
+        let expires = expiry(now, input.lease_ms)?;
+        let token = ServingToken {
+            repository: input.repository,
+            reader: input.reader,
+            owner: context.owner_fence(),
+            admission_sequence: context.sequence(),
+            generation: fact.generation,
+        };
+        token.validate()?;
+        let changed=context.sql(&statement("INSERT INTO catalog_serving_pins(reader,incarnation,admission_sequence,owner_epoch,generation,expires_at_ms) VALUES(?1,?2,?3,?4,?5,?6)",vec![blob(input.reader),blob(token.owner.incarnation.as_bytes()),number(token.admission_sequence)?,blob(token.owner.epoch.to_be_bytes()),number(token.generation)?,SqlValue::Integer(expires)]))?;
+        if changed.first().is_none_or(|set| set.rows_affected != 1) {
+            return Err(Error::Command("serving pin was not inserted"));
+        }
+        Ok(CommandResult::Success(ServingReply::Granted(Box::new(
+            grant(token, fact, format, now, expires)?,
+        ))))
+    }
+}
+pub struct RenewServingPin;
+impl Command for RenewServingPin {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 45;
+    const CODEC_VERSION: u32 = 1;
+    type Input = RenewServingRequest;
+    type Output = ServingReply;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        input.encode(&mut BoundedEncoder::new(1024)?)?;
+        let token = input.check.token;
+        if !self::context(context.target(), token.repository)?
+            || rows(&context.sql(&access(&input.check.actor)?)?)?.is_empty()
+        {
+            return Ok(denied(ServingDenial::Unauthorized));
+        }
+        if token.owner != context.owner_fence() {
+            return Ok(denied(ServingDenial::Stale));
+        }
+        let Some(format) = identity(
+            &context.sql(&statement(IDENTITY, vec![]))?,
+            token.repository,
+        )?
+        else {
+            return Ok(denied(ServingDenial::Unauthorized));
+        };
+        let Some(expires) = row(
+            &context.sql(&statement(ROW, vec![blob(token.reader)]))?,
+            token,
+        )?
+        else {
+            return Ok(denied(ServingDenial::Conflict));
+        };
+        let now = now(context.now_ms())?;
+        if expires <= now {
+            return Ok(denied(ServingDenial::Expired));
+        }
+        let expires = expiry(now, input.lease_ms)?.max(expires);
+        let changed = context.sql(&statement(
+            "UPDATE catalog_serving_pins SET expires_at_ms=?1 WHERE reader=?2",
+            vec![SqlValue::Integer(expires), blob(token.reader)],
+        ))?;
+        if changed.first().is_none_or(|set| set.rows_affected != 1) {
+            return Err(Error::Command("serving pin was not renewed"));
+        }
+        let fact = super::super::commands::fact(
+            context,
+            token.repository,
+            format,
+            Some(token.generation),
+        )?;
+        Ok(CommandResult::Success(ServingReply::Granted(Box::new(
+            grant(token, fact, format, now, expires)?,
+        ))))
+    }
+}
+pub struct CheckServingPin;
+impl Query for CheckServingPin {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 47;
+    const CODEC_VERSION: u32 = 1;
+    type Input = ServingCheck;
+    type Output = Option<ServingLease>;
+    fn execute(
+        context: &mut QueryContext<'_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<Self::Output> {
+        input.encode(&mut BoundedEncoder::new(1024)?)?;
+        let token = input.token;
+        // QueryContext is scoped by its trusted CellClient capability. The
+        // service additionally verifies actual target/owner before artifact I/O.
+        if rows(&context.sql(&access(&input.actor)?)?)?.is_empty() {
+            return Ok(None);
+        }
+        let Some(format) = identity(
+            &context.sql(&statement(IDENTITY, vec![]))?,
+            token.repository,
+        )?
+        else {
+            return Ok(None);
+        };
+        let Some(expires) = row(
+            &context.sql(&statement(ROW, vec![blob(token.reader)]))?,
+            token,
+        )?
+        else {
+            return Ok(None);
+        };
+        let now = now(context.now_ms())?;
+        if expires <= now {
+            return Ok(None);
+        }
+        let fact = generation(
+            &context.sql(&statement(GENERATION, vec![number(token.generation)?]))?,
+            token.repository,
+            format,
+        )?;
+        Ok(Some(grant(token, fact, format, now, expires)?))
+    }
+}
+pub struct ReleaseServingPin;
+impl Command for ReleaseServingPin {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 46;
+    const CODEC_VERSION: u32 = 1;
+    type Input = ServingDrainProof;
+    type Output = ServingReleaseReply;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        let data = input.data()?;
+        let reject = |reason| Ok(CommandResult::Rejected(ServingReleaseReply::Denied(reason)));
+        if data.tenant != *context.target().tenant().as_bytes()
+            || data.application != *context.target().application().as_bytes()
+            || data.token.owner != context.owner_fence()
+            || super::super::commands::authorized(
+                context,
+                data.token.repository,
+                &data.administrator,
+                TokenScope::Admin,
+            )?
+            .is_none()
+        {
+            return reject(ServingDenial::Unauthorized);
+        }
+        let seeds = context.sql(&statement(
+            "SELECT push_cert_seed FROM repository_identity WHERE singleton=1",
+            vec![],
+        ))?;
+        let Some([seed]) = rows(&seeds)?.first().map(Vec::as_slice) else {
+            return Err(Error::Command("serving pin seed absent"));
+        };
+        if !input.0.authenticated(&fixed(seed)?) {
+            return reject(ServingDenial::Unauthorized);
+        }
+        if row(
+            &context.sql(&statement(ROW, vec![blob(data.token.reader)]))?,
+            data.token,
+        )?
+        .is_none()
+        {
+            return reject(ServingDenial::Conflict);
+        }
+        // Expiry does not remove this root. Only an authenticated drained owner
+        // can release it; old workers may still own artifacts after their lease.
+        let changed = context.sql(&statement(
+            "DELETE FROM catalog_serving_pins WHERE reader=?1",
+            vec![blob(data.token.reader)],
+        ))?;
+        if changed.first().is_none_or(|set| set.rows_affected != 1) {
+            return Err(Error::Command("serving pin was not released"));
+        }
+        Ok(CommandResult::Success(ServingReleaseReply::Released))
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/ownership.rs b/crates/canopy-server/src/packs/publication/serving/ownership.rs
new file mode 100644
index 00000000..03ac6237
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/ownership.rs
@@ -0,0 +1,56 @@
+//! One physical drain owner per exact pin across every context in this process.
+//! A weak entry survives while any worker, pin or retained release owns its Arc.
+use super::*;
+use std::{
+    collections::HashMap,
+    sync::{Mutex, OnceLock, Weak},
+};
+
+pub const MAX_SERVING_OWNERS: usize = 4096;
+#[derive(Clone, Copy, PartialEq, Eq, Hash)]
+struct Key {
+    tenant: [u8; 16],
+    application: [u8; 16],
+    repository: [u8; 16],
+    reader: [u8; 16],
+    incarnation: [u8; 16],
+    epoch: u64,
+    sequence: u64,
+}
+static OWNERS: OnceLock<Mutex<HashMap<Key, Weak<()>>>> = OnceLock::new();
+
+pub(super) fn reserve(
+    target: &CellTarget,
+    token: ServingToken,
+) -> Result<Arc<()>, ServingReadError> {
+    token.validate()?;
+    if crate::repository_target(target.tenant(), target.application(), token.repository)? != *target
+    {
+        return Err(ServingReadError::Context);
+    }
+    let key = Key {
+        tenant: *target.tenant().as_bytes(),
+        application: *target.application().as_bytes(),
+        repository: token.repository,
+        reader: token.reader,
+        incarnation: *token.owner.incarnation.as_bytes(),
+        epoch: token.owner.epoch,
+        sequence: token.admission_sequence,
+    };
+    let mut owners = OWNERS
+        .get_or_init(|| Mutex::new(HashMap::new()))
+        .lock()
+        .expect("serving ownership");
+    owners.retain(|_, owner| owner.strong_count() != 0);
+    if owners.contains_key(&key) {
+        return Err(ServingReadError::AlreadyOwned);
+    }
+    if owners.len() >= MAX_SERVING_OWNERS {
+        return Err(ServingReadError::Capability(Error::Capacity(
+            "node serving owners",
+        )));
+    }
+    let owner = Arc::new(());
+    owners.insert(key, Arc::downgrade(&owner));
+    Ok(owner)
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/schema.sql b/crates/canopy-server/src/packs/publication/serving/schema.sql
new file mode 100644
index 00000000..58b5137b
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/schema.sql
@@ -0,0 +1,23 @@
+-- Bounded read retention, not a creating namespace or historical object table.
+-- Expired readers stop serving but remain GC roots until physical work drains.
+CREATE TABLE catalog_serving_pins (
+    reader BLOB PRIMARY KEY CHECK(typeof(reader)='blob' AND length(reader)=16 AND reader!=zeroblob(16)),
+    incarnation BLOB NOT NULL CHECK(typeof(incarnation)='blob' AND length(incarnation)=16),
+    admission_sequence INTEGER NOT NULL CHECK(typeof(admission_sequence)='integer' AND admission_sequence>0),
+    owner_epoch BLOB NOT NULL CHECK(typeof(owner_epoch)='blob' AND length(owner_epoch)=8 AND owner_epoch!=zeroblob(8)),
+    generation INTEGER NOT NULL REFERENCES catalog_generations(generation) CHECK(typeof(generation)='integer' AND generation>0),
+    expires_at_ms INTEGER NOT NULL CHECK(typeof(expires_at_ms)='integer' AND expires_at_ms>=0),
+    UNIQUE(incarnation,admission_sequence)
+) WITHOUT ROWID;
+CREATE INDEX catalog_serving_pins_by_generation ON catalog_serving_pins(generation);
+CREATE TRIGGER catalog_serving_pin_not_replaced BEFORE INSERT ON catalog_serving_pins
+WHEN EXISTS(SELECT 1 FROM catalog_serving_pins WHERE reader=NEW.reader OR (incarnation=NEW.incarnation AND admission_sequence=NEW.admission_sequence))
+BEGIN SELECT RAISE(ABORT,'serving pin cannot be replaced'); END;
+CREATE TRIGGER catalog_serving_pin_identity_immutable BEFORE UPDATE ON catalog_serving_pins
+WHEN NEW.reader IS NOT OLD.reader OR NEW.incarnation IS NOT OLD.incarnation
+  OR NEW.admission_sequence IS NOT OLD.admission_sequence OR NEW.owner_epoch IS NOT OLD.owner_epoch
+  OR NEW.generation IS NOT OLD.generation OR NEW.expires_at_ms<OLD.expires_at_ms
+BEGIN SELECT RAISE(ABORT,'serving pin identity cannot change'); END;
+CREATE TRIGGER catalog_serving_pins_bounded BEFORE INSERT ON catalog_serving_pins
+WHEN (SELECT count(*) FROM (SELECT reader FROM catalog_serving_pins LIMIT 4096))>=4096
+BEGIN SELECT RAISE(ABORT,'serving pin capacity'); END;
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
new file mode 100644
index 00000000..c5122877
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -0,0 +1,471 @@
+use super::*;
+use crate::{
+    ReadIdentity,
+    admission::AccountAdmission,
+    packs::{
+        catalog::{CatalogFiles, CatalogIndexes, CatalogReader},
+        metadata::{ObjectHeader, PAGE_OBJECTS},
+    },
+};
+use cellule_runtime::{Committed, InvocationError, Receipt, primitives::sql::SqlCell};
+use std::sync::Mutex;
+use tokio::{sync::Notify, time::Instant};
+use tokio_util::{sync::CancellationToken, task::TaskTracker};
+
+#[derive(Debug, thiserror::Error)]
+pub enum ServingReadError {
+    #[error("serving pin already has a physical drain owner")]
+    AlreadyOwned,
+    #[error("serving read is inactive or unavailable")]
+    Inactive,
+    #[error("invalid serving context or budget")]
+    Context,
+    #[error("serving authority failed")]
+    Authority(#[from] PreparationBaseError),
+    #[error("serving query failed")]
+    Query(#[source] Box<InvocationError<Option<ServingLease>>>),
+    #[error("serving metadata failed")]
+    Metadata(#[from] crate::packs::directory::index::IndexError),
+    #[error("serving capability failed")]
+    Capability(#[from] Error),
+    #[error("serving encoding failed")]
+    Codec(#[from] CodecError),
+    #[error("serving worker failed")]
+    Task(#[from] tokio::task::JoinError),
+    #[error("serving release proof query failed")]
+    Proof(#[source] Box<InvocationError<Vec<SqlResultSet>>>),
+    #[error("serving release command preparation failed")]
+    Prepare(#[source] Box<InvocationError<ServingReleaseReply>>),
+}
+#[derive(Clone)]
+pub struct ServingReadBudget {
+    inner: Arc<Budget>,
+}
+struct Budget {
+    admission: AccountAdmission,
+    tasks: TaskTracker,
+    stop: CancellationToken,
+}
+impl ServingReadBudget {
+    pub fn new(limit: u16, tasks: TaskTracker) -> Result<Self, ServingReadError> {
+        if !(2..=64).contains(&limit) {
+            return Err(ServingReadError::Context);
+        }
+        Ok(Self {
+            inner: Arc::new(Budget {
+                admission: AccountAdmission::new(
+                    usize::from(limit),
+                    "node serving reads",
+                    "account serving reads",
+                ),
+                tasks,
+                stop: CancellationToken::new(),
+            }),
+        })
+    }
+    pub fn close(&self) {
+        self.inner.stop.cancel();
+    }
+}
+/// Trusted service configuration. No decoded catalog or lease DTO supplies
+/// closure authority: open reobserves the registered pin through this client.
+pub struct ServingContext {
+    client: CellClient,
+    target: CellTarget,
+    authority: PreparationAuthority,
+    indexes: Arc<CatalogIndexes>,
+    files: Arc<CatalogFiles>,
+    budget: ServingReadBudget,
+    administrator: String,
+}
+impl ServingContext {
+    pub fn new(
+        client: CellClient,
+        target: CellTarget,
+        authority: PreparationAuthority,
+        indexes: Arc<CatalogIndexes>,
+        files: Arc<CatalogFiles>,
+        budget: ServingReadBudget,
+        administrator: String,
+    ) -> Result<Self, ServingReadError> {
+        validate_component(&administrator)?;
+        if !authority.matches(&target)
+            || crate::repository_target(
+                target.tenant(),
+                target.application(),
+                indexes.store().repository(),
+            )? != target
+        {
+            return Err(ServingReadError::Context);
+        }
+        Ok(Self {
+            client,
+            target,
+            authority,
+            indexes,
+            files,
+            budget,
+            administrator,
+        })
+    }
+}
+#[derive(Clone)]
+pub struct ServingPin {
+    inner: Arc<Inner>,
+}
+struct Inner {
+    // Must outlive every active worker and original release command.
+    _exclusive: Arc<()>,
+    context: ServingContext,
+    lease: ServingLease,
+    state: Mutex<Workers>,
+    changed: Notify,
+    reader: tokio::sync::Mutex<Option<Arc<CatalogReader>>>,
+    release: tokio::sync::Mutex<Option<ReleaseCommand>>,
+}
+#[derive(Default)]
+struct Workers {
+    closed: bool,
+    active: usize,
+    released: bool,
+}
+struct Active(Arc<Inner>);
+impl Drop for Active {
+    fn drop(&mut self) {
+        let mut state = self.0.state.lock().expect("serving workers");
+        state.active -= 1;
+        drop(state);
+        self.0.changed.notify_waiters();
+    }
+}
+struct ReleaseCommand {
+    command: Arc<PreparedCommand<ReleaseServingPin>>,
+    digest: [u8; 32],
+}
+impl ServingPin {
+    pub async fn open(
+        context: ServingContext,
+        token: ServingToken,
+        actor: Option<String>,
+    ) -> Result<Self, ServingReadError> {
+        if context.budget.inner.stop.is_cancelled() {
+            return Err(ServingReadError::Inactive);
+        }
+        let scope = actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        let permit = context.budget.inner.admission.acquire(scope).await?;
+        let exclusive = super::ownership::reserve(&context.target, token)?;
+        let tasks = context.budget.inner.tasks.clone();
+        tasks
+            .spawn(async move {
+                let _permit = permit;
+                context
+                    .authority
+                    .check(&context.target, token.owner)
+                    .await?;
+                let lease = context
+                    .client
+                    .query::<CheckServingPin>(&context.target, None, ServingCheck { token, actor })
+                    .await
+                    .map_err(|error| ServingReadError::Query(Box::new(error)))?
+                    .output
+                    .ok_or(ServingReadError::Inactive)?;
+                context
+                    .authority
+                    .check(&context.target, token.owner)
+                    .await?;
+                if lease.token != token || lease.format != context.indexes.sources().format() {
+                    return Err(ServingReadError::Context);
+                }
+                Ok(Self {
+                    inner: Arc::new(Inner {
+                        _exclusive: exclusive,
+                        context,
+                        lease,
+                        state: Mutex::new(Workers::default()),
+                        changed: Notify::new(),
+                        reader: tokio::sync::Mutex::new(None),
+                        release: tokio::sync::Mutex::new(None),
+                    }),
+                })
+            })
+            .await?
+    }
+    pub fn token(&self) -> ServingToken {
+        self.inner.lease.token
+    }
+    pub fn fact(&self) -> GenerationFact {
+        self.inner.lease.fact
+    }
+    /// Cancellation only detaches observation. The tracked worker retains read
+    /// admission and the physical-drain guard until all metadata work finishes.
+    pub async fn headers(
+        &self,
+        actor: Option<String>,
+        ids: &[crate::ObjectId],
+    ) -> Result<Vec<Option<ObjectHeader>>, ServingReadError> {
+        if ids.is_empty()
+            || ids.len() > PAGE_OBJECTS
+            || ids
+                .iter()
+                .any(|oid| oid.is_zero() || oid.format() != self.inner.lease.format)
+        {
+            return Err(ServingReadError::Context);
+        }
+        if self.inner.context.budget.inner.stop.is_cancelled() {
+            return Err(ServingReadError::Inactive);
+        }
+        let scope = actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        let permit = self
+            .inner
+            .context
+            .budget
+            .inner
+            .admission
+            .acquire(scope)
+            .await?;
+        let guard = {
+            let mut state = self.inner.state.lock().expect("serving workers");
+            if state.closed {
+                return Err(ServingReadError::Inactive);
+            }
+            state.active += 1;
+            Active(Arc::clone(&self.inner))
+        };
+        let ids = ids.to_vec();
+        let inner = Arc::clone(&self.inner);
+        self.inner
+            .context
+            .budget
+            .inner
+            .tasks
+            .spawn(async move {
+                let (_permit, _guard) = (permit, guard);
+                let (_, deadline) = inner.observe(actor.clone()).await?;
+                let reader = {
+                    let mut reader = inner.reader.lock().await;
+                    if reader.is_none() {
+                        *reader = Some(Arc::new(
+                            CatalogReader::open(
+                                Arc::clone(&inner.context.indexes),
+                                inner.lease.fact.catalog.ok_or(ServingReadError::Context)?,
+                            )
+                            .await?,
+                        ));
+                    }
+                    Arc::clone(reader.as_ref().expect("opened serving catalog"))
+                };
+                // Never time out by dropping owned metadata/SQLite work. Expiry
+                // stops serving its result; the pin remains until explicit drain.
+                if Instant::now() >= deadline {
+                    return Err(ServingReadError::Inactive);
+                }
+                let headers = reader
+                    .headers(&ids, &*inner.context.files, &*inner.context.files)
+                    .await?;
+                inner.observe(actor).await?;
+                if Instant::now() >= deadline {
+                    return Err(ServingReadError::Inactive);
+                }
+                Ok(headers)
+            })
+            .await?
+    }
+    /// Closing is sticky. Cancellation cannot reopen acquisition while workers
+    /// or a retained original release command remain owned by this service.
+    pub async fn close_and_drain(&self) {
+        self.inner.state.lock().expect("serving workers").closed = true;
+        loop {
+            let changed = self.inner.changed.notified();
+            tokio::pin!(changed);
+            changed.as_mut().enable();
+            if self.inner.state.lock().expect("serving workers").active == 0 {
+                return;
+            }
+            changed.await;
+        }
+    }
+    pub async fn ready_release(
+        &self,
+        identity: MutationIdentity,
+    ) -> Result<ReadyServingRelease, ServingReadError> {
+        self.close_and_drain().await;
+        let mut retained = self.inner.release.lock().await;
+        if self.inner.state.lock().expect("serving workers").released {
+            return Err(ServingReadError::Inactive);
+        }
+        if let Some(original) = retained.as_ref() {
+            return Ok(ReadyServingRelease {
+                inner: Arc::clone(&self.inner),
+                command: original.command.clone(),
+                digest: original.digest,
+            });
+        }
+        let ctx = &self.inner.context;
+        ctx.authority.check(&ctx.target, self.token().owner).await?;
+        let sql = SqlCell::<RepositoryModule>::new(ctx.client.clone(), ctx.target.clone())?;
+        let seed = sql
+            .query(
+                None,
+                super::super::sql::statement(
+                    "SELECT push_cert_seed FROM repository_identity WHERE singleton=1 AND owner=?1",
+                    vec![SqlValue::Text(ctx.administrator.clone())],
+                ),
+            )
+            .await
+            .map_err(|error| ServingReadError::Proof(Box::new(error)))?;
+        let Some([seed]) = super::super::sql::rows(&seed.output)?
+            .first()
+            .map(Vec::as_slice)
+        else {
+            return Err(ServingReadError::Inactive);
+        };
+        let data = DrainData {
+            tenant: *ctx.target.tenant().as_bytes(),
+            application: *ctx.target.application().as_bytes(),
+            token: self.token(),
+            administrator: ctx.administrator.clone(),
+        };
+        let proof = ServingDrainProof(super::super::certificate::CertificateEnvelope::seal(
+            &data,
+            &super::super::sql::fixed(seed)?,
+        )?);
+        let mut bytes = BoundedEncoder::new(1024)?;
+        proof.encode(&mut bytes)?;
+        let digest = *blake3::hash(&bytes.finish()).as_bytes();
+        let command = ctx
+            .client
+            .prepare_command::<ReleaseServingPin>(&ctx.target, identity, proof)
+            .await
+            .map_err(|error| ServingReadError::Prepare(Box::new(error)))?;
+        let command = Arc::new(command);
+        *retained = Some(ReleaseCommand {
+            command: command.clone(),
+            digest,
+        });
+        Ok(ReadyServingRelease {
+            inner: Arc::clone(&self.inner),
+            command,
+            digest,
+        })
+    }
+}
+impl Inner {
+    async fn observe(&self, actor: Option<String>) -> Result<(Receipt, Instant), ServingReadError> {
+        let ctx = &self.context;
+        ctx.authority
+            .check(&ctx.target, self.lease.token.owner)
+            .await?;
+        let started = Instant::now();
+        let observed = ctx
+            .client
+            .query::<CheckServingPin>(
+                &ctx.target,
+                None,
+                ServingCheck {
+                    token: self.lease.token,
+                    actor,
+                },
+            )
+            .await
+            .map_err(|error| ServingReadError::Query(Box::new(error)))?;
+        let lease = observed.output.ok_or(ServingReadError::Inactive)?;
+        if lease.token != self.lease.token
+            || lease.fact != self.lease.fact
+            || lease.format != self.lease.format
+        {
+            return Err(ServingReadError::Context);
+        }
+        let remaining = u64::try_from(lease.expires_at_ms - lease.observed_at_ms)
+            .map_err(|_| ServingReadError::Inactive)?;
+        let deadline = started
+            .checked_add(std::time::Duration::from_millis(
+                remaining.min(MAX_LEASE_MS),
+            ))
+            .ok_or(ServingReadError::Context)?;
+        ctx.authority
+            .check(&ctx.target, self.lease.token.owner)
+            .await?;
+        if Instant::now() >= deadline {
+            return Err(ServingReadError::Inactive);
+        }
+        Ok((observed.receipt, deadline))
+    }
+}
+#[must_use]
+pub struct ReadyServingRelease {
+    inner: Arc<Inner>,
+    command: Arc<PreparedCommand<ReleaseServingPin>>,
+    digest: [u8; 32],
+}
+impl ReadyServingRelease {
+    pub fn evidence(&self) -> &cellule_runtime::PendingMutation {
+        self.command.evidence()
+    }
+    pub(in crate::packs::publication) fn dispatch_copy(&self) -> Self {
+        Self {
+            inner: Arc::clone(&self.inner),
+            command: self.command.clone(),
+            digest: self.digest,
+        }
+    }
+    pub(in crate::packs::publication) fn context(
+        &self,
+    ) -> (&CellClient, &CellTarget, BeginRequest) {
+        let ctx = &self.inner.context;
+        (
+            &ctx.client,
+            &ctx.target,
+            BeginRequest {
+                repository: self.inner.lease.token.repository,
+                operation: self.inner.lease.token.reader,
+                request_digest: self.digest,
+                actor: ctx.administrator.clone(),
+                lease_ms: DEFAULT_LEASE_MS,
+            },
+        )
+    }
+    pub(in crate::packs::publication) fn pending(&self) -> PublicationError {
+        PublicationError::ServingRelease(InvocationError::Pending(Box::new(
+            self.command.evidence().clone(),
+        )))
+    }
+    pub(in crate::packs::publication) async fn dispatch(
+        self,
+        recover: bool,
+        fault: u8,
+    ) -> Result<Committed<ServingReleaseReply>, InvocationError<ServingReleaseReply>> {
+        let client = self.inner.context.client.clone();
+        let inner = Arc::clone(&self.inner);
+        let result = super::super::exact::invoke_guarded(
+            &client,
+            (*self.command).clone(),
+            recover,
+            128,
+            fault,
+            move || {
+                let state = self.inner.state.lock().expect("serving workers");
+                if !state.closed || state.active != 0 {
+                    return Err(Error::Command("serving workers have not drained"));
+                }
+                Ok(())
+            },
+        )
+        .await;
+        if !matches!(
+            &result,
+            Err(InvocationError::Pending(_) | InvocationError::InvalidPublishedResult { .. })
+        ) {
+            // Drop the cached original before the coordinator releases credits.
+            let mut retained = inner.release.lock().await;
+            if matches!(&result,Ok(value) if value.output==ServingReleaseReply::Released) {
+                inner.state.lock().expect("serving workers").released = true;
+            }
+            retained.take();
+        }
+        result
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 20073872..282baab2 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -28,6 +28,7 @@ mod refs;
 mod root_completion;
 mod root_dispatch;
 mod root_outcome;
+mod serving;
 mod staged_durable;
 mod staging;
 mod staging_receipt;
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
new file mode 100644
index 00000000..ef5992b8
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -0,0 +1,562 @@
+//! Serving pins protect real immutable roots through worker and receipt loss.
+use super::*;
+use super::{initialization::empty, publishing::edit};
+use crate::packs::catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes};
+use canopy_object_storage::artifact::ArtifactStore;
+use cellule_ltx::DiskBudget;
+use cellule_runtime::{Committed, PreparedCommand};
+use tokio::time::{Duration, timeout};
+use tokio_util::task::TaskTracker;
+
+async fn initialize(f: &Fixture, store: Arc<ArtifactStore>) -> Result<GenerationFact> {
+    let (prepared, root, budget) = Box::pin(empty(f, [241; 16], store.clone())).await?;
+    let prepared = Arc::new(prepared);
+    let ready = prepared.ready_initialization(identity()?).await?;
+    let registered = ready.persist_recovery(&store, identity()?).await?;
+    let InitializationReply::Initialized(fact) = ready.complete(&registered, &store).await?.output
+    else {
+        return Err("initialization not committed".into());
+    };
+    let admin = super::terminal_retention::maintenance(&f.handle, f.repository).await?;
+    assert_eq!(
+        registered
+            .ready_terminal_release(f.client(), &store, admin, identity()?)
+            .await?
+            .complete()
+            .await?
+            .output,
+        TerminalReleaseReply::Released
+    );
+    drop(prepared);
+    super::prepare::cleaned(root.path(), &budget).await?;
+    Ok(*fact)
+}
+fn request(f: &Fixture, actor: Option<&str>, reader: u8, lease_ms: u64) -> AcquireServingRequest {
+    AcquireServingRequest {
+        repository: f.repository,
+        reader: [reader; 16],
+        actor: actor.map(str::to_owned),
+        lease_ms,
+    }
+}
+fn granted(reply: ServingReply) -> Result<ServingLease> {
+    match reply {
+        ServingReply::Granted(lease) => Ok(*lease),
+        other => Err(format!("unexpected {other:?}").into()),
+    }
+}
+async fn acquire(
+    f: &Fixture,
+    actor: Option<&str>,
+    reader: u8,
+    lease_ms: u64,
+) -> Result<(
+    ServingLease,
+    PreparedCommand<AcquireServingPin>,
+    Committed<ServingReply>,
+)> {
+    let command = f
+        .client()
+        .prepare_command::<AcquireServingPin>(
+            &f.target,
+            identity()?,
+            request(f, actor, reader, lease_ms),
+        )
+        .await?;
+    let committed = command.clone().execute().await?;
+    Ok((granted(committed.output.clone())?, command, committed))
+}
+async fn pin_count(f: &Fixture) -> Result<u64> {
+    let bytes = f
+        .handle
+        .query(0, 8, |db| {
+            let count: u64 =
+                db.query_row("SELECT count(*) FROM catalog_serving_pins", [], |row| {
+                    row.get(0)
+                })?;
+            Ok(count.to_be_bytes().to_vec())
+        })
+        .await?;
+    Ok(u64::from_be_bytes(bytes.as_slice().try_into()?))
+}
+fn context(
+    f: &Fixture,
+    store: Arc<ArtifactStore>,
+    root: &tempfile::TempDir,
+    tasks: TaskTracker,
+) -> Result<ServingContext> {
+    Ok(ServingContext::new(
+        f.client(),
+        f.target.clone(),
+        f.authority(),
+        Arc::new(CatalogIndexes::new(store.clone(), f.format)),
+        Arc::new(CatalogFiles::new(
+            root.path(),
+            DiskBudget::new(64 << 20),
+            store,
+            f.format,
+            CatalogFileLimits::default(),
+        )?),
+        ServingReadBudget::new(4, tasks)?,
+        "owner".into(),
+    )?)
+}
+fn missing(f: &Fixture) -> Result<crate::ObjectId> {
+    Ok(match f.format {
+        ObjectFormat::Sha1 => crate::ObjectId::Sha1([7; 20]),
+        ObjectFormat::Sha256 => crate::ObjectId::Sha256([7; 32]),
+    })
+}
+async fn release(f: &Fixture, pin: &ServingPin) -> Result<Committed<ServingReleaseReply>> {
+    let ready = pin.ready_release(identity()?).await?;
+    let coordinator = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
+    let ticket = coordinator.submit(ready).await?;
+    let state = timeout(Duration::from_secs(5), ticket.wait()).await?;
+    let PublicationState::Finished(Ok(PublicationOutcome::ServingRelease(result))) = state else {
+        return Err(format!("unexpected serving release {state:?}").into());
+    };
+    assert!(coordinator.close_and_drain().await.is_empty());
+    Ok(result)
+}
+
+#[tokio::test]
+async fn grants_require_read_and_joint_initialization_without_allocating_namespaces() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        for (actor, reason) in [
+            (Some("owner"), ServingDenial::Uninitialized),
+            (None, ServingDenial::Unauthorized),
+            (Some("other"), ServingDenial::Unauthorized),
+        ] {
+            let result = f
+                .client()
+                .command::<AcquireServingPin>(
+                    &f.target,
+                    identity()?,
+                    request(&f, actor, 242, DEFAULT_LEASE_MS),
+                )
+                .await;
+            assert!(
+                matches!(result, Err(InvocationError::Rejected(value)) if value.output==ServingReply::Denied(reason))
+            );
+        }
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let fact = initialize(&f, store.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let before = f.counts().await?;
+        let (lease, original, receipt) = acquire(&f, Some("viewer"), 243, DEFAULT_LEASE_MS).await?;
+        assert_eq!(lease.fact, fact);
+        assert_eq!(lease.token.owner, f.handle.owner_fence());
+        assert_eq!(f.counts().await?, before);
+        assert_eq!(pin_count(&f).await?, 1);
+        let duplicate = f
+            .client()
+            .command::<AcquireServingPin>(
+                &f.target,
+                identity()?,
+                request(&f, Some("viewer"), 243, DEFAULT_LEASE_MS),
+            )
+            .await;
+        assert!(
+            matches!(duplicate, Err(InvocationError::Rejected(value)) if value.output==ServingReply::Denied(ServingDenial::Conflict))
+        );
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pin = ServingPin::open(
+            context(&f, store.clone(), &root, tasks.clone())?,
+            lease.token,
+            Some("viewer".into()),
+        )
+        .await?;
+        assert_eq!(
+            pin.headers(Some("viewer".into()), &[missing(&f)?]).await?,
+            vec![None]
+        );
+        assert_eq!(
+            release(&f, &pin).await?.output,
+            ServingReleaseReply::Released
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        assert!(pin.ready_release(identity()?).await.is_err());
+        // SDK replay is immutable evidence, not a fresh serving capability.
+        let replay = original.execute().await?;
+        assert_eq!(
+            (replay.output, replay.receipt),
+            (receipt.output, receipt.receipt)
+        );
+        assert!(
+            ServingPin::open(
+                context(&f, store, &root, tasks.clone())?,
+                lease.token,
+                Some("viewer".into())
+            )
+            .await
+            .is_err()
+        );
+        tasks.close();
+        timeout(Duration::from_secs(5), tasks.wait()).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn anonymous_public_reads_revocation_and_token_scope_are_rechecked() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    edit(&f, "UPDATE ref_generation SET visibility='public'").await?;
+    let (lease, _, _) = acquire(&f, None, 244, DEFAULT_LEASE_MS).await?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let pin =
+        ServingPin::open(context(&f, store, &root, tasks.clone())?, lease.token, None).await?;
+    assert_eq!(pin.headers(None, &[missing(&f)?]).await?, vec![None]);
+    for field in 0..5 {
+        let mut token = lease.token;
+        match field {
+            0 => token.repository[15] ^= 1,
+            1 => token.reader[15] ^= 1,
+            2 => token.owner.epoch += 1,
+            3 => token.admission_sequence += 1,
+            _ => token.generation += 1,
+        }
+        assert!(
+            f.client()
+                .query::<CheckServingPin>(&f.target, None, ServingCheck { token, actor: None })
+                .await?
+                .output
+                .is_none()
+        );
+    }
+    edit(&f, "UPDATE ref_generation SET visibility='private'").await?;
+    assert!(matches!(
+        pin.headers(None, &[missing(&f)?]).await,
+        Err(ServingReadError::Inactive)
+    ));
+    assert_eq!(pin_count(&f).await?, 1);
+    assert_eq!(
+        release(&f, &pin).await?.output,
+        ServingReleaseReply::Released
+    );
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn expiry_refuses_reads_and_renewal_but_retains_generation_until_drained_release() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha1).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    let fact = initialize(&f, store.clone()).await?;
+    let (lease, _, _) = acquire(&f, Some("owner"), 245, 1_000).await?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let pin = ServingPin::open(
+        context(&f, store, &root, tasks.clone())?,
+        lease.token,
+        Some("owner".into()),
+    )
+    .await?;
+    // Fixture injection qualifies retention, not publication of a native graph.
+    f.install_generation(2, fact.catalog.ok_or("catalog")?, fact.refs)
+        .await?;
+    tokio::time::sleep(Duration::from_millis(1_100)).await;
+    assert!(matches!(
+        pin.headers(Some("owner".into()), &[missing(&f)?]).await,
+        Err(ServingReadError::Inactive)
+    ));
+    let renewal = f
+        .client()
+        .command::<RenewServingPin>(
+            &f.target,
+            identity()?,
+            RenewServingRequest {
+                check: ServingCheck {
+                    token: lease.token,
+                    actor: Some("owner".into()),
+                },
+                lease_ms: DEFAULT_LEASE_MS,
+            },
+        )
+        .await;
+    assert!(
+        matches!(renewal, Err(InvocationError::Rejected(value)) if value.output==ServingReply::Denied(ServingDenial::Expired))
+    );
+    // Expire abandoned preparation work; its floor must not mask serving retention.
+    edit(
+        &f,
+        "UPDATE catalog_operations SET expires_at_ms=0; UPDATE catalog_leases SET expires_at_ms=0",
+    )
+    .await?;
+    let maintenance = super::terminal_retention::maintenance(&f.handle, f.repository).await?;
+    f.client()
+        .command::<ReapPreparation>(&f.target, identity()?, maintenance.clone())
+        .await?;
+    assert_eq!(pin_count(&f).await?, 1);
+    assert!(
+        edit(&f, "DELETE FROM catalog_generations WHERE generation=1")
+            .await
+            .is_err()
+    );
+    assert_eq!(
+        release(&f, &pin).await?.output,
+        ServingReleaseReply::Released
+    );
+    f.client()
+        .command::<ReapPreparation>(&f.target, identity()?, maintenance)
+        .await?;
+    let count = f
+        .handle
+        .query(0, 1, |db| {
+            let count: u8 = db.query_row(
+                "SELECT count(*) FROM catalog_generations WHERE generation=1",
+                [],
+                |row| row.get(0),
+            )?;
+            Ok(vec![count])
+        })
+        .await?;
+    assert_eq!(count, vec![0]);
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[test]
+fn schema_bounds_serving_pins_and_rejects_identity_replacement() -> Result {
+    let db = rusqlite::Connection::open_in_memory()?;
+    db.execute_batch("PRAGMA foreign_keys=ON")?;
+    db.execute_batch(SCHEMA)?;
+    db.execute_batch("INSERT INTO catalog_generations(generation,catalog,certificate) VALUES(1,x'01',zeroblob(32)),(2,x'02',zeroblob(32)); INSERT INTO catalog_serving_pins VALUES(randomblob(16),zeroblob(16),1,x'0000000000000001',1,100)")?;
+    for sql in [
+        "UPDATE catalog_serving_pins SET reader=randomblob(16)",
+        "UPDATE catalog_serving_pins SET incarnation=randomblob(16)",
+        "UPDATE catalog_serving_pins SET admission_sequence=2",
+        "UPDATE catalog_serving_pins SET owner_epoch=x'0000000000000002'",
+        "UPDATE catalog_serving_pins SET generation=2",
+        "UPDATE catalog_serving_pins SET expires_at_ms=99",
+        "INSERT OR REPLACE INTO catalog_serving_pins SELECT * FROM catalog_serving_pins",
+        "DELETE FROM catalog_generations WHERE generation=1",
+    ] {
+        assert!(db.execute_batch(sql).is_err(), "{sql}");
+    }
+    db.execute_batch("UPDATE catalog_serving_pins SET expires_at_ms=101; WITH RECURSIVE n(x) AS (VALUES(2) UNION ALL SELECT x+1 FROM n WHERE x<4096) INSERT INTO catalog_serving_pins SELECT randomblob(16),zeroblob(16),x,x'0000000000000001',1,0 FROM n")?;
+    assert!(db.execute_batch("INSERT INTO catalog_serving_pins VALUES(randomblob(16),zeroblob(16),4097,x'0000000000000001',1,0)").is_err());
+    db.execute_batch(
+        "DELETE FROM catalog_serving_pins; DELETE FROM catalog_generations WHERE generation=1",
+    )?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn release_uncertainty_reuses_original_command_and_receipt_after_caller_loss() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in 1..=3 {
+            let f = Fixture::new(format).await?;
+            let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+            initialize(&f, store.clone()).await?;
+            let (lease, _, _) = acquire(&f, Some("owner"), 246, DEFAULT_LEASE_MS).await?;
+            let root = tempfile::TempDir::new()?;
+            let tasks = TaskTracker::new();
+            let pin = ServingPin::open(
+                context(&f, store, &root, tasks.clone())?,
+                lease.token,
+                Some("owner".into()),
+            )
+            .await?;
+            let ready = pin.ready_release(identity()?).await?;
+            let evidence = ready.evidence().clone();
+            assert_eq!(pin.ready_release(identity()?).await?.evidence(), &evidence);
+            let coordinator = PublicationCoordinator::new(
+                f.target.clone(),
+                PublicationLimits::default(),
+                f.publication_budget.clone(),
+            )?;
+            coordinator.fault_for_test(fault);
+            let ticket = coordinator.submit(ready).await?;
+            let state = timeout(Duration::from_secs(5), ticket.wait()).await?;
+            assert!(matches!(state, PublicationState::Uncertain(_)), "{state:?}");
+            drop(ticket);
+            assert_eq!(pin.ready_release(identity()?).await?.evidence(), &evidence);
+            coordinator.fault_for_test(0);
+            let ticket = coordinator
+                .pending_serving_release(lease.token.reader)
+                .await
+                .ok_or("retained release")?;
+            ticket.recover().await?;
+            let state = timeout(Duration::from_secs(5), ticket.wait()).await?;
+            assert!(
+                matches!(state, PublicationState::Finished(Ok(PublicationOutcome::ServingRelease(ref result))) if result.output==ServingReleaseReply::Released),
+                "{state:?}"
+            );
+            assert_eq!(pin_count(&f).await?, 0);
+            assert!(pin.ready_release(identity()?).await.is_err());
+            assert!(coordinator.close_and_drain().await.is_empty());
+            tasks.close();
+            tasks.wait().await;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+mod blocked;
+
+#[tokio::test]
+async fn renewal_preserves_snapshot_and_cannot_shorten_or_revive_an_existing_pin() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    let fact = initialize(&f, store).await?;
+    let (lease, _, _) = acquire(&f, Some("owner"), 249, DEFAULT_LEASE_MS).await?;
+    f.install_generation(2, fact.catalog.ok_or("catalog")?, fact.refs)
+        .await?;
+    let input = RenewServingRequest {
+        check: ServingCheck {
+            token: lease.token,
+            actor: Some("owner".into()),
+        },
+        lease_ms: 1,
+    };
+    let original = f
+        .client()
+        .prepare_command::<RenewServingPin>(&f.target, identity()?, input.clone())
+        .await?;
+    let renewed = original.clone().execute().await?;
+    let grant = granted(renewed.output.clone())?;
+    assert_eq!(grant.token, lease.token);
+    assert_eq!(grant.fact, fact);
+    assert_eq!(grant.expires_at_ms, lease.expires_at_ms);
+    let replay = original.execute().await?;
+    assert_eq!(
+        (replay.output, replay.receipt),
+        (renewed.output, renewed.receipt)
+    );
+    edit(&f, "UPDATE repository_identity SET owner='replacement'").await?;
+    let result = f
+        .client()
+        .command::<RenewServingPin>(&f.target, identity()?, input)
+        .await;
+    assert!(
+        matches!(result, Err(InvocationError::Rejected(value)) if value.output==ServingReply::Denied(ServingDenial::Unauthorized))
+    );
+    assert_eq!(pin_count(&f).await?, 1);
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn owner_restoration_cannot_convert_an_old_pin_dto_into_fresh_serving_authority() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha1).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let (lease, _, _) = acquire(&f, Some("owner"), 250, DEFAULT_LEASE_MS).await?;
+    let (runtime, handle, client) =
+        super::durable_recovery::restore_owner_fence(&f, lease.token.owner).await?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    // Use the actual restored client, not an old local handle or decoded fence.
+    let restored = ServingContext::new(
+        client.clone(),
+        f.target.clone(),
+        f.authority(),
+        Arc::new(CatalogIndexes::new(store.clone(), f.format)),
+        Arc::new(CatalogFiles::new(
+            root.path(),
+            DiskBudget::new(64 << 20),
+            store,
+            f.format,
+            CatalogFileLimits::default(),
+        )?),
+        ServingReadBudget::new(4, tasks.clone())?,
+        "owner".into(),
+    )?;
+    assert!(matches!(
+        ServingPin::open(restored, lease.token, Some("owner".into())).await,
+        Err(ServingReadError::Authority(_))
+    ));
+    let result = client
+        .command::<RenewServingPin>(
+            &f.target,
+            identity()?,
+            RenewServingRequest {
+                check: ServingCheck {
+                    token: lease.token,
+                    actor: Some("owner".into()),
+                },
+                lease_ms: DEFAULT_LEASE_MS,
+            },
+        )
+        .await;
+    assert!(
+        matches!(result, Err(InvocationError::Rejected(value)) if value.output==ServingReply::Denied(ServingDenial::Stale))
+    );
+    let bytes = handle
+        .query(0, 8, |db| {
+            let count: u64 =
+                db.query_row("SELECT count(*) FROM catalog_serving_pins", [], |row| {
+                    row.get(0)
+                })?;
+            Ok(count.to_be_bytes().to_vec())
+        })
+        .await?;
+    assert_eq!(u64::from_be_bytes(bytes.as_slice().try_into()?), 1);
+    tasks.close();
+    tasks.wait().await;
+    runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn serving_release_and_preparation_share_budgets_without_colliding_logical_ids() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let (base, _, _) = super::prepare::opened(&f, [251; 16], store.clone()).await?;
+    let (lease, _, _) = acquire(&f, Some("owner"), 251, DEFAULT_LEASE_MS).await?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let pin = ServingPin::open(
+        context(&f, store, &root, tasks.clone())?,
+        lease.token,
+        Some("owner".into()),
+    )
+    .await?;
+    let queue = PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?;
+    let preparation = queue.try_reserve(
+        Arc::new(base.session.clone())
+            .ready_renew(identity()?, DEFAULT_LEASE_MS)
+            .await?,
+    )?;
+    assert!(matches!(preparation.state(), PublicationState::Held));
+    let reader = queue.submit(pin.ready_release(identity()?).await?).await?;
+    assert!(
+        matches!(timeout(Duration::from_secs(5), reader.wait()).await?, PublicationState::Finished(Ok(PublicationOutcome::ServingRelease(ref value))) if value.output==ServingReleaseReply::Released)
+    );
+    assert!(queue.pending([251; 16]).await.is_some());
+    preparation.activate().await?;
+    assert!(matches!(
+        timeout(Duration::from_secs(5), preparation.wait()).await?,
+        PublicationState::Finished(Ok(PublicationOutcome::Preparation(_)))
+    ));
+    assert!(queue.close_and_drain().await.is_empty());
+    assert_eq!(queue.stats().await.command_bytes, 0);
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/blocked.rs b/crates/canopy-server/src/packs/publication/tests/serving/blocked.rs
new file mode 100644
index 00000000..19eab237
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/blocked.rs
@@ -0,0 +1,196 @@
+use super::*;
+use async_trait::async_trait;
+use futures_util::stream::BoxStream;
+use object_store::{
+    CopyOptions, GetOptions, GetResult, ListResult, MultipartUpload, ObjectMeta, ObjectStore,
+    PutMultipartOptions, PutOptions, PutPayload, PutResult,
+};
+use std::sync::atomic::{AtomicBool, Ordering};
+use tokio::sync::Semaphore;
+
+#[derive(Debug)]
+struct Gate {
+    store: InMemory,
+    armed: AtomicBool,
+    entered: Semaphore,
+    proceed: Semaphore,
+}
+impl Gate {
+    fn new() -> Self {
+        Self {
+            store: InMemory::new(),
+            armed: AtomicBool::new(false),
+            entered: Semaphore::new(0),
+            proceed: Semaphore::new(0),
+        }
+    }
+}
+impl std::fmt::Display for Gate {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "blocked serving provider")
+    }
+}
+#[async_trait]
+impl ObjectStore for Gate {
+    async fn put_opts(
+        &self,
+        location: &Path,
+        payload: PutPayload,
+        opts: PutOptions,
+    ) -> object_store::Result<PutResult> {
+        self.store.put_opts(location, payload, opts).await
+    }
+    async fn put_multipart_opts(
+        &self,
+        location: &Path,
+        opts: PutMultipartOptions,
+    ) -> object_store::Result<Box<dyn MultipartUpload>> {
+        self.store.put_multipart_opts(location, opts).await
+    }
+    async fn get_opts(
+        &self,
+        location: &Path,
+        options: GetOptions,
+    ) -> object_store::Result<GetResult> {
+        if self.armed.swap(false, Ordering::AcqRel) {
+            self.entered.add_permits(1);
+            self.proceed
+                .acquire()
+                .await
+                .expect("provider gate")
+                .forget();
+        }
+        self.store.get_opts(location, options).await
+    }
+    fn delete_stream(
+        &self,
+        locations: BoxStream<'static, object_store::Result<Path>>,
+    ) -> BoxStream<'static, object_store::Result<Path>> {
+        self.store.delete_stream(locations)
+    }
+    fn list(&self, prefix: Option<&Path>) -> BoxStream<'static, object_store::Result<ObjectMeta>> {
+        self.store.list(prefix)
+    }
+    async fn list_with_delimiter(&self, prefix: Option<&Path>) -> object_store::Result<ListResult> {
+        self.store.list_with_delimiter(prefix).await
+    }
+    async fn copy_opts(
+        &self,
+        from: &Path,
+        to: &Path,
+        options: CopyOptions,
+    ) -> object_store::Result<()> {
+        self.store.copy_opts(from, to, options).await
+    }
+}
+
+#[tokio::test]
+async fn canceled_observer_cannot_release_pin_while_real_provider_worker_is_suspended() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(Gate::new());
+        let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+        initialize(&f, store.clone()).await?;
+        let (lease, _, _) = acquire(&f, Some("owner"), 247, DEFAULT_LEASE_MS).await?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pin = ServingPin::open(
+            context(&f, store.clone(), &root, tasks.clone())?,
+            lease.token,
+            Some("owner".into()),
+        )
+        .await?;
+        provider.armed.store(true, Ordering::Release);
+        let worker = pin.clone();
+        let oid = missing(&f)?;
+        let observer =
+            tokio::spawn(async move { worker.headers(Some("owner".into()), &[oid]).await });
+        timeout(Duration::from_secs(5), provider.entered.acquire())
+            .await??
+            .forget();
+        observer.abort();
+        assert!(observer.await.unwrap_err().is_cancelled());
+        assert!(!tasks.is_empty());
+        // Even a separately constructed context/budget cannot mint a second
+        // drain counter while the detached provider worker owns this pin.
+        assert!(matches!(
+            ServingPin::open(
+                context(&f, store.clone(), &root, tasks.clone())?,
+                lease.token,
+                Some("owner".into())
+            )
+            .await,
+            Err(ServingReadError::AlreadyOwned)
+        ));
+
+        assert!(
+            timeout(Duration::from_millis(50), pin.ready_release(identity()?))
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        assert!(matches!(
+            pin.headers(Some("owner".into()), &[oid]).await,
+            Err(ServingReadError::Inactive)
+        ));
+        provider.proceed.add_permits(1);
+        tasks.close();
+        timeout(Duration::from_secs(5), tasks.wait()).await?;
+        assert_eq!(
+            release(&f, &pin).await?.output,
+            ServingReleaseReply::Released
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn revocation_during_provider_io_discards_result_without_abandoning_retention() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let provider = Arc::new(Gate::new());
+    let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+    initialize(&f, store.clone()).await?;
+    edit(
+        &f,
+        "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+    )
+    .await?;
+    let (lease, _, _) = acquire(&f, Some("viewer"), 248, DEFAULT_LEASE_MS).await?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let pin = ServingPin::open(
+        context(&f, store.clone(), &root, tasks.clone())?,
+        lease.token,
+        Some("viewer".into()),
+    )
+    .await?;
+    provider.armed.store(true, Ordering::Release);
+    let worker = pin.clone();
+    let oid = missing(&f)?;
+    let observer = tokio::spawn(async move { worker.headers(Some("viewer".into()), &[oid]).await });
+    timeout(Duration::from_secs(5), provider.entered.acquire())
+        .await??
+        .forget();
+    edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+    assert!(
+        timeout(Duration::from_millis(50), pin.close_and_drain())
+            .await
+            .is_err()
+    );
+    assert_eq!(pin_count(&f).await?, 1);
+    provider.proceed.add_permits(1);
+    assert!(matches!(
+        timeout(Duration::from_secs(5), observer).await??,
+        Err(ServingReadError::Inactive)
+    ));
+    assert_eq!(
+        release(&f, &pin).await?.output,
+        ServingReleaseReply::Released
+    );
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
new file mode 100644
index 00000000..fe01e5c5
--- /dev/null
+++ b/docs/design/certified-serving-pins.md
@@ -0,0 +1,131 @@
+# Certified serving generations and physical drain
+
+Serving readers need an authorized immutable catalog/ref snapshot whose retained
+artifacts cannot disappear while an owned worker is suspended. The implementation
+adds a bounded serving-pin receiver and an owned metadata-read capability. This
+is a foundation for production reader conversion; the production manager does
+not yet acquire, renew, cache or hand off these pins to its serving consumers.
+The branch remains unreleasable until that conversion and the full cutover gates
+are complete.
+
+## Atomic selection and independent retention
+
+`AcquireServingPin` selects the current nonzero `GenerationFact` and inserts its
+exact generation retention in one Cellule command. Both catalog and refs must be
+present. The request needs current Read access, including anonymous public reads;
+it does not grant Write/Admin or create a preparation/artifact namespace. The
+pin binds repository, logical reader ID, actual owner incarnation/epoch and
+admission sequence. Reusing an existing reader ID is a conflict. Replaying the
+same original SDK command returns its original receipt, not a new lease.
+
+The hard cap is 4,096 retained serving pins per repository. Count probes are
+bounded, generation lookups are indexed, and the serving table has a generation
+index. SQL triggers reject identity changes, replacement, backwards lease
+updates and insertion above the cap. `RenewServingPin` requires current Read,
+actual owner and an unexpired exact pin. Renewal cannot shorten its deadline or
+change its selected generation, even if the current head has advanced.
+
+Lease expiry prevents serving and renewal. It never deletes retention: an old
+worker can remain suspended after its lease or owner expires. Existing generation
+reaping excludes exactly the serving-pinned generations and retains the existing
+preparation floor protection independently. This is SQL fact retention, not a
+completed remote artifact collector. The final typed GC/backup/restore inventory
+must include these roots and all other reader/backup/recovery owners.
+
+## Capability construction and admitted reads
+
+`ServingContext` is explicit trusted configuration: real CellClient/target,
+actual PreparationAuthority, shared CatalogIndexes/CatalogFiles, shared node
+read budget/TaskTracker, and repository administrator identity. Passing decoded
+catalog or generation data cannot construct a serving capability. `ServingPin`
+opens only after a fresh exact-pin query and actual owner checks. QueryContext
+does not expose its target/owner; SQL repository identity scopes the query,
+and the service verifies the configured target and fresh actual owner before
+artifact I/O. A pin query result alone grants no serving authority.
+
+Every exact pin also has one process-wide physical owner. A private Arc guard
+is reserved before tracked construction and retained by the pin, detached
+workers and release proofs. Duplicate construction is refused even through
+independent contexts/budgets. Only cloning that same capability shares its drain
+counter. Weak entries are pruned under a short synchronous mutex; the process
+hard cap is 4,096 live owners, independent of the per-repository SQL cap. No
+provider/Cell await runs under that mutex. Guard loss permits reconstruction
+only after every previous local owner/worker/proof has dropped; SQL and actual
+owner must then be rechecked. This local exclusion registry is not a durable
+acquisition ledger or a substitute for process fencing and restoration.
+
+The serving budget is explicit, 2–64 concurrent workers, with the existing
+nonwaiting node/account admission and half-cap account share. Production must
+create it once for the node and pass clones, not create a new budget per request.
+Closing prevents new work; it does not abandon an accepted read. Production must
+stop and join admission producers before closing and waiting its TaskTracker.
+
+The implemented read operation returns at most 512 authenticated object headers.
+It validates OIDs, obtains admission, increments an owned physical-drain guard,
+and spawns through the supplied TaskTracker before yielding. The tracked worker
+reobserves current Read/exact pin/fresh owner, opens the actual certified catalog,
+performs the existing bounded metadata batch and rechecks authorization and lease
+before returning. A conservative local deadline starts before the lease query;
+query/provider delays cannot extend the lease. An expired or revoked result is
+refused after owned I/O finishes. Cancellation detaches the observer; it cannot
+drop the tracked worker, admission or drain guard. There is no timeout that drops
+an owned metadata/SQLite future.
+
+The pin retains one lazy reader; configured index/file clients share their bounded
+caches across generations. This does not expose raw catalog readers or native
+workspace mutation authority. Object bodies, native operations, response streams
+and all current object/ref/cache/graph/browser consumers still need conversion.
+
+## Sticky closure and exact release
+
+Closure prevents new reads and waits for every owned drain guard. Notify
+registration precedes active-count observation, avoiding a lost final wakeup.
+Only after physical drain may the private owner mint a purpose-separated MAC
+proof binding tenant/application, exact pin and administrator. The release
+receiver checks the MAC, current Admin, actual owner and exact row. Lease expiry
+does not prevent a drained release.
+
+Release uses the existing publication coordinator's reserved maintenance share,
+with an 8 KiB command reservation and 1 KiB input/128-byte output bounds. A
+separate job kind preserves the actual reader ID without colliding with a
+creating publication or custody retirement that has the same logical ID. The
+owner caches an Arc of the original prepared SDK command. Repeated factories
+reuse that original even if the caller supplies a different proposed identity.
+Absent/lost-reply/panic recovery resolves its exact evidence and retains credits
+through uncertainty. Known outcomes clear the retained command before credit
+return; a known successful release permanently closes the pin. A caller cannot
+reopen it by replaying acquisition or by cloning an old receipt.
+
+A new owner cannot renew/release old-owner pins merely because its epoch is newer.
+They remain roots until actual physical fencing/drain and an authenticated
+adoption/release protocol is implemented. Conservatively retaining abandoned
+roots preserves correctness but does not establish operational quota recovery.
+Process-loss acquisition/renewal discovery is still missing. Do not compensate
+with automatic expiry deletion or a synthetic owner fence.
+
+## Production integration and qualification gates
+
+The next serving layer must own exact acquisition and renewal commands, preserve
+outcomes across cancellation/process loss, and hand off retained capabilities
+before observers can detach. Cache/coalesce a bounded set of active generation
+owners per repository rather than allocating a pin per browser/SDE. Carry that
+ownership through native work, object bodies and response streams; integrate
+its drain into actual eviction and shutdown. A close must join all producers and
+workers before Cell/workspace/artifact release.
+
+Regression families exercise Read/public access, joint initialization, original
+acquisition replay after release, token scope, revocation, expiry, monotone
+renewal, generation reaping, schema quota/identity guards, blocked real provider
+I/O, observer cancellation, actual owner restoration, bounded codecs/MAC domains,
+and exact release absence/lost acknowledgement/panic. Initialization retention is
+retired through its actual registered terminal release so an unrelated floor
+cannot conceal a serving-retention bug. Trusted generation/quota SQL fixtures
+qualify receiver invariants, not native publication or team capacity.
+
+The current full workspace library still has five failing unconverted `objects`
+readers. Production producer/reader/final DDL conversion, admitted immutable
+custody history and exact lookup, physical input takeover, scanner restart/fault
+campaigns, typed GC/backup/isolated restore, OS CPU/RSS/I/O/PID containment, native
+acceleration/physical rewrite/fair maintenance, signed native completion/cold clone,
+[file attribution](file-attribution.md), and full Linux/Kubernetes/Chromium plus
+10,000-SDE mixed-load/recovery/capacity qualification remain mandatory.
diff --git a/docs/design/shared-publication-dispatch.md b/docs/design/shared-publication-dispatch.md
index c3824ea0..d9e4ad18 100644
--- a/docs/design/shared-publication-dispatch.md
+++ b/docs/design/shared-publication-dispatch.md
@@ -117,3 +117,16 @@ Keep one coordinator and geometric planner per repository, with one shared publi
 Tests exercise class/account admission, retained failure values, duplicate logical IDs, maintenance concurrency while foreground completes, canceled observers, current admin revocation, and SHA-1/SHA-256 absent/lost-acknowledgement/panic recovery with original receipts and exactly one logical outcome. The existing push dispatcher tests remain in place with typed-result assertions. The geometric native fixture now prepares and publishes repeatedly through this shared dispatcher until ingress and level debt drain, checking canonical/source/version identity, unchanged refs and old-reader access.
 
 These fixtures establish bounded dispatch and recovery. They do not establish stable maintenance service under 35 pushes/s, full-history amplification, durability grouping, source-independent restore or capacity for 10,000 engineers. The mandatory workload and recovery campaigns remain release gates.
+
+## Serving retention release
+
+`ReadyServingRelease` joins the existing maintenance class under an 8 KiB
+reservation, with the original exact 1 KiB command and 128-byte result. Its
+private factory requires sticky serving closure and actual physical read-worker
+drain. A distinct typed job kind keeps its real reader ID separate from both
+creating publications and custody retirement; it does not fabricate an artifact
+namespace or grant preparation authority. Uncertainty retains the original
+command/owner/credits, and release recovery is looked up through
+`pending_serving_release`. See the [serving contract](certified-serving-pins.md).
+Production acquisition/renewal, generation caching and read-owner handoff still
+require integration.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 50926b6b..2e79218d 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -6,7 +6,7 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
-## Resident recovery lifecycle under final qualification
+## Resident recovery lifecycle checkpoint
 
 The production repository manager now retains one recovery coordinator plus root
 and custody scanners for each initialized local resident, sharing node command
@@ -55,6 +55,56 @@ maintenance, signed completion/cold clone, file attribution and full-history plu
 10,000-developer capacity qualification remain mandatory. This branch remains
 local, unpublished and unreleasable.
 
+## Certified serving pin foundation
+
+The [serving contract](design/certified-serving-pins.md) describes the new atomic
+Read-only generation receiver, separate bounded retention table, owner-checked
+metadata capability and tracked physical-drain/release protocol. It is not yet
+connected to production acquisition/renewal, object/native/stream consumers or
+snapshot caching. Expired serving pins remain retained until authenticated drain;
+no expiry/epoch-only cleanup is introduced. The original goal remains active.
+Final-source macOS/Rust 1.98.0 qualification passes all twelve focused serving
+families (1.63 seconds), including independent-context duplicate exclusion,
+blocked-provider cancellation/revocation, real owner restoration, and original
+release absence/lost-reply/panic in both object formats. Initialization's recovery
+floor is retired through its authentic terminal release before checking serving
+reaping. A separate typed scheduler key prevents logical-ID collisions with held
+preparation jobs while retaining the shared node/class/account budgets.
+
+The full workspace library remains **failed** (exit 101): 625 pass and the same
+five unconverted `objects` readers fail, out of 630 unique cases. All 336
+publication, seven startup and four production resident-recovery cases pass
+within that run; two nested subprocess summaries are excluded. Nine additional
+workspace/lifecycle cases pass in 4.42 seconds, including prebound cancellation.
+Combined: 639 unique executed, 634 passed, five failed. Clippy workspace/all-targets
+with warnings denied (23.28 seconds), server build (30.96 seconds), formatting
+(1.08 seconds), diff/static checks, 459 frozen source/schema/manifest files
+(446 Rust), 151 local doc links, exact five SDK manifest/six lock pins and the
+protected original index/archive checks pass. Retained proof and logs use the
+`/tmp/canopy-serving-pins-*` prefix. Draft diagnostics are retained, not counted
+as passing qualification.
+
+The bounded process-wide owner registry closes the duplicate-drain-counter gap:
+all contexts reject a second constructor for an owned exact pin, including with
+an independent budget. It retains only weak entries, caps live owners at 4,096,
+and holds no async/provider work under its lock. This local physical exclusion
+is not a durable acquisition ledger. Expired/old-owner SQL roots deliberately
+remain retained until their actual ownership is resolved; automatic expiry or
+new-epoch cleanup would violate correctness.
+
+Highest next: a production serving owner must retain exact acquisition/renewal
+commands, coalesce a bounded set of generation capabilities, and carry their
+worker/stream lifetime through actual eviction/shutdown. Convert all actual
+object/ref/cache/graph/browser/policy/check/merge consumers, including the five
+failures. Complete owned HTTP/SSH/generated producers and final hard-cutover DDL;
+admitted immutable custody history/exact lookup, retained physical-input
+adoption and scanner/fault campaigns remain required. Typed GC/backup/isolated
+restore, OS containment, native acceleration/physical rewrite/fair maintenance,
+signed completion/cold clone, file-attribution endpoint/UI/cache/index, and full
+Linux/Kubernetes/Chromium plus 10,000-engineer mixed-load/recovery/capacity gates
+remain mandatory. The branch is local, unpublished and unreleasable; no capacity
+claim or whole-goal completion is made.
+
 ## Shared node publication budget
 
 Repository dispatchers now require an explicit `PublicationBudget`, reusing the

From e9ea1b3864cf4b3d8fc7bfb3534cd1080d0242e5 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 07:48:50 -0700
Subject: [PATCH 17/55] Register exact serving acquisition and renewal through
 shared custody

---
 crates/canopy-server/src/lib.rs               |   1 +
 .../src/packs/publication/coordinator.rs      |  34 +-
 .../src/packs/publication/coordinator/work.rs |  30 +-
 .../src/packs/publication/custody/codec.rs    | 145 ++++
 .../src/packs/publication/custody/commands.rs |  65 +-
 .../src/packs/publication/custody/dispatch.rs |  30 +-
 .../src/packs/publication/custody/mod.rs      | 165 ++++-
 .../src/packs/publication/custody/scan.rs     |  34 +-
 .../src/packs/publication/custody/stop.rs     |  45 +-
 .../src/packs/publication/mod.rs              |  17 +-
 .../src/packs/publication/registry.rs         |   8 +-
 .../src/packs/publication/schema.sql          |  13 +-
 .../src/packs/publication/serving.rs          |   2 +
 .../src/packs/publication/serving/codec.rs    |   4 +-
 .../publication/serving/command_owner.rs      | 149 +++++
 .../src/packs/publication/serving/session.rs  |  43 +-
 .../publication/staging_service/restore.rs    |   6 +-
 .../src/packs/publication/tests.rs            |   8 +
 .../src/packs/publication/tests/custody.rs    |   4 +-
 .../packs/publication/tests/custody_stop.rs   |   6 +-
 .../publication/tests/recovery_discovery.rs   |   2 +-
 .../src/packs/publication/tests/serving.rs    |   1 +
 .../publication/tests/serving/custody.rs      | 618 ++++++++++++++++++
 docs/design/certified-serving-pins.md         |  69 +-
 .../large-repository-implementation-status.md |  57 ++
 25 files changed, 1437 insertions(+), 119 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/serving/command_owner.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/custody.rs

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index a5694922..45c133ae 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -295,6 +295,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/serving.rs"));
                 source.update(include_bytes!("packs/publication/serving/codec.rs"));
                 source.update(include_bytes!("packs/publication/serving/commands.rs"));
+                source.update(include_bytes!("packs/publication/serving/command_owner.rs"));
                 source.update(include_bytes!("packs/publication/serving/session.rs"));
                 source.update(include_bytes!("packs/publication/serving/ownership.rs"));
                 source.update(include_bytes!("packs/publication/serving/schema.sql"));
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index 8925cbd5..34162bb1 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -250,6 +250,8 @@ enum JobKind {
     Publication,
     CustodyStop,
     ServingRelease,
+    ServingCommand,
+    ServingStop,
 }
 struct Job {
     operation: [u8; 16],
@@ -676,7 +678,26 @@ impl PublicationCoordinator {
     }
     /// Retirement has a separate bounded key kind, never a fabricated operation.
     pub async fn pending_custody_stop(&self, operation: [u8; 16]) -> Option<PublicationTicket> {
-        self.pending_kind(operation, JobKind::CustodyStop).await
+        self.pending_custody_stop_for(CustodyPurpose::Creating, operation)
+            .await
+    }
+    pub(in crate::packs::publication) async fn pending_custody_stop_for(
+        &self,
+        purpose: CustodyPurpose,
+        operation: [u8; 16],
+    ) -> Option<PublicationTicket> {
+        self.pending_kind(
+            operation,
+            if purpose == CustodyPurpose::Serving {
+                JobKind::ServingStop
+            } else {
+                JobKind::CustodyStop
+            },
+        )
+        .await
+    }
+    pub async fn pending_serving_command(&self, reader: [u8; 16]) -> Option<PublicationTicket> {
+        self.pending_kind(reader, JobKind::ServingCommand).await
     }
     /// Read-retention release cannot collide with a creating request's ID.
     pub async fn pending_serving_release(&self, reader: [u8; 16]) -> Option<PublicationTicket> {
@@ -1065,7 +1086,14 @@ async fn finish(inner: &Inner, job: &Job, outcome: DispatchResult) {
             && value.stop.is_some()
             && let Some(original) = state
                 .jobs
-                .get(&(job.operation, JobKind::Publication))
+                .get(&(
+                    job.operation,
+                    if value.purpose == CustodyPurpose::Serving {
+                        JobKind::ServingCommand
+                    } else {
+                        JobKind::Publication
+                    },
+                ))
                 .cloned()
             && matches!(*original.status.borrow(), PublicationState::Uncertain(_))
         {
@@ -1074,7 +1102,7 @@ async fn finish(inner: &Inner, job: &Job, outcome: DispatchResult) {
                 .lock()
                 .await
                 .as_ref()
-                .and_then(ReadyPublication::preparation_original)
+                .and_then(ReadyPublication::custody_original)
                 .is_some_and(|evidence| *evidence == value.original);
             if matches {
                 original.status.send_replace(PublicationState::Queued);
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index a77cd77b..ede4582d 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -69,6 +69,7 @@ impl PreparedCompaction {
 #[must_use]
 pub enum ReadyPublication {
     ServingRelease(ReadyServingRelease),
+    ServingCommand(Box<ReadyServingCommand>),
     Push(ReadyCatalogPush),
     RootRecovery(ReadyRootRecovery),
     TerminalRelease(Box<ReadyTerminalRelease>),
@@ -78,6 +79,11 @@ pub enum ReadyPublication {
     Inputs(ReadyNativeInputs),
     Preparation(ReadyPreparation),
 }
+impl From<ReadyServingCommand> for ReadyPublication {
+    fn from(ready: ReadyServingCommand) -> Self {
+        Self::ServingCommand(Box::new(ready))
+    }
+}
 impl From<ReadyServingRelease> for ReadyPublication {
     fn from(ready: ReadyServingRelease) -> Self {
         Self::ServingRelease(ready)
@@ -126,14 +132,19 @@ impl From<ReadyPreparation> for ReadyPublication {
 impl ReadyPublication {
     pub(super) fn job_kind(&self) -> JobKind {
         match self {
+            Self::CustodyStop(ready) if ready.purpose() == CustodyPurpose::Serving => {
+                JobKind::ServingStop
+            }
             Self::CustodyStop(_) => JobKind::CustodyStop,
+            Self::ServingCommand(_) => JobKind::ServingCommand,
             Self::ServingRelease(_) => JobKind::ServingRelease,
             _ => JobKind::Publication,
         }
     }
-    pub(super) fn preparation_original(&self) -> Option<&cellule_runtime::PendingMutation> {
+    pub(super) fn custody_original(&self) -> Option<&cellule_runtime::PendingMutation> {
         match self {
             Self::Preparation(ready) => Some(ready.evidence()),
+            Self::ServingCommand(ready) => Some(ready.evidence()),
             _ => None,
         }
     }
@@ -155,7 +166,8 @@ impl ReadyPublication {
             | Self::RootRecovery(_)
             | Self::TerminalRelease(_)
             | Self::CustodyStop(_)
-            | Self::ServingRelease(_) => return false,
+            | Self::ServingRelease(_)
+            | Self::ServingCommand(_) => return false,
         };
         source.target == session.target
             && source.check == session.check
@@ -165,6 +177,7 @@ impl ReadyPublication {
     }
     pub(super) fn reservation(&self) -> u64 {
         match self {
+            Self::ServingCommand(ready) => ready.reservation(),
             Self::Inputs(_) => inputs::INPUT_RESERVATION,
             Self::Preparation(_) => preparation::RESERVATION,
             Self::RootRecovery(ready) => ready.reservation(),
@@ -175,6 +188,7 @@ impl ReadyPublication {
     pub(super) fn dispatch_copy(&self) -> Self {
         match self {
             Self::ServingRelease(ready) => Self::ServingRelease(ready.dispatch_copy()),
+            Self::ServingCommand(ready) => Self::ServingCommand(Box::new(ready.dispatch_copy())),
             Self::Preparation(ready) => Self::Preparation(ready.dispatch_copy()),
             Self::RootRecovery(ready) => Self::RootRecovery(ready.clone()),
             Self::TerminalRelease(ready) => Self::TerminalRelease(ready.clone()),
@@ -198,6 +212,7 @@ impl ReadyPublication {
     pub(super) fn class(&self) -> PublicationClass {
         match self {
             Self::Push(_)
+            | Self::ServingCommand(_)
             | Self::RootRecovery(_)
             | Self::BoundRecovery(_)
             | Self::Inputs(_)
@@ -211,6 +226,7 @@ impl ReadyPublication {
     pub(super) fn context(&self) -> (&CellClient, &CellTarget, BeginRequest) {
         let (client, target, check) = match self {
             Self::ServingRelease(ready) => return ready.context(),
+            Self::ServingCommand(ready) => return ready.context(),
             Self::CustodyStop(ready) => return ready.context(),
             Self::Push(ready) => ready.owner.capability(),
             Self::RootRecovery(ready) => ready.capability(),
@@ -235,6 +251,7 @@ impl ReadyPublication {
     pub(super) fn pending(&self) -> PublicationError {
         match self {
             Self::ServingRelease(ready) => ready.pending(),
+            Self::ServingCommand(ready) => ready.pending(),
             Self::Preparation(ready) => ready.pending(),
             Self::RootRecovery(ready) => ready.pending(),
             Self::TerminalRelease(ready) => ready.pending(),
@@ -254,6 +271,10 @@ impl ReadyPublication {
     pub(super) async fn dispatch(self, recover: bool, fault: u8) -> DispatchResult {
         let client = self.context().0.clone();
         match self {
+            Self::ServingCommand(ready) => ready
+                .dispatch(recover, fault)
+                .await
+                .map(PublicationOutcome::ServingCommand),
             Self::ServingRelease(ready) => ready
                 .dispatch(recover, fault)
                 .await
@@ -308,6 +329,7 @@ impl ReadyPublication {
 #[derive(Clone, Debug)]
 pub enum PublicationOutcome {
     ServingRelease(Committed<ServingReleaseReply>),
+    ServingCommand(Committed<ServingReply>),
     Initialization(Committed<InitializationReply>),
     Push(Committed<CatalogCompletionReply>),
     RootPush(Committed<RootCompletionReply>),
@@ -323,6 +345,8 @@ pub enum PublicationOutcome {
 pub enum PublicationError {
     #[error("serving pin release: {0}")]
     ServingRelease(#[source] InvocationError<ServingReleaseReply>),
+    #[error("serving custody command: {0}")]
+    ServingCommand(#[source] InvocationError<ServingReply>),
     #[error("publication custody intent failed")]
     Custody {
         evidence: Box<cellule_runtime::PendingMutation>,
@@ -368,6 +392,7 @@ impl PublicationError {
             Self::Custody { .. } => "not_started",
             Self::Recovery { .. } => "pending",
             Self::ServingRelease(error) => kind(error),
+            Self::ServingCommand(error) => kind(error),
             Self::Initialization(error) => kind(error),
             Self::Push(error) => kind(error),
             Self::RootPush(error) => kind(error),
@@ -390,6 +415,7 @@ impl PublicationError {
             Self::Custody { source, .. } => source.uncertain(),
             Self::Recovery { .. } => true,
             Self::ServingRelease(error) => unknown(error),
+            Self::ServingCommand(error) => unknown(error),
             Self::Initialization(error) => unknown(error),
             Self::Push(error) => unknown(error),
             Self::RootPush(error) => unknown(error),
diff --git a/crates/canopy-server/src/packs/publication/custody/codec.rs b/crates/canopy-server/src/packs/publication/custody/codec.rs
index 82128416..2f31729d 100644
--- a/crates/canopy-server/src/packs/publication/custody/codec.rs
+++ b/crates/canopy-server/src/packs/publication/custody/codec.rs
@@ -32,6 +32,23 @@ impl WireValue for CustodyAction {
                 e.write_u8(6)?;
                 r.encode(e)
             }
+            Self::AcquireServing(r) => {
+                e.write_u8(7)?;
+                r.encode(e)
+            }
+            Self::RenewServing {
+                request,
+                request_digest,
+            } => {
+                if request.check.actor.is_none() {
+                    return Err(CodecError::Invalid(
+                        "serving custody needs an account owner",
+                    ));
+                }
+                e.write_u8(8)?;
+                request.encode(e)?;
+                e.write_bytes(request_digest)
+            }
         }
     }
     fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
@@ -43,6 +60,19 @@ impl WireValue for CustodyAction {
             4 => Self::ClaimStaging(LeaseRequest::decode(d)?),
             5 => Self::RenewStaging(LeaseRequest::decode(d)?),
             6 => Self::BindStaging(LeaseCheck::decode(d)?),
+            7 => Self::AcquireServing(BeginRequest::decode(d)?),
+            8 => {
+                let request = RenewServingRequest::decode(d)?;
+                if request.check.actor.is_none() {
+                    return Err(CodecError::Invalid(
+                        "serving custody needs an account owner",
+                    ));
+                }
+                Self::RenewServing {
+                    request,
+                    request_digest: wire_fixed(d)?,
+                }
+            }
             _ => return Err(CodecError::Invalid("custody action purpose")),
         })
     }
@@ -88,12 +118,17 @@ impl WireValue for CustodyReply {
                 e.write_u8(1)?;
                 reply.encode(e)
             }
+            Self::Serving(reply) => {
+                e.write_u8(2)?;
+                reply.encode(e)
+            }
         }
     }
     fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
         match d.read_u8()? {
             0 => Ok(Self::Preparation(PreparationReply::decode(d)?)),
             1 => Ok(Self::Staging(StagingReply::decode(d)?)),
+            2 => Ok(Self::Serving(ServingReply::decode(d)?)),
             _ => Err(CodecError::Invalid("custody reply purpose")),
         }
     }
@@ -108,6 +143,7 @@ impl WireValue for Header {
             return Err(CodecError::Invalid("custody header identity"));
         }
         e.write_bytes(DOMAIN)?;
+        e.write_u8(self.purpose.number())?;
         e.write_bytes(&self.tenant)?;
         e.write_bytes(&self.application)?;
         e.write_bytes(self.incarnation.as_bytes())?;
@@ -128,6 +164,7 @@ impl WireValue for Header {
             return Err(CodecError::Invalid("custody header purpose"));
         }
         let value = Self {
+            purpose: CustodyPurpose::parse(d.read_u8()?)?,
             tenant: wire_fixed(d)?,
             application: wire_fixed(d)?,
             incarnation: IncarnationId::from_bytes(wire_fixed(d)?),
@@ -171,6 +208,8 @@ pub(super) fn validate_phase(phase: &Recorded, request: &CustodyRequest) -> Resu
     let reply: CustodyReply = phase.decode_reply()?;
     if phase.rejected() != reply.rejected()
         || request.action.staging() != matches!(reply, CustodyReply::Staging(_))
+        || (request.action.purpose() == CustodyPurpose::Serving)
+            != matches!(reply, CustodyReply::Serving(_))
     {
         return Err(CodecError::Invalid("custody result purpose differs"));
     }
@@ -180,6 +219,24 @@ pub(super) fn validate_phase(phase: &Recorded, request: &CustodyRequest) -> Resu
             Some(lease.token)
         }
         CustodyReply::Staging(StagingReply::Granted(lease)) => Some(lease.token),
+        CustodyReply::Serving(ServingReply::Granted(lease)) => {
+            lease.validate()?;
+            let (repository, reader, _, _) = request.action.identity();
+            if lease.token.repository != repository
+                || lease.token.reader != reader
+                || lease.token.admission_sequence > phase.sequence()
+            {
+                return Err(CodecError::Invalid("serving custody grant binding differs"));
+            }
+            match &request.action {
+                CustodyAction::AcquireServing(_)
+                    if lease.token.admission_sequence == phase.sequence() => {}
+                CustodyAction::RenewServing { request, .. }
+                    if request.check.token == lease.token => {}
+                _ => return Err(CodecError::Invalid("serving custody original differs")),
+            }
+            None
+        }
         _ => None,
     };
     if let Some(token) = token {
@@ -194,3 +251,91 @@ pub(super) fn validate_phase(phase: &Recorded, request: &CustodyRequest) -> Resu
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn serving_wire_requires_account_exact_framing_and_v2_purpose() -> Result<(), CodecError> {
+        let begin = BeginRequest {
+            repository: *uuid::Uuid::new_v4().as_bytes(),
+            operation: [2; 16],
+            request_digest: [3; 32],
+            actor: "viewer".into(),
+            lease_ms: DEFAULT_LEASE_MS,
+        };
+        let token = ServingToken {
+            repository: begin.repository,
+            reader: begin.operation,
+            owner: OwnerFence {
+                incarnation: IncarnationId::from_bytes([4; 16]),
+                epoch: 1,
+            },
+            admission_sequence: 5,
+            generation: 1,
+        };
+        let renew = RenewServingRequest {
+            check: ServingCheck {
+                token,
+                actor: Some("viewer".into()),
+            },
+            lease_ms: DEFAULT_LEASE_MS,
+        };
+        for action in [
+            CustodyAction::AcquireServing(begin.clone()),
+            CustodyAction::RenewServing {
+                request: renew.clone(),
+                request_digest: begin.request_digest,
+            },
+        ] {
+            let request = CustodyRequest {
+                step: 0,
+                previous: None,
+                action,
+            };
+            let bytes = encode(&request, INPUT_BYTES)?;
+            assert_eq!(decode::<CustodyRequest>(&bytes, INPUT_BYTES)?, request);
+            for length in 0..bytes.len() {
+                assert!(decode::<CustodyRequest>(&bytes[..length], INPUT_BYTES).is_err());
+            }
+            let mut trailing = bytes.clone();
+            trailing.push(0);
+            assert!(decode::<CustodyRequest>(&trailing, INPUT_BYTES).is_err());
+            let mut old = bytes;
+            let version = old
+                .windows(3)
+                .position(|part| part == b"v2\0")
+                .expect("domain version");
+            old[version + 1] = b'1';
+            assert!(decode::<CustodyRequest>(&old, INPUT_BYTES).is_err());
+            for reply in [
+                CustodyReply::Preparation(PreparationReply::Denied(
+                    PreparationDenial::Unauthorized,
+                )),
+                CustodyReply::Staging(StagingReply::Denied(PreparationDenial::Unauthorized)),
+            ] {
+                let phase = Recorded::new(6, true, encode(&reply, 512)?)?;
+                assert!(validate_phase(&phase, &request).is_err());
+            }
+            let reply = CustodyReply::Serving(ServingReply::Denied(ServingDenial::Unauthorized));
+            let bytes = encode(&reply, 512)?;
+            assert!(validate_phase(&Recorded::new(6, false, bytes.clone())?, &request).is_err());
+            validate_phase(&Recorded::new(6, true, bytes)?, &request)?;
+        }
+        let mut anonymous = renew;
+        anonymous.check.actor = None;
+        assert!(
+            encode(
+                &CustodyAction::RenewServing {
+                    request: anonymous,
+                    request_digest: [3; 32]
+                },
+                INPUT_BYTES
+            )
+            .is_err()
+        );
+        assert!(CustodyPurpose::parse(2).is_err());
+        Ok(())
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/custody/commands.rs b/crates/canopy-server/src/packs/publication/custody/commands.rs
index 62687fc7..33afda22 100644
--- a/crates/canopy-server/src/packs/publication/custody/commands.rs
+++ b/crates/canopy-server/src/packs/publication/custody/commands.rs
@@ -5,7 +5,7 @@ pub struct RegisterCustodyIntent;
 impl Command for RegisterCustodyIntent {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 41;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = CustodyIntent;
     type Output = RootRecoveryReply;
     fn execute(
@@ -20,9 +20,9 @@ impl Command for RegisterCustodyIntent {
         let request = intent.request()?;
         let bytes = intent.encoded()?;
         let previous = context.sql(&SqlBatch {
-            statements: vec![row_statement(header.operation, None), seed_statement()],
+            statements: vec![row_statement(header.key(), None), seed_statement()],
         })?;
-        let previous = from_sets(&previous, context.target(), header.operation)?;
+        let previous = from_sets(&previous, context.target(), header.key())?;
         if let Some(previous) = &previous {
             if previous.intent == intent {
                 // Exact knowledge is idempotent even after permission/owner loss.
@@ -52,7 +52,11 @@ impl Command for RegisterCustodyIntent {
             context,
             header.repository,
             &header.actor,
-            TokenScope::Write,
+            if header.purpose == CustodyPurpose::Serving {
+                TokenScope::Read
+            } else {
+                TokenScope::Write
+            },
         )?
         .is_none()
         {
@@ -69,9 +73,9 @@ impl Command for RegisterCustodyIntent {
             return deny(PreparationDenial::Capacity);
         }
         super::super::publish::changed(context.sql(&statement(
-            "INSERT INTO catalog_custody_commands(operation,step,incarnation,request_id,intent,phase) VALUES(?1,?2,?3,?4,?5,NULL)",
+            "INSERT INTO catalog_custody_commands(operation,step,incarnation,request_id,intent,phase,purpose) VALUES(?1,?2,?3,?4,?5,NULL,?6)",
             vec![blob(header.operation),number(u64::from(header.step))?,blob(header.incarnation.as_bytes()),
-                blob(intent.snapshot.evidence().identity().request_id.as_bytes()), SqlValue::Blob(bytes)],
+                blob(intent.snapshot.evidence().identity().request_id.as_bytes()), SqlValue::Blob(bytes), number(u64::from(header.purpose.number()))?],
         ))?)?;
         Ok(CommandResult::Success(RootRecoveryReply::Registered))
     }
@@ -83,7 +87,7 @@ pub struct ExecuteCustody;
 impl Command for ExecuteCustody {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 42;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = CustodyRequest;
     type Output = CustodyReply;
     fn execute(
@@ -93,11 +97,11 @@ impl Command for ExecuteCustody {
         let (_, operation, _, _) = request.action.identity();
         let sets = context.sql(&SqlBatch {
             statements: vec![
-                row_statement(operation, Some(request.step)),
+                row_statement(request.action.key(), Some(request.step)),
                 seed_statement(),
             ],
         })?;
-        let saved = from_sets(&sets, context.target(), operation)?
+        let saved = from_sets(&sets, context.target(), request.action.key())?
             .ok_or(Error::Command("custody command is not registered"))?;
         let header = saved.intent.header()?;
         let evidence = context
@@ -126,24 +130,43 @@ impl Command for ExecuteCustody {
             CustodyAction::ClaimStaging(input) => stage(ClaimStaging::execute(context, input)?),
             CustodyAction::RenewStaging(input) => stage(RenewStaging::execute(context, input)?),
             CustodyAction::BindStaging(input) => prep(BindStaging::execute(context, input)?),
+            CustodyAction::AcquireServing(input) => serving(AcquireServingPin::execute(
+                context,
+                AcquireServingRequest {
+                    repository: input.repository,
+                    reader: input.operation,
+                    actor: Some(input.actor),
+                    lease_ms: input.lease_ms,
+                },
+            )?),
+            CustodyAction::RenewServing { request, .. } => {
+                serving(RenewServingPin::execute(context, request)?)
+            }
         };
         let phase = Recorded::new(context.sequence(), output.rejected(), encode(&output, 512)?)?;
         codec::validate_phase(&phase, &request)?;
-        let token = match &output {
-            CustodyReply::Preparation(PreparationReply::Granted(lease)) => Some(lease.token),
-            CustodyReply::Staging(StagingReply::Granted(lease)) => Some(lease.token),
+        let grant = match &output {
+            CustodyReply::Preparation(PreparationReply::Granted(lease)) => {
+                Some((lease.token.owner, lease.token.attempt))
+            }
+            CustodyReply::Staging(StagingReply::Granted(lease)) => {
+                Some((lease.token.owner, lease.token.attempt))
+            }
+            CustodyReply::Serving(ServingReply::Granted(lease)) => {
+                Some((lease.token.owner, lease.token.admission_sequence))
+            }
             _ => None,
         };
-        let grant_incarnation = token.map_or(SqlValue::Null, |token| {
-            blob(token.owner.incarnation.as_bytes())
+        let grant_incarnation = grant.map_or(SqlValue::Null, |(owner, _)| {
+            blob(owner.incarnation.as_bytes())
         });
-        let grant_attempt = token
-            .map(|token| number(token.attempt))
+        let grant_attempt = grant
+            .map(|(_, attempt)| number(attempt))
             .transpose()?
             .unwrap_or(SqlValue::Null);
         super::super::publish::changed(context.sql(&statement(
-            "UPDATE catalog_custody_commands SET phase=?1,granted_incarnation=?5,granted_attempt=?6 WHERE operation=?2 AND step=?3 AND intent=?4 AND phase IS NULL AND stopped IS NULL",
-            vec![SqlValue::Blob(encode(&phase, 1024)?),blob(operation),number(u64::from(request.step))?,SqlValue::Blob(saved.intent.encoded()?),grant_incarnation,grant_attempt],
+            "UPDATE catalog_custody_commands SET phase=?1,granted_incarnation=?5,granted_attempt=?6 WHERE operation=?2 AND step=?3 AND intent=?4 AND phase IS NULL AND stopped IS NULL AND purpose=?7",
+            vec![SqlValue::Blob(encode(&phase, 1024)?),blob(operation),number(u64::from(request.step))?,SqlValue::Blob(saved.intent.encoded()?),grant_incarnation,grant_attempt,number(u64::from(header.purpose.number()))?],
         ))?)?;
         // Trusted denials commit the original phase alongside SDK acceptance;
         // the private service normalizes them back to Rejected at its boundary.
@@ -160,3 +183,9 @@ fn stage(result: CommandResult<StagingReply>) -> CustodyReply {
         CommandResult::Success(r) | CommandResult::Rejected(r) => r,
     })
 }
+
+fn serving(result: CommandResult<ServingReply>) -> CustodyReply {
+    CustodyReply::Serving(match result {
+        CommandResult::Success(r) | CommandResult::Rejected(r) => r,
+    })
+}
diff --git a/crates/canopy-server/src/packs/publication/custody/dispatch.rs b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
index 80f4a7c0..4917fef4 100644
--- a/crates/canopy-server/src/packs/publication/custody/dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
@@ -19,6 +19,7 @@ pub(in crate::packs::publication) struct OwnedCustody {
 pub(in crate::packs::publication) struct CustodyStopProbe {
     target: CellTarget,
     operation: [u8; 16],
+    purpose: CustodyPurpose,
     step: u32,
     digest: [u8; 32],
     evidence: PendingMutation,
@@ -31,7 +32,17 @@ impl CustodyStopProbe {
         &self,
         client: &CellClient,
     ) -> Result<bool, CustodyError> {
-        let Some(saved) = load(client, &self.target, self.operation, Some(self.step)).await? else {
+        let Some(saved) = load(
+            client,
+            &self.target,
+            CustodyKey {
+                purpose: self.purpose,
+                operation: self.operation,
+            },
+            Some(self.step),
+        )
+        .await?
+        else {
             return Ok(false);
         };
         if *blake3::hash(&saved.intent.encoded()?).as_bytes() != self.digest
@@ -50,6 +61,7 @@ impl OwnedCustody {
         Ok(CustodyStopProbe {
             target: self.evidence().target().clone(),
             operation: header.operation,
+            purpose: header.purpose,
             step: header.step,
             digest: *blake3::hash(&self.prepared.intent.encoded()?).as_bytes(),
             evidence: self.evidence().clone(),
@@ -81,7 +93,15 @@ impl OwnedCustody {
         target: &CellTarget,
         operation: [u8; 16],
     ) -> Result<Self, CustodyError> {
-        let registered = load(client, target, operation, None)
+        Self::restore_for(client, target, CustodyPurpose::Creating, operation).await
+    }
+    pub(in crate::packs::publication) async fn restore_for(
+        client: &CellClient,
+        target: &CellTarget,
+        purpose: CustodyPurpose,
+        operation: [u8; 16],
+    ) -> Result<Self, CustodyError> {
+        let registered = load(client, target, CustodyKey { purpose, operation }, None)
             .await?
             .ok_or(CustodyError::Context)?;
         Ok(Self {
@@ -109,7 +129,7 @@ impl OwnedCustody {
     ) -> Result<RegisteredCustody, CustodyError> {
         let header = self.prepared.intent.header()?;
         let target = self.evidence().target();
-        if let Some(saved) = load(client, target, header.operation, Some(header.step)).await? {
+        if let Some(saved) = load(client, target, header.key(), Some(header.step)).await? {
             return if saved.intent == self.prepared.intent {
                 if let Some(fact) = saved.stop_fact() {
                     return Err(CustodyError::Stopped(Box::new(fact)));
@@ -138,9 +158,7 @@ impl OwnedCustody {
         // requests recovery; ordinary network loss can use a durable pointer.
         if registration_fault != 0 {
             result.map_err(|error| CustodyError::Registration(Box::new(error)))?;
-        } else if let Some(saved) =
-            load(client, target, header.operation, Some(header.step)).await?
-        {
+        } else if let Some(saved) = load(client, target, header.key(), Some(header.step)).await? {
             return if saved.intent == self.prepared.intent {
                 Ok(saved)
             } else {
diff --git a/crates/canopy-server/src/packs/publication/custody/mod.rs b/crates/canopy-server/src/packs/publication/custody/mod.rs
index b920a53f..b56f92e0 100644
--- a/crates/canopy-server/src/packs/publication/custody/mod.rs
+++ b/crates/canopy-server/src/packs/publication/custody/mod.rs
@@ -26,8 +26,42 @@ pub use stop::{
 const INPUT_BYTES: u32 = 1024;
 const INTENT_BYTES: u32 = 4096;
 const MAX_STEPS: u32 = 65_535;
-const DOMAIN: &[u8] = b"canopy.custody-command-intent.v1\0";
+const DOMAIN: &[u8] = b"canopy.custody-command-intent.v2\0";
 
+/// Creating and serving requests retain separate exact command histories.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum CustodyPurpose {
+    Creating,
+    Serving,
+}
+impl CustodyPurpose {
+    fn number(self) -> u8 {
+        match self {
+            Self::Creating => 0,
+            Self::Serving => 1,
+        }
+    }
+    fn parse(value: u8) -> Result<Self, CodecError> {
+        match value {
+            0 => Ok(Self::Creating),
+            1 => Ok(Self::Serving),
+            _ => Err(CodecError::Invalid("custody purpose")),
+        }
+    }
+}
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+struct CustodyKey {
+    purpose: CustodyPurpose,
+    operation: [u8; 16],
+}
+impl From<[u8; 16]> for CustodyKey {
+    fn from(operation: [u8; 16]) -> Self {
+        Self {
+            purpose: CustodyPurpose::Creating,
+            operation,
+        }
+    }
+}
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum CustodyAction {
     BeginPreparation(BeginRequest),
@@ -37,11 +71,16 @@ pub enum CustodyAction {
     ClaimStaging(LeaseRequest),
     RenewStaging(LeaseRequest),
     BindStaging(LeaseCheck),
+    AcquireServing(BeginRequest),
+    RenewServing {
+        request: RenewServingRequest,
+        request_digest: [u8; 32],
+    },
 }
 impl CustodyAction {
     fn identity(&self) -> ([u8; 16], [u8; 16], [u8; 32], &str) {
         match self {
-            Self::BeginPreparation(r) | Self::BeginStaging(r) => {
+            Self::BeginPreparation(r) | Self::BeginStaging(r) | Self::AcquireServing(r) => {
                 (r.repository, r.operation, r.request_digest, &r.actor)
             }
             Self::ClaimPreparation(r)
@@ -49,6 +88,28 @@ impl CustodyAction {
             | Self::ClaimStaging(r)
             | Self::RenewStaging(r) => identity_of(&r.check),
             Self::BindStaging(r) => identity_of(r),
+            Self::RenewServing {
+                request,
+                request_digest,
+            } => (
+                request.check.token.repository,
+                request.check.token.reader,
+                *request_digest,
+                request.check.actor.as_deref().unwrap_or(""),
+            ),
+        }
+    }
+    fn purpose(&self) -> CustodyPurpose {
+        if matches!(self, Self::AcquireServing(_) | Self::RenewServing { .. }) {
+            CustodyPurpose::Serving
+        } else {
+            CustodyPurpose::Creating
+        }
+    }
+    fn key(&self) -> CustodyKey {
+        CustodyKey {
+            purpose: self.purpose(),
+            operation: self.identity().1,
         }
     }
     fn staging(&self) -> bool {
@@ -58,7 +119,10 @@ impl CustodyAction {
         )
     }
     fn begin(&self) -> bool {
-        matches!(self, Self::BeginPreparation(_) | Self::BeginStaging(_))
+        matches!(
+            self,
+            Self::BeginPreparation(_) | Self::BeginStaging(_) | Self::AcquireServing(_)
+        )
     }
 }
 fn identity_of(check: &LeaseCheck) -> ([u8; 16], [u8; 16], [u8; 32], &str) {
@@ -74,12 +138,15 @@ fn identity_of(check: &LeaseCheck) -> ([u8; 16], [u8; 16], [u8; 32], &str) {
 pub enum CustodyReply {
     Preparation(PreparationReply),
     Staging(StagingReply),
+    Serving(ServingReply),
 }
 impl CustodyReply {
     fn rejected(&self) -> bool {
         matches!(
             self,
-            Self::Preparation(PreparationReply::Denied(_)) | Self::Staging(StagingReply::Denied(_))
+            Self::Preparation(PreparationReply::Denied(_))
+                | Self::Staging(StagingReply::Denied(_))
+                | Self::Serving(ServingReply::Denied(_))
         )
     }
 }
@@ -94,6 +161,7 @@ pub struct CustodyRequest {
 }
 #[derive(Clone, Debug, PartialEq, Eq)]
 struct Header {
+    purpose: CustodyPurpose,
     tenant: [u8; 16],
     application: [u8; 16],
     incarnation: IncarnationId,
@@ -124,7 +192,8 @@ impl CustodyIntent {
         let request = self.request()?;
         let evidence = self.snapshot.evidence();
         let (repository, operation, digest, actor) = request.action.identity();
-        if !self.certificate.authenticated(seed)
+        if header.purpose != request.action.purpose()
+            || !self.certificate.authenticated(seed)
             || header.tenant != *target.tenant().as_bytes()
             || header.application != *target.application().as_bytes()
             || crate::repository_target(target.tenant(), target.application(), repository)?
@@ -245,23 +314,37 @@ fn seed_statement() -> SqlStatement {
         parameters: vec![],
     }
 }
-fn row_statement(operation: [u8; 16], step: Option<u32>) -> SqlStatement {
-    match step {
-        Some(step) => SqlStatement {
-            sql: "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands WHERE operation=?1 AND step=?2".into(),
-            parameters: vec![blob(operation), SqlValue::Integer(i64::from(step))],
-        },
-        None => SqlStatement {
-            sql: "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands WHERE operation=?1 ORDER BY step DESC LIMIT 1".into(),
-            parameters: vec![blob(operation)],
-        },
+impl Header {
+    fn key(&self) -> CustodyKey {
+        CustodyKey {
+            purpose: self.purpose,
+            operation: self.operation,
+        }
+    }
+}
+fn row_statement(key: impl Into<CustodyKey>, step: Option<u32>) -> SqlStatement {
+    let key = key.into();
+    let mut parameters = vec![
+        blob(key.operation),
+        SqlValue::Integer(i64::from(key.purpose.number())),
+    ];
+    let sql = if let Some(step) = step {
+        parameters.push(SqlValue::Integer(i64::from(step)));
+        "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands WHERE operation=?1 AND purpose=?2 AND step=?3"
+    } else {
+        "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands WHERE operation=?1 AND purpose=?2 ORDER BY step DESC LIMIT 1"
+    };
+    SqlStatement {
+        sql: sql.into(),
+        parameters,
     }
 }
 fn from_sets(
     sets: &[SqlResultSet],
     target: &CellTarget,
-    operation: [u8; 16],
+    key: impl Into<CustodyKey>,
 ) -> cellule_runtime::Result<Option<RegisteredCustody>> {
+    let key = key.into();
     let Some(row) = rows(sets)?.first() else {
         return Ok(None);
     };
@@ -281,7 +364,7 @@ fn from_sets(
         super::attestation::seed(sets.get(1..).ok_or(Error::Command("custody seed absent"))?)?;
     let header = intent.validate(target, &seed)?;
     if i64::from(header.step) != *step
-        || header.operation != operation
+        || header.key() != key
         || fixed::<16>(incarnation)? != *header.incarnation.as_bytes()
         || fixed::<16>(request_id)? != *intent.snapshot.evidence().identity().request_id.as_bytes()
     {
@@ -308,20 +391,21 @@ fn from_sets(
 async fn load(
     client: &CellClient,
     target: &CellTarget,
-    operation: [u8; 16],
+    key: impl Into<CustodyKey>,
     step: Option<u32>,
 ) -> Result<Option<RegisteredCustody>, CustodyError> {
+    let key = key.into();
     let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
     let output = sql
         .query(
             None,
             SqlBatch {
-                statements: vec![row_statement(operation, step), seed_statement()],
+                statements: vec![row_statement(key, step), seed_statement()],
             },
         )
         .await
         .map_err(|error| CustodyError::Query(Box::new(error)))?;
-    Ok(from_sets(&output.output, target, operation)?)
+    Ok(from_sets(&output.output, target, key)?)
 }
 impl PreparedCustody {
     pub async fn prepare(
@@ -330,11 +414,11 @@ impl PreparedCustody {
         action: CustodyAction,
         identity: MutationIdentity,
     ) -> Result<Self, CustodyError> {
-        let (repository, operation, digest, actor) = action.identity();
+        let (repository, _, digest, actor) = action.identity();
         if crate::repository_target(target.tenant(), target.application(), repository)? != *target {
             return Err(CustodyError::Context);
         }
-        let head = load(client, target, operation, None).await?;
+        let head = load(client, target, action.key(), None).await?;
         let (step, previous) = if let Some(head) = head {
             let header = head.intent.header()?;
             if header.repository != repository
@@ -367,6 +451,7 @@ impl PreparedCustody {
         let request: CustodyRequest = decode(&body, INPUT_BYTES)?;
         let (repository, operation, request_digest, actor) = request.action.identity();
         let header = Header {
+            purpose: request.action.purpose(),
             tenant: *target.tenant().as_bytes(),
             application: *target.application().as_bytes(),
             incarnation: command.evidence().incarnation(),
@@ -422,7 +507,7 @@ impl PreparedCustody {
     ) -> Result<RegisteredCustody, CustodyError> {
         let header = self.intent.header()?;
         let target = self.evidence().target();
-        if let Some(saved) = load(client, target, header.operation, Some(header.step)).await? {
+        if let Some(saved) = load(client, target, header.key(), Some(header.step)).await? {
             return if saved.intent == self.intent {
                 Ok(saved)
             } else {
@@ -434,7 +519,7 @@ impl PreparedCustody {
         let result = client
             .command::<RegisterCustodyIntent>(target, identity, self.intent.clone())
             .await;
-        let saved = load(client, target, header.operation, Some(header.step)).await?;
+        let saved = load(client, target, header.key(), Some(header.step)).await?;
         if let Some(saved) = saved {
             if saved.intent == self.intent {
                 return Ok(saved);
@@ -456,6 +541,14 @@ impl RegisteredCustody {
     ) -> Result<Option<Self>, CustodyError> {
         load(client, target, operation, None).await
     }
+    pub async fn load_for(
+        client: &CellClient,
+        target: &CellTarget,
+        purpose: CustodyPurpose,
+        operation: [u8; 16],
+    ) -> Result<Option<Self>, CustodyError> {
+        load(client, target, CustodyKey { purpose, operation }, None).await
+    }
     pub fn evidence(&self) -> &PendingMutation {
         self.intent.snapshot.evidence()
     }
@@ -483,6 +576,15 @@ impl RegisteredCustody {
             _ => None,
         })
     }
+    pub async fn recover_serving(
+        &self,
+        client: &CellClient,
+    ) -> Result<Committed<ServingReply>, InvocationError<ServingReply>> {
+        project(self.recover(client).await, |reply| match reply {
+            CustodyReply::Serving(reply) => Some(reply),
+            _ => None,
+        })
+    }
     pub async fn recover_staging(
         &self,
         client: &CellClient,
@@ -506,15 +608,10 @@ impl RegisteredCustody {
         let evidence = self.evidence();
         let recover = async {
             let header = self.intent.header()?;
-            let current = load(
-                client,
-                evidence.target(),
-                header.operation,
-                Some(header.step),
-            )
-            .await
-            .map_err(|_| Error::Command("custody phase query failed"))?
-            .ok_or(Error::Command("custody intent disappeared"))?;
+            let current = load(client, evidence.target(), header.key(), Some(header.step))
+                .await
+                .map_err(|_| Error::Command("custody phase query failed"))?
+                .ok_or(Error::Command("custody intent disappeared"))?;
             if current.intent != self.intent {
                 return Err(Error::Command("custody recovery binding differs"));
             }
@@ -596,7 +693,7 @@ pub(super) fn restart_matches(
     staging: bool,
 ) -> cellule_runtime::Result<bool> {
     let sets = context.sql(&SqlBatch { statements: vec![SqlStatement {
-        sql: "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE operation=?1 AND granted_incarnation=?2 AND granted_attempt=?3 ORDER BY step DESC LIMIT 1".into(),
+        sql: "SELECT step,incarnation,request_id,intent,phase,stopped FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE purpose=0 AND operation=?1 AND granted_incarnation=?2 AND granted_attempt=?3 ORDER BY step DESC LIMIT 1".into(),
         parameters: vec![blob(check.token.operation), blob(check.token.owner.incarnation.as_bytes()), number(check.token.attempt)?],
     }, seed_statement()] })?;
     let Some(saved) = from_sets(&sets, context.target(), check.token.operation)? else {
diff --git a/crates/canopy-server/src/packs/publication/custody/scan.rs b/crates/canopy-server/src/packs/publication/custody/scan.rs
index c5a7165a..be478e76 100644
--- a/crates/canopy-server/src/packs/publication/custody/scan.rs
+++ b/crates/canopy-server/src/packs/publication/custody/scan.rs
@@ -4,7 +4,7 @@ use super::*;
 use std::sync::Arc;
 use tokio::{sync::watch, task::JoinHandle};
 
-const SEEK: &str = "SELECT operation FROM catalog_custody_commands INDEXED BY catalog_custody_pending WHERE phase IS NULL AND stopped IS NULL AND operation>?1 ORDER BY operation LIMIT ?2";
+const SEEK: &str = "SELECT purpose,operation FROM catalog_custody_commands INDEXED BY catalog_custody_pending WHERE phase IS NULL AND stopped IS NULL AND (purpose,operation)>(?1,?2) ORDER BY purpose,operation LIMIT ?3";
 #[derive(Clone, Debug, Default)]
 pub struct CustodyScanStats {
     pub passes: u64,
@@ -85,21 +85,21 @@ struct Scan {
 impl Scan {
     async fn visit(
         &self,
-        operation: [u8; 16],
+        key: CustodyKey,
         stats: &mut CustodyScanStats,
     ) -> Result<(), CustodyError> {
         // The coordinator owns accepted uncertainty even if its SQL key vanished.
         // Do not create a second retirement identity for an admitted operation.
         if self
             .coordinator
-            .pending_custody_stop(operation)
+            .pending_custody_stop_for(key.purpose, key.operation)
             .await
             .is_some()
         {
             stats.deferred = stats.deferred.saturating_add(1);
             return Ok(());
         }
-        let Some(saved) = load(&self.client, &self.target, operation, None).await? else {
+        let Some(saved) = load(&self.client, &self.target, key, None).await? else {
             return Ok(());
         };
         if saved.closed() || saved.evidence().identity().expires_at_ms > now(0)? {
@@ -127,13 +127,20 @@ impl Scan {
 }
 async fn page(
     sql: &SqlCell<RepositoryModule>,
-    after: [u8; 16],
+    after: CustodyKey,
     count: u16,
-) -> Result<Vec<[u8; 16]>, CustodyError> {
+) -> Result<Vec<CustodyKey>, CustodyError> {
     let result = sql
         .query(
             None,
-            statement(SEEK, vec![blob(after), number(u64::from(count))?]),
+            statement(
+                SEEK,
+                vec![
+                    number(u64::from(after.purpose.number()))?,
+                    blob(after.operation),
+                    number(u64::from(count))?,
+                ],
+            ),
         )
         .await
         .map_err(|error| CustodyError::Query(Box::new(error)))?;
@@ -144,10 +151,15 @@ async fn page(
     let mut keys = Vec::with_capacity(rows.len());
     let mut previous = after;
     for row in rows {
-        let [key] = row.as_slice() else {
+        let [SqlValue::Integer(purpose), key] = row.as_slice() else {
             return Err(CustodyError::Context);
         };
-        let key = fixed::<16>(key)?;
+        let key = CustodyKey {
+            purpose: CustodyPurpose::parse(
+                u8::try_from(*purpose).map_err(|_| CustodyError::Context)?,
+            )?,
+            operation: fixed::<16>(key)?,
+        };
         if key <= previous {
             return Err(CustodyError::Context);
         }
@@ -164,7 +176,7 @@ async fn run(
     updates: watch::Sender<CustodyScanStats>,
 ) -> CustodyScanStats {
     let mut stats = CustodyScanStats::default();
-    let mut after = [0; 16];
+    let mut after = CustodyKey::from([0; 16]);
     loop {
         let Some(round) = control.enter(&settings).await else {
             return stats;
@@ -190,7 +202,7 @@ async fn run(
         match page(&sql, after, settings.limits.page).await {
             Ok(keys) => {
                 if keys.is_empty() {
-                    after = [0; 16];
+                    after = CustodyKey::from([0; 16]);
                     stats.passes = stats.passes.saturating_add(1);
                 }
                 for key in keys {
diff --git a/crates/canopy-server/src/packs/publication/custody/stop.rs b/crates/canopy-server/src/packs/publication/custody/stop.rs
index 55bfe75a..246879e8 100644
--- a/crates/canopy-server/src/packs/publication/custody/stop.rs
+++ b/crates/canopy-server/src/packs/publication/custody/stop.rs
@@ -2,9 +2,10 @@
 use super::*;
 use cellule_runtime::{PreparedCommand, Receipt};
 
-const DOMAIN: &[u8] = b"canopy.custody-retirement.v1\0";
+const DOMAIN: &[u8] = b"canopy.custody-retirement.v2\0";
 #[derive(Clone, Debug, PartialEq, Eq)]
 struct StopData {
+    purpose: CustodyPurpose,
     tenant: [u8; 16],
     application: [u8; 16],
     operation: [u8; 16],
@@ -18,6 +19,7 @@ impl WireValue for StopData {
             return Err(CodecError::Invalid("custody retirement context"));
         }
         e.write_bytes(DOMAIN)?;
+        e.write_u8(self.purpose.number())?;
         e.write_bytes(&self.tenant)?;
         e.write_bytes(&self.application)?;
         e.write_bytes(&self.operation)?;
@@ -31,6 +33,7 @@ impl WireValue for StopData {
             return Err(CodecError::Invalid("custody retirement purpose"));
         }
         let value = Self {
+            purpose: CustodyPurpose::parse(d.read_u8()?)?,
             tenant: crate::packs::directory::index::codec::fixed(d)?,
             application: crate::packs::directory::index::codec::fixed(d)?,
             operation: crate::packs::directory::index::codec::fixed(d)?,
@@ -162,6 +165,7 @@ pub(super) fn record(
     let header = intent.header()?;
     if value.data.tenant != header.tenant
         || value.data.application != header.application
+        || value.data.purpose != header.purpose
         || value.data.operation != header.operation
         || value.data.step != header.step
         || value.data.intent_digest != *blake3::hash(&intent.encoded()?).as_bytes()
@@ -176,7 +180,7 @@ pub struct StopCustodyIntent;
 impl Command for StopCustodyIntent {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 43;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = CustodyStopInput;
     type Output = CustodyStopReply;
     fn execute(
@@ -187,7 +191,13 @@ impl Command for StopCustodyIntent {
         let data: StopData = input.certificate.data()?;
         let sets = context.sql(&SqlBatch {
             statements: vec![
-                row_statement(data.operation, Some(data.step)),
+                row_statement(
+                    CustodyKey {
+                        purpose: data.purpose,
+                        operation: data.operation,
+                    },
+                    Some(data.step),
+                ),
                 seed_statement(),
             ],
         })?;
@@ -198,7 +208,15 @@ impl Command for StopCustodyIntent {
         {
             return deny(PreparationDenial::Unauthorized);
         }
-        let Some(saved) = from_sets(&sets, context.target(), data.operation)? else {
+        let Some(saved) = from_sets(
+            &sets,
+            context.target(),
+            CustodyKey {
+                purpose: data.purpose,
+                operation: data.operation,
+            },
+        )?
+        else {
             return deny(PreparationDenial::Missing);
         };
         if data.intent_digest != *blake3::hash(&saved.intent.encoded()?).as_bytes() {
@@ -235,8 +253,8 @@ impl Command for StopCustodyIntent {
         };
         let bytes = encode(&CertificateEnvelope::seal(&record, &seed)?, 1024)?;
         super::super::publish::changed(context.sql(&statement(
-            "UPDATE catalog_custody_commands SET stopped=?1 WHERE operation=?2 AND step=?3 AND intent=?4 AND phase IS NULL AND stopped IS NULL",
-            vec![SqlValue::Blob(bytes),blob(record.data.operation), number(u64::from(record.data.step))?,SqlValue::Blob(saved.intent.encoded()?)],
+            "UPDATE catalog_custody_commands SET stopped=?1 WHERE operation=?2 AND step=?3 AND intent=?4 AND phase IS NULL AND stopped IS NULL AND purpose=?5",
+            vec![SqlValue::Blob(bytes),blob(record.data.operation), number(u64::from(record.data.step))?,SqlValue::Blob(saved.intent.encoded()?),number(u64::from(record.data.purpose.number()))?],
         ))?)?;
         Ok(CommandResult::Success(CustodyStopReply::Stopped))
     }
@@ -244,6 +262,7 @@ impl Command for StopCustodyIntent {
 
 #[derive(Clone, Debug)]
 pub struct CustodyStopOutcome {
+    pub purpose: CustodyPurpose,
     pub original: PendingMutation,
     pub invocation: PendingMutation,
     pub stop: Option<CustodyStopFact>,
@@ -254,6 +273,7 @@ pub struct CustodyStopOutcome {
 #[derive(Clone)]
 #[must_use]
 pub struct ReadyCustodyStop {
+    purpose: CustodyPurpose,
     client: CellClient,
     target: CellTarget,
     request: BeginRequest,
@@ -271,7 +291,7 @@ impl RegisteredCustody {
     ) -> Result<ReadyCustodyStop, CustodyError> {
         let target = self.evidence().target().clone();
         let header = self.intent.header()?;
-        let current = load(&client, &target, header.operation, Some(header.step))
+        let current = load(&client, &target, header.key(), Some(header.step))
             .await?
             .ok_or(CustodyError::Context)?;
         if current.intent != self.intent {
@@ -302,6 +322,7 @@ impl RegisteredCustody {
         )?;
         let intent_digest = *blake3::hash(&self.intent.encoded()?).as_bytes();
         let data = StopData {
+            purpose: header.purpose,
             tenant: header.tenant,
             application: header.application,
             operation: header.operation,
@@ -322,6 +343,7 @@ impl RegisteredCustody {
             .await
             .map_err(|error| CustodyError::Owner(Box::new(error)))?;
         Ok(ReadyCustodyStop {
+            purpose: header.purpose,
             client,
             target,
             request: BeginRequest {
@@ -339,6 +361,9 @@ impl RegisteredCustody {
     }
 }
 impl ReadyCustodyStop {
+    pub(in crate::packs::publication) fn purpose(&self) -> CustodyPurpose {
+        self.purpose
+    }
     pub fn evidence(&self) -> &PendingMutation {
         self.command.evidence()
     }
@@ -357,7 +382,10 @@ impl ReadyCustodyStop {
         let saved = load(
             &self.client,
             &self.target,
-            self.request.operation,
+            CustodyKey {
+                purpose: self.purpose,
+                operation: self.request.operation,
+            },
             Some(self.step),
         )
         .await?
@@ -432,6 +460,7 @@ impl ReadyCustodyStop {
             (saved.map(|value| value.fact(&self.target)), Some(committed))
         };
         Ok(CustodyStopOutcome {
+            purpose: self.purpose,
             original: self.original,
             invocation,
             stop,
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index c9f1d315..09706118 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -17,9 +17,10 @@ use cellule_runtime::{
 mod serving;
 pub use serving::{
     AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_SERVING_OWNERS,
-    MAX_SERVING_PINS, ReadyServingRelease, ReleaseServingPin, RenewServingPin, RenewServingRequest,
-    ServingCheck, ServingContext, ServingDenial, ServingDrainProof, ServingLease, ServingPin,
-    ServingReadBudget, ServingReadError, ServingReleaseReply, ServingReply, ServingToken,
+    MAX_SERVING_PINS, ReadyServingCommand, ReadyServingRelease, ReleaseServingPin, RenewServingPin,
+    RenewServingRequest, ServingCheck, ServingContext, ServingDenial, ServingDrainProof,
+    ServingLease, ServingPin, ServingReadBudget, ServingReadError, ServingReleaseReply,
+    ServingReply, ServingToken,
 };
 mod owner;
 pub(crate) mod registry;
@@ -113,10 +114,10 @@ pub use root_completion::{
 mod admission_receipt;
 mod custody;
 pub use custody::{
-    CustodyAction, CustodyError, CustodyIntent, CustodyReply, CustodyRequest, CustodyScanStats,
-    CustodyStopFact, CustodyStopInput, CustodyStopOutcome, CustodyStopReply, CustodySupervisor,
-    ExecuteCustody, PreparedCustody, ReadyCustodyStop, RegisterCustodyIntent, RegisteredCustody,
-    StopCustodyIntent,
+    CustodyAction, CustodyError, CustodyIntent, CustodyPurpose, CustodyReply, CustodyRequest,
+    CustodyScanStats, CustodyStopFact, CustodyStopInput, CustodyStopOutcome, CustodyStopReply,
+    CustodySupervisor, ExecuteCustody, PreparedCustody, ReadyCustodyStop, RegisterCustodyIntent,
+    RegisteredCustody, StopCustodyIntent,
 };
 mod preparation_receipt;
 pub use preparation_receipt::{PreparationAdmission, PreparationReceiptError};
@@ -242,8 +243,6 @@ pub struct MaintenanceRequest {
 /// Bind the packed production contract. Inline publication/completion adapters
 /// are deliberately excluded; qualification binds its historical fixtures itself.
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
-    registry.bind_command::<AcquireServingPin>()?;
-    registry.bind_command::<RenewServingPin>()?;
     registry.bind_command::<ReleaseServingPin>()?;
     registry.bind_query::<CheckServingPin>()?;
     registry.bind_command::<RegisterCustodyIntent>()?;
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 8f185781..54178310 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,7 +23,7 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 19] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 17] = [
     crate::operation(1),
     command::<AbortPreparation>(4096, 4096),
     command::<ReapPreparation>(4096, 4096),
@@ -40,8 +40,6 @@ pub(crate) const COMMANDS: [OperationDescriptor; 19] = [
     command::<RegisterCustodyIntent>(4096, 4096),
     command::<ExecuteCustody>(1024, 512),
     command::<StopCustodyIntent>(1024, 128),
-    command::<AcquireServingPin>(1024, 1024),
-    command::<RenewServingPin>(1024, 1024),
     command::<ReleaseServingPin>(1024, 128),
 ];
 pub(crate) const QUERIES: [OperationDescriptor; 10] = [
@@ -85,7 +83,7 @@ mod tests {
         assert_eq!(
             ids,
             vec![
-                1, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 44, 45, 46
+                1, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46
             ]
         );
         assert_eq!(
@@ -120,8 +118,6 @@ mod tests {
             (41, RegisterCustodyIntent::CODEC_VERSION, 4096, 4096),
             (42, ExecuteCustody::CODEC_VERSION, 1024, 512),
             (43, StopCustodyIntent::CODEC_VERSION, 1024, 128),
-            (44, AcquireServingPin::CODEC_VERSION, 1024, 1024),
-            (45, RenewServingPin::CODEC_VERSION, 1024, 1024),
             (46, ReleaseServingPin::CODEC_VERSION, 1024, 128),
         ] {
             let operation = descriptor
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index 3f79f57a..6bf84189 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -551,6 +551,7 @@ BEGIN SELECT RAISE(ABORT, 'push outcome bytes cannot be replaced'); END;
 -- One unresolved head per logical request. Rows represent custody transitions,
 -- never Git objects, and historical grants are not generation retention roots.
 CREATE TABLE catalog_custody_commands (
+    purpose INTEGER NOT NULL CHECK(typeof(purpose)='integer' AND purpose IN (0,1)),
     operation BLOB NOT NULL CHECK(typeof(operation)='blob' AND length(operation)=16),
     step INTEGER NOT NULL CHECK(typeof(step)='integer' AND step BETWEEN 0 AND 65535),
     incarnation BLOB NOT NULL CHECK(typeof(incarnation)='blob' AND length(incarnation)=16),
@@ -564,20 +565,20 @@ CREATE TABLE catalog_custody_commands (
     CHECK(stopped IS NULL OR granted_attempt IS NULL),
     CHECK((granted_incarnation IS NULL)=(granted_attempt IS NULL)),
     CHECK(phase IS NOT NULL OR granted_attempt IS NULL),
-    PRIMARY KEY(operation,step),
+    PRIMARY KEY(purpose,operation,step),
     UNIQUE(incarnation,request_id)
 ) WITHOUT ROWID;
-CREATE INDEX catalog_custody_grants ON catalog_custody_commands(operation,granted_incarnation,granted_attempt,step DESC) WHERE granted_attempt IS NOT NULL;
-CREATE UNIQUE INDEX catalog_custody_pending ON catalog_custody_commands(operation) WHERE phase IS NULL AND stopped IS NULL;
-CREATE TRIGGER catalog_custody_identity_immutable BEFORE UPDATE OF operation,step,incarnation,request_id,intent ON catalog_custody_commands
-WHEN NEW.operation IS NOT OLD.operation OR NEW.step IS NOT OLD.step
+CREATE INDEX catalog_custody_grants ON catalog_custody_commands(purpose,operation,granted_incarnation,granted_attempt,step DESC) WHERE granted_attempt IS NOT NULL;
+CREATE UNIQUE INDEX catalog_custody_pending ON catalog_custody_commands(purpose,operation) WHERE phase IS NULL AND stopped IS NULL;
+CREATE TRIGGER catalog_custody_identity_immutable BEFORE UPDATE OF purpose,operation,step,incarnation,request_id,intent ON catalog_custody_commands
+WHEN NEW.purpose IS NOT OLD.purpose OR NEW.operation IS NOT OLD.operation OR NEW.step IS NOT OLD.step
   OR NEW.incarnation IS NOT OLD.incarnation OR NEW.request_id IS NOT OLD.request_id OR NEW.intent IS NOT OLD.intent
 BEGIN SELECT RAISE(ABORT, 'custody command identity is immutable'); END;
 CREATE TRIGGER catalog_custody_phase_immutable BEFORE UPDATE OF phase,granted_incarnation,granted_attempt ON catalog_custody_commands
 WHEN OLD.phase IS NOT NULL AND (NEW.phase IS NOT OLD.phase OR NEW.granted_incarnation IS NOT OLD.granted_incarnation OR NEW.granted_attempt IS NOT OLD.granted_attempt)
 BEGIN SELECT RAISE(ABORT, 'custody command result is immutable'); END;
 CREATE TRIGGER catalog_custody_not_replaced BEFORE INSERT ON catalog_custody_commands
-WHEN EXISTS(SELECT 1 FROM catalog_custody_commands WHERE operation=NEW.operation AND step=NEW.step)
+WHEN EXISTS(SELECT 1 FROM catalog_custody_commands WHERE purpose=NEW.purpose AND operation=NEW.operation AND step=NEW.step)
   OR EXISTS(SELECT 1 FROM catalog_custody_commands WHERE incarnation=NEW.incarnation AND request_id=NEW.request_id)
 BEGIN SELECT RAISE(ABORT, 'custody command cannot be replaced'); END;
 CREATE TRIGGER catalog_custody_retained BEFORE DELETE ON catalog_custody_commands
diff --git a/crates/canopy-server/src/packs/publication/serving.rs b/crates/canopy-server/src/packs/publication/serving.rs
index 2041c282..e842b196 100644
--- a/crates/canopy-server/src/packs/publication/serving.rs
+++ b/crates/canopy-server/src/packs/publication/serving.rs
@@ -3,7 +3,9 @@ use super::*;
 use cellule_runtime::{CellClient, CellTarget, MutationIdentity, PreparedCommand};
 use std::sync::Arc;
 mod codec;
+mod command_owner;
 mod commands;
+pub use command_owner::ReadyServingCommand;
 mod ownership;
 pub use ownership::MAX_SERVING_OWNERS;
 mod session;
diff --git a/crates/canopy-server/src/packs/publication/serving/codec.rs b/crates/canopy-server/src/packs/publication/serving/codec.rs
index 1bee0382..21d84879 100644
--- a/crates/canopy-server/src/packs/publication/serving/codec.rs
+++ b/crates/canopy-server/src/packs/publication/serving/codec.rs
@@ -17,7 +17,7 @@ fn duration(value: u64) -> Result<(), CodecError> {
     Ok(())
 }
 impl ServingToken {
-    pub(super) fn validate(&self) -> Result<(), CodecError> {
+    pub(in crate::packs::publication) fn validate(&self) -> Result<(), CodecError> {
         crate::validate_repository_id(self.repository).map_err(|_| invalid())?;
         if self.reader == [0; 16]
             || self.owner.epoch == 0
@@ -111,7 +111,7 @@ impl WireValue for RenewServingRequest {
     }
 }
 impl ServingLease {
-    pub(super) fn validate(&self) -> Result<(), CodecError> {
+    pub(in crate::packs::publication) fn validate(&self) -> Result<(), CodecError> {
         self.token.validate()?;
         self.fact.validate()?;
         if self.fact.generation != self.token.generation
diff --git a/crates/canopy-server/src/packs/publication/serving/command_owner.rs b/crates/canopy-server/src/packs/publication/serving/command_owner.rs
new file mode 100644
index 00000000..c311aa00
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/command_owner.rs
@@ -0,0 +1,149 @@
+//! Registered originals reuse custody history and the common publication queue.
+use super::super::custody::{OwnedCustody, RESERVATION, project};
+use super::*;
+use cellule_runtime::{Committed, InvocationError, PendingMutation};
+
+#[must_use]
+pub struct ReadyServingCommand {
+    client: CellClient,
+    target: CellTarget,
+    request: BeginRequest,
+    original: OwnedCustody,
+    // Renewal is owned physical work from preparation until known disposition.
+    _guard: Option<Arc<super::session::Active>>,
+}
+impl ReadyServingCommand {
+    pub async fn acquire(
+        client: CellClient,
+        target: CellTarget,
+        request: BeginRequest,
+        identity: MutationIdentity,
+        authority: PreparationAuthority,
+    ) -> Result<Self, CustodyError> {
+        request.encode(&mut BoundedEncoder::new(4096)?)?;
+        if !authority.matches(&target)
+            || crate::repository_target(target.tenant(), target.application(), request.repository)?
+                != target
+        {
+            return Err(CustodyError::Context);
+        }
+        let original = OwnedCustody::prepare(
+            &client,
+            &target,
+            CustodyAction::AcquireServing(request.clone()),
+            identity,
+        )
+        .await?;
+        Ok(Self {
+            client,
+            target,
+            request,
+            original,
+            _guard: None,
+        })
+    }
+    pub(super) async fn renew(
+        client: CellClient,
+        target: CellTarget,
+        request: RenewServingRequest,
+        request_digest: [u8; 32],
+        identity: MutationIdentity,
+        guard: Arc<super::session::Active>,
+    ) -> Result<Self, CustodyError> {
+        let action = CustodyAction::RenewServing {
+            request,
+            request_digest,
+        };
+        let context = context(&action)?;
+        let original = OwnedCustody::prepare(&client, &target, action, identity).await?;
+        Ok(Self {
+            client,
+            target,
+            request: context,
+            original,
+            _guard: Some(guard),
+        })
+    }
+    /// Reconstruct the recorded serving original. A historical grant remains
+    /// knowledge; ServingPin construction separately rechecks physical authority.
+    pub async fn restore(
+        client: CellClient,
+        target: CellTarget,
+        reader: [u8; 16],
+        authority: PreparationAuthority,
+    ) -> Result<Self, CustodyError> {
+        if !authority.matches(&target) {
+            return Err(CustodyError::Context);
+        }
+        let original =
+            OwnedCustody::restore_for(&client, &target, CustodyPurpose::Serving, reader).await?;
+        let request = context(&original.action()?)?;
+        Ok(Self {
+            client,
+            target,
+            request,
+            original,
+            _guard: None,
+        })
+    }
+    pub fn evidence(&self) -> &PendingMutation {
+        self.original.evidence()
+    }
+    pub(in crate::packs::publication) fn reservation(&self) -> u64 {
+        RESERVATION
+    }
+    pub(in crate::packs::publication) fn dispatch_copy(&self) -> Self {
+        Self {
+            client: self.client.clone(),
+            target: self.target.clone(),
+            request: self.request.clone(),
+            original: self.original.clone(),
+            _guard: self._guard.clone(),
+        }
+    }
+    pub(in crate::packs::publication) fn context(
+        &self,
+    ) -> (&CellClient, &CellTarget, BeginRequest) {
+        (&self.client, &self.target, self.request.clone())
+    }
+    pub(in crate::packs::publication) fn pending(&self) -> PublicationError {
+        PublicationError::ServingCommand(InvocationError::Pending(Box::new(
+            self.evidence().clone(),
+        )))
+    }
+    pub(in crate::packs::publication) async fn dispatch(
+        self,
+        recover: bool,
+        fault: u8,
+    ) -> Result<Committed<ServingReply>, PublicationError> {
+        let result = self
+            .original
+            .invoke(&self.client, recover, fault, || Ok(()))
+            .await
+            .map_err(|source| PublicationError::Custody {
+                evidence: Box::new(self.evidence().clone()),
+                source: Box::new(source),
+            })?;
+        project(result, |reply| match reply {
+            CustodyReply::Serving(reply) => Some(reply),
+            _ => None,
+        })
+        .map_err(PublicationError::ServingCommand)
+    }
+}
+fn context(action: &CustodyAction) -> Result<BeginRequest, CustodyError> {
+    match action {
+        CustodyAction::AcquireServing(request) => Ok(request.clone()),
+        CustodyAction::RenewServing {
+            request,
+            request_digest,
+        } => Ok(BeginRequest {
+            repository: request.check.token.repository,
+            operation: request.check.token.reader,
+            request_digest: *request_digest,
+            actor: request.check.actor.clone().ok_or(CustodyError::Context)?,
+            lease_ms: request.lease_ms,
+        }),
+        _ => Err(CustodyError::Context),
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index c5122877..a3938daa 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -28,6 +28,8 @@ pub enum ServingReadError {
     Metadata(#[from] crate::packs::directory::index::IndexError),
     #[error("serving capability failed")]
     Capability(#[from] Error),
+    #[error("serving custody intent failed")]
+    Custody(#[source] Box<CustodyError>),
     #[error("serving encoding failed")]
     Codec(#[from] CodecError),
     #[error("serving worker failed")]
@@ -129,7 +131,7 @@ struct Workers {
     active: usize,
     released: bool,
 }
-struct Active(Arc<Inner>);
+pub(super) struct Active(Arc<Inner>);
 impl Drop for Active {
     fn drop(&mut self) {
         let mut state = self.0.state.lock().expect("serving workers");
@@ -274,6 +276,45 @@ impl ServingPin {
             })
             .await?
     }
+    /// Own the exact renewal and its drain guard before yielding to a caller.
+    /// The coordinator retains both across held/unknown states and transport loss.
+    pub async fn ready_renew(
+        &self,
+        actor: String,
+        request_digest: [u8; 32],
+        identity: MutationIdentity,
+        lease_ms: u64,
+    ) -> Result<ReadyServingCommand, ServingReadError> {
+        if self.inner.context.budget.inner.stop.is_cancelled() {
+            return Err(ServingReadError::Inactive);
+        }
+        let guard = {
+            let mut state = self.inner.state.lock().expect("serving workers");
+            if state.closed {
+                return Err(ServingReadError::Inactive);
+            }
+            state.active += 1;
+            Arc::new(Active(Arc::clone(&self.inner)))
+        };
+        let ctx = &self.inner.context;
+        ctx.authority.check(&ctx.target, self.token().owner).await?;
+        ReadyServingCommand::renew(
+            ctx.client.clone(),
+            ctx.target.clone(),
+            RenewServingRequest {
+                check: ServingCheck {
+                    token: self.token(),
+                    actor: Some(actor),
+                },
+                lease_ms,
+            },
+            request_digest,
+            identity,
+            guard,
+        )
+        .await
+        .map_err(|error| ServingReadError::Custody(Box::new(error)))
+    }
     /// Closing is sticky. Cancellation cannot reopen acquisition while workers
     /// or a retained original release command remain owned by this service.
     pub async fn close_and_drain(&self) {
diff --git a/crates/canopy-server/src/packs/publication/staging_service/restore.rs b/crates/canopy-server/src/packs/publication/staging_service/restore.rs
index ed8dadc5..8f147f65 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/restore.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/restore.rs
@@ -22,6 +22,9 @@ impl ReadyStaging {
             // Bind has no requested renewal duration. This synthetic value is
             // admission metadata only, never execution bytes or a lease clock.
             CustodyAction::BindStaging(check) => context(check, DEFAULT_LEASE_MS),
+            CustodyAction::AcquireServing(_) | CustodyAction::RenewServing { .. } => {
+                return Err(StagingError::Context);
+            }
         };
         if request.operation != operation
             || crate::repository_target(target.tenant(), target.application(), request.repository)
@@ -146,7 +149,8 @@ pub(super) async fn accept(inner: &Inner, job: &Job, value: Committed<CustodyRep
                 }
             }
         }
-        CustodyReply::Staging(StagingReply::Denied(_))
+        CustodyReply::Serving(_)
+        | CustodyReply::Staging(StagingReply::Denied(_))
         | CustodyReply::Preparation(PreparationReply::Denied(_)) => {
             fence_and_drain(inner, job, StagingError::Context).await;
             false
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 282baab2..821c7ff4 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -75,6 +75,12 @@ impl CellModule for Module {
             complete_descriptor.input_limit = 4 << 20;
             let mut commands = super::registry::COMMANDS.to_vec();
             commands.extend([publish_descriptor, complete_descriptor, ref_descriptor]);
+            for id in [AcquireServingPin::ID, RenewServingPin::ID] {
+                let mut raw = descriptor(id);
+                raw.input_limit = 1024;
+                raw.output_limit = 1024;
+                commands.push(raw);
+            }
             // Raw domain receivers qualify their invariants here. Production
             // binds only the mandatory registered custody envelope.
             for (id, codec) in [
@@ -121,6 +127,8 @@ impl CellModule for Module {
     fn register(self, registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
         cellule_runtime::primitives::sql::register_sql::<RepositoryModule>(registry)?;
         super::register(registry)?;
+        registry.bind_command::<AcquireServingPin>()?;
+        registry.bind_command::<RenewServingPin>()?;
         registry.bind_command::<BeginPreparation>()?;
         registry.bind_command::<ClaimPreparation>()?;
         registry.bind_command::<RenewPreparation>()?;
diff --git a/crates/canopy-server/src/packs/publication/tests/custody.rs b/crates/canopy-server/src/packs/publication/tests/custody.rs
index cf9a89f8..193fe140 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody.rs
@@ -507,9 +507,9 @@ async fn corrupted_metadata_blocks_sdk_fallback_and_journal_queries_are_indexed(
         let plans = f.handle.query(0, 4096, |db| {
             let mut all = String::new();
             for sql in [
-                "EXPLAIN QUERY PLAN SELECT intent,phase FROM catalog_custody_commands WHERE operation=zeroblob(16) ORDER BY step DESC LIMIT 1",
+                "EXPLAIN QUERY PLAN SELECT intent,phase FROM catalog_custody_commands WHERE purpose=0 AND operation=zeroblob(16) ORDER BY step DESC LIMIT 1",
                 "EXPLAIN QUERY PLAN SELECT operation FROM catalog_custody_commands WHERE phase IS NULL AND stopped IS NULL LIMIT 1024",
-                "EXPLAIN QUERY PLAN SELECT intent,phase FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE operation=zeroblob(16) AND granted_incarnation=zeroblob(16) AND granted_attempt=1 ORDER BY step DESC LIMIT 1",
+                "EXPLAIN QUERY PLAN SELECT intent,phase FROM catalog_custody_commands INDEXED BY catalog_custody_grants WHERE purpose=0 AND operation=zeroblob(16) AND granted_incarnation=zeroblob(16) AND granted_attempt=1 ORDER BY step DESC LIMIT 1",
             ] {
                 let mut statement = db.prepare(sql)?;
                 let mut rows = statement.query([])?;
diff --git a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
index 4d6fdf70..8ce17155 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
@@ -382,7 +382,7 @@ async fn stop_service_reply_loss_and_panic_keep_bounded_originals_through_closed
 }
 
 async fn junk(f: &Fixture, count: usize) -> Result {
-    edit(f, &format!("WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<{count}) INSERT INTO catalog_custody_commands(operation,step,incarnation,request_id,intent) SELECT CAST(printf('%016d',x) AS BLOB),0,zeroblob(16),CAST(printf('%016d',x) AS BLOB),x'01' FROM n")).await?;
+    edit(f, &format!("WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<{count}) INSERT INTO catalog_custody_commands(purpose,operation,step,incarnation,request_id,intent) SELECT 0, CAST(printf('%016d',x) AS BLOB),0,zeroblob(16),CAST(printf('%016d',x) AS BLOB),x'01' FROM n")).await?;
     Ok(())
 }
 
@@ -424,8 +424,8 @@ async fn custody_scan_uses_bounded_indexed_pages_and_revisits_corruption_without
     let (evidence, _) = head_expiring(&f, 0, false, true).await?;
     expired(&evidence).await?;
     f.handle.query(0,4096,|db| {
-        let mut query = db.prepare("EXPLAIN QUERY PLAN SELECT operation FROM catalog_custody_commands INDEXED BY catalog_custody_pending WHERE phase IS NULL AND stopped IS NULL AND operation>?1 ORDER BY operation LIMIT ?2")?;
-        let details: Vec<String> = query.query_map(rusqlite::params![vec![0u8;16],17], |r| r.get(3))?.collect::<std::result::Result<_,_>>()?;
+        let mut query = db.prepare("EXPLAIN QUERY PLAN SELECT purpose,operation FROM catalog_custody_commands INDEXED BY catalog_custody_pending WHERE phase IS NULL AND stopped IS NULL AND (purpose,operation)>(?1,?2) ORDER BY purpose,operation LIMIT ?3")?;
+        let details: Vec<String> = query.query_map(rusqlite::params![0,vec![0u8;16],17], |r| r.get(3))?.collect::<std::result::Result<_,_>>()?;
         assert!(details.iter().any(|v|v.contains("SEARCH") && v.contains("catalog_custody_pending")),"{details:?}");
         assert!(details.iter().all(|v|!v.contains("TEMP B-TREE")),"{details:?}");
         Ok(Vec::new())
diff --git a/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs b/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
index 716cac9c..dd246cb5 100644
--- a/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs
@@ -345,7 +345,7 @@ async fn resident_scanners_pause_independently_and_resume_live_indexed_discovery
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let f = Fixture::new(format).await?;
         edit(&f, "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<30) INSERT INTO catalog_leases(incarnation,admission_sequence,operation,owner_epoch,artifact_operation,expires_at_ms,recovery) SELECT zeroblob(16),x,zeroblob(16),x'0000000000000001',randomblob(16),0,x'01' FROM n").await?;
-        edit(&f, "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<30) INSERT INTO catalog_custody_commands(operation,step,incarnation,request_id,intent) SELECT CAST(printf('%016d',x) AS BLOB),0,zeroblob(16),CAST(printf('%016d',x) AS BLOB),x'01' FROM n").await?;
+        edit(&f, "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<30) INSERT INTO catalog_custody_commands(purpose,operation,step,incarnation,request_id,intent) SELECT 0, CAST(printf('%016d',x) AS BLOB),0,zeroblob(16),CAST(printf('%016d',x) AS BLOB),x'01' FROM n").await?;
         let queue = PublicationCoordinator::new(
             f.target.clone(),
             PublicationLimits::default(),
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index ef5992b8..aeb3cbc6 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -7,6 +7,7 @@ use cellule_ltx::DiskBudget;
 use cellule_runtime::{Committed, PreparedCommand};
 use tokio::time::{Duration, timeout};
 use tokio_util::task::TaskTracker;
+mod custody;
 
 async fn initialize(f: &Fixture, store: Arc<ArtifactStore>) -> Result<GenerationFact> {
     let (prepared, root, budget) = Box::pin(empty(f, [241; 16], store.clone())).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/custody.rs b/crates/canopy-server/src/packs/publication/tests/serving/custody.rs
new file mode 100644
index 00000000..e63ee2bf
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/custody.rs
@@ -0,0 +1,618 @@
+//! Serving uses the same exact intent protocol without gaining write custody.
+use super::*;
+use cellule_runtime::{PendingMutation, Resolution};
+
+fn queue(f: &Fixture) -> Result<PublicationCoordinator> {
+    Ok(PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?)
+}
+async fn ready(f: &Fixture, reader: u8, actor: &str) -> Result<ReadyServingCommand> {
+    let mut request = f.begin([reader; 16]);
+    request.actor = actor.into();
+    Ok(ReadyServingCommand::acquire(
+        f.client(),
+        f.target.clone(),
+        request,
+        identity()?,
+        f.authority(),
+    )
+    .await?)
+}
+async fn result(ticket: &PublicationTicket) -> Result<Committed<ServingReply>> {
+    match timeout(Duration::from_secs(10), ticket.wait()).await? {
+        PublicationState::Finished(Ok(PublicationOutcome::ServingCommand(value))) => Ok(value),
+        other => Err(format!("serving command: {other:?}").into()),
+    }
+}
+async fn saved(f: &Fixture, reader: u8) -> Result<RegisteredCustody> {
+    Ok(RegisteredCustody::load_for(
+        &f.client(),
+        &f.target,
+        CustodyPurpose::Serving,
+        [reader; 16],
+    )
+    .await?
+    .ok_or("serving intent missing")?)
+}
+async fn expired(evidence: &PendingMutation) -> Result {
+    let now = sql::now(0)?;
+    if now <= evidence.identity().expires_at_ms {
+        tokio::time::sleep(Duration::from_millis(u64::try_from(
+            evidence.identity().expires_at_ms - now + 1,
+        )?))
+        .await;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn readonly_serving_and_creating_same_id_keep_distinct_originals_and_no_namespace() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let fact = initialize(&f, store.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let creating = PreparedCustody::prepare(
+            &f.client(),
+            &f.target,
+            CustodyAction::BeginPreparation(f.begin([220; 16])),
+            identity()?,
+        )
+        .await?
+        .register(&f.client(), identity()?)
+        .await?;
+        let before = f.counts().await?;
+        let q = queue(&f)?;
+        let serving = ready(&f, 220, "viewer").await?;
+        let evidence = serving.evidence().clone();
+        assert_ne!(&evidence, creating.evidence());
+        let committed = result(&q.submit(serving).await?).await?;
+        let lease = granted(committed.output.clone())?;
+        assert_eq!(lease.fact, fact);
+        assert_eq!(
+            lease.token.admission_sequence,
+            committed.receipt.commit_sequence
+        );
+        assert_eq!(f.counts().await?, before);
+        assert_eq!(pin_count(&f).await?, 1);
+        assert_eq!(saved(&f, 220).await?.evidence(), &evidence);
+        assert_eq!(
+            saved(&f, 220).await?.recover_serving(&f.client()).await?,
+            committed
+        );
+        assert_eq!(
+            RegisteredCustody::load_latest(&f.client(), &f.target, [220; 16])
+                .await?
+                .ok_or("creating intent lost")?
+                .evidence(),
+            creating.evidence()
+        );
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pin = ServingPin::open(
+            context(&f, store, &root, tasks.clone())?,
+            lease.token,
+            Some("viewer".into()),
+        )
+        .await?;
+        assert_eq!(
+            release(&f, &pin).await?.output,
+            ServingReleaseReply::Released
+        );
+        // Historical knowledge is unchanged by physical release.
+        assert_eq!(
+            saved(&f, 220).await?.recover_serving(&f.client()).await?,
+            committed
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn acquisition_six_transport_faults_recover_exact_original_after_observer_loss() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in 1..=6 {
+            let f = Fixture::new(format).await?;
+            let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+            initialize(&f, store.clone()).await?;
+            let before = f.counts().await?;
+            let q = queue(&f)?;
+            let original = ready(&f, 221, "owner").await?;
+            let evidence = original.evidence().clone();
+            q.fault_for_test(fault);
+            let ticket = q.submit(original).await?;
+            assert!(
+                matches!(
+                    timeout(Duration::from_secs(10), ticket.wait()).await?,
+                    PublicationState::Uncertain(_)
+                ),
+                "fault {fault}"
+            );
+            assert_eq!(pin_count(&f).await?, u64::from(matches!(fault, 2 | 3)));
+            assert_eq!(
+                q.stats().await.command_bytes,
+                crate::packs::publication::custody::RESERVATION
+            );
+            assert_eq!(q.stats().await.foreground, 1);
+            drop(ticket);
+            let ticket = q
+                .pending_serving_command([221; 16])
+                .await
+                .ok_or("original lost")?;
+            assert_eq!(q.close_and_drain().await.len(), 1);
+            ticket.recover().await?;
+            let committed = result(&ticket).await?;
+            let lease = granted(committed.output.clone())?;
+            let saved = saved(&f, 221).await?;
+            assert_eq!(saved.evidence(), &evidence);
+            assert_eq!(saved.recover_serving(&f.client()).await?, committed);
+            assert_eq!(pin_count(&f).await?, 1);
+            assert_eq!(f.counts().await?, before);
+            assert_eq!(q.stats().await.command_bytes, 0);
+            let root = tempfile::TempDir::new()?;
+            let tasks = TaskTracker::new();
+            let pin = ServingPin::open(
+                context(&f, store, &root, tasks.clone())?,
+                lease.token,
+                Some("owner".into()),
+            )
+            .await?;
+            release(&f, &pin).await?;
+            assert!(q.close_and_drain().await.is_empty());
+            tasks.close();
+            tasks.wait().await;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn renewal_retains_physical_drain_guard_across_all_uncertain_transports() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in 1..=6 {
+            let f = Fixture::new(format).await?;
+            let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+            initialize(&f, store.clone()).await?;
+            let q = queue(&f)?;
+            let lease = granted(
+                result(&q.submit(ready(&f, 222, "owner").await?).await?)
+                    .await?
+                    .output,
+            )?;
+            let root = tempfile::TempDir::new()?;
+            let tasks = TaskTracker::new();
+            let pin = ServingPin::open(
+                context(&f, store, &root, tasks.clone())?,
+                lease.token,
+                Some("owner".into()),
+            )
+            .await?;
+            let renewal = pin
+                .ready_renew("owner".into(), [17; 32], identity()?, DEFAULT_LEASE_MS)
+                .await?;
+            let evidence = renewal.evidence().clone();
+            let held = q.try_reserve(renewal)?;
+            let observer = held.clone();
+            let observing = tokio::spawn(async move { observer.wait().await });
+            tokio::task::yield_now().await;
+            observing.abort();
+            assert!(observing.await.unwrap_err().is_cancelled());
+            drop(held);
+            let closing_pin = pin.clone();
+            let closing = tokio::spawn(async move { closing_pin.close_and_drain().await });
+            tokio::task::yield_now().await;
+            assert!(!closing.is_finished());
+            let held = q
+                .pending_serving_command([222; 16])
+                .await
+                .ok_or("held renewal lost")?;
+            assert_eq!(q.close_and_drain().await.len(), 1);
+            q.fault_for_test(fault);
+            held.activate().await?;
+            assert!(matches!(
+                timeout(Duration::from_secs(10), held.wait()).await?,
+                PublicationState::Uncertain(_)
+            ));
+            assert!(!closing.is_finished());
+            assert_eq!(pin_count(&f).await?, 1);
+            assert_eq!(
+                q.stats().await.command_bytes,
+                crate::packs::publication::custody::RESERVATION
+            );
+            held.recover().await?;
+            let renewed = granted(result(&held).await?.output)?;
+            assert_eq!(renewed.token, lease.token);
+            assert_eq!(renewed.fact, lease.fact);
+            assert!(renewed.expires_at_ms >= lease.expires_at_ms);
+            assert_eq!(saved(&f, 222).await?.evidence(), &evidence);
+            timeout(Duration::from_secs(5), closing).await??;
+            assert!(
+                pin.ready_renew("owner".into(), [17; 32], identity()?, 1)
+                    .await
+                    .is_err()
+            );
+            release(&f, &pin).await?;
+            assert_eq!(pin_count(&f).await?, 0);
+            assert!(q.close_and_drain().await.is_empty());
+            tasks.close();
+            tasks.wait().await;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn discarded_unexecuted_renewal_releases_guard_and_preserves_acquisition_head() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let q = queue(&f)?;
+    let acquisition = result(&q.submit(ready(&f, 223, "owner").await?).await?).await?;
+    let original = saved(&f, 223).await?.evidence().clone();
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let pin = ServingPin::open(
+        context(&f, store, &root, tasks.clone())?,
+        granted(acquisition.output)?.token,
+        Some("owner".into()),
+    )
+    .await?;
+    let renewal = pin
+        .ready_renew("owner".into(), [17; 32], identity()?, 1)
+        .await?;
+    let evidence = renewal.evidence().clone();
+    let held = q.try_reserve(renewal)?;
+    let closing_pin = pin.clone();
+    let closing = tokio::spawn(async move { closing_pin.close_and_drain().await });
+    tokio::task::yield_now().await;
+    assert!(!closing.is_finished());
+    held.discard_held().await?;
+    timeout(Duration::from_secs(5), closing).await??;
+    assert!(matches!(
+        f.client().resolve(&evidence).await?,
+        Resolution::Absent
+    ));
+    assert_eq!(saved(&f, 223).await?.evidence(), &original);
+    release(&f, &pin).await?;
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn late_serving_phase_fault_rolls_back_pin_and_sdk_acceptance_before_exact_retry() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for ignore in [false, true] {
+            let f = Fixture::new(format).await?;
+            let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+            initialize(&f, store).await?;
+            let prepared = PreparedCustody::prepare(
+                &f.client(),
+                &f.target,
+                CustodyAction::AcquireServing(f.begin([224; 16])),
+                identity()?,
+            )
+            .await?;
+            let registered = prepared.register(&f.client(), identity()?).await?;
+            let evidence = registered.evidence().clone();
+            let raised = if ignore {
+                "IGNORE"
+            } else {
+                "ABORT,'late serving phase fault'"
+            };
+            edit(&f, &format!("CREATE TRIGGER serving_phase_fault BEFORE UPDATE OF phase ON catalog_custody_commands WHEN NEW.purpose=1 BEGIN SELECT RAISE({raised}); END")).await?;
+            assert!(matches!(
+                registered.recover_serving(&f.client()).await,
+                Err(InvocationError::NotStarted(_))
+            ));
+            assert_eq!(pin_count(&f).await?, 0);
+            assert!(matches!(
+                f.client().resolve(&evidence).await?,
+                Resolution::Absent
+            ));
+            assert!(!saved(&f, 224).await?.settled());
+            edit(&f, "DROP TRIGGER serving_phase_fault").await?;
+            let committed = registered.recover_serving(&f.client()).await?;
+            assert_eq!(
+                granted(committed.output.clone())?.token.admission_sequence,
+                committed.receipt.commit_sequence
+            );
+            assert_eq!(pin_count(&f).await?, 1);
+            assert_eq!(registered.recover_serving(&f.client()).await?, committed);
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn revoked_read_is_recorded_as_original_denial_and_never_rewritten_by_restored_access()
+-> Result {
+    let f = Fixture::new(ObjectFormat::Sha1).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store).await?;
+    edit(
+        &f,
+        "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+    )
+    .await?;
+    let mut request = f.begin([225; 16]);
+    request.actor = "viewer".into();
+    let prepared = PreparedCustody::prepare(
+        &f.client(),
+        &f.target,
+        CustodyAction::AcquireServing(request),
+        identity()?,
+    )
+    .await?;
+    let registered = prepared.register(&f.client(), identity()?).await?;
+    edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+    let Err(InvocationError::Rejected(first)) = registered.recover_serving(&f.client()).await
+    else {
+        return Err("revoked read was not recorded as denied".into());
+    };
+    assert_eq!(
+        first.output,
+        ServingReply::Denied(ServingDenial::Unauthorized)
+    );
+    assert!(saved(&f, 225).await?.settled());
+    assert_eq!(pin_count(&f).await?, 0);
+    edit(
+        &f,
+        "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+    )
+    .await?;
+    let q = queue(&f)?;
+    let restored =
+        ReadyServingCommand::restore(f.client(), f.target.clone(), [225; 16], f.authority())
+            .await?;
+    assert_eq!(restored.evidence(), registered.evidence());
+    let state = timeout(Duration::from_secs(5), q.submit(restored).await?.wait()).await?;
+    assert!(matches!(state, PublicationState::Finished(Err(ref error))
+        if matches!(&**error, PublicationError::ServingCommand(InvocationError::Rejected(value)) if **value==*first)));
+    assert_eq!(pin_count(&f).await?, 0);
+    assert!(q.close_and_drain().await.is_empty());
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn cold_owner_restoration_preserves_grant_receipt_but_refuses_old_physical_authority()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let mut mutation = identity()?;
+        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+        let original = ReadyServingCommand::acquire(
+            f.client(),
+            f.target.clone(),
+            f.begin([226; 16]),
+            mutation,
+            f.authority(),
+        )
+        .await?;
+        let committed = result(&q.submit(original).await?).await?;
+        let lease = granted(committed.output.clone())?;
+        let evidence = saved(&f, 226).await?.evidence().clone();
+        assert!(q.close_and_drain().await.is_empty());
+        let (runtime, handle, client) =
+            super::super::durable_recovery::restore_owner_fence(&f, lease.token.owner).await?;
+        assert_ne!(handle.owner_fence(), lease.token.owner);
+        expired(&evidence).await?;
+        assert!(matches!(
+            client.resolve(&evidence).await?,
+            Resolution::Expired
+        ));
+        let recovered =
+            RegisteredCustody::load_for(&client, &f.target, CustodyPurpose::Serving, [226; 16])
+                .await?
+                .ok_or("durable serving history lost")?;
+        assert_eq!(recovered.evidence(), &evidence);
+        assert_eq!(recovered.recover_serving(&client).await?, committed);
+        let cold_q = queue(&f)?;
+        let restored = ReadyServingCommand::restore(
+            client.clone(),
+            f.target.clone(),
+            [226; 16],
+            f.authority(),
+        )
+        .await?;
+        assert_eq!(result(&cold_q.submit(restored).await?).await?, committed);
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let ctx = ServingContext::new(
+            client,
+            f.target.clone(),
+            f.authority(),
+            Arc::new(CatalogIndexes::new(store.clone(), format)),
+            Arc::new(CatalogFiles::new(
+                root.path(),
+                DiskBudget::new(64 << 20),
+                store,
+                format,
+                CatalogFileLimits::default(),
+            )?),
+            ServingReadBudget::new(4, tasks.clone())?,
+            "owner".into(),
+        )?;
+        assert!(matches!(
+            ServingPin::open(ctx, lease.token, Some("owner".into())).await,
+            Err(ServingReadError::Authority(PreparationBaseError::Inactive))
+        ));
+        handle
+            .query(0, 8, |db| {
+                assert_eq!(
+                    db.query_row("SELECT count(*) FROM catalog_serving_pins", [], |row| row
+                        .get::<_, u64>(
+                        0
+                    ))?,
+                    1
+                );
+                Ok(Vec::new())
+            })
+            .await?;
+        assert!(cold_q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn scanner_retires_both_purposes_with_same_id_without_removing_accepted_serving_root()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let live = granted(
+            result(&q.submit(ready(&f, 228, "owner").await?).await?)
+                .await?
+                .output,
+        )?;
+        let mut records = Vec::new();
+        for purpose in [CustodyPurpose::Creating, CustodyPurpose::Serving] {
+            let mut mutation = identity()?;
+            mutation.expires_at_ms = mutation.issued_at_ms + 200;
+            let action = if purpose == CustodyPurpose::Creating {
+                CustodyAction::BeginPreparation(f.begin([227; 16]))
+            } else {
+                CustodyAction::AcquireServing(f.begin([227; 16]))
+            };
+            let registered = PreparedCustody::prepare(&f.client(), &f.target, action, mutation)
+                .await?
+                .register(&f.client(), identity()?)
+                .await?;
+            records.push((purpose, registered));
+        }
+        for (_, record) in &records {
+            expired(record.evidence()).await?;
+        }
+        let service = CustodySupervisor::start(
+            f.client(),
+            f.target.clone(),
+            q.clone(),
+            f.scans(RecoveryScanLimits {
+                page: 1,
+                interval: Duration::from_millis(10),
+            }),
+            f.authority(),
+        )?;
+        timeout(Duration::from_secs(10), async {
+            loop {
+                let mut complete = true;
+                for (purpose, _) in &records {
+                    complete &=
+                        RegisteredCustody::load_for(&f.client(), &f.target, *purpose, [227; 16])
+                            .await?
+                            .ok_or("scope disappeared")?
+                            .stop_fact()
+                            .is_some();
+                }
+                if complete {
+                    return Ok::<_, Box<dyn std::error::Error>>(());
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await??;
+        let stats = service.shutdown().await?;
+        assert_eq!(stats.submitted, 2);
+        assert_eq!(stats.failures, 0);
+        for (purpose, original) in records {
+            let saved = RegisteredCustody::load_for(&f.client(), &f.target, purpose, [227; 16])
+                .await?
+                .ok_or("stopped scope lost")?;
+            assert_eq!(saved.evidence(), original.evidence());
+            assert!(!saved.settled());
+            assert!(saved.closed());
+            assert!(matches!(saved.recover(&f.client()).await,
+                Err(InvocationError::Pending(value)) if *value==*original.evidence()));
+        }
+        assert_eq!(pin_count(&f).await?, 1);
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pin = ServingPin::open(
+            context(&f, store, &root, tasks.clone())?,
+            live.token,
+            Some("owner".into()),
+        )
+        .await?;
+        release(&f, &pin).await?;
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn serving_journal_identity_is_immutable_and_pending_quota_is_shared() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let prepared = PreparedCustody::prepare(
+        &f.client(),
+        &f.target,
+        CustodyAction::AcquireServing(f.begin([229; 16])),
+        identity()?,
+    )
+    .await?;
+    let registered = prepared.register(&f.client(), identity()?).await?;
+    for statement in [
+        "UPDATE catalog_custody_commands SET purpose=0 WHERE purpose=1",
+        "INSERT OR REPLACE INTO catalog_custody_commands SELECT * FROM catalog_custody_commands",
+        "INSERT INTO catalog_custody_commands(purpose,operation,step,incarnation,request_id,intent) SELECT 0,operation,step,incarnation,request_id,intent FROM catalog_custody_commands",
+        "INSERT INTO catalog_custody_commands(operation,step,incarnation,request_id,intent) VALUES(zeroblob(16),0,zeroblob(16),zeroblob(16),x'01')",
+        "DELETE FROM catalog_custody_commands",
+    ] {
+        assert!(edit(&f, statement).await.is_err(), "{statement}");
+    }
+    assert_eq!(saved(&f, 229).await?.evidence(), registered.evidence());
+    assert!(
+        RegisteredCustody::load_latest(&f.client(), &f.target, [229; 16])
+            .await?
+            .is_none()
+    );
+    // Trusted invalid heads qualify the bounded quota probe, not recovery.
+    edit(&f, "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<1023) INSERT INTO catalog_custody_commands(purpose,operation,step,incarnation,request_id,intent) SELECT 0,CAST(printf('%016d',x) AS BLOB),0,zeroblob(16),CAST(printf('%016d',x) AS BLOB),x'01' FROM n").await?;
+    for action in [
+        CustodyAction::AcquireServing(f.begin([230; 16])),
+        CustodyAction::BeginPreparation(f.begin([230; 16])),
+    ] {
+        let original =
+            PreparedCustody::prepare(&f.client(), &f.target, action, identity()?).await?;
+        assert!(matches!(original.register(&f.client(), identity()?).await,
+            Err(CustodyError::Registration(error)) if matches!(&*error,
+                InvocationError::Rejected(value) if value.output==RootRecoveryReply::Denied(PreparationDenial::Capacity))));
+        assert!(matches!(
+            f.client().resolve(original.evidence()).await?,
+            Resolution::Absent
+        ));
+    }
+    assert_eq!(f.counts().await?, (0, 0));
+    assert_eq!(pin_count(&f).await?, 0);
+    f.runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index fe01e5c5..c4616741 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -32,6 +32,56 @@ preparation floor protection independently. This is SQL fact retention, not a
 completed remote artifact collector. The final typed GC/backup/restore inventory
 must include these roots and all other reader/backup/recovery owners.
 
+## Exact acquisition and renewal custody
+
+Production acquisition and renewal run through `ReadyServingCommand` and the
+existing publication coordinator. Raw commands 44/45 remain domain receivers
+for the custody envelope and test fixtures; production does not register them.
+Commands 41/42/43 use codec version 2 with fresh schema and MAC domains. There is
+no decoder, default purpose or data migration for the old journal format.
+
+Reuse the existing custody intent, SDK snapshot/body, authenticated carrier,
+ordered predecessor, recorded phase, first-writer retirement and shared bounded
+queue. The primary key is `(purpose, operation, step)`, with distinct creating
+and serving purposes. Pending/grant indexes, exact loads, stop authentication and
+scanner keysets include purpose. The same logical ID can therefore name one
+creating request and one serving reader without joining their histories or
+coordinator jobs. An SDK request identity remains globally unique in the journal.
+Historical serving grants never restart a creating namespace.
+
+Serving intent registration requires current Read rather than Write. Acquisition
+uses the existing BeginRequest identity fields for repository, reader ID, request
+digest, service account and requested lease; it allocates no artifact namespace.
+Anonymous browsers use a pin owned by an authorized service account and remain
+subject to their own fresh Read checks. The exact record is not an anonymous
+mutation or an account-authentication shortcut. Renewal keeps the acquisition's
+logical account/digest and exact token. The domain write, recorded serving result
+and SDK acceptance commit together; late errors or ignored phase writes leave
+both the pin mutation and SDK acceptance absent.
+
+The coordinator retains both original registration and execution commands across
+absent/lost replies and panics. It uses the shared foreground class with the
+custody reservation of 28 KiB; that body does not fit the 8 KiB maintenance
+reservation. Dropping an observer or closing the queue does not free retained
+uncertainty. Known results release retained ownership before returning credits.
+Fresh physical capability construction remains separate from historical receipt
+recovery, including after actual Cell owner restoration.
+
+`ServingPin::ready_renew` acquires a physical-drain guard before preparing the
+original. The ready value, held admission, dispatch and uncertain recovery share
+that same guard. Closing the pin waits until a proven unexecuted held command is
+discarded or the exact original reaches a known disposition. Cancellation of an
+observer cannot release it. The production owner must retain and activate/discard
+held tickets and drive uncertain recovery; this primitive is not a complete
+resident pin pool or automatic renewal supervisor.
+
+The existing bounded custody scanner also visits serving heads and can retire an
+expired unexecuted original. A stop records logical closure and never invents an
+execution result or releases an accepted serving pin. Reconstruction APIs select
+the serving purpose explicitly; creating staging recovery rejects serving actions
+and results. Settled history is still stored in SQL and requires the planned
+admitted immutable history frames and exact lookup to bound long-term growth.
+
 ## Capability construction and admitted reads
 
 `ServingContext` is explicit trusted configuration: real CellClient/target,
@@ -100,14 +150,17 @@ A new owner cannot renew/release old-owner pins merely because its epoch is newe
 They remain roots until actual physical fencing/drain and an authenticated
 adoption/release protocol is implemented. Conservatively retaining abandoned
 roots preserves correctness but does not establish operational quota recovery.
-Process-loss acquisition/renewal discovery is still missing. Do not compensate
-with automatic expiry deletion or a synthetic owner fence.
+Exact acquisition/renewal command reconstruction is implemented below. Automatic
+production handoff, physical fencing/adoption and abandoned-root quota recovery
+remain required. Do not compensate with automatic expiry deletion or a synthetic
+owner fence.
 
 ## Production integration and qualification gates
 
-The next serving layer must own exact acquisition and renewal commands, preserve
-outcomes across cancellation/process loss, and hand off retained capabilities
-before observers can detach. Cache/coalesce a bounded set of active generation
+The next serving layer must integrate these exact acquisition and renewal
+commands into a resident producer and hand off retained capabilities before
+observers can detach. Command reconstruction alone does not establish this
+physical ownership handoff. Cache/coalesce a bounded set of active generation
 owners per repository rather than allocating a pin per browser/SDE. Carry that
 ownership through native work, object bodies and response streams; integrate
 its drain into actual eviction and shutdown. A close must join all producers and
@@ -117,7 +170,11 @@ Regression families exercise Read/public access, joint initialization, original
 acquisition replay after release, token scope, revocation, expiry, monotone
 renewal, generation reaping, schema quota/identity guards, blocked real provider
 I/O, observer cancellation, actual owner restoration, bounded codecs/MAC domains,
-and exact release absence/lost acknowledgement/panic. Initialization retention is
+and exact release absence/lost acknowledgement/panic. Registered acquisition and
+renewal families exercise all six registrar/execution transport fault modes,
+held/canceled observation, closed recovery, late/ignored atomic rollback,
+recorded revocation, cold owner restoration after SDK expiry, both-purpose
+page-one scanning, shared pending quota and v2-only bounded codecs. Initialization retention is
 retired through its actual registered terminal release so an unrelated floor
 cannot conceal a serving-retention bug. Trusted generation/quota SQL fixtures
 qualify receiver invariants, not native publication or team capacity.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 2e79218d..02c9108c 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -55,6 +55,63 @@ maintenance, signed completion/cold clone, file attribution and full-history plu
 10,000-developer capacity qualification remain mandatory. This branch remains
 local, unpublished and unreleasable.
 
+## Durable serving command checkpoint
+
+Serving acquisition and renewal now use the existing durable custody journal and
+publication queue through `ReadyServingCommand`. Raw 44/45 receivers are excluded
+from production registration. Fresh command codecs 41/42/43 and authenticated
+intent/stop domains use version 2; the journal key, indexed discovery and MACs
+bind creating versus serving purpose. Registration requires Read for serving,
+while acquisition allocates no creating namespace. The original logical account
+and request digest persist through renewal. Exact known serving grants and
+denials remain immutable knowledge rather than fresh physical read authority.
+
+Renewal retains a shared physical-drain guard through factory ownership, held
+admission, dispatch and uncertainty. The queue reuses its foreground/account/node
+budgets with the existing 28 KiB custody reservation; release/stop keep their
+reserved maintenance class. Separate job kinds prevent collisions among serving
+commands, serving stops, releases and creating requests with the same real ID.
+The existing scanner visits both purposes and stops expired unexecuted originals
+without deleting accepted serving roots. The [serving contract](design/certified-serving-pins.md)
+details protocol bounds and the still-missing resident ownership handoff.
+
+Final-source macOS/Rust 1.98.0 qualification executes 640 unique workspace
+library cases: **635 pass and five fail**, with exit 101 retained. All 346
+publication, seven startup and four production resident-recovery cases pass;
+two nested subprocess summaries are excluded. The ten new serving integration
+and codec families are included in that total. Nine additional workspace and
+lifecycle cases pass in 3.60 seconds, including canceled prebound startup.
+Combined: 649 unique executed, 644 pass and five fail. The failure set remains
+exactly the five legacy `objects` readers awaiting certified-root conversion.
+
+The new families cover both formats, all six registration/execution transport
+fault modes, canceled and closed observation, held discard, atomic late/ignored
+phase rollback, recorded revocation, actual cold owner restoration after SDK
+expiry, same-ID purpose separation, page-one scanner traversal, immutable
+identity/shared pending quota, framing, role mismatch and v2-only decoding. The
+first eight-family run passed in 3.32 seconds. Preliminary enum-size, moved-test-
+guard and invalid UUID fixture diagnostics remain under the draft/pre-UUID log
+prefixes; they are not passing qualification. No compatibility fallback or lint
+suppression was introduced.
+
+Warnings-denied workspace/all-target Clippy passes in 25.42 seconds, the server
+build in 29.78 seconds and formatting in 1.07 seconds. Static/diff checks verify
+461 frozen source/schema/manifest files including 448 Rust files, 152 local doc
+links, the five SDK manifest/six lock pins, a clean SDK and unchanged protected
+original index/archive. Proof and final-source logs use the
+`/tmp/canopy-serving-custody-*` prefix. The qualification driver terminates with
+zero only after explicitly recording the failed library run and passing the
+remaining checks; this is not a green workspace test result.
+
+Production resident acquisition/renewal ownership and bounded generation pooling,
+physical handoff before detached observers, all object/ref/graph/native/stream
+consumer conversion, old-owner physical fencing/adoption/quota recovery and
+admitted immutable custody history with exact lookup remain immediate priorities.
+All full producer/final-DDL, typed GC/backup/isolated restore, OS containment,
+native acceleration/physical rewrite/fair maintenance, signed completion/cold
+clone, file attribution and full-history/10,000-SDE capacity gates remain open.
+This local branch remains unpublished and unreleasable.
+
 ## Certified serving pin foundation
 
 The [serving contract](design/certified-serving-pins.md) describes the new atomic

From dab8bd0a8ef4c7a42ee304e6863f470d4af93cbc Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 08:43:57 -0700
Subject: [PATCH 18/55] Observe current serving roots and drain exact pins
 before closure

---
 crates/canopy-server/src/lib.rs               |   3 +
 .../src/packs/publication/coordinator.rs      |  44 +-
 .../publication/coordinator/serving_drain.rs  | 136 ++++
 .../src/packs/publication/coordinator/work.rs |   7 +
 .../src/packs/publication/mod.rs              |   9 +-
 .../src/packs/publication/registry.rs         |   5 +-
 .../src/packs/publication/serving.rs          |  10 +-
 .../src/packs/publication/serving/codec.rs    |  16 +
 .../publication/serving/command_owner.rs      |   8 +-
 .../src/packs/publication/serving/commands.rs |  35 +
 .../src/packs/publication/serving/session.rs  |   4 +
 .../src/packs/publication/tests/serving.rs    |   1 +
 .../tests/serving/selection_drain.rs          | 624 ++++++++++++++++++
 docs/design/certified-serving-pins.md         |  26 +
 .../large-repository-implementation-status.md |  41 ++
 15 files changed, 955 insertions(+), 14 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/coordinator/serving_drain.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/selection_drain.rs

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 45c133ae..bbee706e 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -270,6 +270,9 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/custody/dispatch.rs"));
                 source.update(include_bytes!("packs/publication/preparation_receipt.rs"));
                 source.update(include_bytes!("packs/publication/coordinator.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/coordinator/serving_drain.rs"
+                ));
                 source.update(include_bytes!("packs/publication/coordinator/budget.rs"));
                 source.update(include_bytes!("packs/publication/scan.rs"));
                 source.update(include_bytes!("packs/publication/custody/scan.rs"));
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index 34162bb1..2bf52518 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -33,9 +33,11 @@ pub use roots::{ReadyRootPush, RootPushReadyError};
 mod recovery;
 pub use recovery::{ReadyBoundRecovery, RecoveryBindingFailure};
 mod preparation;
+mod serving_drain;
 pub use preparation::{
     PreparationCommandKind, PreparationCommandOutcome, PreparationReadyError, ReadyPreparation,
 };
+pub use serving_drain::ServingDrainAdmission;
 mod budget;
 pub use budget::{PublicationBudget, PublicationBudgetStats};
 mod work;
@@ -363,6 +365,7 @@ struct Inner {
     state: Mutex<State>,
     drained: Notify,
     changed: Notify,
+    serving_drain: std::sync::Mutex<Option<serving_drain::Gate>>,
     #[cfg(test)]
     gate: Mutex<Option<TestGate>>,
     #[cfg(test)]
@@ -421,6 +424,7 @@ impl PublicationCoordinator {
                 state: Mutex::new(State::default()),
                 drained: Notify::new(),
                 changed: Notify::new(),
+                serving_drain: std::sync::Mutex::new(None),
                 #[cfg(test)]
                 gate: Mutex::new(None),
                 #[cfg(test)]
@@ -482,7 +486,7 @@ impl PublicationCoordinator {
         };
         let reason = if target != &self.inner.target {
             Some(PublicationScheduleError::Foreign)
-        } else if state.closed {
+        } else if state.closed || !self.inner.drain_allows(&ready) {
             Some(PublicationScheduleError::Closed)
         } else if state.jobs.contains_key(&(request.operation, kind)) {
             Some(PublicationScheduleError::Duplicate)
@@ -646,6 +650,20 @@ impl PublicationCoordinator {
             wake.as_mut().enable();
             {
                 let mut state = self.inner.state.lock().await;
+                // An eviction owner must submit its remaining exact releases
+                // before global closure. Do not strand that owner's admission.
+                if !state.closed
+                    && self
+                        .inner
+                        .serving_drain
+                        .lock()
+                        .expect("serving drain admission")
+                        .is_some()
+                {
+                    drop(state);
+                    wake.await;
+                    continue;
+                }
                 state.closed = true;
                 if !state.worker {
                     return state
@@ -665,7 +683,15 @@ impl PublicationCoordinator {
     /// their admission and may resume discovery without replacing commands.
     pub(crate) async fn close_if_idle(&self) -> bool {
         let mut state = self.inner.state.lock().await;
-        if state.worker || !state.jobs.is_empty() {
+        if state.worker
+            || !state.jobs.is_empty()
+            || self
+                .inner
+                .serving_drain
+                .lock()
+                .expect("serving drain admission")
+                .is_some()
+        {
             return false;
         }
         state.closed = true;
@@ -1077,9 +1103,21 @@ async fn finish(inner: &Inner, job: &Job, outcome: DispatchResult) {
             .send_replace(PublicationState::Uncertain(Arc::new(outcome.unwrap_err())));
     } else {
         // Drop large resources before making their admission reusable.
-        job.ready.lock().await.take();
+        let retained = job.ready.lock().await.take();
+        let released = if matches!(&outcome, Ok(PublicationOutcome::ServingRelease(value)) if value.output == ServingReleaseReply::Released)
+        {
+            retained
+                .as_ref()
+                .and_then(ReadyPublication::serving_release_token)
+        } else {
+            None
+        };
+        drop(retained);
         let mut state = inner.state.lock().await;
         release(&mut state, job);
+        if let Some(token) = released {
+            inner.observe_serving_release(token);
+        }
         // A retired original may itself occupy a foreground uncertainty slot.
         // Resume only that exact preparation evidence, never unrelated work.
         if let Ok(PublicationOutcome::CustodyStop(value)) = &outcome
diff --git a/crates/canopy-server/src/packs/publication/coordinator/serving_drain.rs b/crates/canopy-server/src/packs/publication/coordinator/serving_drain.rs
new file mode 100644
index 00000000..3106ee0b
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/coordinator/serving_drain.rs
@@ -0,0 +1,136 @@
+//! An eviction owner excludes new work while releasing its exact read pins.
+use super::*;
+
+pub(super) struct Gate {
+    owner: Arc<()>,
+    readers: Box<[ServingToken]>,
+    remaining: Vec<ServingToken>,
+}
+
+/// This controls scheduling only. Every release still needs its private drained
+/// capability, current Admin/owner and exact receiver checks.
+#[must_use]
+pub struct ServingDrainAdmission {
+    inner: Arc<Inner>,
+    owner: Arc<()>,
+}
+impl Drop for ServingDrainAdmission {
+    fn drop(&mut self) {
+        let mut gate = self
+            .inner
+            .serving_drain
+            .lock()
+            .expect("serving drain admission");
+        if gate
+            .as_ref()
+            .is_some_and(|gate| Arc::ptr_eq(&gate.owner, &self.owner))
+        {
+            gate.take();
+        }
+        drop(gate);
+        self.inner.drained.notify_waiters();
+        // Never change State.closed or abandon any accepted command here.
+    }
+}
+impl Inner {
+    pub(super) fn drain_allows(&self, ready: &ReadyPublication) -> bool {
+        self.serving_drain
+            .lock()
+            .expect("serving drain admission")
+            .as_ref()
+            .is_none_or(|gate| {
+                ready
+                    .serving_release_token()
+                    .is_some_and(|token| gate.readers.contains(&token))
+            })
+    }
+}
+impl PublicationCoordinator {
+    /// Pause serving producers/borrows first and keep them paused until this
+    /// guard is dropped or the coordinator is closed. Busy admission is refused
+    /// without changing any existing command or closing the queue.
+    pub async fn reserve_serving_drain(
+        &self,
+        readers: &[ServingToken],
+    ) -> Result<Option<ServingDrainAdmission>, PublicationScheduleError> {
+        if readers.len() > 16
+            || readers.iter().any(|token| token.validate().is_err())
+            || readers
+                .iter()
+                .enumerate()
+                .any(|(i, id)| readers[..i].contains(id))
+        {
+            return Err(PublicationScheduleError::InvalidLimits);
+        }
+        for token in readers {
+            if crate::repository_target(
+                self.inner.target.tenant(),
+                self.inner.target.application(),
+                token.repository,
+            )
+            .map_err(|_| PublicationScheduleError::Foreign)?
+                != self.inner.target
+            {
+                return Err(PublicationScheduleError::Foreign);
+            }
+        }
+        let state = self.inner.state.lock().await;
+        let mut gate = self
+            .inner
+            .serving_drain
+            .lock()
+            .expect("serving drain admission");
+        if state.closed || state.worker || !state.jobs.is_empty() || gate.is_some() {
+            return Ok(None);
+        }
+        let owner = Arc::new(());
+        *gate = Some(Gate {
+            owner: owner.clone(),
+            readers: readers.into(),
+            remaining: readers.to_vec(),
+        });
+        Ok(Some(ServingDrainAdmission {
+            inner: self.inner.clone(),
+            owner,
+        }))
+    }
+}
+
+impl Inner {
+    pub(super) fn observe_serving_release(&self, token: ServingToken) {
+        if let Some(gate) = self
+            .serving_drain
+            .lock()
+            .expect("serving drain admission")
+            .as_mut()
+        {
+            gate.remaining.retain(|pending| *pending != token);
+        }
+    }
+}
+impl ServingDrainAdmission {
+    /// Close only after every selected exact root has an observed successful
+    /// release and all admitted work has finished. A denial or uncertainty is
+    /// never a completed release. Failure leaves the guard and queue unchanged.
+    pub async fn close_if_drained(&self) -> bool {
+        let mut state = self.inner.state.lock().await;
+        let gate = self
+            .inner
+            .serving_drain
+            .lock()
+            .expect("serving drain admission");
+        if !gate
+            .as_ref()
+            .is_some_and(|gate| Arc::ptr_eq(&gate.owner, &self.owner) && gate.remaining.is_empty())
+            || state.worker
+            || !state.jobs.is_empty()
+        {
+            return false;
+        }
+        state.closed = true;
+        drop(gate);
+        drop(state);
+        self.inner.drained.notify_waiters();
+        true
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index ede4582d..7bc2b5fd 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -130,6 +130,13 @@ impl From<ReadyPreparation> for ReadyPublication {
     }
 }
 impl ReadyPublication {
+    pub(super) fn serving_release_token(&self) -> Option<ServingToken> {
+        match self {
+            Self::ServingRelease(ready) => Some(ready.token()),
+            _ => None,
+        }
+    }
+
     pub(super) fn job_kind(&self) -> JobKind {
         match self {
             Self::CustodyStop(ready) if ready.purpose() == CustodyPurpose::Serving => {
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 09706118..657138c1 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -18,9 +18,9 @@ mod serving;
 pub use serving::{
     AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_SERVING_OWNERS,
     MAX_SERVING_PINS, ReadyServingCommand, ReadyServingRelease, ReleaseServingPin, RenewServingPin,
-    RenewServingRequest, ServingCheck, ServingContext, ServingDenial, ServingDrainProof,
-    ServingLease, ServingPin, ServingReadBudget, ServingReadError, ServingReleaseReply,
-    ServingReply, ServingToken,
+    RenewServingRequest, SelectServingGeneration, ServingCheck, ServingContext, ServingDenial,
+    ServingDrainProof, ServingLease, ServingPin, ServingReadBudget, ServingReadError,
+    ServingReleaseReply, ServingReply, ServingSelection, ServingToken,
 };
 mod owner;
 pub(crate) mod registry;
@@ -76,7 +76,7 @@ pub use coordinator::{
     PublicationTicket, ReadyBoundRecovery, ReadyCatalogCompaction, ReadyCatalogPush,
     ReadyInitialization, ReadyNativeInputs, ReadyPreparation, ReadyPublication, ReadyRefPolicyPage,
     ReadyRootPush, RecoveryBindingFailure, RefPolicyReadyError, RefPolicyRefusalFailure,
-    RegisteredNativeInputs, RootPushReadyError,
+    RegisteredNativeInputs, RootPushReadyError, ServingDrainAdmission,
 };
 pub use scan::{RecoveryScanBudget, RecoveryScanSettings};
 mod commands;
@@ -245,6 +245,7 @@ pub struct MaintenanceRequest {
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_command::<ReleaseServingPin>()?;
     registry.bind_query::<CheckServingPin>()?;
+    registry.bind_query::<SelectServingGeneration>()?;
     registry.bind_command::<RegisterCustodyIntent>()?;
     registry.bind_command::<ExecuteCustody>()?;
     registry.bind_command::<StopCustodyIntent>()?;
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 54178310..eaadd40c 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -42,7 +42,7 @@ pub(crate) const COMMANDS: [OperationDescriptor; 17] = [
     command::<StopCustodyIntent>(1024, 128),
     command::<ReleaseServingPin>(1024, 128),
 ];
-pub(crate) const QUERIES: [OperationDescriptor; 10] = [
+pub(crate) const QUERIES: [OperationDescriptor; 11] = [
     crate::operation(2),
     query::<CheckPreparation>(4096, 4096),
     query::<CheckPreparationFrontier>(4096, 4096),
@@ -53,6 +53,7 @@ pub(crate) const QUERIES: [OperationDescriptor; 10] = [
     query::<CheckRefPolicyGuard>(4096, 128),
     query::<CheckCompletedRootPush>(4096, 512),
     query::<CheckServingPin>(1024, 1024),
+    query::<SelectServingGeneration>(1024, 512),
 ];
 
 #[cfg(test)]
@@ -92,7 +93,7 @@ mod tests {
                 .iter()
                 .map(|operation| operation.id)
                 .collect::<Vec<_>>(),
-            vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47]
+            vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48]
         );
         for (id, codec, input, output) in [
             (
diff --git a/crates/canopy-server/src/packs/publication/serving.rs b/crates/canopy-server/src/packs/publication/serving.rs
index e842b196..5b1b43c9 100644
--- a/crates/canopy-server/src/packs/publication/serving.rs
+++ b/crates/canopy-server/src/packs/publication/serving.rs
@@ -9,7 +9,9 @@ pub use command_owner::ReadyServingCommand;
 mod ownership;
 pub use ownership::MAX_SERVING_OWNERS;
 mod session;
-pub use commands::{AcquireServingPin, CheckServingPin, ReleaseServingPin, RenewServingPin};
+pub use commands::{
+    AcquireServingPin, CheckServingPin, ReleaseServingPin, RenewServingPin, SelectServingGeneration,
+};
 pub use session::{
     ReadyServingRelease, ServingContext, ServingPin, ServingReadBudget, ServingReadError,
 };
@@ -30,6 +32,12 @@ pub struct AcquireServingRequest {
     pub actor: Option<String>,
     pub lease_ms: u64,
 }
+/// Observe a current joint root. This neither retains it nor grants artifact I/O.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ServingSelection {
+    pub repository: [u8; 16],
+    pub actor: Option<String>,
+}
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct ServingCheck {
     pub token: ServingToken,
diff --git a/crates/canopy-server/src/packs/publication/serving/codec.rs b/crates/canopy-server/src/packs/publication/serving/codec.rs
index 21d84879..848ae8c8 100644
--- a/crates/canopy-server/src/packs/publication/serving/codec.rs
+++ b/crates/canopy-server/src/packs/publication/serving/codec.rs
@@ -80,6 +80,22 @@ impl WireValue for AcquireServingRequest {
         Ok(value)
     }
 }
+impl WireValue for ServingSelection {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        crate::validate_repository_id(self.repository).map_err(|_| invalid())?;
+        actor(&self.actor)?;
+        e.write_bytes(&self.repository)?;
+        self.actor.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            repository: fixed(d)?,
+            actor: Option::<String>::decode(d)?,
+        };
+        value.encode(&mut BoundedEncoder::new(1024)?)?;
+        Ok(value)
+    }
+}
 impl WireValue for ServingCheck {
     fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
         actor(&self.actor)?;
diff --git a/crates/canopy-server/src/packs/publication/serving/command_owner.rs b/crates/canopy-server/src/packs/publication/serving/command_owner.rs
index c311aa00..331bc806 100644
--- a/crates/canopy-server/src/packs/publication/serving/command_owner.rs
+++ b/crates/canopy-server/src/packs/publication/serving/command_owner.rs
@@ -8,7 +8,7 @@ pub struct ReadyServingCommand {
     client: CellClient,
     target: CellTarget,
     request: BeginRequest,
-    original: OwnedCustody,
+    original: Arc<OwnedCustody>,
     // Renewal is owned physical work from preparation until known disposition.
     _guard: Option<Arc<super::session::Active>>,
 }
@@ -38,7 +38,7 @@ impl ReadyServingCommand {
             client,
             target,
             request,
-            original,
+            original: Arc::new(original),
             _guard: None,
         })
     }
@@ -60,7 +60,7 @@ impl ReadyServingCommand {
             client,
             target,
             request: context,
-            original,
+            original: Arc::new(original),
             _guard: Some(guard),
         })
     }
@@ -82,7 +82,7 @@ impl ReadyServingCommand {
             client,
             target,
             request,
-            original,
+            original: Arc::new(original),
             _guard: None,
         })
     }
diff --git a/crates/canopy-server/src/packs/publication/serving/commands.rs b/crates/canopy-server/src/packs/publication/serving/commands.rs
index 58f5ad4a..a3f245d7 100644
--- a/crates/canopy-server/src/packs/publication/serving/commands.rs
+++ b/crates/canopy-server/src/packs/publication/serving/commands.rs
@@ -222,6 +222,41 @@ impl Query for CheckServingPin {
         Ok(Some(grant(token, fact, format, now, expires)?))
     }
 }
+pub struct SelectServingGeneration;
+impl Query for SelectServingGeneration {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 48;
+    const CODEC_VERSION: u32 = 1;
+    type Input = ServingSelection;
+    type Output = Option<GenerationFact>;
+    fn execute(
+        context: &mut QueryContext<'_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<Self::Output> {
+        input.encode(&mut BoundedEncoder::new(1024)?)?;
+        if rows(&context.sql(&access(&input.actor)?)?)?.is_empty() {
+            return Ok(None);
+        }
+        let Some(format) = identity(
+            &context.sql(&statement(IDENTITY, vec![]))?,
+            input.repository,
+        )?
+        else {
+            return Ok(None);
+        };
+        // Both immutable roots come from one indexed head observation. A caller
+        // must acquire/check its own exact serving retention before artifact I/O.
+        let fact = generation(
+            &context.sql(&statement(CURRENT, vec![]))?,
+            input.repository,
+            format,
+        )?;
+        if fact.generation == 0 || fact.catalog.is_none() || fact.refs.is_none() {
+            return Ok(None);
+        }
+        Ok(Some(fact))
+    }
+}
 pub struct ReleaseServingPin;
 impl Command for ReleaseServingPin {
     const MODULE: &'static str = RepositoryModule::NAME;
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index a3938daa..1d539526 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -443,6 +443,10 @@ pub struct ReadyServingRelease {
     digest: [u8; 32],
 }
 impl ReadyServingRelease {
+    pub(in crate::packs::publication) fn token(&self) -> ServingToken {
+        self.inner.lease.token
+    }
+
     pub fn evidence(&self) -> &cellule_runtime::PendingMutation {
         self.command.evidence()
     }
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index aeb3cbc6..5a73fc28 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -8,6 +8,7 @@ use cellule_runtime::{Committed, PreparedCommand};
 use tokio::time::{Duration, timeout};
 use tokio_util::task::TaskTracker;
 mod custody;
+mod selection_drain;
 
 async fn initialize(f: &Fixture, store: Arc<ArtifactStore>) -> Result<GenerationFact> {
     let (prepared, root, budget) = Box::pin(empty(f, [241; 16], store.clone())).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/selection_drain.rs b/crates/canopy-server/src/packs/publication/tests/serving/selection_drain.rs
new file mode 100644
index 00000000..d382da6d
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/selection_drain.rs
@@ -0,0 +1,624 @@
+//! Indexed current-root observation and exact eviction admission, with real receipts.
+use super::*;
+use cellule_runtime::Resolution;
+
+async fn selection(f: &Fixture, actor: Option<&str>) -> Result<Option<GenerationFact>> {
+    Ok(f.client()
+        .query::<SelectServingGeneration>(
+            &f.target,
+            None,
+            ServingSelection {
+                repository: f.repository,
+                actor: actor.map(str::to_owned),
+            },
+        )
+        .await?
+        .output)
+}
+fn queue(f: &Fixture) -> Result<PublicationCoordinator> {
+    Ok(PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?)
+}
+async fn pin(
+    f: &Fixture,
+    store: Arc<ArtifactStore>,
+    root: &tempfile::TempDir,
+    tasks: TaskTracker,
+    reader: u8,
+) -> Result<ServingPin> {
+    let (lease, _, _) = acquire(f, Some("owner"), reader, DEFAULT_LEASE_MS).await?;
+    Ok(ServingPin::open(
+        context(f, store, root, tasks)?,
+        lease.token,
+        Some("owner".into()),
+    )
+    .await?)
+}
+async fn acquisition(f: &Fixture, operation: u8) -> Result<ReadyServingCommand> {
+    Ok(ReadyServingCommand::acquire(
+        f.client(),
+        f.target.clone(),
+        f.begin([operation; 16]),
+        identity()?,
+        f.authority(),
+    )
+    .await?)
+}
+async fn close_drained(gate: &ServingDrainAdmission) -> Result {
+    timeout(Duration::from_secs(5), async {
+        while !gate.close_if_drained().await {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await?;
+    Ok(())
+}
+async fn release_result(ticket: &PublicationTicket) -> Result<Committed<ServingReleaseReply>> {
+    match timeout(Duration::from_secs(5), ticket.wait()).await? {
+        PublicationState::Finished(Ok(PublicationOutcome::ServingRelease(value))) => Ok(value),
+        state => Err(format!("release state {state:?}").into()),
+    }
+}
+
+#[tokio::test]
+async fn selection_requires_current_read_joint_initialization_and_exact_repository_identity()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        assert!(selection(&f, Some("owner")).await?.is_none());
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let fact = initialize(&f, store).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let before = f.counts().await?;
+        assert_eq!(selection(&f, Some("viewer")).await?, Some(fact));
+        assert_eq!(selection(&f, Some("owner")).await?, Some(fact));
+        assert!(selection(&f, Some("other")).await?.is_none());
+        assert!(selection(&f, None).await?.is_none());
+        let wrong = ServingSelection {
+            repository: *uuid::Uuid::new_v4().as_bytes(),
+            actor: Some("owner".into()),
+        };
+        assert!(
+            f.client()
+                .query::<SelectServingGeneration>(&f.target, None, wrong)
+                .await?
+                .output
+                .is_none()
+        );
+        edit(&f, "UPDATE ref_generation SET visibility='public'").await?;
+        assert_eq!(selection(&f, None).await?, Some(fact));
+        edit(&f, "UPDATE ref_generation SET visibility='private'; DELETE FROM repository_members WHERE account='viewer'").await?;
+        assert!(selection(&f, None).await?.is_none());
+        assert!(selection(&f, Some("viewer")).await?.is_none());
+        assert_eq!(f.counts().await?, before);
+        assert_eq!(pin_count(&f).await?, 0);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn selection_follows_current_joint_head_while_old_pin_remains_immutable() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let initial = initialize(&f, store.clone()).await?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let old = pin(&f, store, &root, tasks.clone(), 201).await?;
+        // Trusted copied roots qualify head selection, not native publication.
+        edit(&f, "INSERT INTO catalog_generations(generation,catalog,certificate,refs) SELECT 2,catalog,certificate,refs FROM catalog_generations WHERE generation=1; UPDATE catalog_state SET generation=2 WHERE singleton=1").await?;
+        let current = selection(&f, Some("owner"))
+            .await?
+            .ok_or("current root missing")?;
+        assert_eq!(current.generation, 2);
+        assert_eq!(
+            (current.catalog, current.refs, current.certificate),
+            (initial.catalog, initial.refs, initial.certificate)
+        );
+        assert_eq!(old.fact(), initial);
+        assert_eq!(
+            f.client()
+                .query::<CheckServingPin>(
+                    &f.target,
+                    None,
+                    ServingCheck {
+                        token: old.token(),
+                        actor: Some("owner".into()),
+                    }
+                )
+                .await?
+                .output
+                .ok_or("old retention lost")?
+                .fact,
+            initial
+        );
+        f.handle.query(0,4096,|db| {
+            let mut query=db.prepare("EXPLAIN QUERY PLAN SELECT g.generation,g.catalog,g.certificate,g.refs FROM catalog_state s JOIN catalog_generations g ON g.generation=s.generation WHERE s.singleton=1")?;
+            let plan:Vec<String>=query.query_map([],|r|r.get(3))?.collect::<std::result::Result<_,_>>()?;
+            assert!(plan.iter().all(|line| !line.contains("SCAN") && !line.contains("TEMP B-TREE")),"{plan:?}");
+            Ok(Vec::new())
+        }).await?;
+        release(&f, &old).await?;
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[test]
+fn selection_codec_is_bounded_and_does_not_carry_a_pin() -> Result {
+    let repository = *uuid::Uuid::new_v4().as_bytes();
+    for actor in [None, Some("viewer".into())] {
+        let input = ServingSelection { repository, actor };
+        let mut encoder = BoundedEncoder::new(1024)?;
+        input.encode(&mut encoder)?;
+        let bytes = encoder.finish();
+        let mut decoder = BoundedDecoder::new(&bytes, 1024)?;
+        assert_eq!(ServingSelection::decode(&mut decoder)?, input);
+        decoder.finish()?;
+        for end in 0..bytes.len() {
+            assert!(
+                (|| -> std::result::Result<(), CodecError> {
+                    let mut decoder = BoundedDecoder::new(&bytes[..end], 1024)?;
+                    ServingSelection::decode(&mut decoder)?;
+                    decoder.finish()
+                })()
+                .is_err()
+            );
+        }
+        let mut trailing = bytes;
+        trailing.push(0);
+        let mut decoder = BoundedDecoder::new(&trailing, 1024)?;
+        ServingSelection::decode(&mut decoder)?;
+        assert!(decoder.finish().is_err());
+    }
+    assert!(
+        ServingSelection {
+            repository: [0; 16],
+            actor: None
+        }
+        .encode(&mut BoundedEncoder::new(1024)?)
+        .is_err()
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn eviction_admits_only_exact_selected_releases_and_closes_after_all_real_successes() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let first = pin(&f, store.clone(), &root, tasks.clone(), 202).await?;
+        let second = pin(&f, store.clone(), &root, tasks.clone(), 203).await?;
+        let foreign = pin(&f, store, &root, tasks.clone(), 204).await?;
+        let q = queue(&f)?;
+        let gate = q
+            .reserve_serving_drain(&[first.token(), second.token()])
+            .await?
+            .ok_or("idle drain refused")?;
+        assert!(!gate.close_if_drained().await);
+        assert!(!q.close_if_idle().await);
+        assert!(q.reserve_serving_drain(&[]).await?.is_none());
+        let before = f.counts().await?;
+        let denied = q
+            .try_reserve(acquisition(&f, 202).await?)
+            .err()
+            .ok_or("acquisition admitted during drain")?;
+        assert_eq!(denied.reason, PublicationScheduleError::Closed);
+        assert_eq!(f.counts().await?, before);
+        let denied_release = q
+            .try_reserve(foreign.ready_release(identity()?).await?)
+            .err()
+            .ok_or("foreign release admitted during drain")?;
+        assert_eq!(denied_release.reason, PublicationScheduleError::Closed);
+        assert_eq!(pin_count(&f).await?, 3);
+        let held = q.try_reserve(first.ready_release(identity()?).await?)?;
+        assert!(!gate.close_if_drained().await);
+        held.activate().await?;
+        assert_eq!(
+            release_result(&held).await?.output,
+            ServingReleaseReply::Released
+        );
+        assert!(!gate.close_if_drained().await);
+        let held = q.try_reserve(second.ready_release(identity()?).await?)?;
+        held.activate().await?;
+        assert_eq!(
+            release_result(&held).await?.output,
+            ServingReleaseReply::Released
+        );
+        close_drained(&gate).await?;
+        drop(gate);
+        assert!(q.stats().await.closed);
+        assert_eq!(
+            q.try_reserve(denied.ready)
+                .err()
+                .ok_or("closed admission reopened")?
+                .reason,
+            PublicationScheduleError::Closed
+        );
+        assert!(q.close_and_drain().await.is_empty());
+        release(&f, &foreign).await?;
+        assert_eq!(pin_count(&f).await?, 0);
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn busy_or_invalid_drain_never_changes_existing_admission_or_exact_evidence() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let q = queue(&f)?;
+    let held = q.try_reserve(acquisition(&f, 205).await?)?;
+    assert!(q.reserve_serving_drain(&[]).await?.is_none());
+    assert!(!q.stats().await.closed);
+    held.discard_held().await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let retained = pin(&f, store.clone(), &root, tasks.clone(), 206).await?;
+    for tokens in [vec![retained.token(); 2], vec![retained.token(); 17]] {
+        assert!(matches!(
+            q.reserve_serving_drain(&tokens).await,
+            Err(PublicationScheduleError::InvalidLimits)
+        ));
+    }
+    let mut malformed = retained.token();
+    malformed.admission_sequence = 0;
+    assert!(matches!(
+        q.reserve_serving_drain(&[malformed]).await,
+        Err(PublicationScheduleError::InvalidLimits)
+    ));
+    let mut foreign = retained.token();
+    foreign.repository = *uuid::Uuid::new_v4().as_bytes();
+    assert!(matches!(
+        q.reserve_serving_drain(&[foreign]).await,
+        Err(PublicationScheduleError::Foreign)
+    ));
+    let ordinary = acquisition(&f, 207).await?;
+    let original = ordinary.evidence().clone();
+    let gate = q
+        .reserve_serving_drain(&[])
+        .await?
+        .ok_or("idle admission")?;
+    let failure = q
+        .try_reserve(ordinary)
+        .err()
+        .ok_or("acquisition admitted during drain")?;
+    assert_eq!(failure.reason, PublicationScheduleError::Closed);
+    assert!(matches!(
+        f.client().resolve(&original).await?,
+        Resolution::Absent
+    ));
+    drop(gate);
+    let ticket = q.try_reserve(failure.ready)?;
+    ticket.activate().await?;
+    let state = timeout(Duration::from_secs(5), ticket.wait()).await?;
+    let PublicationState::Finished(Ok(PublicationOutcome::ServingCommand(value))) = state else {
+        return Err(format!("acquisition state {state:?}").into());
+    };
+    let lease = granted(value.output)?;
+    let resumed = ServingPin::open(
+        context(&f, store, &root, tasks.clone())?,
+        lease.token,
+        Some("owner".into()),
+    )
+    .await?;
+    assert!(matches!(
+        f.client().resolve(&original).await?,
+        Resolution::Committed(_)
+    ));
+    assert!(!q.stats().await.closed);
+    release(&f, &retained).await?;
+    release(&f, &resumed).await?;
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn release_uncertainty_and_observer_loss_cannot_complete_eviction_early() -> Result {
+    for fault in 1..=3 {
+        let f = Fixture::new(ObjectFormat::Sha1).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let retained = pin(&f, store, &root, tasks.clone(), 208).await?;
+        let q = queue(&f)?;
+        let gate = q
+            .reserve_serving_drain(&[retained.token()])
+            .await?
+            .ok_or("idle drain")?;
+        let original = retained.ready_release(identity()?).await?;
+        let evidence = original.evidence().clone();
+        q.fault_for_test(fault);
+        let ticket = q.submit(original).await?;
+        assert!(matches!(
+            timeout(Duration::from_secs(5), ticket.wait()).await?,
+            PublicationState::Uncertain(_)
+        ));
+        assert!(!gate.close_if_drained().await);
+        assert_eq!(q.stats().await.command_bytes, 8 << 10);
+        drop(ticket);
+        let ticket = q
+            .pending_serving_release([208; 16])
+            .await
+            .ok_or("release owner lost")?;
+        ticket.recover().await?;
+        assert_eq!(
+            release_result(&ticket).await?.output,
+            ServingReleaseReply::Released
+        );
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            Resolution::Committed(_)
+        ));
+        close_drained(&gate).await?;
+        assert_eq!(q.stats().await.command_bytes, 0);
+        drop(gate);
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn a_denied_release_keeps_its_sql_root_and_cannot_satisfy_the_drain_guard() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let retained = pin(&f, store, &root, tasks.clone(), 209).await?;
+    let q = queue(&f)?;
+    let gate = q
+        .reserve_serving_drain(&[retained.token()])
+        .await?
+        .ok_or("idle drain")?;
+    let ready = retained.ready_release(identity()?).await?;
+    edit(&f, "UPDATE repository_identity SET owner='other'").await?;
+    let state = timeout(Duration::from_secs(5), q.submit(ready).await?.wait()).await?;
+    assert!(
+        matches!(state,PublicationState::Finished(Err(ref error)) if matches!(&**error,
+        PublicationError::ServingRelease(InvocationError::Rejected(value)) if value.output==ServingReleaseReply::Denied(ServingDenial::Unauthorized)))
+    );
+    assert_eq!(pin_count(&f).await?, 1);
+    assert!(!gate.close_if_drained().await);
+    assert!(!q.close_if_idle().await);
+    drop(gate);
+    edit(&f, "UPDATE repository_identity SET owner='owner'").await?;
+    release(&f, &retained).await?;
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn global_close_waits_for_drain_owner_and_cancellation_never_reopens_closed_admission()
+-> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let q = queue(&f)?;
+    let gate = q.reserve_serving_drain(&[]).await?.ok_or("idle drain")?;
+    let closing = q.clone();
+    let waiter = tokio::spawn(async move { closing.close_and_drain().await });
+    tokio::task::yield_now().await;
+    assert!(!waiter.is_finished());
+    waiter.abort();
+    assert!(
+        waiter
+            .await
+            .err()
+            .ok_or("global close completed before drain")?
+            .is_cancelled()
+    );
+    assert!(!q.stats().await.closed);
+    assert!(gate.close_if_drained().await);
+    drop(gate);
+    assert!(q.stats().await.closed);
+    assert!(q.close_and_drain().await.is_empty());
+    assert!(q.reserve_serving_drain(&[]).await?.is_none());
+
+    let q = queue(&f)?;
+    let gate = q
+        .reserve_serving_drain(&[])
+        .await?
+        .ok_or("new idle drain")?;
+    let closing = q.clone();
+    let waiter = tokio::spawn(async move { closing.close_and_drain().await });
+    tokio::task::yield_now().await;
+    assert!(!waiter.is_finished());
+    drop(gate);
+    assert!(timeout(Duration::from_secs(5), waiter).await??.is_empty());
+    assert!(q.stats().await.closed);
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn reused_reader_id_cannot_release_another_exact_drain_token() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let old = pin(&f, store.clone(), &root, tasks.clone(), 210).await?;
+        let old_token = old.token();
+        release(&f, &old).await?;
+        let current = pin(&f, store, &root, tasks.clone(), 210).await?;
+        assert_eq!(old_token.reader, current.token().reader);
+        assert_ne!(
+            old_token.admission_sequence,
+            current.token().admission_sequence
+        );
+        let q = queue(&f)?;
+        let gate = q
+            .reserve_serving_drain(&[old_token])
+            .await?
+            .ok_or("idle drain")?;
+        let ready = current.ready_release(identity()?).await?;
+        let original = ready.evidence().clone();
+        let refused = q
+            .try_reserve(ready)
+            .err()
+            .ok_or("different token admitted")?;
+        assert_eq!(refused.reason, PublicationScheduleError::Closed);
+        assert!(matches!(
+            f.client().resolve(&original).await?,
+            Resolution::Absent
+        ));
+        assert_eq!(pin_count(&f).await?, 1);
+        assert!(!gate.close_if_drained().await);
+        assert_eq!(q.stats().await.command_bytes, 0);
+        drop(gate);
+        let ticket = q.submit(refused.ready).await?;
+        assert_eq!(
+            release_result(&ticket).await?.output,
+            ServingReleaseReply::Released
+        );
+        assert!(matches!(
+            f.client().resolve(&original).await?,
+            Resolution::Committed(_)
+        ));
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn global_close_preserves_release_admission_through_real_dispatch_and_uncertainty() -> Result
+{
+    for fault in 1..=3 {
+        let f = Fixture::new(ObjectFormat::Sha256).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let retained = pin(&f, store, &root, tasks.clone(), 211).await?;
+        let q = queue(&f)?;
+        let gate = q
+            .reserve_serving_drain(&[retained.token()])
+            .await?
+            .ok_or("idle drain")?;
+        let closing = q.clone();
+        let waiter = tokio::spawn(async move { closing.close_and_drain().await });
+        tokio::task::yield_now().await;
+        assert!(!waiter.is_finished());
+        assert!(!q.stats().await.closed);
+        let (dispatch, entered) = q.pause_for_test().await;
+        q.fault_for_test(fault);
+        let ticket = q.submit(retained.ready_release(identity()?).await?).await?;
+        timeout(Duration::from_secs(5), entered).await??;
+        assert!(!waiter.is_finished());
+        assert!(!gate.close_if_drained().await);
+        assert_eq!(pin_count(&f).await?, 1);
+        dispatch
+            .send(())
+            .map_err(|_| "release worker disappeared")?;
+        assert!(matches!(
+            timeout(Duration::from_secs(5), ticket.wait()).await?,
+            PublicationState::Uncertain(_)
+        ));
+        assert!(!waiter.is_finished());
+        assert!(!gate.close_if_drained().await);
+        ticket.recover().await?;
+        assert_eq!(
+            release_result(&ticket).await?.output,
+            ServingReleaseReply::Released
+        );
+        assert!(!waiter.is_finished());
+        close_drained(&gate).await?;
+        assert!(timeout(Duration::from_secs(5), waiter).await??.is_empty());
+        drop(gate);
+        assert!(q.stats().await.closed);
+        assert_eq!(pin_count(&f).await?, 0);
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn dropping_admission_guard_preserves_dispatched_original_and_its_recovery_credits() -> Result
+{
+    let f = Fixture::new(ObjectFormat::Sha1).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let retained = pin(&f, store, &root, tasks.clone(), 212).await?;
+    let q = queue(&f)?;
+    let gate = q
+        .reserve_serving_drain(&[retained.token()])
+        .await?
+        .ok_or("idle drain")?;
+    let original = retained.ready_release(identity()?).await?;
+    let evidence = original.evidence().clone();
+    let (dispatch, entered) = q.pause_for_test().await;
+    q.fault_for_test(3);
+    let ticket = q.submit(original).await?;
+    timeout(Duration::from_secs(5), entered).await??;
+    drop(gate);
+    drop(ticket);
+    assert_eq!(q.stats().await.command_bytes, 8 << 10);
+    assert_eq!(pin_count(&f).await?, 1);
+    assert!(!q.stats().await.closed);
+    // Guard cancellation resumes admission; it cannot cancel admitted work.
+    let held = q.try_reserve(acquisition(&f, 213).await?)?;
+    assert_eq!(q.stats().await.command_bytes, (8 + 28) << 10);
+    dispatch
+        .send(())
+        .map_err(|_| "release worker disappeared")?;
+    let ticket = q
+        .pending_serving_release([212; 16])
+        .await
+        .ok_or("original lost")?;
+    assert!(matches!(
+        timeout(Duration::from_secs(5), ticket.wait()).await?,
+        PublicationState::Uncertain(_)
+    ));
+    held.discard_held().await?;
+    assert_eq!(q.stats().await.command_bytes, 8 << 10);
+    ticket.recover().await?;
+    assert_eq!(
+        release_result(&ticket).await?.output,
+        ServingReleaseReply::Released
+    );
+    assert!(matches!(
+        f.client().resolve(&evidence).await?,
+        Resolution::Committed(_)
+    ));
+    assert_eq!(pin_count(&f).await?, 0);
+    assert_eq!(q.stats().await.command_bytes, 0);
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index c4616741..23ed6e6c 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -93,6 +93,14 @@ does not expose its target/owner; SQL repository identity scopes the query,
 and the service verifies the configured target and fresh actual owner before
 artifact I/O. A pin query result alone grants no serving authority.
 
+`SelectServingGeneration` (query 48, codec 1) observes the current joint
+catalog/ref head under current Read access. Input is bounded at 1 KiB and output
+at 512 bytes; repository identity scopes the query and its head lookup uses the
+singleton/catalog primary keys. It returns no root before joint initialization.
+Selection allocates no pin or creating namespace. Its `GenerationFact` is only
+an observation: callers must acquire/check an exact serving pin and verify the
+actual owner before artifact I/O. A head advance never changes an existing pin.
+
 Every exact pin also has one process-wide physical owner. A private Arc guard
 is reserved before tracked construction and retained by the pin, detached
 workers and release proofs. Duplicate construction is refused even through
@@ -146,6 +154,24 @@ through uncertainty. Known outcomes clear the retained command before credit
 return; a known successful release permanently closes the pin. A caller cannot
 reopen it by replaying acquisition or by cloning an old receipt.
 
+An eviction owner can reserve `ServingDrainAdmission` only while the common
+coordinator is idle, after pausing its serving producers and borrows. The
+reservation accepts at most 16 distinct exact tokens from that repository and
+admits only their privately prepared releases. Matching a reader ID alone is
+insufficient: owner, original admission sequence and generation must also match.
+Current receiver authorization and physical-drain proofs remain mandatory.
+Busy reservation leaves all existing admission and commands unchanged.
+
+The guard closes the coordinator only after every selected token has an observed
+successful release and no held, dispatched or uncertain work remains. Denial,
+absence and detached observers cannot satisfy this condition. Global queue
+closure waits for the guard to finish or be dropped so selected releases can
+still be admitted. Guard cancellation resumes ordinary admission but never
+cancels accepted work, returns its credits or reopens an already closed queue.
+The caller must keep serving producers paused through guard completion/drop.
+This scheduling primitive is not wired into production residency yet; production
+shutdown must also keep the node publication budget open until releases finish.
+
 A new owner cannot renew/release old-owner pins merely because its epoch is newer.
 They remain roots until actual physical fencing/drain and an authenticated
 adoption/release protocol is implemented. Conservatively retaining abandoned
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 02c9108c..a18f8703 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -55,6 +55,47 @@ maintenance, signed completion/cold clone, file attribution and full-history plu
 10,000-developer capacity qualification remain mandatory. This branch remains
 local, unpublished and unreleasable.
 
+## Current-root selection and exact serving drain checkpoint
+
+Production registers bounded current-Read query 48 to observe the joint
+catalog/ref head without allocating retention. The existing exact pin remains
+immutable across head advances. Acquisition/renewal dispatch copies now share
+their original encoded custody intent through an Arc, preserving identity while
+avoiding duplicated command bodies.
+
+`ServingDrainAdmission` excludes new production work while admitting only a
+bounded set of exact serving releases. Busy reservation changes no existing
+admission. Closure requires every selected token's observed successful release
+and a fully idle coordinator. Global close waits for that owner; dropping the
+guard preserves admitted originals, recovery credits and sticky closure. A
+reused reader ID with another admission sequence cannot satisfy the drain.
+These are scheduling primitives; production generation pooling, ownership
+handoff and residency/shutdown ordering remain unimplemented.
+
+Eleven focused families pass in 1.21 seconds. They cover both object formats,
+current Read/public access and revocation, exact repository identity, joint head
+selection with immutable older retention, indexed lookup, bounded framing,
+busy/invalid reservations, exact-token exclusion, held dispatch, all three
+release transport fault modes, lost observers, denied releases, global close,
+guard cancellation and original-command recovery. The earlier fixture compile
+failures are retained as diagnostics and are not passing qualification.
+
+Final frozen-source library qualification executes 651 unique cases: **646 pass
+and five fail**, with exit 101 retained. All 357 publication, seven startup and
+four production resident-recovery cases pass. Two nested subprocess summaries
+are excluded; focused tests are not counted again. Nine additional workspace
+and lifecycle tests pass in 3.44 seconds. Combined coverage is 660 unique cases,
+655 pass and five fail. Every failure remains one of the five unconverted
+legacy `objects` readers; no compatibility table or green-result substitution
+was introduced. Warnings-denied workspace/all-target Clippy passes in 24.07
+seconds, the server build in 31.51 seconds and formatting in 1.08 seconds.
+Static checks verify 463 frozen source/schema/manifest files, including
+450 Rust files, 152 local doc links, exact SDK pins and unchanged protected
+index/archive. Evidence uses `/tmp/canopy-serving-selection-drain-*`. The draft
+diagnostic summary explicitly records the overwritten initial focused log; the
+final frozen-source logs qualify this source. No capacity or complete production
+reader claim follows from these results.
+
 ## Durable serving command checkpoint
 
 Serving acquisition and renewal now use the existing durable custody journal and

From 2012f867cb5ab50d460cb67c942a6fc518f49c36 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 08:45:55 -0700
Subject: [PATCH 19/55] Link the production cutover draft and preserve release
 status

---
 docs/large-repository-implementation-status.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index a18f8703..a31b5121 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -2,6 +2,12 @@
 
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
+Current cutover review: [draft PR #34](https://github.com/crabbuild/canopy/pull/34),
+directly against `main`. GitHub reports no merge conflicts at publication;
+CI is pending. It remains a draft until the incomplete production conversion
+and release requirements below are verified. Older local/unpublished checkpoint
+notes describe their historical states, not the current publication state.
+
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.

From b21f9d7c74b85eab945146df1c4778433a350a72 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 10:13:23 -0700
Subject: [PATCH 20/55] Own serving generation renewal and exact physical drain

---
 crates/canopy-server/src/lib.rs               |   4 +
 .../src/packs/publication/custody/dispatch.rs |  35 +
 .../src/packs/publication/mod.rs              |   5 +-
 .../src/packs/publication/serving.rs          |   5 +
 .../publication/serving/command_owner.rs      |  19 +
 .../packs/publication/serving/lifecycle.rs    | 607 ++++++++++++++++++
 .../src/packs/publication/serving/session.rs  |  59 ++
 .../publication/serving/session/handoff.rs    |  67 ++
 .../src/packs/publication/tests/serving.rs    |   1 +
 .../publication/tests/serving/blocked.rs      |  10 +-
 .../publication/tests/serving/lifecycle.rs    | 583 +++++++++++++++++
 .../tests/serving/lifecycle/restarts.rs       | 226 +++++++
 docs/design/certified-serving-pins.md         | 103 ++-
 docs/evidence/serving-owner-20261004.json     | 212 ++++++
 .../large-repository-implementation-status.md |  65 +-
 15 files changed, 1982 insertions(+), 19 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/serving/lifecycle.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/handoff.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/lifecycle/restarts.rs
 create mode 100644 docs/evidence/serving-owner-20261004.json

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index bbee706e..f6b12961 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -300,6 +300,10 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/serving/commands.rs"));
                 source.update(include_bytes!("packs/publication/serving/command_owner.rs"));
                 source.update(include_bytes!("packs/publication/serving/session.rs"));
+                source.update(include_bytes!("packs/publication/serving/lifecycle.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/serving/session/handoff.rs"
+                ));
                 source.update(include_bytes!("packs/publication/serving/ownership.rs"));
                 source.update(include_bytes!("packs/publication/serving/schema.sql"));
                 source.update(include_bytes!("packs/publication/registry.rs"));
diff --git a/crates/canopy-server/src/packs/publication/custody/dispatch.rs b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
index 4917fef4..d125aaf0 100644
--- a/crates/canopy-server/src/packs/publication/custody/dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/custody/dispatch.rs
@@ -54,6 +54,41 @@ impl CustodyStopProbe {
     }
 }
 impl OwnedCustody {
+    /// Observe only this exact accepted ordinal. This must never execute an
+    /// absent original or substitute the latest renewal's receipt.
+    pub(in crate::packs::publication) async fn serving_grant(
+        &self,
+        client: &CellClient,
+    ) -> Result<ServingLease, CustodyError> {
+        let header = self.prepared.intent.header()?;
+        if !matches!(self.action()?, CustodyAction::AcquireServing(_)) {
+            return Err(CustodyError::Context);
+        }
+        let saved = load(
+            client,
+            self.evidence().target(),
+            header.key(),
+            Some(header.step),
+        )
+        .await?
+        .ok_or(CustodyError::Context)?;
+        if saved.intent != self.prepared.intent || saved.stopped.is_some() {
+            return Err(CustodyError::Context);
+        }
+        let phase = saved.phase.ok_or(CustodyError::Context)?;
+        let committed = phase.committed::<CustodyReply>(self.evidence())?;
+        match committed.output {
+            CustodyReply::Serving(ServingReply::Granted(lease))
+                if !phase.rejected()
+                    && lease.token.repository == header.repository
+                    && lease.token.reader == header.operation
+                    && lease.token.admission_sequence == committed.receipt.commit_sequence =>
+            {
+                Ok(*lease)
+            }
+            _ => Err(CustodyError::Context),
+        }
+    }
     pub(in crate::packs::publication) fn stop_probe(
         &self,
     ) -> Result<CustodyStopProbe, CustodyError> {
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 657138c1..46048912 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -19,8 +19,9 @@ pub use serving::{
     AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_SERVING_OWNERS,
     MAX_SERVING_PINS, ReadyServingCommand, ReadyServingRelease, ReleaseServingPin, RenewServingPin,
     RenewServingRequest, SelectServingGeneration, ServingCheck, ServingContext, ServingDenial,
-    ServingDrainProof, ServingLease, ServingPin, ServingReadBudget, ServingReadError,
-    ServingReleaseReply, ServingReply, ServingSelection, ServingToken,
+    ServingDrainObserver, ServingDrainProof, ServingLease, ServingOwner, ServingOwnerError,
+    ServingOwnerPhase, ServingOwnerStats, ServingPin, ServingReadBudget, ServingReadError,
+    ServingReleaseReply, ServingReply, ServingSelection, ServingSnapshot, ServingToken,
 };
 mod owner;
 pub(crate) mod registry;
diff --git a/crates/canopy-server/src/packs/publication/serving.rs b/crates/canopy-server/src/packs/publication/serving.rs
index 5b1b43c9..190dbaa8 100644
--- a/crates/canopy-server/src/packs/publication/serving.rs
+++ b/crates/canopy-server/src/packs/publication/serving.rs
@@ -6,7 +6,12 @@ mod codec;
 mod command_owner;
 mod commands;
 pub use command_owner::ReadyServingCommand;
+mod lifecycle;
 mod ownership;
+pub use lifecycle::{
+    ServingDrainObserver, ServingOwner, ServingOwnerError, ServingOwnerPhase, ServingOwnerStats,
+    ServingSnapshot,
+};
 pub use ownership::MAX_SERVING_OWNERS;
 mod session;
 pub use commands::{
diff --git a/crates/canopy-server/src/packs/publication/serving/command_owner.rs b/crates/canopy-server/src/packs/publication/serving/command_owner.rs
index 331bc806..ffdadb15 100644
--- a/crates/canopy-server/src/packs/publication/serving/command_owner.rs
+++ b/crates/canopy-server/src/packs/publication/serving/command_owner.rs
@@ -9,6 +9,9 @@ pub struct ReadyServingCommand {
     target: CellTarget,
     request: BeginRequest,
     original: Arc<OwnedCustody>,
+    // Only the original local acquisition can hand off physical ownership.
+    // Restored journal knowledge and renewals cannot recreate it.
+    local_acquisition: bool,
     // Renewal is owned physical work from preparation until known disposition.
     _guard: Option<Arc<super::session::Active>>,
 }
@@ -39,6 +42,7 @@ impl ReadyServingCommand {
             target,
             request,
             original: Arc::new(original),
+            local_acquisition: true,
             _guard: None,
         })
     }
@@ -61,6 +65,7 @@ impl ReadyServingCommand {
             target,
             request: context,
             original: Arc::new(original),
+            local_acquisition: false,
             _guard: Some(guard),
         })
     }
@@ -83,12 +88,25 @@ impl ReadyServingCommand {
             target,
             request,
             original: Arc::new(original),
+            local_acquisition: false,
             _guard: None,
         })
     }
     pub fn evidence(&self) -> &PendingMutation {
         self.original.evidence()
     }
+    /// Retain this accepted local acquisition even if its lease expired or the
+    /// requesting account lost Read. Every I/O still checks fresh Read/expiry;
+    /// this handoff permits safe physical ownership and authenticated cleanup.
+    pub async fn retain_acquisition(
+        &self,
+        context: ServingContext,
+    ) -> Result<ServingPin, ServingReadError> {
+        if !self.local_acquisition || self.target != context.target_for_handoff() {
+            return Err(ServingReadError::Context);
+        }
+        ServingPin::retain_original(context, self.original.clone()).await
+    }
     pub(in crate::packs::publication) fn reservation(&self) -> u64 {
         RESERVATION
     }
@@ -98,6 +116,7 @@ impl ReadyServingCommand {
             target: self.target.clone(),
             request: self.request.clone(),
             original: self.original.clone(),
+            local_acquisition: self.local_acquisition,
             _guard: self._guard.clone(),
         }
     }
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
new file mode 100644
index 00000000..8dd3fd4e
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -0,0 +1,607 @@
+//! A generation's producer survives callers and owns renewal through real drain.
+use super::*;
+use crate::admission::AdmissionPermit;
+use cellule_runtime::InvocationError;
+use std::sync::{Mutex, Weak};
+use tokio::{
+    sync::watch,
+    time::{Duration, Instant},
+};
+use tokio_util::task::TaskTracker;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ServingOwnerError {
+    #[error("serving owner read failed")]
+    Read(#[from] ServingReadError),
+    #[error("serving owner clock failed")]
+    Clock(#[source] Box<crate::server::ServerError>),
+    #[error("serving owner scheduling failed")]
+    Schedule(#[from] PublicationScheduleError),
+    #[error("serving owner command failed")]
+    Command(#[source] Arc<PublicationError>),
+    #[error("serving owner custody failed")]
+    Custody(#[source] Box<CustodyError>),
+    #[error("serving owner invariant failed")]
+    Context,
+}
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ServingOwnerPhase {
+    Acquiring,
+    Ready,
+    Draining,
+    Released,
+    Denied,
+}
+#[derive(Clone, Debug)]
+pub struct ServingOwnerStats {
+    pub phase: ServingOwnerPhase,
+    pub token: Option<ServingToken>,
+    pub renewals: u64,
+    pub retries: u64,
+    pub last_error: Option<Arc<ServingOwnerError>>,
+}
+struct Control {
+    closed: bool,
+    borrowers: usize,
+    pin: Option<ServingPin>,
+}
+struct Inner {
+    context: ServingContext,
+    coordinator: PublicationCoordinator,
+    request: BeginRequest,
+    control: Mutex<Control>,
+    driver: tokio::sync::Mutex<Driver>,
+    changed: tokio::sync::Notify,
+    tasks: TaskTracker,
+    updates: watch::Sender<ServingOwnerStats>,
+    permit: Mutex<Option<AdmissionPermit>>,
+    #[cfg(test)]
+    fault: std::sync::atomic::AtomicU8,
+    #[cfg(test)]
+    recovery_gate: tokio::sync::Mutex<Option<RecoveryGate>>,
+}
+#[cfg(test)]
+struct RecoveryGate {
+    entered: tokio::sync::oneshot::Sender<()>,
+    proceed: tokio::sync::oneshot::Receiver<()>,
+}
+struct Lifetime(Weak<Inner>);
+impl Drop for Lifetime {
+    fn drop(&mut self) {
+        if let Some(inner) = self.0.upgrade() {
+            inner.close();
+        }
+    }
+}
+/// Clone shares one producer, one pin and one physical drain. Last handle loss
+/// stops new borrows; detached workers keep their private ownership until drain.
+#[derive(Clone)]
+#[must_use]
+pub struct ServingOwner {
+    inner: Arc<Inner>,
+    _lifetime: Arc<Lifetime>,
+}
+/// Joining an existing producer does not keep its admission lifetime open.
+/// Residency can observe last-handle cleanup without becoming a producer.
+#[derive(Clone)]
+pub struct ServingDrainObserver {
+    tasks: TaskTracker,
+    stats: watch::Receiver<ServingOwnerStats>,
+}
+impl ServingDrainObserver {
+    pub async fn wait(&self) -> ServingOwnerStats {
+        self.tasks.close();
+        self.tasks.wait().await;
+        self.stats.borrow().clone()
+    }
+}
+struct Borrow {
+    inner: Arc<Inner>,
+    _permit: AdmissionPermit,
+}
+impl Drop for Borrow {
+    fn drop(&mut self) {
+        let mut state = self.inner.control.lock().expect("serving owner control");
+        state.borrowers -= 1;
+        drop(state);
+        self.inner.changed.notify_waiters();
+    }
+}
+/// Its private guard survives snapshot clones. No raw pin escapes the producer.
+#[derive(Clone)]
+pub struct ServingSnapshot {
+    pin: ServingPin,
+    actor: Option<String>,
+    _borrow: Arc<Borrow>,
+}
+impl ServingSnapshot {
+    pub fn fact(&self) -> GenerationFact {
+        self.pin.fact()
+    }
+    pub async fn headers(
+        &self,
+        ids: &[crate::ObjectId],
+    ) -> Result<Vec<Option<crate::packs::metadata::ObjectHeader>>, ServingReadError> {
+        self.pin.headers(self.actor.clone(), ids).await
+    }
+}
+enum Original {
+    Command(Arc<ReadyServingCommand>),
+    Release(Arc<ReadyServingRelease>),
+}
+impl Original {
+    fn copy(&self) -> ReadyPublication {
+        match self {
+            Self::Command(value) => value.dispatch_copy().into(),
+            Self::Release(value) => value.dispatch_copy().into(),
+        }
+    }
+}
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Kind {
+    Acquire,
+    Renew,
+    Release,
+}
+struct Pending {
+    kind: Kind,
+    original: Original,
+    ticket: Option<PublicationTicket>,
+}
+struct Driver {
+    plan: Option<(Kind, MutationIdentity)>,
+    pending: Option<Pending>,
+    next_renewal: Instant,
+    done: bool,
+    renewal_denied: bool,
+}
+impl ServingOwner {
+    pub async fn start(
+        context: ServingContext,
+        coordinator: PublicationCoordinator,
+        request: BeginRequest,
+        identity: MutationIdentity,
+    ) -> Result<Self, ServingOwnerError> {
+        let mut bytes = BoundedEncoder::new(4096).map_err(ServingReadError::Codec)?;
+        request
+            .encode(&mut bytes)
+            .map_err(ServingReadError::Codec)?;
+        if coordinator.target() != &context.target_for_handoff()
+            || crate::repository_target(
+                coordinator.target().tenant(),
+                coordinator.target().application(),
+                request.repository,
+            )
+            .map_err(ServingReadError::Capability)?
+                != *coordinator.target()
+        {
+            return Err(ServingOwnerError::Context);
+        }
+        let permit = context.admit_owner(&request.actor).await?;
+        let (updates, _) = watch::channel(ServingOwnerStats {
+            phase: ServingOwnerPhase::Acquiring,
+            token: None,
+            renewals: 0,
+            retries: 0,
+            last_error: None,
+        });
+        let inner = Arc::new(Inner {
+            context,
+            coordinator,
+            request,
+            control: Mutex::new(Control {
+                closed: false,
+                borrowers: 0,
+                pin: None,
+            }),
+            driver: tokio::sync::Mutex::new(Driver {
+                plan: Some((Kind::Acquire, identity)),
+                pending: None,
+                next_renewal: Instant::now(),
+                done: false,
+                renewal_denied: false,
+            }),
+            changed: tokio::sync::Notify::new(),
+            tasks: TaskTracker::new(),
+            updates,
+            permit: Mutex::new(Some(permit)),
+            #[cfg(test)]
+            fault: std::sync::atomic::AtomicU8::new(0),
+            #[cfg(test)]
+            recovery_gate: tokio::sync::Mutex::new(None),
+        });
+        inner.tasks.spawn(supervise(inner.clone()));
+        Ok(Self {
+            _lifetime: Arc::new(Lifetime(Arc::downgrade(&inner))),
+            inner,
+        })
+    }
+    pub fn stats(&self) -> ServingOwnerStats {
+        self.inner.updates.borrow().clone()
+    }
+    pub fn drain_observer(&self) -> ServingDrainObserver {
+        ServingDrainObserver {
+            tasks: self.inner.tasks.clone(),
+            stats: self.inner.updates.subscribe(),
+        }
+    }
+    #[cfg(test)]
+    pub(in crate::packs::publication) fn fault_for_test(&self, point: u8) {
+        self.inner
+            .fault
+            .store(point, std::sync::atomic::Ordering::Release);
+    }
+    #[cfg(test)]
+    pub(in crate::packs::publication) async fn pause_recovery_for_test(
+        &self,
+    ) -> (
+        tokio::sync::oneshot::Sender<()>,
+        tokio::sync::oneshot::Receiver<()>,
+    ) {
+        let (proceed, wait) = tokio::sync::oneshot::channel();
+        let (entered, observed) = tokio::sync::oneshot::channel();
+        *self.inner.recovery_gate.lock().await = Some(RecoveryGate {
+            entered,
+            proceed: wait,
+        });
+        (proceed, observed)
+    }
+    pub fn close(&self) {
+        self.inner.close();
+    }
+    pub async fn close_and_drain(&self) -> ServingOwnerStats {
+        self.close();
+        self.inner.tasks.close();
+        self.inner.tasks.wait().await;
+        self.stats()
+    }
+    /// Waiters and returned borrows share a separate bounded node/account
+    /// budget; long-lived snapshots cannot consume every physical I/O slot.
+    pub async fn snapshot(
+        &self,
+        actor: Option<String>,
+    ) -> Result<ServingSnapshot, ServingReadError> {
+        let permit = self.inner.context.admit_snapshot(&actor).await?;
+        let inner = self.inner.clone();
+        self.inner
+            .context
+            .tasks()
+            .spawn(async move {
+                let mut permit = Some(permit);
+                loop {
+                    let changed = inner.changed.notified();
+                    tokio::pin!(changed);
+                    changed.as_mut().enable();
+                    let acquired = {
+                        let mut state = inner.control.lock().expect("serving owner control");
+                        if state.closed {
+                            return Err(ServingReadError::Inactive);
+                        }
+                        if let Some(pin) = state.pin.clone() {
+                            state.borrowers += 1;
+                            Some(ServingSnapshot {
+                                pin,
+                                actor: actor.clone(),
+                                _borrow: Arc::new(Borrow {
+                                    inner: inner.clone(),
+                                    _permit: permit.take().expect("snapshot admission"),
+                                }),
+                            })
+                        } else {
+                            None
+                        }
+                    };
+                    if let Some(snapshot) = acquired {
+                        snapshot.pin.authorize(actor).await?;
+                        return Ok(snapshot);
+                    }
+                    changed.await;
+                }
+            })
+            .await?
+    }
+}
+impl Inner {
+    #[cfg(test)]
+    fn failpoint(&self, point: u8) {
+        if self
+            .fault
+            .compare_exchange(
+                point,
+                0,
+                std::sync::atomic::Ordering::AcqRel,
+                std::sync::atomic::Ordering::Acquire,
+            )
+            .is_ok()
+        {
+            panic!("injected serving producer panic at {point}");
+        }
+    }
+    fn close(&self) {
+        self.control.lock().expect("serving owner control").closed = true;
+        self.changed.notify_waiters();
+    }
+    fn pin(&self) -> Option<ServingPin> {
+        self.control
+            .lock()
+            .expect("serving owner control")
+            .pin
+            .clone()
+    }
+    fn update(&self, change: impl FnOnce(&mut ServingOwnerStats)) {
+        self.updates.send_modify(change);
+    }
+    async fn step(&self) -> Result<bool, ServingOwnerError> {
+        // Plans, exact bodies and held tickets live outside the supervised task.
+        // Panic during any awaited provider work cannot invent a replacement.
+        let mut driver = self.driver.lock().await;
+        if driver.done {
+            return Ok(true);
+        }
+        if driver.pending.is_none() {
+            let (closed, borrowers, pin) = {
+                let state = self.control.lock().expect("serving owner control");
+                (state.closed, state.borrowers, state.pin.clone())
+            };
+            // A factory has not registered or submitted anything. Once all
+            // borrows end, an unbuilt renewal plan can yield to physical drain.
+            // An already built/admitted original never takes this shortcut.
+            if closed
+                && borrowers == 0
+                && driver
+                    .plan
+                    .as_ref()
+                    .is_some_and(|(kind, _)| *kind == Kind::Renew)
+            {
+                driver.plan.take();
+            }
+            if driver.plan.is_none() {
+                let kind = if closed && borrowers == 0 {
+                    Kind::Release
+                } else if driver.renewal_denied {
+                    return Ok(false);
+                } else if Instant::now() >= driver.next_renewal {
+                    Kind::Renew
+                } else {
+                    return Ok(false);
+                };
+                if pin.is_none() {
+                    return Err(ServingOwnerError::Context);
+                }
+                driver.plan = Some((
+                    kind,
+                    crate::server::mutation_identity()
+                        .map_err(|error| ServingOwnerError::Clock(Box::new(error)))?,
+                ));
+            }
+            let (kind, identity) = driver.plan.expect("owned factory plan");
+            let original = match kind {
+                Kind::Acquire => Original::Command(Arc::new(
+                    ReadyServingCommand::acquire(
+                        self.context.client_for_owner(),
+                        self.context.target_for_handoff(),
+                        self.request.clone(),
+                        identity,
+                        self.context.authority_for_owner(),
+                    )
+                    .await
+                    .map_err(|error| ServingOwnerError::Custody(Box::new(error)))?,
+                )),
+                Kind::Renew => Original::Command(Arc::new(
+                    pin.ok_or(ServingOwnerError::Context)?
+                        .ready_renew(
+                            self.request.actor.clone(),
+                            self.request.request_digest,
+                            identity,
+                            self.request.lease_ms,
+                        )
+                        .await?,
+                )),
+                Kind::Release => {
+                    self.update(|stats| stats.phase = ServingOwnerPhase::Draining);
+                    Original::Release(Arc::new(
+                        pin.ok_or(ServingOwnerError::Context)?
+                            .ready_release(identity)
+                            .await?,
+                    ))
+                }
+            };
+            driver.pending = Some(Pending {
+                kind,
+                original,
+                ticket: None,
+            });
+            #[cfg(test)]
+            self.failpoint(1);
+        }
+        let pending = driver.pending.as_mut().expect("owned original");
+        if pending.ticket.is_none() {
+            match self.coordinator.try_reserve(pending.original.copy()) {
+                Ok(ticket) => {
+                    pending.ticket = Some(ticket);
+                    #[cfg(test)]
+                    self.failpoint(2);
+                }
+                Err(refused) => return Err(refused.reason.into()),
+            }
+        }
+        let ticket = pending.ticket.as_ref().expect("owned held ticket");
+        match ticket.state() {
+            PublicationState::Held => {
+                ticket.activate().await?;
+                Ok(false)
+            }
+            PublicationState::Queued | PublicationState::Running => {
+                ticket.wait().await;
+                Ok(false)
+            }
+            PublicationState::Uncertain(_) => {
+                #[cfg(test)]
+                if let Some(gate) = self.recovery_gate.lock().await.take() {
+                    let _ = gate.entered.send(());
+                    let _ = gate.proceed.await;
+                }
+                ticket.recover().await?;
+                Ok(false)
+            }
+            PublicationState::Discarded => Err(ServingOwnerError::Context),
+            PublicationState::Finished(Err(error)) => {
+                let denied = matches!(
+                    &*error,
+                    PublicationError::ServingCommand(InvocationError::Rejected(_))
+                ) || matches!(&*error, PublicationError::Custody { source, .. } if
+                    matches!(&**source, CustodyError::Stopped(_)) ||
+                    matches!(&**source, CustodyError::Registration(error) if matches!(&**error, InvocationError::Rejected(_))));
+                if denied && pending.kind != Kind::Release {
+                    let has_pin = self.pin().is_some();
+                    self.close();
+                    driver.pending.take();
+                    driver.plan.take();
+                    driver.renewal_denied = true;
+                    if !has_pin {
+                        self.update(|stats| {
+                            stats.phase = ServingOwnerPhase::Denied;
+                            stats.last_error = Some(Arc::new(ServingOwnerError::Command(error)));
+                        });
+                        driver.done = true;
+                        return Ok(true);
+                    }
+                    return Ok(false);
+                }
+                if pending.kind == Kind::Release
+                    && matches!(
+                        &*error,
+                        PublicationError::ServingRelease(InvocationError::Rejected(_))
+                    )
+                {
+                    // An immutable known denial releases nothing. A new proof
+                    // can be prepared only after this original is settled.
+                    driver.pending.take();
+                    driver.plan.take();
+                    return Err(ServingOwnerError::Command(error));
+                }
+                // A proven non-execution retries the original; its body never
+                // changes because the factory plan remains retained.
+                pending.ticket.take();
+                Err(ServingOwnerError::Command(error))
+            }
+            PublicationState::Finished(Ok(PublicationOutcome::ServingRelease(value)))
+                if pending.kind == Kind::Release
+                    && value.output == ServingReleaseReply::Released =>
+            {
+                #[cfg(test)]
+                self.failpoint(5);
+                driver.pending.take();
+                driver.plan.take();
+                self.control
+                    .lock()
+                    .expect("serving owner control")
+                    .pin
+                    .take();
+                driver.done = true;
+                self.update(|stats| stats.phase = ServingOwnerPhase::Released);
+                Ok(true)
+            }
+            PublicationState::Finished(Ok(PublicationOutcome::ServingCommand(value)))
+                if pending.kind != Kind::Release =>
+            {
+                let ServingReply::Granted(lease) = value.output else {
+                    return Err(ServingOwnerError::Context);
+                };
+                let pin = if pending.kind == Kind::Acquire {
+                    let Original::Command(original) = &pending.original else {
+                        return Err(ServingOwnerError::Context);
+                    };
+                    if let Some(pin) = self.pin() {
+                        pin
+                    } else {
+                        let pin = original.retain_acquisition(self.context.clone()).await?;
+                        self.control.lock().expect("serving owner control").pin = Some(pin.clone());
+                        pin
+                    }
+                } else {
+                    self.pin().ok_or(ServingOwnerError::Context)?
+                };
+                if lease.token != pin.token() || lease.fact != pin.fact() {
+                    return Err(ServingOwnerError::Context);
+                }
+                #[cfg(test)]
+                self.failpoint(if pending.kind == Kind::Acquire { 3 } else { 4 });
+                let renewed = pending.kind == Kind::Renew;
+                driver.pending.take();
+                driver.plan.take();
+                self.update(|stats| {
+                    stats.token = Some(pin.token());
+                    if renewed {
+                        stats.renewals = stats.renewals.saturating_add(1);
+                    }
+                });
+                match pin.authorize(Some(self.request.actor.clone())).await {
+                    Ok(deadline) => {
+                        driver.next_renewal =
+                            Instant::now() + deadline.saturating_duration_since(Instant::now()) / 3;
+                        self.update(|stats| stats.phase = ServingOwnerPhase::Ready);
+                        self.changed.notify_waiters();
+                    }
+                    Err(error) => {
+                        self.close();
+                        return Err(error.into());
+                    }
+                }
+                Ok(false)
+            }
+            _ => Err(ServingOwnerError::Context),
+        }
+    }
+}
+async fn run(inner: Arc<Inner>) {
+    loop {
+        let changed = inner.changed.notified();
+        tokio::pin!(changed);
+        changed.as_mut().enable();
+        match inner.step().await {
+            Ok(true) => {
+                inner.permit.lock().expect("serving owner admission").take();
+                inner.changed.notify_waiters();
+                return;
+            }
+            Ok(false) => {}
+            Err(error) => {
+                if matches!(
+                    &error,
+                    ServingOwnerError::Read(
+                        ServingReadError::Inactive
+                            | ServingReadError::Authority(PreparationBaseError::Inactive)
+                    )
+                ) {
+                    inner.close();
+                    // No original was submitted if its factory failed. Wait
+                    // for borrowers instead of churning unbuildable renewals.
+                    let mut driver = inner.driver.lock().await;
+                    if driver.pending.is_none() && inner.pin().is_some() {
+                        driver.plan.take();
+                        driver.renewal_denied = true;
+                    }
+                }
+                inner.update(|stats| {
+                    stats.retries = stats.retries.saturating_add(1);
+                    stats.last_error = Some(Arc::new(error));
+                });
+            }
+        }
+        tokio::select! { _ = changed => {}, _ = tokio::time::sleep(Duration::from_millis(100)) => {} }
+    }
+}
+async fn supervise(inner: Arc<Inner>) {
+    loop {
+        match tokio::spawn(run(inner.clone())).await {
+            Ok(()) => return,
+            Err(error) => inner.update(|stats| {
+                stats.retries = stats.retries.saturating_add(1);
+                stats.last_error = Some(Arc::new(ServingOwnerError::Read(ServingReadError::Task(
+                    error,
+                ))));
+            }),
+        }
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index 1d539526..87f40093 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -11,6 +11,7 @@ use cellule_runtime::{Committed, InvocationError, Receipt, primitives::sql::SqlC
 use std::sync::Mutex;
 use tokio::{sync::Notify, time::Instant};
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
+mod handoff;
 
 #[derive(Debug, thiserror::Error)]
 pub enum ServingReadError {
@@ -45,6 +46,8 @@ pub struct ServingReadBudget {
 }
 struct Budget {
     admission: AccountAdmission,
+    owners: AccountAdmission,
+    snapshots: AccountAdmission,
     tasks: TaskTracker,
     stop: CancellationToken,
 }
@@ -60,6 +63,16 @@ impl ServingReadBudget {
                     "node serving reads",
                     "account serving reads",
                 ),
+                owners: AccountAdmission::new(
+                    usize::from(limit),
+                    "node serving owners",
+                    "account serving owners",
+                ),
+                snapshots: AccountAdmission::new(
+                    usize::from(limit),
+                    "node serving snapshots",
+                    "account serving snapshots",
+                ),
                 tasks,
                 stop: CancellationToken::new(),
             }),
@@ -71,6 +84,7 @@ impl ServingReadBudget {
 }
 /// Trusted service configuration. No decoded catalog or lease DTO supplies
 /// closure authority: open reobserves the registered pin through this client.
+#[derive(Clone)]
 pub struct ServingContext {
     client: CellClient,
     target: CellTarget,
@@ -81,6 +95,45 @@ pub struct ServingContext {
     administrator: String,
 }
 impl ServingContext {
+    pub(super) fn client_for_owner(&self) -> CellClient {
+        self.client.clone()
+    }
+    pub(super) fn authority_for_owner(&self) -> PreparationAuthority {
+        self.authority.clone()
+    }
+    pub(super) async fn admit_owner(
+        &self,
+        actor: &str,
+    ) -> Result<crate::admission::AdmissionPermit, ServingReadError> {
+        if self.budget.inner.stop.is_cancelled() {
+            return Err(ServingReadError::Inactive);
+        }
+        Ok(self
+            .budget
+            .inner
+            .owners
+            .acquire(ReadIdentity::Account(actor))
+            .await?)
+    }
+    pub(super) async fn admit_snapshot(
+        &self,
+        actor: &Option<String>,
+    ) -> Result<crate::admission::AdmissionPermit, ServingReadError> {
+        if self.budget.inner.stop.is_cancelled() {
+            return Err(ServingReadError::Inactive);
+        }
+        let actor = actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        actor.validate()?;
+        Ok(self.budget.inner.snapshots.acquire(actor).await?)
+    }
+    pub(super) fn tasks(&self) -> TaskTracker {
+        self.budget.inner.tasks.clone()
+    }
+    pub(super) fn target_for_handoff(&self) -> CellTarget {
+        self.target.clone()
+    }
     pub fn new(
         client: CellClient,
         target: CellTarget,
@@ -145,6 +198,12 @@ struct ReleaseCommand {
     digest: [u8; 32],
 }
 impl ServingPin {
+    pub(super) async fn authorize(
+        &self,
+        actor: Option<String>,
+    ) -> Result<Instant, ServingReadError> {
+        Ok(self.inner.observe(actor).await?.1)
+    }
     pub async fn open(
         context: ServingContext,
         token: ServingToken,
diff --git a/crates/canopy-server/src/packs/publication/serving/session/handoff.rs b/crates/canopy-server/src/packs/publication/serving/session/handoff.rs
new file mode 100644
index 00000000..0823f8ab
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/handoff.rs
@@ -0,0 +1,67 @@
+//! Accepted original knowledge retains a root; fresh observations authorize I/O.
+use super::*;
+use crate::packs::publication::{custody::OwnedCustody, sql};
+
+impl ServingPin {
+    pub(in crate::packs::publication::serving) async fn retain_original(
+        context: ServingContext,
+        original: Arc<OwnedCustody>,
+    ) -> Result<Self, ServingReadError> {
+        // Cleanup remains possible after read admission closes. The trusted
+        // administrator's ordinary bounded node/account slot owns this probe.
+        let permit = context
+            .budget
+            .inner
+            .admission
+            .acquire(ReadIdentity::Account(&context.administrator))
+            .await?;
+        let tasks = context.budget.inner.tasks.clone();
+        tasks.spawn(async move {
+            let _permit = permit;
+            if original.evidence().target() != &context.target {
+                return Err(ServingReadError::Context);
+            }
+            let lease = original.serving_grant(&context.client).await
+                .map_err(|error| ServingReadError::Custody(Box::new(error)))?;
+            if lease.format != context.indexes.sources().format() {
+                return Err(ServingReadError::Context);
+            }
+            context.authority.check(&context.target, lease.token.owner).await?;
+            let exclusive = super::super::ownership::reserve(&context.target, lease.token)?;
+            let sql = SqlCell::<RepositoryModule>::new(context.client.clone(), context.target.clone())?;
+            let mut batch = sql::statement(
+                "SELECT incarnation,admission_sequence,owner_epoch,generation FROM catalog_serving_pins WHERE reader=?1",
+                vec![SqlValue::Blob(lease.token.reader.to_vec())],
+            );
+            batch.statements.extend(sql::statement(
+                sql::GENERATION,
+                vec![sql::number(lease.token.generation)?],
+            ).statements);
+            let sets = sql.query(None, batch).await
+                .map_err(|error| ServingReadError::Proof(Box::new(error)))?;
+            use sql::{fixed, generation, rows, unsigned};
+            let (retained, generations) = sets.output.split_first().ok_or(ServingReadError::Context)?;
+            let Some([incarnation, sequence, epoch, retained_generation]) = rows(std::slice::from_ref(retained))?.first().map(Vec::as_slice) else {
+                return Err(ServingReadError::Inactive);
+            };
+            if fixed::<16>(incarnation)? != *lease.token.owner.incarnation.as_bytes()
+                || unsigned(sequence)? != lease.token.admission_sequence
+                || u64::from_be_bytes(fixed(epoch)?) != lease.token.owner.epoch
+                || unsigned(retained_generation)? != lease.token.generation
+                || generation(generations, lease.token.repository, lease.format)? != lease.fact
+            {
+                return Err(ServingReadError::Context);
+            }
+            context.authority.check(&context.target, lease.token.owner).await?;
+            Ok(Self { inner: Arc::new(Inner {
+                _exclusive: exclusive,
+                context,
+                lease,
+                state: Mutex::new(Workers::default()),
+                changed: Notify::new(),
+                reader: tokio::sync::Mutex::new(None),
+                release: tokio::sync::Mutex::new(None),
+            }) })
+        }).await?
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index 5a73fc28..724004aa 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -8,6 +8,7 @@ use cellule_runtime::{Committed, PreparedCommand};
 use tokio::time::{Duration, timeout};
 use tokio_util::task::TaskTracker;
 mod custody;
+mod lifecycle;
 mod selection_drain;
 
 async fn initialize(f: &Fixture, store: Arc<ArtifactStore>) -> Result<GenerationFact> {
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/blocked.rs b/crates/canopy-server/src/packs/publication/tests/serving/blocked.rs
index 19eab237..b182f77b 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/blocked.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/blocked.rs
@@ -9,14 +9,14 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use tokio::sync::Semaphore;
 
 #[derive(Debug)]
-struct Gate {
+pub(super) struct Gate {
     store: InMemory,
-    armed: AtomicBool,
-    entered: Semaphore,
-    proceed: Semaphore,
+    pub(super) armed: AtomicBool,
+    pub(super) entered: Semaphore,
+    pub(super) proceed: Semaphore,
 }
 impl Gate {
-    fn new() -> Self {
+    pub(super) fn new() -> Self {
         Self {
             store: InMemory::new(),
             armed: AtomicBool::new(false),
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
new file mode 100644
index 00000000..709f5829
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
@@ -0,0 +1,583 @@
+//! Accepted ownership survives actual command, lease and observer boundaries.
+use super::*;
+use cellule_runtime::Resolution;
+mod restarts;
+
+fn queue(f: &Fixture) -> Result<PublicationCoordinator> {
+    Ok(PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?)
+}
+fn input(f: &Fixture, reader: u8, actor: &str, lease_ms: u64) -> BeginRequest {
+    let mut input = f.begin([reader; 16]);
+    input.actor = actor.into();
+    input.lease_ms = lease_ms;
+    input
+}
+fn shared_context(
+    f: &Fixture,
+    store: Arc<ArtifactStore>,
+    root: &tempfile::TempDir,
+    budget: ServingReadBudget,
+) -> Result<ServingContext> {
+    Ok(ServingContext::new(
+        f.client(),
+        f.target.clone(),
+        f.authority(),
+        Arc::new(CatalogIndexes::new(store.clone(), f.format)),
+        Arc::new(CatalogFiles::new(
+            root.path(),
+            DiskBudget::new(64 << 20),
+            store,
+            f.format,
+            CatalogFileLimits::default(),
+        )?),
+        budget,
+        "owner".into(),
+    )?)
+}
+async fn ready(owner: &ServingOwner) -> Result<ServingOwnerStats> {
+    Ok(timeout(Duration::from_secs(8), async {
+        loop {
+            let stats = owner.stats();
+            if stats.phase == ServingOwnerPhase::Ready {
+                break stats;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?)
+}
+async fn zero_pins(f: &Fixture) -> Result {
+    timeout(Duration::from_secs(8), async {
+        while pin_count(f).await.unwrap() != 0 {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
+    Ok(())
+}
+async fn command(ticket: &PublicationTicket) -> Result<Committed<ServingReply>> {
+    match timeout(Duration::from_secs(8), ticket.wait()).await? {
+        PublicationState::Finished(Ok(PublicationOutcome::ServingCommand(value))) => Ok(value),
+        state => Err(format!("serving command {state:?}").into()),
+    }
+}
+async fn original(
+    f: &Fixture,
+    reader: u8,
+    actor: &str,
+    lease_ms: u64,
+) -> Result<ReadyServingCommand> {
+    Ok(ReadyServingCommand::acquire(
+        f.client(),
+        f.target.clone(),
+        input(f, reader, actor, lease_ms),
+        identity()?,
+        f.authority(),
+    )
+    .await?)
+}
+
+#[tokio::test]
+async fn accepted_local_handoff_retains_expired_revoked_grant_without_granting_read() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let fact = initialize(&f, store.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = queue(&f)?;
+        let request = original(&f, 212, "viewer", 1_000).await?;
+        let grant = granted(
+            command(&q.submit(request.dispatch_copy()).await?)
+                .await?
+                .output,
+        )?;
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+        tokio::time::sleep(Duration::from_millis(1_100)).await;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let budget = ServingReadBudget::new(4, tasks.clone())?;
+        budget.close();
+        let pin = request
+            .retain_acquisition(shared_context(&f, store.clone(), &root, budget)?)
+            .await?;
+        assert_eq!(pin.token(), grant.token);
+        assert_eq!(pin.fact(), fact);
+        assert!(matches!(
+            pin.headers(Some("viewer".into()), &[missing(&f)?]).await,
+            Err(ServingReadError::Inactive)
+        ));
+        assert_eq!(pin_count(&f).await?, 1);
+        assert_eq!(
+            release(&f, &pin).await?.output,
+            ServingReleaseReply::Released
+        );
+        assert!(
+            request
+                .retain_acquisition(context(&f, store, &root, tasks.clone())?)
+                .await
+                .is_err()
+        );
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn missing_denied_and_restored_originals_cannot_mint_physical_handoff() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pending = original(&f, 214, "owner", DEFAULT_LEASE_MS).await?;
+        assert!(
+            pending
+                .retain_acquisition(context(&f, store.clone(), &root, tasks.clone())?)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        q.fault_for_test(1);
+        let ticket = q.submit(pending.dispatch_copy()).await?;
+        assert!(matches!(
+            ticket.wait().await,
+            PublicationState::Uncertain(_)
+        ));
+        assert!(
+            pending
+                .retain_acquisition(context(&f, store.clone(), &root, tasks.clone())?)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        ticket.recover().await?;
+        let accepted = command(&ticket).await?;
+        let restored =
+            ReadyServingCommand::restore(f.client(), f.target.clone(), [214; 16], f.authority())
+                .await?;
+        assert_eq!(restored.evidence(), pending.evidence());
+        assert!(matches!(
+            restored
+                .retain_acquisition(context(&f, store.clone(), &root, tasks.clone())?)
+                .await,
+            Err(ServingReadError::Context)
+        ));
+        let pin = pending
+            .retain_acquisition(context(&f, store.clone(), &root, tasks.clone())?)
+            .await?;
+        assert_eq!(pin.token(), granted(accepted.output)?.token);
+        assert!(matches!(
+            pending
+                .retain_acquisition(context(&f, store.clone(), &root, tasks.clone())?)
+                .await,
+            Err(ServingReadError::AlreadyOwned)
+        ));
+        let denied = original(&f, 215, "other", DEFAULT_LEASE_MS).await?;
+        assert!(matches!(
+            q.submit(denied.dispatch_copy()).await?.wait().await,
+            PublicationState::Finished(Err(_))
+        ));
+        assert!(
+            denied
+                .retain_acquisition(context(&f, store, &root, tasks.clone())?)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        release(&f, &pin).await?;
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn handoff_uses_original_acquisition_ordinal_after_a_later_renewal() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    let fact = initialize(&f, store.clone()).await?;
+    let q = queue(&f)?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let original = original(&f, 216, "owner", DEFAULT_LEASE_MS).await?;
+    let accepted = command(&q.submit(original.dispatch_copy()).await?).await?;
+    let pin = original
+        .retain_acquisition(context(&f, store.clone(), &root, tasks.clone())?)
+        .await?;
+    let renewal = pin
+        .ready_renew(
+            "owner".into(),
+            f.begin([216; 16]).request_digest,
+            identity()?,
+            DEFAULT_LEASE_MS,
+        )
+        .await?;
+    let renewed = command(&q.submit(renewal.dispatch_copy()).await?).await?;
+    assert!(renewed.receipt.commit_sequence > accepted.receipt.commit_sequence);
+    assert!(matches!(
+        renewal
+            .retain_acquisition(context(&f, store.clone(), &root, tasks.clone())?)
+            .await,
+        Err(ServingReadError::Context)
+    ));
+    drop(renewal);
+    drop(pin);
+    let retained = original
+        .retain_acquisition(context(&f, store, &root, tasks.clone())?)
+        .await?;
+    assert_eq!(
+        retained.token().admission_sequence,
+        accepted.receipt.commit_sequence
+    );
+    assert_eq!(retained.fact(), fact);
+    release(&f, &retained).await?;
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn automatic_owner_recovers_all_six_fault_modes_after_snapshot_observer_loss() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in 1..=6 {
+            let f = Fixture::new(format).await?;
+            let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+            initialize(&f, store.clone()).await?;
+            let q = queue(&f)?;
+            let root = tempfile::TempDir::new()?;
+            let tasks = TaskTracker::new();
+            let (dispatch, entered) = q.pause_for_test().await;
+            q.fault_for_test(fault);
+            let owner = ServingOwner::start(
+                context(&f, store, &root, tasks.clone())?,
+                q.clone(),
+                input(&f, 217, "owner", DEFAULT_LEASE_MS),
+                identity()?,
+            )
+            .await?;
+            let observed = owner.clone();
+            let observer =
+                tokio::spawn(async move { observed.snapshot(Some("owner".into())).await });
+            timeout(Duration::from_secs(8), entered).await??;
+            observer.abort();
+            assert!(
+                observer
+                    .await
+                    .err()
+                    .ok_or("observer completed")?
+                    .is_cancelled()
+            );
+            dispatch.send(()).map_err(|_| "dispatcher lost")?;
+            let stats = ready(&owner).await?;
+            assert_eq!(stats.token.ok_or("token")?.reader, [217; 16]);
+            let saved = RegisteredCustody::load_for(
+                &f.client(),
+                &f.target,
+                CustodyPurpose::Serving,
+                [217; 16],
+            )
+            .await?
+            .ok_or("original missing")?;
+            assert_eq!(
+                saved
+                    .recover_serving(&f.client())
+                    .await?
+                    .receipt
+                    .commit_sequence,
+                stats.token.unwrap().admission_sequence
+            );
+            let snapshot = owner.snapshot(Some("owner".into())).await?;
+            assert_eq!(snapshot.headers(&[missing(&f)?]).await?, vec![None]);
+            drop(snapshot);
+            assert_eq!(
+                timeout(Duration::from_secs(8), owner.close_and_drain())
+                    .await?
+                    .phase,
+                ServingOwnerPhase::Released
+            );
+            assert_eq!(pin_count(&f).await?, 0);
+            assert_eq!(q.stats().await.command_bytes, 0);
+            assert!(q.close_and_drain().await.is_empty());
+            tasks.close();
+            tasks.wait().await;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clone_drops() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let fact = initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let owner = ServingOwner::start(
+            context(&f, store, &root, tasks.clone())?,
+            q.clone(),
+            input(&f, 218, "owner", 1_000),
+            identity()?,
+        )
+        .await?;
+        ready(&owner).await?;
+        let snapshot = owner.snapshot(Some("owner".into())).await?;
+        let clone = snapshot.clone();
+        let token = owner.stats().token.ok_or("token")?;
+        owner.close();
+        assert!(matches!(
+            owner.snapshot(Some("owner".into())).await,
+            Err(ServingReadError::Inactive)
+        ));
+        tokio::time::sleep(Duration::from_millis(1_500)).await;
+        assert!(owner.stats().renewals >= 2, "{:?}", owner.stats());
+        assert_eq!(owner.stats().token, Some(token));
+        assert_eq!(snapshot.fact(), fact);
+        assert_eq!(snapshot.headers(&[missing(&f)?]).await?, vec![None]);
+        drop(snapshot);
+        assert_eq!(pin_count(&f).await?, 1);
+        drop(clone);
+        assert_eq!(
+            timeout(Duration::from_secs(8), owner.close_and_drain())
+                .await?
+                .phase,
+            ServingOwnerPhase::Released
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn last_handle_drop_drains_after_borrow_and_joins_uncertain_release() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let q = queue(&f)?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let owner = ServingOwner::start(
+        context(&f, store, &root, tasks.clone())?,
+        q.clone(),
+        input(&f, 219, "owner", DEFAULT_LEASE_MS),
+        identity()?,
+    )
+    .await?;
+    ready(&owner).await?;
+    let snapshot = owner.snapshot(Some("owner".into())).await?;
+    let drained = owner.drain_observer();
+    drop(owner);
+    assert_eq!(pin_count(&f).await?, 1);
+    assert_eq!(snapshot.headers(&[missing(&f)?]).await?, vec![None]);
+    q.fault_for_test(3);
+    drop(snapshot);
+    assert_eq!(
+        timeout(Duration::from_secs(8), drained.wait()).await?.phase,
+        ServingOwnerPhase::Released
+    );
+    zero_pins(&f).await?;
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn denied_release_stays_owned_until_current_admin_can_authentically_release() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let q = queue(&f)?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let owner = ServingOwner::start(
+        context(&f, store, &root, tasks.clone())?,
+        q.clone(),
+        input(&f, 220, "owner", DEFAULT_LEASE_MS),
+        identity()?,
+    )
+    .await?;
+    ready(&owner).await?;
+    let (dispatch, entered) = q.pause_for_test().await;
+    owner.close();
+    timeout(Duration::from_secs(8), entered).await??;
+    edit(&f, "UPDATE repository_identity SET owner='other'").await?;
+    dispatch.send(()).map_err(|_| "dispatcher lost")?;
+    timeout(Duration::from_secs(8), async {
+        while owner.stats().last_error.is_none() {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
+    assert_eq!(pin_count(&f).await?, 1);
+    let closing = owner.clone();
+    let observer = tokio::spawn(async move { closing.close_and_drain().await });
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    assert!(!observer.is_finished());
+    observer.abort();
+    assert!(observer.await.err().ok_or("closed early")?.is_cancelled());
+    edit(&f, "UPDATE repository_identity SET owner='owner'").await?;
+    assert_eq!(
+        timeout(Duration::from_secs(8), owner.close_and_drain())
+            .await?
+            .phase,
+        ServingOwnerPhase::Released
+    );
+    assert_eq!(pin_count(&f).await?, 0);
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn closed_read_budget_refuses_new_work_but_preserves_existing_owner_cleanup() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha1).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    let q = queue(&f)?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let budget = ServingReadBudget::new(4, tasks.clone())?;
+    let context = shared_context(&f, store, &root, budget.clone())?;
+    let owner = ServingOwner::start(
+        context.clone(),
+        q.clone(),
+        input(&f, 221, "owner", 1_000),
+        identity()?,
+    )
+    .await?;
+    ready(&owner).await?;
+    let snapshot = owner.snapshot(Some("owner".into())).await?;
+    budget.close();
+    owner.close();
+    assert!(
+        ServingOwner::start(
+            context,
+            q.clone(),
+            input(&f, 222, "owner", DEFAULT_LEASE_MS),
+            identity()?
+        )
+        .await
+        .is_err()
+    );
+    assert!(matches!(
+        snapshot.headers(&[missing(&f)?]).await,
+        Err(ServingReadError::Inactive)
+    ));
+    tokio::time::sleep(Duration::from_millis(500)).await;
+    assert_eq!(pin_count(&f).await?, 1);
+    drop(snapshot);
+    assert_eq!(
+        timeout(Duration::from_secs(8), owner.close_and_drain())
+            .await?
+            .phase,
+        ServingOwnerPhase::Released
+    );
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn shared_owner_and_snapshot_budgets_preserve_account_shares_and_physical_read_slots()
+-> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+    initialize(&f, store.clone()).await?;
+    edit(
+        &f,
+        "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+    )
+    .await?;
+    let q = queue(&f)?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let context = shared_context(&f, store, &root, ServingReadBudget::new(4, tasks.clone())?)?;
+    let mut owners = Vec::new();
+    for reader in 223..=224 {
+        owners.push(
+            ServingOwner::start(
+                context.clone(),
+                q.clone(),
+                input(&f, reader, "owner", DEFAULT_LEASE_MS),
+                identity()?,
+            )
+            .await?,
+        );
+    }
+    assert!(
+        ServingOwner::start(
+            context.clone(),
+            q.clone(),
+            input(&f, 225, "owner", DEFAULT_LEASE_MS),
+            identity()?
+        )
+        .await
+        .is_err()
+    );
+    owners.push(
+        ServingOwner::start(
+            context,
+            q.clone(),
+            input(&f, 226, "viewer", DEFAULT_LEASE_MS),
+            identity()?,
+        )
+        .await?,
+    );
+    for owner in &owners {
+        ready(owner).await?;
+    }
+    assert_eq!(pin_count(&f).await?, 3);
+    let first = owners[0].snapshot(Some("owner".into())).await?;
+    let second = owners[0].snapshot(Some("owner".into())).await?;
+    assert!(owners[0].snapshot(Some("owner".into())).await.is_err());
+    let other = owners[0].snapshot(Some("viewer".into())).await?;
+    assert_eq!(first.headers(&[missing(&f)?]).await?, vec![None]);
+    assert_eq!(other.headers(&[missing(&f)?]).await?, vec![None]);
+    drop(first);
+    drop(second);
+    drop(other);
+    for owner in owners {
+        assert_eq!(
+            timeout(Duration::from_secs(8), owner.close_and_drain())
+                .await?
+                .phase,
+            ServingOwnerPhase::Released
+        );
+    }
+    assert_eq!(pin_count(&f).await?, 0);
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/lifecycle/restarts.rs b/crates/canopy-server/src/packs/publication/tests/serving/lifecycle/restarts.rs
new file mode 100644
index 00000000..c77e380b
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/lifecycle/restarts.rs
@@ -0,0 +1,226 @@
+use super::*;
+
+#[tokio::test]
+async fn known_registration_denial_closes_without_a_pin_or_namespace_and_returns_owner_admission()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let context = shared_context(&f, store, &root, ServingReadBudget::new(2, tasks.clone())?)?;
+        let before = f.counts().await?;
+        for reader in 229..=231 {
+            let owner = ServingOwner::start(
+                context.clone(),
+                q.clone(),
+                input(&f, reader, "other", DEFAULT_LEASE_MS),
+                identity()?,
+            )
+            .await?;
+            let result = timeout(Duration::from_secs(8), owner.drain_observer().wait()).await?;
+            assert_eq!(result.phase, ServingOwnerPhase::Denied);
+            assert!(result.token.is_none());
+            assert_eq!(pin_count(&f).await?, 0);
+            assert_eq!(f.counts().await?, before);
+            assert!(owner.snapshot(Some("other".into())).await.is_err());
+        }
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn lost_acquisition_ack_then_read_revocation_still_hands_off_and_authentically_drains()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (dispatch, entered) = q.pause_for_test().await;
+        q.fault_for_test(2);
+        let owner = ServingOwner::start(
+            context(&f, store, &root, tasks.clone())?,
+            q.clone(),
+            input(&f, 232, "viewer", DEFAULT_LEASE_MS),
+            identity()?,
+        )
+        .await?;
+        let (recover, recovering) = owner.pause_recovery_for_test().await;
+        timeout(Duration::from_secs(8), entered).await??;
+        dispatch.send(()).map_err(|_| "dispatch disappeared")?;
+        timeout(Duration::from_secs(8), recovering).await??;
+        let ticket = q
+            .pending_serving_command([232; 16])
+            .await
+            .ok_or("owned uncertainty disappeared")?;
+        assert!(matches!(ticket.state(), PublicationState::Uncertain(_)));
+        assert_eq!(pin_count(&f).await?, 1);
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+        recover.send(()).map_err(|_| "recovery owner disappeared")?;
+        let result = timeout(Duration::from_secs(8), owner.drain_observer().wait()).await?;
+        assert_eq!(result.phase, ServingOwnerPhase::Released);
+        assert!(result.token.is_some());
+        assert!(matches!(
+            ticket.state(),
+            PublicationState::Finished(Ok(PublicationOutcome::ServingCommand(_)))
+        ));
+        assert_eq!(pin_count(&f).await?, 0);
+        assert!(owner.snapshot(Some("viewer".into())).await.is_err());
+        let saved =
+            RegisteredCustody::load_for(&f.client(), &f.target, CustodyPurpose::Serving, [232; 16])
+                .await?
+                .ok_or("recorded grant lost")?;
+        assert!(matches!(
+            saved.recover_serving(&f.client()).await?.output,
+            ServingReply::Granted(_)
+        ));
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn producer_restarts_preserve_factory_identity_held_ticket_capture_renewal_and_release()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for point in 1..=5 {
+            let f = Fixture::new(format).await?;
+            let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+            initialize(&f, store.clone()).await?;
+            let q = queue(&f)?;
+            let root = tempfile::TempDir::new()?;
+            let tasks = TaskTracker::new();
+            let first = identity()?;
+            let owner = ServingOwner::start(
+                context(&f, store, &root, tasks.clone())?,
+                q.clone(),
+                input(&f, 227, "owner", 2_000),
+                first,
+            )
+            .await?;
+            // The current-thread runtime cannot run the spawned producer until
+            // this caller next yields, after its failure point is configured.
+            owner.fault_for_test(point);
+            let stats = ready(&owner).await?;
+            let token = stats.token.ok_or("token")?;
+            if point == 4 {
+                timeout(Duration::from_secs(8), async {
+                    while owner.stats().renewals == 0 {
+                        tokio::time::sleep(Duration::from_millis(10)).await;
+                    }
+                })
+                .await?;
+            }
+            if point <= 3 {
+                let saved = RegisteredCustody::load_for(
+                    &f.client(),
+                    &f.target,
+                    CustodyPurpose::Serving,
+                    [227; 16],
+                )
+                .await?
+                .ok_or("original")?;
+                assert_eq!(saved.evidence().identity().request_id, first.request_id);
+                assert!(matches!(
+                    f.client().resolve(saved.evidence()).await?,
+                    Resolution::Committed(_)
+                ));
+                assert_eq!(
+                    token.admission_sequence,
+                    saved
+                        .recover_serving(&f.client())
+                        .await?
+                        .receipt
+                        .commit_sequence
+                );
+            }
+            let final_state = timeout(Duration::from_secs(8), owner.close_and_drain()).await?;
+            assert_eq!(final_state.phase, ServingOwnerPhase::Released);
+            assert!(final_state.retries >= 1, "point {point}: {final_state:?}");
+            assert_eq!(final_state.token, Some(token));
+            assert_eq!(pin_count(&f).await?, 0);
+            assert!(q.close_and_drain().await.is_empty());
+            tasks.close();
+            tasks.wait().await;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn owner_drain_keeps_cell_root_and_workspace_until_detached_provider_work_finishes() -> Result
+{
+    use std::sync::atomic::Ordering;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::super::blocked::Gate::new());
+        let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let owner = ServingOwner::start(
+            context(&f, store, &root, tasks.clone())?,
+            q.clone(),
+            input(&f, 228, "owner", DEFAULT_LEASE_MS),
+            identity()?,
+        )
+        .await?;
+        ready(&owner).await?;
+        let snapshot = owner.snapshot(Some("owner".into())).await?;
+        provider.armed.store(true, Ordering::Release);
+        let oid = missing(&f)?;
+        let observed = tokio::spawn(async move { snapshot.headers(&[oid]).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        observed.abort();
+        assert!(
+            observed
+                .await
+                .err()
+                .ok_or("provider completed")?
+                .is_cancelled()
+        );
+        let closing = owner.clone();
+        let drain = tokio::spawn(async move { closing.close_and_drain().await });
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        assert!(!drain.is_finished());
+        assert!(!tasks.is_empty());
+        assert_eq!(pin_count(&f).await?, 1);
+        assert!(root.path().exists());
+        assert!(matches!(
+            owner.snapshot(Some("owner".into())).await,
+            Err(ServingReadError::Inactive)
+        ));
+        provider.proceed.add_permits(1);
+        assert_eq!(
+            timeout(Duration::from_secs(8), drain).await??.phase,
+            ServingOwnerPhase::Released
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index 23ed6e6c..b483236a 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -3,8 +3,9 @@
 Serving readers need an authorized immutable catalog/ref snapshot whose retained
 artifacts cannot disappear while an owned worker is suspended. The implementation
 adds a bounded serving-pin receiver and an owned metadata-read capability. This
-is a foundation for production reader conversion; the production manager does
-not yet acquire, renew, cache or hand off these pins to its serving consumers.
+is a foundation for production reader conversion. A service-owned producer now
+acquires, retains, renews and drains one generation independently of its callers;
+the production manager does not yet pool or hand these owners to its consumers.
 The branch remains unreleasable until that conversion and the full cutover gates
 are complete.
 
@@ -72,8 +73,8 @@ original. The ready value, held admission, dispatch and uncertain recovery share
 that same guard. Closing the pin waits until a proven unexecuted held command is
 discarded or the exact original reaches a known disposition. Cancellation of an
 observer cannot release it. The production owner must retain and activate/discard
-held tickets and drive uncertain recovery; this primitive is not a complete
-resident pin pool or automatic renewal supervisor.
+held tickets and drive uncertain recovery. `ServingOwner` now performs that
+ownership and automatic renewal; a resident generation pool is still required.
 
 The existing bounded custody scanner also visits serving heads and can retire an
 expired unexecuted original. A stop records logical closure and never invents an
@@ -84,6 +85,71 @@ admitted immutable history frames and exact lookup to bound long-term growth.
 
 ## Capability construction and admitted reads
 
+### Owned producer and accepted acquisition handoff
+
+`ServingOwner::start` obtains bounded owner admission before spawning a private
+supervisor. The supervisor retains its proposed SDK identity, factory plan,
+original prepared command and any held ticket outside the restartable worker.
+It activates held originals and resolves uncertainty through their exact
+evidence. Registration/execution transport loss, worker panic and caller loss
+cannot replace an admitted original with a fresh acquisition or renewal.
+
+Before publishing a successful acquisition to borrowers, the producer calls
+`ReadyServingCommand::retain_acquisition`. Only an original local acquisition
+can use that handoff; a restored journal command or a renewal cannot. The probe
+loads the acquisition's exact ordinal, authenticates its recorded acceptance and
+checks its original admission sequence. It then reserves the existing exclusive
+physical owner, verifies the still-retained exact SQL pin and historical
+generation, and brackets that observation with actual owner checks. A later
+renewal must not hide the acquisition ordinal. No absent or denied command is
+executed by this probe, and no receipt DTO becomes a physical capability.
+
+Accepted acquisition knowledge remains available after lease expiry or Read
+revocation. This permits retention and authenticated cleanup rather than fresh
+I/O: every serving operation still checks current access, exact pin, actual
+owner and a conservative lease deadline. Cleanup may use the administrator's
+bounded physical-read slot after read admission closes. A released, rebound or
+missing row fails handoff; duplicate physical ownership is rejected.
+
+`ServingSnapshot` carries a private borrow guard and exposes only the generation
+fact and admitted metadata headers. Clones share that guard until the last clone
+drops. Closing a producer refuses new borrows while existing borrows retain their
+generation and continue renewal. Renewal is scheduled at one third of the
+conservatively observed remaining lease; this is a scheduling policy, not a
+guarantee that an overloaded or fenced owner can renew. Read revocation, expiry
+or known renewal denial closes new borrowing. Physical roots remain retained.
+
+After the last borrow, the owner stops producing renewals, joins actual pin
+workers and prepares the authenticated exact release. Uncertain releases keep
+their original. Only a settled denial allows a new release proof to be prepared
+after administrator access is restored. Neither a denied release nor an
+observer timeout counts as drain. The last producer handle initiates closure;
+`ServingDrainObserver` joins its real completion without keeping admission open.
+The supervisor and physical pin outlive detached observers. Loss of authority
+can keep cleanup pending; physical fencing/adoption remains mandatory work.
+
+Owner, snapshot and physical-I/O admissions each use the configured 2–64 node
+limit and half-cap account share, with separate semaphores. Owner admission
+covers the producer's entire lifetime, including a built original before queue
+admission. Snapshot admission covers waiting and returned borrow lifetimes.
+Long-lived snapshots therefore cannot exhaust the separate physical-I/O slots.
+Read budgets must be shared once per node; repository-scoped artifact/index
+clients must be shared across the resident's generations. Producer tasks use a
+private tracker so their drain can be joined explicitly; production
+must stop and join them before closing the node tracker or publication budget.
+
+Thirteen focused lifecycle families pass on macOS/Rust 1.98.0. They cover both
+formats, six registrar/execution fault modes, five producer restart points,
+borrowed renewal and clone lifetime, deterministic lost-ack/revocation ordering,
+denied registration/release, closed read admission, original-ordinal handoff,
+independent contexts' physical exclusion, canceled observers and blocked actual
+artifact-provider I/O. They qualify this component, not resident pooling,
+process fencing/adoption, production reader conversion or large-team capacity.
+The owner fixtures use certified initialized empty catalogs and missing-object
+lookups. Full nonempty native/body/history reads require their own production
+conversion and qualification; suspended real provider I/O proves drain ownership,
+not full-repository serving performance.
+
 `ServingContext` is explicit trusted configuration: real CellClient/target,
 actual PreparationAuthority, shared CatalogIndexes/CatalogFiles, shared node
 read budget/TaskTracker, and repository administrator identity. Passing decoded
@@ -183,15 +249,36 @@ owner fence.
 
 ## Production integration and qualification gates
 
-The next serving layer must integrate these exact acquisition and renewal
-commands into a resident producer and hand off retained capabilities before
-observers can detach. Command reconstruction alone does not establish this
-physical ownership handoff. Cache/coalesce a bounded set of active generation
+The next serving layer must integrate `ServingOwner` and its accepted acquisition
+handoff into production residency. Command reconstruction alone does not
+establish physical ownership. Cache/coalesce a bounded set of active generation
 owners per repository rather than allocating a pin per browser/SDE. Carry that
 ownership through native work, object bodies and response streams; integrate
 its drain into actual eviction and shutdown. A close must join all producers and
 workers before Cell/workspace/artifact release.
 
+Production integration must preserve these boundaries:
+
+1. `RepositoryManager` owns the node read budget. Each local resident owns one
+   repository-scoped context and bounded generation pool, sharing its index/file
+   caches. Coalesce acquisitions rather than constructing a producer per viewer.
+   Query 48 observes a head; acquisition selects and retains its actual accepted
+   fact atomically. A head race must not associate a producer with an earlier
+   observation's generation. Product reads bind to the accepted joint fact.
+2. Eviction pauses acquisition/renewal producers and new borrows before reserving
+   exact drain admission. A pause handshake must account for built/held/uncertain
+   originals; merely toggling a boolean cannot establish an idle coordinator.
+   Refusal resumes the same owners. One blocked old-generation worker must not
+   serialize unrelated live-generation renewal.
+3. Shutdown stops borrowing and joins all generation producers while Cell,
+   administrator authority and publication admission remain usable. Only then
+   may the node tracker/publication budget close and resident recovery/Cell/
+   workspace drain finish. The current shutdown path is not yet wired this way.
+4. Actual process fencing and restored-owner adoption must precede releasing an
+   abandoned pin. A historical lease or an expired deadline is insufficient.
+   Quota recovery must use that authenticated lifecycle rather than reaping SQL
+   roots based on expiry.
+
 Regression families exercise Read/public access, joint initialization, original
 acquisition replay after release, token scope, revocation, expiry, monotone
 renewal, generation reaping, schema quota/identity guards, blocked real provider
diff --git a/docs/evidence/serving-owner-20261004.json b/docs/evidence/serving-owner-20261004.json
new file mode 100644
index 00000000..5a87c8d8
--- /dev/null
+++ b/docs/evidence/serving-owner-20261004.json
@@ -0,0 +1,212 @@
+{
+  "source_files": 468,
+  "rust_files": 454,
+  "source_hash_digest": "15b8b304b6e94849fbc3ebc156f8004efb4b92aaf08faedd6f2a9e634d52c732",
+  "phases": [
+    {
+      "label": "clippy",
+      "exit_code": 0,
+      "log": "/tmp/canopy-serving-owner-clippy.log",
+      "preceding_unchanged_source": true,
+      "log_sha256": "4bee68cce0c5bc16353ee4eade3198820acc007be132601c6f1aaac76052d1e4"
+    },
+    {
+      "label": "focused",
+      "exit_code": 0,
+      "log": "/tmp/canopy-serving-owner-focused.log",
+      "preceding_unchanged_source": true,
+      "log_sha256": "049a023df5e6a7f558f229dccefbc0bb562e6403c65fdd81f336a6d3522bfcbc"
+    },
+    {
+      "label": "library",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "--workspace",
+        "--lib",
+        "--locked",
+        "--",
+        "--test-threads=4"
+      ],
+      "exit_code": 101,
+      "seconds": 306.149,
+      "log": "/tmp/canopy-serving-owner-library.log",
+      "passed": 659,
+      "failed": 5,
+      "ignored": 0,
+      "publication_passed": 370,
+      "known_failures": [
+        "git_gateway::fetch::tests::reachability_stops_at_live_refs_without_scanning_other_history",
+        "object_reads::tests::byte_limited_page_advances_only_over_the_selected_prefix",
+        "object_reads::tests::duplicate_rollback_and_deletion_do_not_hide_subsequent_inserts",
+        "object_reads::tests::insertion_cursor_finds_lower_oids_and_excludes_later_publications",
+        "object_reads::tests::small_increment_uses_bounded_sql_work_after_large_history"
+      ],
+      "nested_summaries_excluded": 2,
+      "log_sha256": "0270e2739cb943f4015ad93caecf7e6d1d592e794409e3aedff735302650aab9"
+    },
+    {
+      "label": "workspace",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "workspace::",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 55.346,
+      "log": "/tmp/canopy-serving-owner-workspace.log",
+      "passed": 3,
+      "log_sha256": "e624ecbce6f17a4c7b0b3596c91923fdde6d409653529ea5e6182a743e1c547c"
+    },
+    {
+      "label": "lifecycle",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::fork::",
+        "lifecycle::cancelled_prebound_startup",
+        "lifecycle::runtime_destruction",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 2.578,
+      "log": "/tmp/canopy-serving-owner-lifecycle.log",
+      "passed": 2,
+      "log_sha256": "144e78806ba656a04f0d78e90d743461f1abb0fe3391673f5c5c8e969553fee5"
+    },
+    {
+      "label": "drain",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::cancelled_startup_keeps_workspace",
+        "lifecycle::dropped_handle_and_cancelled_shutdown",
+        "lifecycle::failed_drain_retains_workspace",
+        "lifecycle::startup_rejects_ignored_conditional",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 2.542,
+      "log": "/tmp/canopy-serving-owner-drain.log",
+      "passed": 4,
+      "log_sha256": "6a024d55ca170f22153fd32e74cfb309b29def579a59646ff551ecef2312212b"
+    },
+    {
+      "label": "build",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "build",
+        "--locked",
+        "--bin",
+        "canopy"
+      ],
+      "exit_code": 0,
+      "seconds": 37.259,
+      "log": "/tmp/canopy-serving-owner-build.log",
+      "log_sha256": "60125a374783a064cfd21cb84bb2e3bdba615a41d566065c2e528186072e25ea"
+    },
+    {
+      "label": "fmt",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 1.148,
+      "log": "/tmp/canopy-serving-owner-fmt.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "diff",
+      "command": [
+        "git",
+        "diff",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 0.048,
+      "log": "/tmp/canopy-serving-owner-diff.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "harness",
+      "command": [
+        "python3",
+        "-B",
+        "-m",
+        "unittest",
+        "discover",
+        "-s",
+        "scripts",
+        "-p",
+        "test_*.py"
+      ],
+      "exit_code": 0,
+      "seconds": 41.109,
+      "log": "/tmp/canopy-serving-owner-harness.log",
+      "log_sha256": "1d58c5218a1e090b434b641ebbcda2d16f500a7f37bdcaae710d64d00ce43e53"
+    }
+  ],
+  "release_qualified": false,
+  "driver_diagnostic": "The driver exited 1 twice after completed test commands: the startup count initially used the lifecycle prefix rather than catalog_initialization; the initial integration selection expected Linux-only fork tests on macOS. Actual logs and exit codes are retained. Corrected assertions reuse completed commands and add four unexecuted portable lifecycle cases; no successful command is repeated.",
+  "unique_workspace_cases": 673,
+  "unique_workspace_passed": 668,
+  "unique_workspace_failed": 5,
+  "execution_complete": true,
+  "clippy_seconds": 29.19,
+  "harness_cases": 96,
+  "scope": "Workspace library plus nine selected portable multi_server cases; focused lifecycle cases are included in the library total. This is not full production or capacity qualification.",
+  "platform": "macOS / Rust 1.98.0; Linux-only fork cases not executed locally",
+  "environment": {
+    "CARGO_INCREMENTAL": "0",
+    "CARGO_TARGET_DIR": "shared ignored build directory; no deployment/demo restart"
+  },
+  "sdk_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+  "sdk_manifest_pins": 5,
+  "sdk_lock_pins": 6,
+  "protected_hashes": {
+    "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "/Users/haipingfu/.codex/worktrees/packed-catalog-publication-pr/canopy/docs/archive/pr20-progress-through-8bb0ee7.md": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+  },
+  "validated_source_parent": "2012f867cb5ab50d460cb67c942a6fc518f49c36",
+  "fetched_main": "9438bb865959fb975d5349ba8b9908b461653821",
+  "prior_ci": {
+    "head": "2012f867cb5ab50d460cb67c942a6fc518f49c36",
+    "rust": "failed: five legacy objects readers",
+    "harness": "passed",
+    "runs": [
+      37214232434,
+      37214228893
+    ],
+    "not_qualification_for_new_source": true
+  },
+  "checked_local_documentation_links": 79
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index a31b5121..5c0eb0f8 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -2,16 +2,73 @@
 
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
-Current cutover review: [draft PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. GitHub reports no merge conflicts at publication;
-CI is pending. It remains a draft until the incomplete production conversion
-and release requirements below are verified. Older local/unpublished checkpoint
+Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
+directly against `main`. At the preceding published head `2012f86`, GitHub reports
+no merge conflicts; both Rust CI runs fail on the same five unconverted
+legacy `objects` readers and both harness checks pass. The PR is currently marked
+ready for review, but production conversion and release requirements remain
+incomplete. Older local/unpublished checkpoint
 notes describe their historical states, not the current publication state.
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Owned serving lifecycle checkpoint
+
+`ServingOwner` now owns acquisition, accepted-original physical handoff,
+automatic renewal and exact release independently of request observers. Its
+private restart supervisor retains factory identities, original commands and
+held/uncertain tickets. Snapshot clones share a private borrow lifetime;
+closure refuses new borrows and renews existing ones until their last guard
+drops. Physical provider work drains before release, including work detached by
+observer cancellation. A known denied release retains ownership and permits a
+new proof only after the denied original has settled. Read revocation after a
+lost acquisition acknowledgement still retains and authentically drains the
+accepted pin. No lease expiry, timeout or logical denial deletes physical roots.
+
+The accepted handoff authenticates the exact original acquisition ordinal and
+current retained pin/generation under actual owner checks. Restored commands,
+renewals, absent/denied executions and independent duplicate physical owners
+cannot mint that handoff. Owner, snapshot and physical-I/O budgets are separate,
+bounded node/account shares; a snapshot cannot consume every I/O slot. The new
+production files participate in the RepositoryModule code digest. See the
+[serving contract](design/certified-serving-pins.md).
+
+Thirteen focused families pass in 8.29 seconds after compilation, including six
+transport fault modes, five producer restart points, clone renewal, deterministic
+recovery/revocation, canceled release observation and blocked actual provider
+I/O. Their initialized empty catalogs qualify lifecycle ownership, not full
+nonempty native/body/history serving or capacity.
+
+Final frozen-source library qualification executes 664 unique cases: **659 pass
+and five fail**, with exit 101 retained. All 370 publication, seven startup and
+four resident-recovery families pass. Two nested subprocess summaries are
+excluded and focused cases are not counted twice. Nine selected portable
+workspace/lifecycle cases also pass, including canceled prebound startup.
+Combined coverage is 673 unique cases, 668 pass and five fail. Every failure is
+one of the five unconverted legacy `objects` readers. Warnings-denied
+workspace/all-target Clippy passes in 29.19 seconds, the server build in 37.26
+seconds, formatting in 1.15 seconds, and all 96 Python harness tests pass.
+The freeze includes 468 Rust/SQL/manifest files, including 454 Rust files and
+the design SQL fixture. The [persisted evidence](evidence/serving-owner-20261004.json)
+records the actual failures, commands and source fingerprint. Library failure
+remains exit 101; the validation driver also finishes 101 after completing its
+other checks. Initial driver prefix/platform assertion mistakes are recorded
+separately, and successful completed commands are reused rather than rerun.
+Linux-only fork cases were not executed locally; their latest prior CI does not
+qualify this new source.
+
+Highest next priorities are the bounded resident generation pool, shared
+node budgets and repository-scoped contexts, eviction/shutdown joining before publication-budget and
+Cell/workspace closure, and conversion of every authoritative reader and
+HTTP/SSH/generated producer. Physical fencing/adoption and quota recovery,
+admitted immutable custody history/exact lookup, final DDL, typed collection,
+backup/restore, fault campaigns, OS containment, native acceleration/physical
+rewrite/fair maintenance, signed completion/cold clone, file attribution and
+full-history plus 10,000-developer capacity qualification remain mandatory.
+This checkpoint does not complete the full goal or make the branch releasable.
+
 ## Resident recovery lifecycle checkpoint
 
 The production repository manager now retains one recovery coordinator plus root

From 02307fd3b7de774ed47943548d460ddaa329911b Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 10:55:13 -0700
Subject: [PATCH 21/55] Pool resident serving generations and join them before
 Cell release

---
 crates/canopy-server/src/lib.rs               |  33 ++
 .../src/packs/publication/mod.rs              |  13 +-
 .../src/packs/publication/serving.rs          |   2 +
 .../packs/publication/serving/lifecycle.rs    |  56 +++-
 .../src/packs/publication/serving/pool.rs     | 297 +++++++++++++++++
 .../src/packs/publication/serving/session.rs  |  47 +++
 .../src/packs/publication/tests/serving.rs    |   1 +
 .../packs/publication/tests/serving/pool.rs   | 313 ++++++++++++++++++
 crates/canopy-server/src/server/lifecycle.rs  |   1 +
 crates/canopy-server/src/server/mod.rs        |   3 +
 .../src/server/residency/recovery.rs          |  79 ++++-
 .../src/server/residency/tests.rs             |   1 +
 .../src/server/residency/tests/recovery.rs    |   6 +-
 .../src/server/residency/tests/serving.rs     | 141 ++++++++
 docs/design/certified-serving-pins.md         |  72 +++-
 docs/design/resident-publication-recovery.md  |  14 +-
 docs/evidence/serving-pool-20261004.json      | 219 ++++++++++++
 .../large-repository-implementation-status.md |  57 +++-
 18 files changed, 1326 insertions(+), 29 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/serving/pool.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/pool.rs
 create mode 100644 crates/canopy-server/src/server/residency/tests/serving.rs
 create mode 100644 docs/evidence/serving-pool-20261004.json

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index f6b12961..83a45771 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -301,6 +301,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/serving/command_owner.rs"));
                 source.update(include_bytes!("packs/publication/serving/session.rs"));
                 source.update(include_bytes!("packs/publication/serving/lifecycle.rs"));
+                source.update(include_bytes!("packs/publication/serving/pool.rs"));
                 source.update(include_bytes!(
                     "packs/publication/serving/session/handoff.rs"
                 ));
@@ -415,6 +416,7 @@ pub struct RepositoryCell {
     // Gateways own the cache lifetime. Sharing the reader through a weak
     // reference must not retain its original disk budget after gateway eviction.
     pack_readers: std::sync::Mutex<Vec<std::sync::Weak<pack_store::PackReader>>>,
+    serving: std::sync::Mutex<Option<std::sync::Weak<packs::publication::ServingPool>>>,
 }
 
 impl RepositoryCell {
@@ -442,9 +444,40 @@ impl RepositoryCell {
             application: application.clone(),
             target,
             pack_readers: std::sync::Mutex::new(Vec::new()),
+            serving: std::sync::Mutex::new(None),
         })
     }
 
+    pub(crate) fn attach_serving(&self, pool: &std::sync::Arc<packs::publication::ServingPool>) {
+        *self.serving.lock().expect("repository serving pool") =
+            Some(std::sync::Arc::downgrade(pool));
+    }
+    /// Borrow the resident's certified joint generation; a detached caller
+    /// cannot abandon its acquisition or extend a released residency.
+    pub async fn serving_snapshot(
+        &self,
+        actor: ReadIdentity<'_>,
+    ) -> std::result::Result<
+        packs::publication::ServingSnapshot,
+        packs::publication::ServingOwnerError,
+    > {
+        actor
+            .validate()
+            .map_err(packs::publication::ServingReadError::Capability)?;
+        let pool = self
+            .serving
+            .lock()
+            .expect("repository serving pool")
+            .as_ref()
+            .and_then(std::sync::Weak::upgrade)
+            .ok_or(packs::publication::ServingReadError::Inactive)?;
+        let actor = match actor {
+            ReadIdentity::Anonymous => None,
+            ReadIdentity::Account(value) => Some(value.to_owned()),
+        };
+        pool.snapshot(actor).await
+    }
+
     /// Prepares bounded graph certificates, then publishes one all-or-none ref plan.
     pub async fn finalize_push(
         &self,
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 46048912..8d6d14b6 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -16,12 +16,13 @@ use cellule_runtime::{
 };
 mod serving;
 pub use serving::{
-    AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_SERVING_OWNERS,
-    MAX_SERVING_PINS, ReadyServingCommand, ReadyServingRelease, ReleaseServingPin, RenewServingPin,
-    RenewServingRequest, SelectServingGeneration, ServingCheck, ServingContext, ServingDenial,
-    ServingDrainObserver, ServingDrainProof, ServingLease, ServingOwner, ServingOwnerError,
-    ServingOwnerPhase, ServingOwnerStats, ServingPin, ServingReadBudget, ServingReadError,
-    ServingReleaseReply, ServingReply, ServingSelection, ServingSnapshot, ServingToken,
+    AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_SERVING_GENERATIONS,
+    MAX_SERVING_OWNERS, MAX_SERVING_PINS, ReadyServingCommand, ReadyServingRelease,
+    ReleaseServingPin, RenewServingPin, RenewServingRequest, SelectServingGeneration, ServingCheck,
+    ServingContext, ServingDenial, ServingDrainObserver, ServingDrainProof, ServingLease,
+    ServingOwner, ServingOwnerError, ServingOwnerPhase, ServingOwnerStats, ServingPin, ServingPool,
+    ServingPoolLimits, ServingReadBudget, ServingReadError, ServingReleaseReply, ServingReply,
+    ServingSelection, ServingSnapshot, ServingToken,
 };
 mod owner;
 pub(crate) mod registry;
diff --git a/crates/canopy-server/src/packs/publication/serving.rs b/crates/canopy-server/src/packs/publication/serving.rs
index 190dbaa8..485ae93d 100644
--- a/crates/canopy-server/src/packs/publication/serving.rs
+++ b/crates/canopy-server/src/packs/publication/serving.rs
@@ -8,11 +8,13 @@ mod commands;
 pub use command_owner::ReadyServingCommand;
 mod lifecycle;
 mod ownership;
+mod pool;
 pub use lifecycle::{
     ServingDrainObserver, ServingOwner, ServingOwnerError, ServingOwnerPhase, ServingOwnerStats,
     ServingSnapshot,
 };
 pub use ownership::MAX_SERVING_OWNERS;
+pub use pool::{MAX_SERVING_GENERATIONS, ServingPool, ServingPoolLimits};
 mod session;
 pub use commands::{
     AcquireServingPin, CheckServingPin, ReleaseServingPin, RenewServingPin, SelectServingGeneration,
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
index 8dd3fd4e..17d0b3ca 100644
--- a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -42,6 +42,7 @@ pub struct ServingOwnerStats {
 }
 struct Control {
     closed: bool,
+    paused: bool,
     borrowers: usize,
     pin: Option<ServingPin>,
 }
@@ -191,6 +192,7 @@ impl ServingOwner {
             request,
             control: Mutex::new(Control {
                 closed: false,
+                paused: false,
                 borrowers: 0,
                 pin: None,
             }),
@@ -219,6 +221,48 @@ impl ServingOwner {
     pub fn stats(&self) -> ServingOwnerStats {
         self.inner.updates.borrow().clone()
     }
+    pub(super) fn is_drained(&self) -> bool {
+        self.inner.tasks.is_empty()
+    }
+    pub(super) fn retire_if_idle(&self) -> bool {
+        let mut state = self.inner.control.lock().expect("serving owner control");
+        if state.borrowers != 0 {
+            return false;
+        }
+        state.closed = true;
+        drop(state);
+        self.inner.changed.notify_waiters();
+        true
+    }
+    /// A nonwaiting handshake: the worker cannot create another original after
+    /// its driver lock has been observed while paused. Busy originals stay owned.
+    pub(super) fn pause_for_drain(&self) -> Option<Option<ServingToken>> {
+        self.inner
+            .control
+            .lock()
+            .expect("serving owner control")
+            .paused = true;
+        let Ok(driver) = self.inner.driver.try_lock() else {
+            return None;
+        };
+        if driver.done {
+            return Some(None);
+        }
+        let state = self.inner.control.lock().expect("serving owner control");
+        if state.closed || state.borrowers != 0 || driver.pending.is_some() {
+            return None;
+        }
+        let pin = state.pin.as_ref()?;
+        pin.workers_idle().then_some(Some(pin.token()))
+    }
+    pub(super) fn resume(&self) {
+        self.inner
+            .control
+            .lock()
+            .expect("serving owner control")
+            .paused = false;
+        self.inner.changed.notify_waiters();
+    }
     pub fn drain_observer(&self) -> ServingDrainObserver {
         ServingDrainObserver {
             tasks: self.inner.tasks.clone(),
@@ -262,6 +306,13 @@ impl ServingOwner {
         actor: Option<String>,
     ) -> Result<ServingSnapshot, ServingReadError> {
         let permit = self.inner.context.admit_snapshot(&actor).await?;
+        self.snapshot_admitted(actor, permit).await
+    }
+    pub(super) async fn snapshot_admitted(
+        &self,
+        actor: Option<String>,
+        permit: AdmissionPermit,
+    ) -> Result<ServingSnapshot, ServingReadError> {
         let inner = self.inner.clone();
         self.inner
             .context
@@ -274,7 +325,7 @@ impl ServingOwner {
                     changed.as_mut().enable();
                     let acquired = {
                         let mut state = inner.control.lock().expect("serving owner control");
-                        if state.closed {
+                        if state.closed || state.paused {
                             return Err(ServingReadError::Inactive);
                         }
                         if let Some(pin) = state.pin.clone() {
@@ -341,6 +392,9 @@ impl Inner {
         if driver.pending.is_none() {
             let (closed, borrowers, pin) = {
                 let state = self.control.lock().expect("serving owner control");
+                if state.paused && !state.closed {
+                    return Ok(false);
+                }
                 (state.closed, state.borrowers, state.pin.clone())
             };
             // A factory has not registered or submitted anything. Once all
diff --git a/crates/canopy-server/src/packs/publication/serving/pool.rs b/crates/canopy-server/src/packs/publication/serving/pool.rs
new file mode 100644
index 00000000..770d74e0
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/pool.rs
@@ -0,0 +1,297 @@
+//! Bounded resident generation ownership; observers cannot abandon acquisitions.
+use super::*;
+use crate::admission::AdmissionPermit;
+use std::sync::{
+    Weak,
+    atomic::{AtomicBool, Ordering},
+};
+use tokio::sync::Mutex;
+use tokio_util::{sync::CancellationToken, task::TaskTracker};
+
+pub const MAX_SERVING_GENERATIONS: u8 = 4;
+#[derive(Clone, Copy, Debug)]
+pub struct ServingPoolLimits {
+    pub generations: u8,
+    pub lease_ms: u64,
+}
+impl Default for ServingPoolLimits {
+    fn default() -> Self {
+        Self {
+            generations: MAX_SERVING_GENERATIONS,
+            lease_ms: DEFAULT_LEASE_MS,
+        }
+    }
+}
+struct Slot {
+    requested_generation: u64,
+    touched: u64,
+    owner: ServingOwner,
+}
+struct State {
+    closed: bool,
+    clock: u64,
+    slots: Vec<Slot>,
+}
+struct Inner {
+    context: ServingContext,
+    coordinator: PublicationCoordinator,
+    limits: ServingPoolLimits,
+    state: Mutex<State>,
+    paused: AtomicBool,
+    stop: CancellationToken,
+    requests: TaskTracker,
+    drain: TaskTracker,
+}
+struct Lifetime(Weak<Inner>);
+impl Drop for Lifetime {
+    fn drop(&mut self) {
+        if let Some(inner) = self.0.upgrade() {
+            inner.stop.cancel();
+        }
+    }
+}
+/// Clones share one residency lifetime and at most four retained generation owners.
+#[derive(Clone)]
+#[must_use]
+pub struct ServingPool {
+    inner: Arc<Inner>,
+    _lifetime: Arc<Lifetime>,
+}
+struct Resume {
+    inner: Arc<Inner>,
+    owners: Vec<ServingOwner>,
+}
+impl Drop for Resume {
+    fn drop(&mut self) {
+        for owner in &self.owners {
+            owner.resume();
+        }
+        self.inner.paused.store(false, Ordering::Release);
+    }
+}
+impl ServingPool {
+    pub fn new(
+        context: ServingContext,
+        coordinator: PublicationCoordinator,
+        limits: ServingPoolLimits,
+    ) -> Result<Self, ServingOwnerError> {
+        if !(1..=MAX_SERVING_GENERATIONS).contains(&limits.generations)
+            || !(1000..=MAX_LEASE_MS).contains(&limits.lease_ms)
+            || coordinator.target() != &context.target_for_handoff()
+        {
+            return Err(ServingOwnerError::Context);
+        }
+        let inner = Arc::new(Inner {
+            context,
+            coordinator,
+            limits,
+            state: Mutex::new(State {
+                closed: false,
+                clock: 0,
+                slots: Vec::new(),
+            }),
+            paused: AtomicBool::new(false),
+            stop: CancellationToken::new(),
+            requests: TaskTracker::new(),
+            drain: TaskTracker::new(),
+        });
+        let work = inner.clone();
+        inner.drain.spawn(async move {
+            work.stop.cancelled().await;
+            let owners = {
+                let mut state = work.state.lock().await;
+                state.closed = true;
+                state
+                    .slots
+                    .iter()
+                    .map(|slot| slot.owner.clone())
+                    .collect::<Vec<_>>()
+            };
+            for owner in &owners {
+                owner.close();
+            }
+            work.requests.close();
+            work.requests.wait().await;
+            // Independent producers keep renewing/draining concurrently. One
+            // blocked old generation cannot stop another's exact release.
+            futures_util::future::join_all(owners.iter().map(|owner| owner.close_and_drain()))
+                .await;
+        });
+        Ok(Self {
+            _lifetime: Arc::new(Lifetime(Arc::downgrade(&inner))),
+            inner,
+        })
+    }
+    pub async fn snapshot(
+        &self,
+        actor: Option<String>,
+    ) -> Result<ServingSnapshot, ServingOwnerError> {
+        if self.inner.stop.is_cancelled() || self.inner.paused.load(Ordering::Acquire) {
+            return Err(ServingReadError::Inactive.into());
+        }
+        // Admission covers queued selection, acquisition wait and the returned
+        // borrow. A canceled observer cannot create unbounded detached waiters.
+        let permit = self.inner.context.admit_snapshot(&actor).await?;
+        let inner = self.inner.clone();
+        self.inner
+            .requests
+            .spawn(async move { inner.snapshot(actor, permit).await })
+            .await
+            .map_err(ServingReadError::Task)?
+    }
+    pub fn close(&self) {
+        self.inner.stop.cancel();
+    }
+    pub async fn close_and_drain(&self) {
+        self.close();
+        self.inner.drain.close();
+        self.inner.drain.wait().await;
+    }
+    /// A private task owns the whole pause/gate/release handshake. Cancellation
+    /// of this observer neither strands paused owners nor abandons accepted drain.
+    pub async fn quiesce(&self) -> Result<bool, ServingOwnerError> {
+        let inner = self.inner.clone();
+        self.inner
+            .drain
+            .spawn(async move { inner.quiesce().await })
+            .await
+            .map_err(ServingReadError::Task)?
+    }
+    #[cfg(test)]
+    pub(in crate::packs::publication) async fn owners_for_test(&self) -> Vec<ServingOwner> {
+        self.inner
+            .state
+            .lock()
+            .await
+            .slots
+            .iter()
+            .map(|slot| slot.owner.clone())
+            .collect()
+    }
+}
+impl Inner {
+    async fn snapshot(
+        self: Arc<Self>,
+        actor: Option<String>,
+        permit: AdmissionPermit,
+    ) -> Result<ServingSnapshot, ServingOwnerError> {
+        if self.stop.is_cancelled() || self.paused.load(Ordering::Acquire) {
+            return Err(ServingReadError::Inactive.into());
+        }
+        let selected = self.context.select(actor.clone()).await?;
+        let owner = {
+            let mut state = self.state.lock().await;
+            if state.closed || self.stop.is_cancelled() || self.paused.load(Ordering::Acquire) {
+                return Err(ServingReadError::Inactive.into());
+            }
+            state.slots.retain(|slot| !slot.owner.is_drained());
+            state.clock = state.clock.saturating_add(1);
+            let touched = state.clock;
+            if let Some(slot) = state.slots.iter_mut().find(|slot| {
+                let stats = slot.owner.stats();
+                match stats.token {
+                    Some(token) => {
+                        stats.phase == ServingOwnerPhase::Ready
+                            && token.generation == selected.generation
+                    }
+                    None => {
+                        stats.phase == ServingOwnerPhase::Acquiring
+                            && slot.requested_generation == selected.generation
+                    }
+                }
+            }) {
+                slot.touched = touched;
+                slot.owner.clone()
+            } else {
+                if state.slots.len() >= usize::from(self.limits.generations) {
+                    // Keep the closing slot until its real producer finishes.
+                    // Retry is explicit; there is no unbounded retired inventory
+                    // or wait behind old provider I/O inside the pool lock.
+                    let mut order: Vec<_> = (0..state.slots.len()).collect();
+                    order.sort_by_key(|i| state.slots[*i].touched);
+                    for i in order {
+                        if state.slots[i].owner.retire_if_idle() {
+                            break;
+                        }
+                    }
+                    return Err(ServingReadError::Capability(Error::Capacity(
+                        "repository serving generations",
+                    ))
+                    .into());
+                }
+                let operation = *uuid::Uuid::new_v4().as_bytes();
+                let mut digest = blake3::Hasher::new();
+                digest.update(b"canopy.serving-pool.v1");
+                digest.update(&self.context.repository());
+                digest.update(&operation);
+                let owner = ServingOwner::start(
+                    self.context.clone(),
+                    self.coordinator.clone(),
+                    BeginRequest {
+                        repository: self.context.repository(),
+                        operation,
+                        request_digest: *digest.finalize().as_bytes(),
+                        actor: self.context.administrator().to_owned(),
+                        lease_ms: self.limits.lease_ms,
+                    },
+                    crate::server::mutation_identity()
+                        .map_err(|error| ServingOwnerError::Clock(Box::new(error)))?,
+                )
+                .await?;
+                state.slots.push(Slot {
+                    requested_generation: selected.generation,
+                    touched,
+                    owner: owner.clone(),
+                });
+                owner
+            }
+        };
+        // The accepted acquisition may select a newer fact than the observation.
+        // Return its fact; never label that capability with the requested hint.
+        Ok(owner.snapshot_admitted(actor, permit).await?)
+    }
+    async fn quiesce(self: Arc<Self>) -> Result<bool, ServingOwnerError> {
+        let state = self.state.lock().await;
+        if state.closed {
+            let drained =
+                self.requests.is_empty() && state.slots.iter().all(|slot| slot.owner.is_drained());
+            drop(state);
+            return Ok(drained && self.coordinator.close_if_idle().await);
+        }
+        if self.paused.swap(true, Ordering::AcqRel) {
+            return Ok(false);
+        }
+        let pause = Resume {
+            inner: self.clone(),
+            owners: state.slots.iter().map(|slot| slot.owner.clone()).collect(),
+        };
+        drop(state);
+        let mut tokens = Vec::new();
+        for owner in &pause.owners {
+            match owner.pause_for_drain() {
+                Some(Some(token)) => tokens.push(token),
+                Some(None) => {}
+                None => return Ok(false),
+            }
+        }
+        let Some(gate) = self.coordinator.reserve_serving_drain(&tokens).await? else {
+            return Ok(false);
+        };
+        // No original can be built between the handshake and exclusive gate.
+        // Queries already admitted finish without creating another slot.
+        self.stop.cancel();
+        for owner in &pause.owners {
+            owner.close();
+        }
+        self.requests.close();
+        self.requests.wait().await;
+        futures_util::future::join_all(pause.owners.iter().map(|owner| owner.close_and_drain()))
+            .await;
+        while !gate.close_if_drained().await {
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        }
+        // Private supervisor can finish concurrently; do not wait its shared
+        // tracker here, which also owns this quiesce operation.
+        Ok(true)
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index 87f40093..f3d55920 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -25,6 +25,8 @@ pub enum ServingReadError {
     Authority(#[from] PreparationBaseError),
     #[error("serving query failed")]
     Query(#[source] Box<InvocationError<Option<ServingLease>>>),
+    #[error("serving generation selection failed")]
+    Selection(#[source] Box<InvocationError<Option<GenerationFact>>>),
     #[error("serving metadata failed")]
     Metadata(#[from] crate::packs::directory::index::IndexError),
     #[error("serving capability failed")]
@@ -95,6 +97,47 @@ pub struct ServingContext {
     administrator: String,
 }
 impl ServingContext {
+    pub(super) fn repository(&self) -> [u8; 16] {
+        self.indexes.store().repository()
+    }
+    pub(super) fn administrator(&self) -> &str {
+        &self.administrator
+    }
+    pub(super) async fn select(
+        &self,
+        actor: Option<String>,
+    ) -> Result<GenerationFact, ServingReadError> {
+        if self.budget.inner.stop.is_cancelled() {
+            return Err(ServingReadError::Inactive);
+        }
+        let scope = actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        let permit = self.budget.inner.admission.acquire(scope).await?;
+        let context = self.clone();
+        self.tasks()
+            .spawn(async move {
+                let _permit = permit;
+                if context.budget.inner.stop.is_cancelled() {
+                    return Err(ServingReadError::Inactive);
+                }
+                context
+                    .client
+                    .query::<SelectServingGeneration>(
+                        &context.target,
+                        None,
+                        ServingSelection {
+                            repository: context.repository(),
+                            actor,
+                        },
+                    )
+                    .await
+                    .map_err(|error| ServingReadError::Selection(Box::new(error)))?
+                    .output
+                    .ok_or(ServingReadError::Inactive)
+            })
+            .await?
+    }
     pub(super) fn client_for_owner(&self) -> CellClient {
         self.client.clone()
     }
@@ -198,6 +241,10 @@ struct ReleaseCommand {
     digest: [u8; 32],
 }
 impl ServingPin {
+    pub(super) fn workers_idle(&self) -> bool {
+        let state = self.inner.state.lock().expect("serving workers");
+        !state.closed && state.active == 0
+    }
     pub(super) async fn authorize(
         &self,
         actor: Option<String>,
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index 724004aa..0d39eead 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -9,6 +9,7 @@ use tokio::time::{Duration, timeout};
 use tokio_util::task::TaskTracker;
 mod custody;
 mod lifecycle;
+mod pool;
 mod selection_drain;
 
 async fn initialize(f: &Fixture, store: Arc<ArtifactStore>) -> Result<GenerationFact> {
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/pool.rs b/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
new file mode 100644
index 00000000..3d2574e7
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
@@ -0,0 +1,313 @@
+//! Bounded pooling and actual lifecycle ownership, including head races.
+use super::*;
+
+fn pooled(
+    f: &Fixture,
+    store: Arc<ArtifactStore>,
+    root: &tempfile::TempDir,
+    tasks: TaskTracker,
+    q: PublicationCoordinator,
+) -> Result<ServingPool> {
+    Ok(ServingPool::new(
+        ServingContext::new(
+            f.client(),
+            f.target.clone(),
+            f.authority(),
+            Arc::new(CatalogIndexes::new(store.clone(), f.format)),
+            Arc::new(CatalogFiles::new(
+                root.path(),
+                DiskBudget::new(64 << 20),
+                store,
+                f.format,
+                CatalogFileLimits::default(),
+            )?),
+            ServingReadBudget::new(32, tasks)?,
+            "owner".into(),
+        )?,
+        q,
+        ServingPoolLimits::default(),
+    )?)
+}
+fn queue(f: &Fixture) -> Result<PublicationCoordinator> {
+    Ok(PublicationCoordinator::new(
+        f.target.clone(),
+        PublicationLimits::default(),
+        f.publication_budget.clone(),
+    )?)
+}
+async fn advance(f: &Fixture, generation: u64) -> Result {
+    // Copied certified roots isolate selection/lifecycle semantics; this is not
+    // native publication, changing Git content, or a full-history benchmark.
+    edit(f, &format!("INSERT INTO catalog_generations(generation,catalog,certificate,refs) SELECT {generation},catalog,certificate,refs FROM catalog_generations WHERE generation=1; UPDATE catalog_state SET generation={generation} WHERE singleton=1")).await
+}
+async fn finish(
+    f: &Fixture,
+    pool: &ServingPool,
+    q: &PublicationCoordinator,
+    tasks: TaskTracker,
+) -> Result {
+    timeout(Duration::from_secs(8), pool.close_and_drain()).await?;
+    assert_eq!(pin_count(f).await?, 0);
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    Ok(())
+}
+
+#[tokio::test]
+async fn concurrent_viewers_share_one_generation_and_every_cached_borrow_checks_access() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let before = f.counts().await?;
+        let snapshots =
+            futures_util::future::join_all((0..12).map(|_| pool.snapshot(Some("viewer".into()))))
+                .await
+                .into_iter()
+                .collect::<std::result::Result<Vec<_>, _>>()?;
+        assert_eq!(pin_count(&f).await?, 1);
+        assert_eq!(pool.owners_for_test().await.len(), 1);
+        assert!(snapshots.iter().all(|s| s.fact() == snapshots[0].fact()));
+        assert_eq!(f.counts().await?, before);
+        assert!(pool.snapshot(Some("other".into())).await.is_err());
+        assert!(pool.snapshot(None).await.is_err());
+        edit(&f, "UPDATE ref_generation SET visibility='public'").await?;
+        let anonymous = pool.snapshot(None).await?;
+        assert_eq!(anonymous.fact(), snapshots[0].fact());
+        assert_eq!(pin_count(&f).await?, 1);
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'; UPDATE ref_generation SET visibility='private'").await?;
+        assert!(pool.snapshot(Some("viewer".into())).await.is_err());
+        assert!(snapshots[0].headers(&[missing(&f)?]).await.is_err());
+        assert!(anonymous.headers(&[missing(&f)?]).await.is_err());
+        drop((snapshots, anonymous));
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn canceled_cold_observer_and_lost_ack_keep_one_owned_acquisition() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let (dispatch, entered) = q.pause_for_test().await;
+        q.fault_for_test(2);
+        let work = pool.clone();
+        let observer = tokio::spawn(async move { work.snapshot(Some("owner".into())).await });
+        timeout(Duration::from_secs(8), entered).await??;
+        observer.abort();
+        assert!(
+            observer
+                .await
+                .err()
+                .ok_or("completed early")?
+                .is_cancelled()
+        );
+        dispatch.send(()).map_err(|_| "dispatch gone")?;
+        let snapshot =
+            timeout(Duration::from_secs(8), pool.snapshot(Some("owner".into()))).await??;
+        assert_eq!(snapshot.fact().generation, 1);
+        assert_eq!(pin_count(&f).await?, 1);
+        assert_eq!(pool.owners_for_test().await.len(), 1);
+        drop(snapshot);
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn four_generation_bound_retains_borrows_and_reuses_only_actually_drained_slots() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let mut snapshots = Vec::new();
+        for generation in 1..=4 {
+            if generation > 1 {
+                advance(&f, generation).await?;
+            }
+            let snapshot = pool.snapshot(Some("owner".into())).await?;
+            assert_eq!(snapshot.fact().generation, generation);
+            snapshots.push(snapshot);
+        }
+        advance(&f, 5).await?;
+        assert!(matches!(
+            pool.snapshot(Some("owner".into())).await,
+            Err(ServingOwnerError::Read(ServingReadError::Capability(
+                Error::Capacity("repository serving generations")
+            )))
+        ));
+        assert_eq!(pin_count(&f).await?, 4);
+        let old = pool.owners_for_test().await.remove(0);
+        drop(snapshots.remove(0));
+        assert!(pool.snapshot(Some("owner".into())).await.is_err());
+        assert_eq!(
+            timeout(Duration::from_secs(8), old.drain_observer().wait())
+                .await?
+                .phase,
+            ServingOwnerPhase::Released
+        );
+        let fifth = pool.snapshot(Some("owner".into())).await?;
+        assert_eq!(fifth.fact().generation, 5);
+        assert_eq!(pin_count(&f).await?, 4);
+        for snapshot in &snapshots {
+            assert_eq!(snapshot.headers(&[missing(&f)?]).await?, vec![None]);
+        }
+        drop((snapshots, fifth));
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn acquisition_head_race_returns_actual_accepted_fact_and_reuses_it() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let (dispatch, entered) = q.pause_for_test().await;
+        let work = pool.clone();
+        let observer = tokio::spawn(async move { work.snapshot(Some("owner".into())).await });
+        timeout(Duration::from_secs(8), entered).await??;
+        advance(&f, 2).await?;
+        dispatch.send(()).map_err(|_| "dispatch gone")?;
+        let snapshot = timeout(Duration::from_secs(8), observer).await???;
+        assert_eq!(snapshot.fact().generation, 2);
+        let second = pool.snapshot(Some("owner".into())).await?;
+        assert_eq!(second.fact(), snapshot.fact());
+        assert_eq!(pin_count(&f).await?, 1);
+        assert_eq!(pool.owners_for_test().await.len(), 1);
+        drop((snapshot, second));
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn busy_eviction_resumes_and_canceled_exclusive_drain_joins_exact_uncertain_release() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let snapshot = pool.snapshot(Some("owner".into())).await?;
+        assert!(!pool.quiesce().await?);
+        assert_eq!(snapshot.headers(&[missing(&f)?]).await?, vec![None]);
+        drop(snapshot);
+        let held = q.try_reserve(
+            ReadyServingCommand::acquire(
+                f.client(),
+                f.target.clone(),
+                f.begin([233; 16]),
+                identity()?,
+                f.authority(),
+            )
+            .await?,
+        )?;
+        assert!(!pool.quiesce().await?);
+        assert!(!q.stats().await.closed);
+        drop(pool.snapshot(Some("owner".into())).await?);
+        held.discard_held().await?;
+        let (dispatch, entered) = q.pause_for_test().await;
+        q.fault_for_test(2);
+        let work = pool.clone();
+        let observed = tokio::spawn(async move { work.quiesce().await });
+        timeout(Duration::from_secs(8), entered).await??;
+        observed.abort();
+        assert!(observed.await.err().ok_or("drained early")?.is_cancelled());
+        assert_eq!(pin_count(&f).await?, 1);
+        dispatch.send(()).map_err(|_| "dispatch gone")?;
+        timeout(Duration::from_secs(8), pool.close_and_drain()).await?;
+        assert_eq!(pin_count(&f).await?, 0);
+        assert!(q.stats().await.closed);
+        assert!(pool.quiesce().await?);
+        assert!(pool.snapshot(Some("owner".into())).await.is_err());
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn blocked_old_generation_does_not_block_other_release_or_allow_early_eviction() -> Result {
+    use std::sync::atomic::Ordering;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let snapshot = pool.snapshot(Some("owner".into())).await?;
+        provider.armed.store(true, Ordering::Release);
+        let oid = missing(&f)?;
+        let observer = tokio::spawn(async move { snapshot.headers(&[oid]).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        observer.abort();
+        assert!(
+            observer
+                .await
+                .err()
+                .ok_or("provider finished")?
+                .is_cancelled()
+        );
+        assert!(!timeout(Duration::from_secs(1), pool.quiesce()).await??);
+        advance(&f, 2).await?;
+        let other = pool.snapshot(Some("owner".into())).await?;
+        let owners = pool.owners_for_test().await;
+        let first = owners[0].drain_observer();
+        let second = owners[1].drain_observer();
+        pool.close();
+        drop(other);
+        assert_eq!(
+            timeout(Duration::from_secs(8), second.wait()).await?.phase,
+            ServingOwnerPhase::Released
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        assert!(
+            timeout(Duration::from_millis(50), first.wait())
+                .await
+                .is_err()
+        );
+        assert!(root.path().exists());
+        provider.proceed.add_permits(1);
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/server/lifecycle.rs b/crates/canopy-server/src/server/lifecycle.rs
index 31873ce2..2476c597 100644
--- a/crates/canopy-server/src/server/lifecycle.rs
+++ b/crates/canopy-server/src/server/lifecycle.rs
@@ -123,6 +123,7 @@ impl RunningServer {
             None
         };
         self.listeners.stop_ingress();
+        self.repositories.drain_serving().await;
         self.tasks.close();
         self.tasks.wait().await;
         self.repositories.drain_recovery().await;
diff --git a/crates/canopy-server/src/server/mod.rs b/crates/canopy-server/src/server/mod.rs
index 9aef8f6e..1e9e9259 100644
--- a/crates/canopy-server/src/server/mod.rs
+++ b/crates/canopy-server/src/server/mod.rs
@@ -206,6 +206,7 @@ pub(crate) struct RepositoryManager {
     maintenance_stop: CancellationToken,
     publication_budget: crate::packs::publication::PublicationBudget,
     recovery_scans: crate::packs::publication::RecoveryScanBudget,
+    serving_reads: crate::packs::publication::ServingReadBudget,
 }
 
 pub(crate) enum MembershipOutcome {
@@ -657,6 +658,8 @@ impl RunningServer {
                     tasks.clone(),
                 )
                 .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
+                serving_reads: crate::packs::publication::ServingReadBudget::new(64, tasks.clone())
+                    .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
             });
             let api = Arc::new(RepositoryHttp::new(Arc::clone(&manager), tasks.clone()));
             deployment.require_ready().await?;
diff --git a/crates/canopy-server/src/server/residency/recovery.rs b/crates/canopy-server/src/server/residency/recovery.rs
index ebd1e3d1..e380b767 100644
--- a/crates/canopy-server/src/server/residency/recovery.rs
+++ b/crates/canopy-server/src/server/residency/recovery.rs
@@ -1,13 +1,16 @@
 //! Resident owners join discovery before release and retain exact uncertain work.
 use super::*;
+use crate::packs::catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes};
 use crate::packs::publication::{
     CustodySupervisor, MaintenanceRequest, PreparationAuthority, PublicationCoordinator,
-    PublicationLimits, PublicationState, RecoveryScanLimits, RecoverySupervisor,
+    PublicationLimits, PublicationState, RecoveryScanLimits, RecoverySupervisor, ServingContext,
+    ServingPool, ServingPoolLimits,
 };
 use canopy_object_storage::artifact::ArtifactStore;
 
 pub(super) struct RecoveryServices {
     pub(super) coordinator: PublicationCoordinator,
+    pub(super) serving: Arc<ServingPool>,
     workers: Mutex<Option<Workers>>,
 }
 struct Workers {
@@ -37,7 +40,37 @@ impl RecoveryServices {
         let settings = manager
             .recovery_scans
             .settings(RecoveryScanLimits::default(), &entry.owner);
-        let roots = RecoverySupervisor::start_retiring(
+        let store = Arc::new(ArtifactStore::new(
+            Arc::clone(&manager.external_store),
+            entry.repository_id,
+        ));
+        let serving = Arc::new(
+            ServingPool::new(
+                ServingContext::new(
+                    client.clone(),
+                    target.clone(),
+                    authority.clone(),
+                    Arc::new(CatalogIndexes::new(store.clone(), entry.object_format)),
+                    Arc::new(
+                        CatalogFiles::new(
+                            manager.local.path(),
+                            manager.disk_budget.clone(),
+                            store,
+                            entry.object_format,
+                            CatalogFileLimits::default(),
+                        )
+                        .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
+                    ),
+                    manager.serving_reads.clone(),
+                    entry.owner.clone(),
+                )
+                .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
+                coordinator.clone(),
+                ServingPoolLimits::default(),
+            )
+            .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
+        );
+        let roots = match RecoverySupervisor::start_retiring(
             client.clone(),
             target.clone(),
             ArtifactStore::new(Arc::clone(&manager.external_store), entry.repository_id),
@@ -45,8 +78,13 @@ impl RecoveryServices {
             settings.clone(),
             authority.clone(),
             maintenance,
-        )
-        .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?;
+        ) {
+            Ok(roots) => roots,
+            Err(error) => {
+                serving.close_and_drain().await;
+                return Err(ServerError::CatalogRecovery(Box::new(error)));
+            }
+        };
         let custody = match CustodySupervisor::start(
             client,
             target,
@@ -59,11 +97,14 @@ impl RecoveryServices {
                 // A partially constructed owner must join its first worker before
                 // giving up the residency transition or its workspace ownership.
                 let _ = roots.shutdown().await;
+                serving.close_and_drain().await;
                 return Err(ServerError::CatalogRecovery(Box::new(error)));
             }
         };
+        repository.attach_serving(&serving);
         Ok(Self {
             coordinator,
+            serving,
             workers: Mutex::new(Some(Workers { roots, custody })),
         })
     }
@@ -73,13 +114,21 @@ impl RecoveryServices {
         if let Some(active) = workers.as_ref() {
             tokio::join!(active.roots.pause(), active.custody.pause());
         }
-        if !self.coordinator.close_if_idle().await {
+        let closed = match self.serving.quiesce().await {
+            Ok(closed) => closed,
+            Err(error) => {
+                tracing::warn!(?error, "serving drain refused repository eviction");
+                false
+            }
+        };
+        if !closed {
             if let Some(active) = workers.as_ref() {
                 active.roots.resume();
                 active.custody.resume();
             }
             return false;
         }
+        self.serving.close_and_drain().await;
         join(workers.take()).await;
         true
     }
@@ -119,7 +168,27 @@ async fn join(workers: Option<Workers>) {
     }
 }
 impl RepositoryManager {
+    pub(in crate::server) async fn drain_serving(&self) {
+        let services: Vec<_> = self
+            .loaded
+            .lock()
+            .await
+            .values()
+            .filter_map(|repository| repository.recovery.as_ref().map(Arc::clone))
+            .collect();
+        for service in &services {
+            service.serving.close();
+        }
+        futures_util::future::join_all(
+            services
+                .iter()
+                .map(|service| service.serving.close_and_drain()),
+        )
+        .await;
+        self.serving_reads.close();
+    }
     pub(in crate::server) async fn drain_recovery(&self) {
+        self.drain_serving().await;
         self.recovery_scans.close();
         self.publication_budget.close();
         // The existing residency cap bounds this inventory. No independent
diff --git a/crates/canopy-server/src/server/residency/tests.rs b/crates/canopy-server/src/server/residency/tests.rs
index 36b3cc19..c8125c54 100644
--- a/crates/canopy-server/src/server/residency/tests.rs
+++ b/crates/canopy-server/src/server/residency/tests.rs
@@ -2,6 +2,7 @@ use std::{collections::VecDeque, convert::Infallible, future::poll_fn};
 
 use super::*;
 mod recovery;
+mod serving;
 
 struct Frames(VecDeque<Frame<Bytes>>);
 
diff --git a/crates/canopy-server/src/server/residency/tests/recovery.rs b/crates/canopy-server/src/server/residency/tests/recovery.rs
index e648f267..9c19146e 100644
--- a/crates/canopy-server/src/server/residency/tests/recovery.rs
+++ b/crates/canopy-server/src/server/residency/tests/recovery.rs
@@ -16,7 +16,7 @@ use tokio::time::{Duration, timeout};
 
 type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error + Send + Sync>>;
 
-async fn server() -> Result<(RunningServer, tempfile::TempDir)> {
+pub(super) async fn server() -> Result<(RunningServer, tempfile::TempDir)> {
     let files = tempfile::TempDir::new()?;
     let server = RunningServer::start(
         ServerConfig {
@@ -45,7 +45,7 @@ async fn server() -> Result<(RunningServer, tempfile::TempDir)> {
     .await?;
     Ok((server, files))
 }
-async fn create(
+pub(super) async fn create(
     manager: &Arc<RepositoryManager>,
     name: &str,
     format: ObjectFormat,
@@ -65,7 +65,7 @@ async fn create(
     })
     .await??)
 }
-async fn loaded(
+pub(super) async fn loaded(
     manager: &RepositoryManager,
     id: [u8; 16],
 ) -> Result<(Arc<RepositoryCell>, CellClient, Arc<RecoveryServices>)> {
diff --git a/crates/canopy-server/src/server/residency/tests/serving.rs b/crates/canopy-server/src/server/residency/tests/serving.rs
new file mode 100644
index 00000000..957f2dcf
--- /dev/null
+++ b/crates/canopy-server/src/server/residency/tests/serving.rs
@@ -0,0 +1,141 @@
+//! Exercise the actual manager, shared pool and server shutdown, not fixture wiring.
+use super::recovery::{create, loaded, server};
+use super::*;
+use crate::{ObjectFormat, ObjectId};
+use cellule_runtime::primitives::sql::{SqlBatch, SqlStatement, SqlValue};
+use tokio::time::{Duration, timeout};
+type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error + Send + Sync>>;
+
+async fn retained(repository: &RepositoryCell) -> Result<i64> {
+    let result = repository
+        .sql
+        .query(
+            None,
+            SqlBatch {
+                statements: vec![SqlStatement {
+                    sql: "SELECT count(*) FROM catalog_serving_pins".into(),
+                    parameters: vec![],
+                }],
+            },
+        )
+        .await?;
+    let Some([SqlValue::Integer(count)]) = result
+        .output
+        .first()
+        .and_then(|set| set.rows.first())
+        .map(Vec::as_slice)
+    else {
+        return Err("serving count absent".into());
+    };
+    Ok(*count)
+}
+fn missing(format: ObjectFormat) -> ObjectId {
+    match format {
+        ObjectFormat::Sha1 => ObjectId::Sha1([7; 20]),
+        ObjectFormat::Sha256 => ObjectId::Sha256([7; 32]),
+    }
+}
+
+#[tokio::test]
+async fn production_resident_shares_generation_and_busy_eviction_resumes_before_exact_drain()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let entry = create(&server.repositories, "pooled", format).await?;
+        let (repository, _client, service) =
+            loaded(&server.repositories, entry.repository_id).await?;
+        let first = repository
+            .serving_snapshot(ReadIdentity::Account("canopy"))
+            .await?;
+        let second = repository
+            .serving_snapshot(ReadIdentity::Account("canopy"))
+            .await?;
+        assert_eq!(first.fact(), second.fact());
+        assert_eq!(retained(&repository).await?, 1);
+        assert!(!service.quiesce().await);
+        assert!(!service.coordinator.stats().await.closed);
+        assert_eq!(first.headers(&[missing(format)]).await?, vec![None]);
+        assert!(
+            repository
+                .serving_snapshot(ReadIdentity::Anonymous)
+                .await
+                .is_err()
+        );
+        drop((first, second));
+        assert!(timeout(Duration::from_secs(8), service.quiesce()).await?);
+        assert_eq!(retained(&repository).await?, 0);
+        assert!(service.coordinator.stats().await.closed);
+        assert!(service.quiesce().await); // retry after a later Cell release refusal
+        assert!(
+            repository
+                .serving_snapshot(ReadIdentity::Account("canopy"))
+                .await
+                .is_err()
+        );
+        server.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_shutdown_keeps_publication_cell_heartbeat_and_workspace_until_last_borrow()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, files) = server().await?;
+        let manager = server.repositories.clone();
+        let entry = create(&manager, "borrowed", format).await?;
+        let (repository, _client, service) = loaded(&manager, entry.repository_id).await?;
+        let first = repository
+            .serving_snapshot(ReadIdentity::Account("canopy"))
+            .await?;
+        let clone = first.clone();
+        let node = server.node.clone();
+        let directory = server.directory.clone();
+        let session = server.advertisement.lock().await.advertisement().session();
+        let mut shutdown = tokio::spawn(server.shutdown());
+        timeout(Duration::from_secs(8), async {
+            loop {
+                if repository
+                    .serving_snapshot(ReadIdentity::Account("canopy"))
+                    .await
+                    .is_err()
+                {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert!(!manager.publication_budget.stats().closed);
+        assert_eq!(retained(&repository).await?, 1);
+        assert!(!node.is_shutting_down());
+        assert!(
+            directory
+                .is_live(session, crate::server::unix_now_ms()?)
+                .await?
+        );
+        assert!(
+            crate::server::workspace::Workspace::open(&files.path().join("node"))
+                .is_err_and(|error| error.kind() == std::io::ErrorKind::WouldBlock)
+        );
+        drop(first);
+        assert!(
+            timeout(Duration::from_millis(50), &mut shutdown)
+                .await
+                .is_err()
+        );
+        assert_eq!(retained(&repository).await?, 1);
+        drop(clone);
+        timeout(Duration::from_secs(10), shutdown).await???;
+        assert!(node.is_shutting_down());
+        assert!(manager.publication_budget.stats().closed);
+        assert!(service.coordinator.stats().await.closed);
+        assert!(
+            !directory
+                .is_live(session, crate::server::unix_now_ms()?)
+                .await?
+        );
+        timeout(Duration::from_secs(2), service.serving.close_and_drain()).await?;
+    }
+    Ok(())
+}
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index b483236a..66549d9f 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -5,7 +5,9 @@ artifacts cannot disappear while an owned worker is suspended. The implementatio
 adds a bounded serving-pin receiver and an owned metadata-read capability. This
 is a foundation for production reader conversion. A service-owned producer now
 acquires, retains, renews and drains one generation independently of its callers;
-the production manager does not yet pool or hand these owners to its consumers.
+the production manager now creates a bounded resident pool and exposes its
+borrow through `RepositoryCell::serving_snapshot`. Existing product/native/body/
+stream consumers still require conversion to this capability.
 The branch remains unreleasable until that conversion and the full cutover gates
 are complete.
 
@@ -74,7 +76,7 @@ that same guard. Closing the pin waits until a proven unexecuted held command is
 discarded or the exact original reaches a known disposition. Cancellation of an
 observer cannot release it. The production owner must retain and activate/discard
 held tickets and drive uncertain recovery. `ServingOwner` now performs that
-ownership and automatic renewal; a resident generation pool is still required.
+ownership and automatic renewal; the resident pool now composes that lifecycle.
 
 The existing bounded custody scanner also visits serving heads and can retire an
 expired unexecuted original. A stop records logical closure and never invents an
@@ -200,6 +202,60 @@ caches across generations. This does not expose raw catalog readers or native
 workspace mutation authority. Object bodies, native operations, response streams
 and all current object/ref/cache/graph/browser consumers still need conversion.
 
+## Bounded resident generation pool
+
+`ServingPool` retains at most four generation slots, including acquisitions and
+closing owners. Pending viewers coalesce on one acquisition; known owners are
+matched by their accepted token's generation. Current-root selection is an
+admitted, tracked observation under the requesting viewer's Read access. A head
+advance between selection and acquisition returns the actual accepted joint
+fact, never a capability labeled with the earlier observation. Product consumers
+must resolve their revision/ref through that accepted snapshot.
+
+The pool admits each viewer before spawning private request work. Its permit
+covers selection, acquisition waiting and the returned snapshot borrow. Observer
+cancellation detaches accepted work, and the owner's original stays retained.
+At capacity, the pool initiates closure of one least-recently-used unborrowed
+owner and returns an explicit capacity error. Its slot remains charged until the
+real producer has exited; there is no unbounded retired-owner list or waiting
+behind old provider work under the pool lock. Borrowed old generations remain
+immutable. Their independent owners keep renewing while other generations work.
+
+Eviction pauses acquisition/borrowing and uses a nonwaiting owner handshake.
+The producer driver must be idle, with no pending original, outstanding borrow
+or physical pin work. An already built/held/uncertain command is never discarded
+by that handshake. Busy refusal resumes the same owners. Only after all owners
+are paused may the common coordinator reserve the bounded exact-token drain
+gate. Accepted drain is owned by a private task: cancellation cannot abandon
+its guard or strand paused owners. Actual releases and producer joins precede
+coordinator closure. Repeating quiescence after a later Cell-release refusal
+works only after every owner/request has really drained.
+
+`RepositoryManager` owns one 64-slot node serving budget. Each initialized local
+resident's `RecoveryServices` owns one pool/context and repository-scoped shared
+index/file clients, using the actual NodePeer authority and its existing common
+publication coordinator. `RepositoryCell` holds a weak pool association; stale
+repository handles do not keep serving admission open. Remote routes receive no
+local pool. Partial service construction explicitly joins its pool/scanner before
+returning failure. Last pool-handle loss initiates its private supervised drain.
+
+Recovery quiescence pauses discovery before pool drain. Server shutdown joins
+HTTP/SSH ingress, closes and joins serving pools while Cell, heartbeat and
+publication admission remain available, then closes the node task tracker and
+drains recovery/Cell/workspace. Node serving admission closes only after pool
+drain. The standalone recovery drain also enforces that ordering. A borrowed
+snapshot clone or detached real I/O cannot permit early publication-budget
+closure, Cell shutdown or workspace reuse.
+
+Six pool and two real-manager families pass as part of 55 focused serving/
+resident tests. They cover concurrent viewer coalescing and current access,
+canceled cold observation/lost acknowledgement, four borrowed generations and
+actual slot reuse, deterministic acquisition head races, busy/canceled exclusive
+drain, blocked old provider work with independent other-generation release, weak
+repository access and real shutdown retaining publication/Cell/heartbeat/workspace
+until the last borrow. These empty/copy-root fixtures qualify ownership and
+selection semantics, not native publication throughput or full-history serving.
+
 ## Sticky closure and exact release
 
 Closure prevents new reads and waits for every owned drain guard. Notify
@@ -249,15 +305,14 @@ owner fence.
 
 ## Production integration and qualification gates
 
-The next serving layer must integrate `ServingOwner` and its accepted acquisition
-handoff into production residency. Command reconstruction alone does not
-establish physical ownership. Cache/coalesce a bounded set of active generation
-owners per repository rather than allocating a pin per browser/SDE. Carry that
+The resident pool now integrates `ServingOwner` and its accepted acquisition
+handoff with manager residency. Command reconstruction alone does not establish
+physical ownership. The next serving layer must carry that
 ownership through native work, object bodies and response streams; integrate
 its drain into actual eviction and shutdown. A close must join all producers and
 workers before Cell/workspace/artifact release.
 
-Production integration must preserve these boundaries:
+Consumer conversion must preserve these boundaries:
 
 1. `RepositoryManager` owns the node read budget. Each local resident owns one
    repository-scoped context and bounded generation pool, sharing its index/file
@@ -273,7 +328,8 @@ Production integration must preserve these boundaries:
 3. Shutdown stops borrowing and joins all generation producers while Cell,
    administrator authority and publication admission remain usable. Only then
    may the node tracker/publication budget close and resident recovery/Cell/
-   workspace drain finish. The current shutdown path is not yet wired this way.
+   workspace drain finish. The current shutdown path enforces this ordering;
+   native/body/stream consumers still need to carry the snapshot guard.
 4. Actual process fencing and restored-owner adoption must precede releasing an
    abandoned pin. A historical lease or an expired deadline is insufficient.
    Quota recovery must use that authenticated lifecycle rather than reaping SQL
diff --git a/docs/design/resident-publication-recovery.md b/docs/design/resident-publication-recovery.md
index 4fc110c1..b467c86d 100644
--- a/docs/design/resident-publication-recovery.md
+++ b/docs/design/resident-publication-recovery.md
@@ -95,9 +95,13 @@ constructed. Cleanup failures retain the released entry and its charged slot.
 ## Shutdown and independent progress
 
 Shutdown closes native admission, stops maintenance, closes scan discovery and
-stops HTTP/SSH ingress. It joins ingress and the node task tracker, including
-accepted requests, residency transitions and owned scan/maintenance rounds.
-The repository manager then closes publication admission and drains the retained
+stops HTTP/SSH ingress. After joining ingress it closes and joins the resident
+[serving pools](certified-serving-pins.md#bounded-resident-generation-pool) while
+publication admission, Cell authority and heartbeat remain available. Borrowed
+snapshot clones and detached physical workers retain their exact roots until
+authenticated release. Only then does it close/join the node task tracker,
+including accepted requests, residency transitions and owned scan/maintenance
+rounds. The repository manager then closes publication admission and drains the retained
 coordinators. All per-repository drain futures run together, bounded by the
 existing loaded-residency cap and shared publication/transport budgets.
 A producer-held command in one repository must not prevent exact recovery in
@@ -127,11 +131,11 @@ Final-source totals and retained diagnostic logs are recorded in the
 [implementation status](../large-repository-implementation-status.md).
 
 The current selected packed schema still exposes unconverted legacy consumers.
-Production HTTP/SSH/generated staging, authoritative certified serving retention,
+Production HTTP/SSH/generated staging, conversion to the resident serving pool,
 all object/ref/graph/browser/policy/check/merge consumers and final DDL removal
 must move together. Admitted immutable custody history/exact lookup, retained
 physical input adoption, typed GC/backup/isolated restore, OS resource containment,
 accelerated reads/physical rewrite, fair continuous maintenance, signed native
 completion/cold clone, file attribution and full Linux/Kubernetes/Chromium plus
 10,000-developer mixed-load qualification remain mandatory. This local branch is
-unpublished and unreleasable until those gates are complete.
+published in PR #34 and unreleasable until those gates are complete.
diff --git a/docs/evidence/serving-pool-20261004.json b/docs/evidence/serving-pool-20261004.json
new file mode 100644
index 00000000..1188a101
--- /dev/null
+++ b/docs/evidence/serving-pool-20261004.json
@@ -0,0 +1,219 @@
+{
+  "source_files": 471,
+  "rust_files": 457,
+  "source_hash_digest": "a82809971ed44451e9be3c0fbf7d088d6206965773d63c8507c6a1d758b3adc5",
+  "phases": [
+    {
+      "label": "clippy",
+      "exit_code": 0,
+      "log": "/tmp/canopy-serving-pool-clippy.log",
+      "preceding_unchanged_source": true,
+      "log_sha256": "a5f2abc6d3c813f9db7d6c40de6bd827a277bad6c99d683ec5ca1b04d65837d2"
+    },
+    {
+      "label": "focused",
+      "exit_code": 0,
+      "log": "/tmp/canopy-serving-pool-focused.log",
+      "preceding_unchanged_source": true,
+      "log_sha256": "e9437cc92d829b7c6f0c6f9522014044f11d00047a690d1a119045174b9d05f7"
+    },
+    {
+      "label": "library",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "--workspace",
+        "--lib",
+        "--locked",
+        "--",
+        "--test-threads=4"
+      ],
+      "exit_code": 101,
+      "seconds": 301.816,
+      "log": "/tmp/canopy-serving-pool-library.log",
+      "passed": 667,
+      "failed": 5,
+      "ignored": 0,
+      "publication_passed": 376,
+      "known_failures": [
+        "git_gateway::fetch::tests::reachability_stops_at_live_refs_without_scanning_other_history",
+        "object_reads::tests::byte_limited_page_advances_only_over_the_selected_prefix",
+        "object_reads::tests::duplicate_rollback_and_deletion_do_not_hide_subsequent_inserts",
+        "object_reads::tests::insertion_cursor_finds_lower_oids_and_excludes_later_publications",
+        "object_reads::tests::small_increment_uses_bounded_sql_work_after_large_history"
+      ],
+      "nested_summaries_excluded": 2,
+      "log_sha256": "4f580b7c5c2fbd85367d45e474c460950c37d122eb2814cc95b80a70ce17f400"
+    },
+    {
+      "label": "workspace",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "workspace::",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 48.787,
+      "log": "/tmp/canopy-serving-pool-workspace.log",
+      "passed": 3,
+      "log_sha256": "7ae4766515dd848464e1753c7ae309b2484062a01cabf2ad5002934dc3e0fb18"
+    },
+    {
+      "label": "lifecycle",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::fork::",
+        "lifecycle::cancelled_prebound_startup",
+        "lifecycle::runtime_destruction",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.451,
+      "log": "/tmp/canopy-serving-pool-lifecycle.log",
+      "passed": 2,
+      "log_sha256": "835770997bec08bd451b5f9e49afa90219501017dcfb87a6806154c7e109a658"
+    },
+    {
+      "label": "drain",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::cancelled_startup_keeps_workspace",
+        "lifecycle::dropped_handle_and_cancelled_shutdown",
+        "lifecycle::failed_drain_retains_workspace",
+        "lifecycle::startup_rejects_ignored_conditional",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.756,
+      "log": "/tmp/canopy-serving-pool-drain.log",
+      "passed": 4,
+      "log_sha256": "07a1f60ef4ea65014dabc54333f7daf0b76f15c9257ec9614a95f4826d026ddf"
+    },
+    {
+      "label": "build",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "build",
+        "--locked",
+        "--bin",
+        "canopy"
+      ],
+      "exit_code": 0,
+      "seconds": 32.158,
+      "log": "/tmp/canopy-serving-pool-build.log",
+      "log_sha256": "86cfe0a814d94b2df2b249de7096d48b8cda847434f64c17ee0cac482337b190"
+    },
+    {
+      "label": "fmt",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 1.352,
+      "log": "/tmp/canopy-serving-pool-fmt.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "diff",
+      "command": [
+        "git",
+        "diff",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 0.054,
+      "log": "/tmp/canopy-serving-pool-diff.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "harness",
+      "command": [
+        "python3",
+        "-B",
+        "-m",
+        "unittest",
+        "discover",
+        "-s",
+        "scripts",
+        "-p",
+        "test_*.py"
+      ],
+      "exit_code": 0,
+      "seconds": 41.818,
+      "log": "/tmp/canopy-serving-pool-harness.log",
+      "log_sha256": "c82b12af80f8b7db1b4bc7a78bb324409155b13661bc503dae43f9dfe5c305ff"
+    }
+  ],
+  "release_qualified": false,
+  "unique_workspace_cases": 681,
+  "unique_workspace_passed": 676,
+  "unique_workspace_failed": 5,
+  "execution_complete": true,
+  "clippy_seconds": 28.89,
+  "harness_cases": 96,
+  "focused_cases": 55,
+  "new_pool_families": 6,
+  "new_production_manager_families": 2,
+  "draft_diagnostic": {
+    "log": "/tmp/canopy-serving-pool-check-draft.log",
+    "exit_code": 101,
+    "reason": "Arc was not imported in lib.rs; fixed with fully qualified std::sync::Arc before the final frozen-source tests."
+  },
+  "scope": "Workspace library plus nine selected portable multi_server cases; focused lifecycle cases are included in the library total. This is not full production or capacity qualification.",
+  "platform": "macOS / Rust 1.98.0; Linux-only fork cases not executed locally",
+  "environment": {
+    "CARGO_INCREMENTAL": "0",
+    "CARGO_TARGET_DIR": "shared ignored build directory; no deployment/demo restart"
+  },
+  "sdk_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+  "sdk_manifest_pins": 5,
+  "sdk_lock_pins": 6,
+  "protected_hashes": {
+    "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "/Users/haipingfu/.codex/worktrees/packed-catalog-publication-pr/canopy/docs/archive/pr20-progress-through-8bb0ee7.md": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+  },
+  "validated_source_parent": "b21f9d7c74b85eab945146df1c4778433a350a72",
+  "fetched_main": "9438bb865959fb975d5349ba8b9908b461653821",
+  "prior_ci": {
+    "head": "b21f9d7c74b85eab945146df1c4778433a350a72",
+    "rust": "failed: five legacy objects readers",
+    "harness": "passed",
+    "runs": [
+      37219758565,
+      37219757347
+    ],
+    "not_qualification_for_new_source": true
+  },
+  "checked_local_documentation_links": 86
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 5c0eb0f8..5625d005 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -3,7 +3,7 @@
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. At the preceding published head `2012f86`, GitHub reports
+directly against `main`. At the preceding published head `b21f9d7`, GitHub reports
 no merge conflicts; both Rust CI runs fail on the same five unconverted
 legacy `objects` readers and both harness checks pass. The PR is currently marked
 ready for review, but production conversion and release requirements remain
@@ -14,6 +14,61 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Resident serving pool checkpoint
+
+The production manager now owns one node serving budget and creates one lazy,
+repository-scoped pool/context with shared index/file clients for each local
+resident. `RepositoryCell::serving_snapshot` uses a weak association. The pool
+coalesces pending viewers, retains at most four generation slots including
+closing owners, and binds returned snapshots to the actual accepted joint fact
+across head races. At capacity it retires an idle old owner, returns explicit
+backpressure and charges the slot until real producer completion.
+
+Eviction pauses borrowing and producer creation, refuses pending originals/
+borrows/physical workers without discarding them, and resumes the same owners
+on refusal. Idle owners release through the existing exact-token admission gate
+before queue closure. A private task owns accepted drain across observer
+cancellation. Pool cleanup and generation releases proceed independently.
+Shutdown joins serving owners before closing the node tracker/publication
+budget or Cell/workspace/heartbeat. Partial construction joins its first owners.
+See the [serving contract](design/certified-serving-pins.md).
+
+Fifty-five focused serving/resident families pass in 20.42 seconds; they include
+six new pool and two actual-manager cases in both formats. The cases cover
+coalescing/current access, canceled cold observation, lost acknowledgement,
+four-generation retention and real slot reuse, deterministic acquisition head
+races, busy/canceled exclusive drain, independent release while an old real
+provider blocks, weak repository association, eviction retry and actual server
+shutdown held by the last borrowed clone. Warnings-denied workspace/all-target
+Clippy passes in 28.89 seconds. Empty/copied-root fixtures qualify this lifecycle,
+not full nonempty native/body/history serving or capacity.
+
+Final frozen-source workspace library qualification executes 672 unique cases:
+**667 pass and five fail**, retaining exit 101. All 376 publication, seven
+startup, four resident recovery and two resident serving families pass. Two
+nested subprocess summaries are excluded and focused cases are not counted
+again. Nine selected portable workspace/lifecycle cases also pass; combined
+coverage is 681 unique cases, 676 pass and five fail. No compatibility table or
+green-result substitution is introduced. The server build passes in 32.16
+seconds and formatting in 1.35 seconds. All 96 Python harness tests pass.
+The freeze covers 471 Rust/SQL/manifest files, including 457 Rust files. The
+[persisted evidence](evidence/serving-pool-20261004.json) records commands, source
+fingerprint and log digests. The initial check's missing Arc qualification is
+retained as a draft diagnostic, not a passing check. The final driver completes
+its other checks and exits 101. Both preceding-head Linux Rust CI failures have
+been read and contain exactly the same five `objects` readers; they qualify the
+preceding source only. Linux-only fork integration cases were not run locally.
+
+Highest next work is conversion of all authoritative object/ref/cache/graph/
+browser/policy/merge readers and HTTP/SSH/generated producers to the resident
+snapshot and certified publication path, including physical native/body/stream
+ownership. Five unconverted legacy `objects` readers still fail. Physically
+fenced adoption/quota recovery, immutable admitted custody history/exact lookup,
+final DDL, typed GC/backup/restore, fault campaigns, OS containment, native
+acceleration/rewrite/fair maintenance, signed completion/cold clone, attribution
+and full-history plus 10,000-developer capacity qualification remain mandatory.
+The full objective remains open and this branch remains unreleasable.
+
 ## Owned serving lifecycle checkpoint
 
 `ServingOwner` now owns acquisition, accepted-original physical handoff,

From 1e32347a411fe24245e34638221e79eb8968b241 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 11:28:09 -0700
Subject: [PATCH 22/55] Fence serving construction against shutdown and join
 rejected owners

---
 crates/canopy-server/src/server/mod.rs        |  11 +
 .../canopy-server/src/server/residency/mod.rs |  29 +-
 .../src/server/residency/recovery.rs          |  24 +-
 .../src/server/residency/tests/serving.rs     |  63 +++++
 docs/design/certified-serving-pins.md         |  23 +-
 docs/design/resident-publication-recovery.md  |  11 +-
 .../serving-pool-shutdown-20261004.json       | 247 ++++++++++++++++++
 .../large-repository-implementation-status.md |  35 ++-
 8 files changed, 421 insertions(+), 22 deletions(-)
 create mode 100644 docs/evidence/serving-pool-shutdown-20261004.json

diff --git a/crates/canopy-server/src/server/mod.rs b/crates/canopy-server/src/server/mod.rs
index 1e9e9259..c32f26da 100644
--- a/crates/canopy-server/src/server/mod.rs
+++ b/crates/canopy-server/src/server/mod.rs
@@ -207,6 +207,14 @@ pub(crate) struct RepositoryManager {
     publication_budget: crate::packs::publication::PublicationBudget,
     recovery_scans: crate::packs::publication::RecoveryScanBudget,
     serving_reads: crate::packs::publication::ServingReadBudget,
+    serving_stop: CancellationToken,
+    #[cfg(test)]
+    serving_construction_gate: Mutex<
+        Option<(
+            tokio::sync::oneshot::Sender<()>,
+            tokio::sync::oneshot::Receiver<()>,
+        )>,
+    >,
 }
 
 pub(crate) enum MembershipOutcome {
@@ -660,6 +668,9 @@ impl RunningServer {
                 .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
                 serving_reads: crate::packs::publication::ServingReadBudget::new(64, tasks.clone())
                     .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
+                serving_stop: CancellationToken::new(),
+                #[cfg(test)]
+                serving_construction_gate: Mutex::new(None),
             });
             let api = Arc::new(RepositoryHttp::new(Arc::clone(&manager), tasks.clone()));
             deployment.require_ready().await?;
diff --git a/crates/canopy-server/src/server/residency/mod.rs b/crates/canopy-server/src/server/residency/mod.rs
index 81d27aac..b7996884 100644
--- a/crates/canopy-server/src/server/residency/mod.rs
+++ b/crates/canopy-server/src/server/residency/mod.rs
@@ -386,12 +386,29 @@ impl RepositoryManager {
         if let Some((repository, client)) = start {
             let recovery =
                 Arc::new(RecoveryServices::start(self, entry, &repository, client).await?);
-            self.loaded
-                .lock()
-                .await
-                .get_mut(&entry.repository_id)
-                .ok_or(ServerError::Repository("loaded repository is absent"))?
-                .recovery = Some(recovery);
+            #[cfg(test)]
+            if let Some((entered, proceed)) = self.serving_construction_gate.lock().await.take() {
+                let _ = entered.send(());
+                let _ = proceed.await;
+            }
+            let rejected = {
+                let mut loaded = self.loaded.lock().await;
+                if self.serving_stop.is_cancelled() {
+                    Some(ServerError::Runtime(Error::CellDraining))
+                } else if let Some(resident) = loaded.get_mut(&entry.repository_id) {
+                    resident.recovery = Some(recovery.clone());
+                    repository.attach_serving(&recovery.serving);
+                    None
+                } else {
+                    Some(ServerError::Repository("loaded repository is absent"))
+                }
+            };
+            if let Some(error) = rejected {
+                // Construction is tracked by this residency owner. Join private
+                // pools, scanners and exact recovery before completing its task.
+                recovery.drain().await;
+                return Err(error);
+            }
         }
         let mut loaded = self.loaded.lock().await;
         let existing = loaded
diff --git a/crates/canopy-server/src/server/residency/recovery.rs b/crates/canopy-server/src/server/residency/recovery.rs
index e380b767..14e443e4 100644
--- a/crates/canopy-server/src/server/residency/recovery.rs
+++ b/crates/canopy-server/src/server/residency/recovery.rs
@@ -24,6 +24,9 @@ impl RecoveryServices {
         repository: &RepositoryCell,
         client: CellClient,
     ) -> Result<Self, ServerError> {
+        if manager.serving_stop.is_cancelled() {
+            return Err(Error::CellDraining.into());
+        }
         let target = repository.target.clone();
         let authority = PreparationAuthority::node(manager.peer.clone(), target.clone());
         let maintenance = MaintenanceRequest {
@@ -101,7 +104,6 @@ impl RecoveryServices {
                 return Err(ServerError::CatalogRecovery(Box::new(error)));
             }
         };
-        repository.attach_serving(&serving);
         Ok(Self {
             coordinator,
             serving,
@@ -133,7 +135,8 @@ impl RecoveryServices {
         true
     }
 
-    async fn drain(&self) {
+    pub(super) async fn drain(&self) {
+        self.serving.close_and_drain().await;
         join(self.workers.lock().await.take()).await;
         loop {
             let pending = self.coordinator.close_and_drain().await;
@@ -169,13 +172,16 @@ async fn join(workers: Option<Workers>) {
 }
 impl RepositoryManager {
     pub(in crate::server) async fn drain_serving(&self) {
-        let services: Vec<_> = self
-            .loaded
-            .lock()
-            .await
-            .values()
-            .filter_map(|repository| repository.recovery.as_ref().map(Arc::clone))
-            .collect();
+        let services: Vec<_> = {
+            let loaded = self.loaded.lock().await;
+            // Share the publication barrier with constructor registration. A
+            // late pool cannot escape this inventory or the node tracker join.
+            self.serving_stop.cancel();
+            loaded
+                .values()
+                .filter_map(|repository| repository.recovery.as_ref().map(Arc::clone))
+                .collect()
+        };
         for service in &services {
             service.serving.close();
         }
diff --git a/crates/canopy-server/src/server/residency/tests/serving.rs b/crates/canopy-server/src/server/residency/tests/serving.rs
index 957f2dcf..94fab77d 100644
--- a/crates/canopy-server/src/server/residency/tests/serving.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving.rs
@@ -36,6 +36,69 @@ fn missing(format: ObjectFormat) -> ObjectId {
     }
 }
 
+#[tokio::test]
+async fn shutdown_refuses_unpublished_serving_constructor_and_joins_it_before_workspace_release()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, files) = server().await?;
+        let manager = server.repositories.clone();
+        let (entered, observed) = tokio::sync::oneshot::channel();
+        let (proceed, waiting) = tokio::sync::oneshot::channel();
+        *manager.serving_construction_gate.lock().await = Some((entered, waiting));
+        let work = manager.clone();
+        let creating = tokio::spawn(async move { work.create("late", format).await });
+        timeout(Duration::from_secs(8), observed).await??;
+        let repository = manager
+            .loaded
+            .lock()
+            .await
+            .values()
+            .find(|loaded| loaded.name == "late")
+            .ok_or("late resident absent")?
+            .repository
+            .clone();
+        // This public capability must be unavailable until its lifecycle owner
+        // is registered in the manager's drain inventory.
+        let premature = repository
+            .serving_snapshot(ReadIdentity::Account("canopy"))
+            .await;
+        let unavailable = premature.is_err();
+        drop(premature);
+        let mut shutdown = tokio::spawn(server.shutdown());
+        timeout(Duration::from_secs(8), manager.serving_stop.cancelled()).await?;
+        assert!(
+            timeout(Duration::from_millis(50), &mut shutdown)
+                .await
+                .is_err()
+        );
+        assert!(!manager.publication_budget.stats().closed);
+        assert!(
+            crate::server::workspace::Workspace::open(&files.path().join("node"))
+                .is_err_and(|error| error.kind() == std::io::ErrorKind::WouldBlock)
+        );
+        proceed.send(()).map_err(|_| "construction disappeared")?;
+        let result = timeout(Duration::from_secs(8), creating).await??;
+        timeout(Duration::from_secs(10), shutdown).await???;
+        assert!(
+            unavailable,
+            "unpublished constructor exposed serving before registered ownership"
+        );
+        assert!(matches!(
+            result,
+            Err(crate::server::ServerError::Runtime(
+                cellule_runtime::Error::CellDraining
+            ))
+        ));
+        assert!(
+            repository
+                .serving_snapshot(ReadIdentity::Account("canopy"))
+                .await
+                .is_err()
+        );
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn production_resident_shares_generation_and_busy_eviction_resumes_before_exact_drain()
 -> Result {
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index 66549d9f..0dc4887b 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -239,6 +239,14 @@ repository handles do not keep serving admission open. Remote routes receive no
 local pool. Partial service construction explicitly joins its pool/scanner before
 returning failure. Last pool-handle loss initiates its private supervised drain.
 
+Service registration and shutdown inventory share the manager's loaded-resident
+mutex. Shutdown cancels the permanent construction barrier under that mutex
+before collecting pools. A constructor registers its lifecycle owner before
+exposing the weak repository capability, under the same mutex. A constructor
+that loses this race joins its private pool, scanners and exact recovery inside
+its already tracked residency task, then returns `CellDraining`. No unpublished
+pool can become accessible or escape the shutdown inventory and task join.
+
 Recovery quiescence pauses discovery before pool drain. Server shutdown joins
 HTTP/SSH ingress, closes and joins serving pools while Cell, heartbeat and
 publication admission remain available, then closes the node task tracker and
@@ -247,7 +255,7 @@ drain. The standalone recovery drain also enforces that ordering. A borrowed
 snapshot clone or detached real I/O cannot permit early publication-budget
 closure, Cell shutdown or workspace reuse.
 
-Six pool and two real-manager families pass as part of 55 focused serving/
+Six pool and three real-manager families pass as part of 56 focused serving/
 resident tests. They cover concurrent viewer coalescing and current access,
 canceled cold observation/lost acknowledgement, four borrowed generations and
 actual slot reuse, deterministic acquisition head races, busy/canceled exclusive
@@ -255,6 +263,11 @@ drain, blocked old provider work with independent other-generation release, weak
 repository access and real shutdown retaining publication/Cell/heartbeat/workspace
 until the last borrow. These empty/copy-root fixtures qualify ownership and
 selection semantics, not native publication throughput or full-history serving.
+The third manager case deterministically pauses a constructor before publication,
+proves that its public capability is unavailable, starts actual server shutdown,
+and verifies that workspace/publication ownership remains until rejected
+construction cleanup joins. The regression fails against the preceding weak
+association ordering and passes with the registration barrier in both formats.
 
 ## Sticky closure and exact release
 
@@ -291,8 +304,8 @@ closure waits for the guard to finish or be dropped so selected releases can
 still be admitted. Guard cancellation resumes ordinary admission but never
 cancels accepted work, returns its credits or reopens an already closed queue.
 The caller must keep serving producers paused through guard completion/drop.
-This scheduling primitive is not wired into production residency yet; production
-shutdown must also keep the node publication budget open until releases finish.
+The resident pool wires this scheduling primitive into production eviction;
+production shutdown keeps the node publication budget open until releases finish.
 
 A new owner cannot renew/release old-owner pins merely because its epoch is newer.
 They remain roots until actual physical fencing/drain and an authenticated
@@ -308,8 +321,8 @@ owner fence.
 The resident pool now integrates `ServingOwner` and its accepted acquisition
 handoff with manager residency. Command reconstruction alone does not establish
 physical ownership. The next serving layer must carry that
-ownership through native work, object bodies and response streams; integrate
-its drain into actual eviction and shutdown. A close must join all producers and
+ownership through native work, object bodies and response streams. Actual
+eviction and shutdown already own pool drain. A close must join all producers and
 workers before Cell/workspace/artifact release.
 
 Consumer conversion must preserve these boundaries:
diff --git a/docs/design/resident-publication-recovery.md b/docs/design/resident-publication-recovery.md
index b467c86d..ed5ae9d4 100644
--- a/docs/design/resident-publication-recovery.md
+++ b/docs/design/resident-publication-recovery.md
@@ -108,6 +108,14 @@ A producer-held command in one repository must not prevent exact recovery in
 another repository. The drain owns these futures directly; it does not detach
 another task inventory or invent a durable queue.
 
+The loaded-resident mutex is also the construction/closing barrier. Shutdown
+permanently closes serving construction under that mutex before collecting the
+registered pools. New services register their owner before exposing repository
+access under the same mutex. An unpublished constructor that loses the race
+joins its own pool, scanners and retained originals in its tracked residency
+task before returning `CellDraining`. The subsequent node task join therefore
+includes its cleanup even though it was absent from the serving inventory.
+
 Each drain joins its scanners, waits for dispatch workers and schedules recovery
 only for their retained uncertain tickets. Known resolution returns the original
 receipt and releases its existing reservation. A held final proof belongs to its
@@ -124,7 +132,8 @@ advertisement. There is no timeout that silently releases unresolved authority.
 Regression coverage includes the shared control/admission barrier, tracked
 shutdown with an owned active round, independent pause/resume of real indexed
 root and custody scanners, authentic orphan retirement, production idle eviction
-and certified restoration, preservation of busy held originals, and production
+and certified restoration, rejection/join of a constructor paused before service
+publication, preservation of busy held originals, and production
 shutdown with held and absent/lost-reply/panicked exact renewal commands across
 repositories. Both Git object formats are exercised by the production families.
 Final-source totals and retained diagnostic logs are recorded in the
diff --git a/docs/evidence/serving-pool-shutdown-20261004.json b/docs/evidence/serving-pool-shutdown-20261004.json
new file mode 100644
index 00000000..cd06dbbb
--- /dev/null
+++ b/docs/evidence/serving-pool-shutdown-20261004.json
@@ -0,0 +1,247 @@
+{
+  "source_files": 471,
+  "rust_files": 457,
+  "source_hash_digest": "c88bdd413d5308745295cffa77ef035e6f8b1b777a61e368561a4ef0cf32931b",
+  "phases": [
+    {
+      "label": "clippy",
+      "exit_code": 0,
+      "log": "/tmp/canopy-serving-pool-shutdown-clippy.log",
+      "preceding_unchanged_source": true,
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "clippy",
+        "--workspace",
+        "--all-targets",
+        "--locked",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "log_sha256": "5ef8cbb8034e3f6032c9161794579ed19d5c168b42c47fc41fb7758a3032fe44"
+    },
+    {
+      "label": "focused",
+      "exit_code": 0,
+      "log": "/tmp/canopy-serving-pool-shutdown-focused.log",
+      "preceding_unchanged_source": true,
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--lib",
+        "--locked",
+        "--",
+        "packs::publication::tests::serving",
+        "server::residency::tests::serving",
+        "server::residency::tests::recovery",
+        "--test-threads=4"
+      ],
+      "log_sha256": "6f7daac8dec2014df2651039a338031bb58a91ffd91e6ce012cdbb30732de744"
+    },
+    {
+      "label": "library",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "--workspace",
+        "--lib",
+        "--locked",
+        "--",
+        "--test-threads=4"
+      ],
+      "exit_code": 101,
+      "seconds": 297.396,
+      "log": "/tmp/canopy-serving-pool-shutdown-library.log",
+      "passed": 668,
+      "failed": 5,
+      "ignored": 0,
+      "publication_passed": 376,
+      "known_failures": [
+        "git_gateway::fetch::tests::reachability_stops_at_live_refs_without_scanning_other_history",
+        "object_reads::tests::byte_limited_page_advances_only_over_the_selected_prefix",
+        "object_reads::tests::duplicate_rollback_and_deletion_do_not_hide_subsequent_inserts",
+        "object_reads::tests::insertion_cursor_finds_lower_oids_and_excludes_later_publications",
+        "object_reads::tests::small_increment_uses_bounded_sql_work_after_large_history"
+      ],
+      "nested_summaries_excluded": 2,
+      "log_sha256": "f2b4e260647098a519396f512e5188864625a7e120bcbd95351bd5e69c4afebe"
+    },
+    {
+      "label": "workspace",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "workspace::",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 50.397,
+      "log": "/tmp/canopy-serving-pool-shutdown-workspace.log",
+      "passed": 3,
+      "log_sha256": "eb093ab093b3b29be1522aaf19f3ac0e782e5cc70fef1407ef994fa08edf27f9"
+    },
+    {
+      "label": "lifecycle",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::fork::",
+        "lifecycle::cancelled_prebound_startup",
+        "lifecycle::runtime_destruction",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.486,
+      "log": "/tmp/canopy-serving-pool-shutdown-lifecycle.log",
+      "passed": 2,
+      "log_sha256": "7eb081b7ba4a3aeb5f29be975711c815618b811c3b84a4ac8979047470284924"
+    },
+    {
+      "label": "drain",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::cancelled_startup_keeps_workspace",
+        "lifecycle::dropped_handle_and_cancelled_shutdown",
+        "lifecycle::failed_drain_retains_workspace",
+        "lifecycle::startup_rejects_ignored_conditional",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.962,
+      "log": "/tmp/canopy-serving-pool-shutdown-drain.log",
+      "passed": 4,
+      "log_sha256": "0a78c2c31b80bdefe5b53fdbb15cfda7a888169b87df5a4964874dfd666d5883"
+    },
+    {
+      "label": "build",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "build",
+        "--locked",
+        "--bin",
+        "canopy"
+      ],
+      "exit_code": 0,
+      "seconds": 34.583,
+      "log": "/tmp/canopy-serving-pool-shutdown-build.log",
+      "log_sha256": "57745bcaf7d13b8145fc270525fdf83599e83b9a56b39ac82cab281f54829a32"
+    },
+    {
+      "label": "fmt",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 1.164,
+      "log": "/tmp/canopy-serving-pool-shutdown-fmt.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "diff",
+      "command": [
+        "git",
+        "diff",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 0.049,
+      "log": "/tmp/canopy-serving-pool-shutdown-diff.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "harness",
+      "command": [
+        "python3",
+        "-B",
+        "-m",
+        "unittest",
+        "discover",
+        "-s",
+        "scripts",
+        "-p",
+        "test_*.py"
+      ],
+      "exit_code": 0,
+      "seconds": 40.636,
+      "log": "/tmp/canopy-serving-pool-shutdown-harness.log",
+      "log_sha256": "0d7c467046352f9152f9998f1140b9221739e6a684843665020c2e8ea3081ef8"
+    }
+  ],
+  "release_qualified": false,
+  "unique_workspace_cases": 682,
+  "unique_workspace_passed": 677,
+  "unique_workspace_failed": 5,
+  "execution_complete": true,
+  "clippy_seconds": 31.41,
+  "harness_cases": 96,
+  "focused_cases": 56,
+  "focused_seconds": 19.4,
+  "pool_families": 6,
+  "production_manager_families": 3,
+  "new_production_manager_families": 1,
+  "regression_before_fix": {
+    "log": "/tmp/canopy-serving-pool-shutdown-regression-red.log",
+    "log_sha256": "4cf72fdd260bd4f4db57e9fa2e87063fe0d59648c5c7ea4066fafb019c736788",
+    "exit_code": 101,
+    "reason": "An unpublished resident constructor exposed the serving capability before its lifecycle owner was registered in shutdown inventory."
+  },
+  "scope": "Workspace library plus nine selected portable multi_server cases; focused lifecycle cases are included in the library total. This is not full production or capacity qualification.",
+  "platform": "macOS / Rust 1.98.0; Linux-only fork cases not executed locally",
+  "environment": {
+    "CARGO_INCREMENTAL": "0",
+    "CARGO_TARGET_DIR": "shared ignored build directory; no deployment/demo restart"
+  },
+  "sdk_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+  "sdk_manifest_pins": 5,
+  "sdk_lock_pins": 6,
+  "protected_hashes": {
+    "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "/Users/haipingfu/.codex/worktrees/packed-catalog-publication-pr/canopy/docs/archive/pr20-progress-through-8bb0ee7.md": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+  },
+  "validated_source_parent": "02307fd3b7de774ed47943548d460ddaa329911b",
+  "fetched_main": "9438bb865959fb975d5349ba8b9908b461653821",
+  "prior_ci": {
+    "head": "02307fd3b7de774ed47943548d460ddaa329911b",
+    "rust": "failed: five legacy objects readers",
+    "harness": "passed",
+    "runs": [
+      37222526207,
+      37222523633
+    ],
+    "not_qualification_for_new_source": true
+  },
+  "checked_local_documentation_links": 87
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 5625d005..73fa4282 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -3,7 +3,7 @@
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. At the preceding published head `b21f9d7`, GitHub reports
+directly against `main`. At the preceding published pool head `02307fd`, GitHub reports
 no merge conflicts; both Rust CI runs fail on the same five unconverted
 legacy `objects` readers and both harness checks pass. The PR is currently marked
 ready for review, but production conversion and release requirements remain
@@ -14,6 +14,39 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Serving construction/shutdown barrier checkpoint
+
+A deterministic regression exposed a resident constructor publishing its weak
+serving capability before registering its lifecycle owner in the manager's drain
+inventory. Shutdown could collect that inventory while construction was pending.
+Registration now precedes capability exposure under the loaded-resident mutex;
+shutdown permanently closes construction under the same mutex before collecting
+pools. A rejected constructor joins its private pool, scanners and exact recovery
+inside its existing tracked residency task before returning `CellDraining`.
+Workspace, Cell and publication ownership therefore outlive that cleanup.
+
+The regression fails against the preceding publication ordering with
+`unpublished constructor exposed serving before registered ownership`; the fixed
+case passes in both formats. All 56 focused serving/recovery families pass in
+19.40 seconds. Warnings-denied workspace/all-target Clippy passes in 31.41 seconds.
+Final frozen-source library qualification executes 673 unique cases: 668 pass
+and the same five legacy `objects` readers fail. All 376 publication, seven
+startup, four resident recovery and three resident serving cases pass. Nine
+selected portable workspace/lifecycle cases pass, giving 682 unique Rust cases,
+677 passed and five failed. Nested subprocess summaries and focused cases are
+not counted twice. This remains an incomplete release gate, with the library's
+actual exit 101 retained. Linux-only fork cases were not run locally.
+The server build, formatting, diff checks and all 96 Python harness tests pass.
+Static qualification verifies the frozen source, exact SDK pins, protected
+original index/archive and local documentation links.
+
+The source fingerprint, commands, log digests and original failing regression
+are retained in [shutdown barrier evidence](evidence/serving-pool-shutdown-20261004.json).
+These lifecycle fixtures do not qualify full nonempty native/body/history serving,
+physical owner adoption or large-team capacity. Highest next work remains the
+authoritative reader and producer conversion listed below; all remaining release
+requirements stay open.
+
 ## Resident serving pool checkpoint
 
 The production manager now owns one node serving budget and creates one lazy,

From b89d92980fbc9ae515b4b5376ec93415f0f88d68 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 12:10:43 -0700
Subject: [PATCH 23/55] Serve browser refs through owned immutable joint
 snapshots

---
 crates/canopy-server/src/git_read/browse.rs   |  71 ++--
 crates/canopy-server/src/git_read/mod.rs      |   4 +
 crates/canopy-server/src/lib.rs               |   2 +
 .../canopy-server/src/packs/catalog/reader.rs |   5 +
 .../src/packs/publication/mod.rs              |  11 +-
 .../src/packs/publication/serving.rs          |   3 +-
 .../packs/publication/serving/lifecycle.rs    |  16 +
 .../src/packs/publication/serving/session.rs  |  90 ++---
 .../publication/serving/session/handoff.rs    |   1 +
 .../publication/serving/session/reads.rs      |  59 +++
 .../packs/publication/serving/session/refs.rs | 122 ++++++
 .../src/packs/publication/tests/serving.rs    |   1 +
 .../packs/publication/tests/serving/pool.rs   |   6 +-
 .../packs/publication/tests/serving/refs.rs   | 357 ++++++++++++++++++
 .../canopy-server/src/packs/ref_state/mod.rs  |   3 +-
 .../src/repository_http/browse.rs             |   6 +-
 .../src/server/residency/tests/serving.rs     |  86 +++++
 docs/design/certified-serving-pins.md         |  42 +++
 docs/evidence/serving-refs-20261004.json      | 256 +++++++++++++
 .../large-repository-implementation-status.md |  53 ++-
 20 files changed, 1079 insertions(+), 115 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/reads.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/refs.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/refs.rs
 create mode 100644 docs/evidence/serving-refs-20261004.json

diff --git a/crates/canopy-server/src/git_read/browse.rs b/crates/canopy-server/src/git_read/browse.rs
index 61ae7e21..5d3a0fdf 100644
--- a/crates/canopy-server/src/git_read/browse.rs
+++ b/crates/canopy-server/src/git_read/browse.rs
@@ -1,6 +1,7 @@
 use super::*;
 use crate::ReadIdentity;
-use crate::refs::{RefReadError, valid_ref_name};
+use crate::packs::ref_state::MAX_NAME_BYTES;
+use crate::refs::valid_ref_name;
 
 const PAGE: usize = 32;
 
@@ -65,21 +66,22 @@ impl Reader {
         generation: Option<i64>,
     ) -> Result<serde_json::Value, ReadError> {
         let actor = actor.into();
-        if (!after.is_empty() && (!valid_ref_name(after) || generation.is_none()))
+        if (!after.is_empty()
+            && (after.len() > MAX_NAME_BYTES || !valid_ref_name(after) || generation.is_none()))
             || generation.is_some_and(|n| n < 0)
         {
             return Err(ReadError::Invalid);
         }
         self.member(actor).await?;
-        let page = self
-            .repository
-            .refs_page(after, generation)
-            .await
-            .map_err(|error| match error {
-                RefReadError::Changed => ReadError::Changed,
-                RefReadError::Cell(error) => ReadError::Cell(error),
-            })?
-            .output;
+        let snapshot = self.repository.serving_snapshot(actor).await?;
+        let page =
+            snapshot
+                .refs_page(after, generation, true)
+                .await
+                .map_err(|error| match error {
+                    crate::packs::publication::ServingReadError::Changed => ReadError::Changed,
+                    error => ReadError::Serving(error),
+                })?;
         let next_after = page
             .has_more
             .then(|| page.refs.last().map(|(name, _)| name.clone()))
@@ -96,44 +98,23 @@ impl Reader {
         reference: Option<&str>,
     ) -> Result<serde_json::Value, ReadError> {
         let actor = actor.into();
-        if reference.is_some_and(|name| !valid_ref_name(name)) {
+        if reference.is_some_and(|name| name.len() > MAX_NAME_BYTES || !valid_ref_name(name)) {
             return Err(ReadError::Invalid);
         }
         self.member(actor).await?;
-        // Resolve default HEAD and its tip in one observation. The returned OID
-        // pins subsequent reads even if a writer moves the ref during browsing.
-        let result = self.repository.sql.query(None, SqlBatch {statements: vec![SqlStatement {
-            sql: "SELECT g.generation, coalesce(?1,g.default_branch), r.oid, r.version FROM ref_generation g LEFT JOIN refs r ON r.name = coalesce(?1,g.default_branch) WHERE g.singleton = 1".into(),
-            parameters: vec![reference.map_or(SqlValue::Null, |value| SqlValue::Text(value.into()))],
-        }]}).await?;
-        let row = result
-            .output
-            .first()
-            .and_then(|set| set.rows.first())
-            .ok_or(ReadError::Malformed)?;
-        let [
-            SqlValue::Integer(generation),
-            SqlValue::Text(name),
-            value,
-            version,
-        ] = row.as_slice()
-        else {
-            return Err(ReadError::Malformed);
-        };
-        let oid = match value {
-            SqlValue::Null => None,
-            SqlValue::Blob(bytes) if matches!(bytes.len(), 20 | 32) => Some(hex::encode(bytes)),
-            _ => return Err(ReadError::Malformed),
-        };
-        let version = match version {
-            SqlValue::Null => None,
-            SqlValue::Integer(n) => Some(*n),
-            _ => return Err(ReadError::Malformed),
-        };
+        let snapshot = self.repository.serving_snapshot(actor).await?;
+        let resolved = snapshot.resolve_ref(reference).await?;
+        let oid = resolved
+            .state
+            .as_ref()
+            .and_then(|state| state.oid)
+            .map(hex::encode);
+        let version = resolved.state.as_ref().map(|state| state.version);
         self.member(actor).await?;
-        Ok(
-            serde_json::json!({"reference":name,"oid":oid,"version":version,"generation":generation}),
-        )
+        Ok(serde_json::json!({
+            "reference":resolved.reference, "oid":oid,
+            "version":version, "generation":resolved.generation,
+        }))
     }
     async fn commit(&mut self, mut target: Oid) -> Result<Commit, ReadError> {
         // Only certified objects are browseable. Staged push bytes do not become
diff --git a/crates/canopy-server/src/git_read/mod.rs b/crates/canopy-server/src/git_read/mod.rs
index 2106d4a1..3f0d6c8c 100644
--- a/crates/canopy-server/src/git_read/mod.rs
+++ b/crates/canopy-server/src/git_read/mod.rs
@@ -50,6 +50,10 @@ pub(crate) enum ReadError {
     Cell(#[from] InvocationError<Vec<SqlResultSet>>),
     #[error("Git read worker failed")]
     Task(#[from] tokio::task::JoinError),
+    #[error("certified Git snapshot is unavailable")]
+    Serving(#[from] crate::packs::publication::ServingReadError),
+    #[error("certified Git snapshot owner is unavailable")]
+    ServingOwner(#[from] crate::packs::publication::ServingOwnerError),
 }
 #[derive(Clone, Copy, PartialEq, Eq)]
 struct Node {
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 83a45771..8e401374 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -300,6 +300,8 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/serving/commands.rs"));
                 source.update(include_bytes!("packs/publication/serving/command_owner.rs"));
                 source.update(include_bytes!("packs/publication/serving/session.rs"));
+                source.update(include_bytes!("packs/publication/serving/session/reads.rs"));
+                source.update(include_bytes!("packs/publication/serving/session/refs.rs"));
                 source.update(include_bytes!("packs/publication/serving/lifecycle.rs"));
                 source.update(include_bytes!("packs/publication/serving/pool.rs"));
                 source.update(include_bytes!(
diff --git a/crates/canopy-server/src/packs/catalog/reader.rs b/crates/canopy-server/src/packs/catalog/reader.rs
index 1d7d6407..04ab4e96 100644
--- a/crates/canopy-server/src/packs/catalog/reader.rs
+++ b/crates/canopy-server/src/packs/catalog/reader.rs
@@ -8,6 +8,7 @@ pub struct CatalogIndexes {
     ranges: RangeIndex,
     sources: Arc<SourceIndex>,
     inputs: super::super::sources::NativeInputIndex,
+    refs: super::super::ref_state::RefStateIndex,
 }
 impl CatalogIndexes {
     pub fn new(store: Arc<ArtifactStore>, format: ObjectFormat) -> Self {
@@ -15,6 +16,7 @@ impl CatalogIndexes {
             ranges: RangeIndex::new(Arc::clone(&store), format),
             sources: Arc::new(SourceIndex::new(Arc::clone(&store), format)),
             inputs: super::super::sources::NativeInputIndex::new(Arc::clone(&store), format),
+            refs: super::super::ref_state::RefStateIndex::new(Arc::clone(&store), format),
             store,
         }
     }
@@ -27,6 +29,9 @@ impl CatalogIndexes {
     pub(in crate::packs) fn inputs(&self) -> &super::super::sources::NativeInputIndex {
         &self.inputs
     }
+    pub(in crate::packs) fn refs(&self) -> &super::super::ref_state::RefStateIndex {
+        &self.refs
+    }
     pub fn input_stats(&self) -> super::super::directory::index::ReadStats {
         self.inputs.stats()
     }
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 8d6d14b6..efc61795 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -18,11 +18,12 @@ mod serving;
 pub use serving::{
     AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_SERVING_GENERATIONS,
     MAX_SERVING_OWNERS, MAX_SERVING_PINS, ReadyServingCommand, ReadyServingRelease,
-    ReleaseServingPin, RenewServingPin, RenewServingRequest, SelectServingGeneration, ServingCheck,
-    ServingContext, ServingDenial, ServingDrainObserver, ServingDrainProof, ServingLease,
-    ServingOwner, ServingOwnerError, ServingOwnerPhase, ServingOwnerStats, ServingPin, ServingPool,
-    ServingPoolLimits, ServingReadBudget, ServingReadError, ServingReleaseReply, ServingReply,
-    ServingSelection, ServingSnapshot, ServingToken,
+    ReleaseServingPin, RenewServingPin, RenewServingRequest, ResolvedServingRef,
+    SelectServingGeneration, ServingCheck, ServingContext, ServingDenial, ServingDrainObserver,
+    ServingDrainProof, ServingLease, ServingOwner, ServingOwnerError, ServingOwnerPhase,
+    ServingOwnerStats, ServingPin, ServingPool, ServingPoolLimits, ServingReadBudget,
+    ServingReadError, ServingReleaseReply, ServingReply, ServingSelection, ServingSnapshot,
+    ServingToken,
 };
 mod owner;
 pub(crate) mod registry;
diff --git a/crates/canopy-server/src/packs/publication/serving.rs b/crates/canopy-server/src/packs/publication/serving.rs
index 485ae93d..f790e6f7 100644
--- a/crates/canopy-server/src/packs/publication/serving.rs
+++ b/crates/canopy-server/src/packs/publication/serving.rs
@@ -20,7 +20,8 @@ pub use commands::{
     AcquireServingPin, CheckServingPin, ReleaseServingPin, RenewServingPin, SelectServingGeneration,
 };
 pub use session::{
-    ReadyServingRelease, ServingContext, ServingPin, ServingReadBudget, ServingReadError,
+    ReadyServingRelease, ResolvedServingRef, ServingContext, ServingPin, ServingReadBudget,
+    ServingReadError,
 };
 
 pub const MAX_SERVING_PINS: u64 = 4096;
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
index 17d0b3ca..55377586 100644
--- a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -125,6 +125,22 @@ impl ServingSnapshot {
     ) -> Result<Vec<Option<crate::packs::metadata::ObjectHeader>>, ServingReadError> {
         self.pin.headers(self.actor.clone(), ids).await
     }
+    pub async fn resolve_ref(
+        &self,
+        reference: Option<&str>,
+    ) -> Result<ResolvedServingRef, ServingReadError> {
+        self.pin.resolve_ref(self.actor.clone(), reference).await
+    }
+    pub async fn refs_page(
+        &self,
+        after: &str,
+        generation: Option<i64>,
+        live_only: bool,
+    ) -> Result<crate::refs::RefPage, ServingReadError> {
+        self.pin
+            .refs_page(self.actor.clone(), after, generation, live_only)
+            .await
+    }
 }
 enum Original {
     Command(Arc<ReadyServingCommand>),
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index f3d55920..138a7257 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -12,6 +12,9 @@ use std::sync::Mutex;
 use tokio::{sync::Notify, time::Instant};
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 mod handoff;
+mod reads;
+mod refs;
+pub use refs::ResolvedServingRef;
 
 #[derive(Debug, thiserror::Error)]
 pub enum ServingReadError {
@@ -21,6 +24,12 @@ pub enum ServingReadError {
     Inactive,
     #[error("invalid serving context or budget")]
     Context,
+    #[error("serving refs changed while reading pages")]
+    Changed,
+    #[error("serving ref snapshot failed")]
+    RefSnapshot(#[from] crate::packs::ref_state::RefSnapshotError),
+    #[error("serving ref index failed")]
+    Refs(#[from] crate::packs::ref_state::RefStateError),
     #[error("serving authority failed")]
     Authority(#[from] PreparationBaseError),
     #[error("serving query failed")]
@@ -219,6 +228,7 @@ struct Inner {
     state: Mutex<Workers>,
     changed: Notify,
     reader: tokio::sync::Mutex<Option<Arc<CatalogReader>>>,
+    refs: tokio::sync::OnceCell<crate::packs::ref_state::RefStateSnapshot>,
     release: tokio::sync::Mutex<Option<ReleaseCommand>>,
 }
 #[derive(Default)]
@@ -294,6 +304,7 @@ impl ServingPin {
                         state: Mutex::new(Workers::default()),
                         changed: Notify::new(),
                         reader: tokio::sync::Mutex::new(None),
+                        refs: tokio::sync::OnceCell::new(),
                         release: tokio::sync::Mutex::new(None),
                     }),
                 })
@@ -321,66 +332,29 @@ impl ServingPin {
         {
             return Err(ServingReadError::Context);
         }
-        if self.inner.context.budget.inner.stop.is_cancelled() {
-            return Err(ServingReadError::Inactive);
-        }
-        let scope = actor
-            .as_deref()
-            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
-        let permit = self
-            .inner
-            .context
-            .budget
-            .inner
-            .admission
-            .acquire(scope)
-            .await?;
-        let guard = {
-            let mut state = self.inner.state.lock().expect("serving workers");
-            if state.closed {
-                return Err(ServingReadError::Inactive);
-            }
-            state.active += 1;
-            Active(Arc::clone(&self.inner))
-        };
         let ids = ids.to_vec();
-        let inner = Arc::clone(&self.inner);
-        self.inner
-            .context
-            .budget
-            .inner
-            .tasks
-            .spawn(async move {
-                let (_permit, _guard) = (permit, guard);
-                let (_, deadline) = inner.observe(actor.clone()).await?;
-                let reader = {
-                    let mut reader = inner.reader.lock().await;
-                    if reader.is_none() {
-                        *reader = Some(Arc::new(
-                            CatalogReader::open(
-                                Arc::clone(&inner.context.indexes),
-                                inner.lease.fact.catalog.ok_or(ServingReadError::Context)?,
-                            )
-                            .await?,
-                        ));
-                    }
-                    Arc::clone(reader.as_ref().expect("opened serving catalog"))
-                };
-                // Never time out by dropping owned metadata/SQLite work. Expiry
-                // stops serving its result; the pin remains until explicit drain.
-                if Instant::now() >= deadline {
-                    return Err(ServingReadError::Inactive);
+        self.read_owned(actor, move |inner, deadline| async move {
+            let reader = {
+                let mut reader = inner.reader.lock().await;
+                if reader.is_none() {
+                    *reader = Some(Arc::new(
+                        CatalogReader::open(
+                            Arc::clone(&inner.context.indexes),
+                            inner.lease.fact.catalog.ok_or(ServingReadError::Context)?,
+                        )
+                        .await?,
+                    ));
                 }
-                let headers = reader
-                    .headers(&ids, &*inner.context.files, &*inner.context.files)
-                    .await?;
-                inner.observe(actor).await?;
-                if Instant::now() >= deadline {
-                    return Err(ServingReadError::Inactive);
-                }
-                Ok(headers)
-            })
-            .await?
+                Arc::clone(reader.as_ref().expect("opened serving catalog"))
+            };
+            if Instant::now() >= deadline {
+                return Err(ServingReadError::Inactive);
+            }
+            Ok(reader
+                .headers(&ids, &*inner.context.files, &*inner.context.files)
+                .await?)
+        })
+        .await
     }
     /// Own the exact renewal and its drain guard before yielding to a caller.
     /// The coordinator retains both across held/unknown states and transport loss.
diff --git a/crates/canopy-server/src/packs/publication/serving/session/handoff.rs b/crates/canopy-server/src/packs/publication/serving/session/handoff.rs
index 0823f8ab..2df8ef8e 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/handoff.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/handoff.rs
@@ -60,6 +60,7 @@ impl ServingPin {
                 state: Mutex::new(Workers::default()),
                 changed: Notify::new(),
                 reader: tokio::sync::Mutex::new(None),
+                refs: tokio::sync::OnceCell::new(),
                 release: tokio::sync::Mutex::new(None),
             }) })
         }).await?
diff --git a/crates/canopy-server/src/packs/publication/serving/session/reads.rs b/crates/canopy-server/src/packs/publication/serving/session/reads.rs
new file mode 100644
index 00000000..331c3d9e
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/reads.rs
@@ -0,0 +1,59 @@
+//! One admission and physical lifetime for private immutable read workers.
+use super::*;
+use std::future::Future;
+
+impl ServingPin {
+    pub(super) async fn read_owned<T, F, Work>(
+        &self,
+        actor: Option<String>,
+        work: Work,
+    ) -> Result<T, ServingReadError>
+    where
+        T: Send + 'static,
+        F: Future<Output = Result<T, ServingReadError>> + Send,
+        Work: FnOnce(Arc<Inner>, Instant) -> F + Send + 'static,
+    {
+        if self.inner.context.budget.inner.stop.is_cancelled() {
+            return Err(ServingReadError::Inactive);
+        }
+        let scope = actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        let permit = self
+            .inner
+            .context
+            .budget
+            .inner
+            .admission
+            .acquire(scope)
+            .await?;
+        let guard = {
+            let mut state = self.inner.state.lock().expect("serving workers");
+            if state.closed {
+                return Err(ServingReadError::Inactive);
+            }
+            state.active += 1;
+            Active(Arc::clone(&self.inner))
+        };
+        let inner = Arc::clone(&self.inner);
+        self.inner
+            .context
+            .tasks()
+            .spawn(async move {
+                let (_permit, _guard) = (permit, guard);
+                let (_, deadline) = inner.observe(actor.clone()).await?;
+                if Instant::now() >= deadline {
+                    return Err(ServingReadError::Inactive);
+                }
+                // Observer cancellation only detaches this task. Do not time out by
+                // dropping provider work and misreporting that its roots drained.
+                let output = work(inner.clone(), deadline).await?;
+                inner.observe(actor).await?;
+                if Instant::now() >= deadline {
+                    return Err(ServingReadError::Inactive);
+                }
+                Ok(output)
+            })
+            .await?
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/session/refs.rs b/crates/canopy-server/src/packs/publication/serving/session/refs.rs
new file mode 100644
index 00000000..757d6af1
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/refs.rs
@@ -0,0 +1,122 @@
+//! Ref facts come only from the accepted joint generation's immutable root.
+use super::*;
+use crate::packs::ref_state::{RefNameKey, RefStateSnapshot};
+use crate::refs::{REF_PAGE_SIZE, RefExpectation, RefPage, valid_ref_name};
+
+const PAGE_BYTES: usize = 512 * 1024;
+
+pub struct ResolvedServingRef {
+    pub generation: i64,
+    pub reference: String,
+    /// None means the name never existed. A retained deletion has a version.
+    pub state: Option<RefExpectation>,
+}
+
+impl Inner {
+    async fn ref_snapshot(&self) -> Result<&RefStateSnapshot, ServingReadError> {
+        self.refs
+            .get_or_try_init(|| async {
+                let fact = self.lease.fact;
+                let snapshot = fact
+                    .refs
+                    .ok_or(ServingReadError::Context)?
+                    .read(&self.context.indexes.store())
+                    .await?;
+                if snapshot.repository != self.lease.token.repository
+                    || snapshot.format != self.lease.format
+                    || snapshot.generation > fact.generation
+                {
+                    return Err(ServingReadError::Context);
+                }
+                Ok(snapshot)
+            })
+            .await
+    }
+}
+
+impl ServingPin {
+    pub async fn resolve_ref(
+        &self,
+        actor: Option<String>,
+        reference: Option<&str>,
+    ) -> Result<ResolvedServingRef, ServingReadError> {
+        if reference.is_some_and(|name| !valid_ref_name(name)) {
+            return Err(ServingReadError::Context);
+        }
+        let reference = reference.map(RefNameKey::new).transpose()?;
+        self.read_owned(actor, move |inner, deadline| async move {
+            let snapshot = inner.ref_snapshot().await?;
+            if Instant::now() >= deadline {
+                return Err(ServingReadError::Inactive);
+            }
+            let reference = reference
+                .as_ref()
+                .map_or(snapshot.default_branch.as_str(), RefNameKey::as_str);
+            let state = inner
+                .context
+                .indexes
+                .refs()
+                .read(snapshot.root.clone(), reference)
+                .await?;
+            Ok(ResolvedServingRef {
+                generation: snapshot.generation as i64,
+                reference: reference.to_owned(),
+                state,
+            })
+        })
+        .await
+    }
+
+    /// Count/byte-bounded page. Live cursors skip whole deleted subtrees; other
+    /// consumers can retain tombstone versions without a second representation.
+    pub async fn refs_page(
+        &self,
+        actor: Option<String>,
+        after: &str,
+        generation: Option<i64>,
+        live_only: bool,
+    ) -> Result<RefPage, ServingReadError> {
+        if (!after.is_empty() && (!valid_ref_name(after) || generation.is_none()))
+            || generation.is_some_and(|value| value < 0)
+        {
+            return Err(ServingReadError::Context);
+        }
+        let after = (!after.is_empty())
+            .then(|| RefNameKey::new(after))
+            .transpose()?;
+        self.read_owned(actor, move |inner, deadline| async move {
+            let snapshot = inner.ref_snapshot().await?;
+            if Instant::now() >= deadline {
+                return Err(ServingReadError::Inactive);
+            }
+            if generation.is_some_and(|value| value != snapshot.generation as i64) {
+                return Err(ServingReadError::Changed);
+            }
+            let mut cursor =
+                inner
+                    .context
+                    .indexes
+                    .refs()
+                    .cursor(snapshot.root.clone(), after, live_only)?;
+            let mut refs = Vec::with_capacity(REF_PAGE_SIZE);
+            let mut bytes = 0;
+            let mut has_more = false;
+            while let Some(record) = cursor.next().await? {
+                let charge = record.name().len() + 64;
+                if refs.len() == REF_PAGE_SIZE || charge > PAGE_BYTES - bytes {
+                    has_more = true;
+                    break;
+                }
+                bytes += charge;
+                refs.push((record.name().to_owned(), record.state().clone()));
+            }
+            Ok(RefPage {
+                generation: snapshot.generation as i64,
+                default_branch: snapshot.default_branch.clone(),
+                refs,
+                has_more,
+            })
+        })
+        .await
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index 0d39eead..f943c0a4 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -10,6 +10,7 @@ use tokio_util::task::TaskTracker;
 mod custody;
 mod lifecycle;
 mod pool;
+mod refs;
 mod selection_drain;
 
 async fn initialize(f: &Fixture, store: Arc<ArtifactStore>) -> Result<GenerationFact> {
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/pool.rs b/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
index 3d2574e7..bc473428 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
@@ -1,7 +1,7 @@
 //! Bounded pooling and actual lifecycle ownership, including head races.
 use super::*;
 
-fn pooled(
+pub(super) fn pooled(
     f: &Fixture,
     store: Arc<ArtifactStore>,
     root: &tempfile::TempDir,
@@ -28,7 +28,7 @@ fn pooled(
         ServingPoolLimits::default(),
     )?)
 }
-fn queue(f: &Fixture) -> Result<PublicationCoordinator> {
+pub(super) fn queue(f: &Fixture) -> Result<PublicationCoordinator> {
     Ok(PublicationCoordinator::new(
         f.target.clone(),
         PublicationLimits::default(),
@@ -40,7 +40,7 @@ async fn advance(f: &Fixture, generation: u64) -> Result {
     // native publication, changing Git content, or a full-history benchmark.
     edit(f, &format!("INSERT INTO catalog_generations(generation,catalog,certificate,refs) SELECT {generation},catalog,certificate,refs FROM catalog_generations WHERE generation=1; UPDATE catalog_state SET generation={generation} WHERE singleton=1")).await
 }
-async fn finish(
+pub(super) async fn finish(
     f: &Fixture,
     pool: &ServingPool,
     q: &PublicationCoordinator,
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/refs.rs b/crates/canopy-server/src/packs/publication/tests/serving/refs.rs
new file mode 100644
index 00000000..f083aaa9
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/refs.rs
@@ -0,0 +1,357 @@
+//! Immutable joint refs, bounded pagination and real retained provider work.
+use super::pool::{finish, pooled, queue};
+use super::*;
+use crate::RefExpectation;
+use crate::packs::ref_state::{
+    RefStateRecord, RefStateSnapshot, RefStateSnapshotRoot, RefStateTree,
+};
+
+fn operation(sequence: u64) -> [u8; 16] {
+    let mut operation = *b"CANOPY0100000000";
+    operation[8..].copy_from_slice(&sequence.to_be_bytes());
+    operation
+}
+
+async fn install(
+    f: &Fixture,
+    store: &ArtifactStore,
+    base: GenerationFact,
+    generation: u64,
+    snapshot: RefStateSnapshot,
+) -> Result {
+    // Trusted root injection isolates reader behavior; it is not native graph
+    // closure or evidence that the production publisher accepts these tips.
+    let root = RefStateSnapshotRoot::upload(store, operation(1_000 + generation), snapshot).await?;
+    f.install_generation(
+        generation,
+        base.catalog.ok_or("catalog absent")?,
+        Some(root),
+    )
+    .await
+}
+fn snapshot(f: &Fixture, generation: u64) -> RefStateSnapshot {
+    RefStateSnapshot {
+        repository: f.repository,
+        format: f.format,
+        generation,
+        default_branch: "refs/heads/main".into(),
+        root: None,
+    }
+}
+
+#[tokio::test]
+async fn immutable_ref_pages_preserve_versions_skip_deleted_subtrees_and_recheck_cached_access()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let base = initialize(&f, store.clone()).await?;
+        let oid = missing(&f)?;
+        let mut records = Vec::new();
+        for n in 0..512 {
+            records.push(RefStateRecord::new(
+                &format!("refs/heads/deleted/{n:04}"),
+                RefExpectation {
+                    oid: None,
+                    version: 2,
+                },
+                format,
+            )?);
+        }
+        for n in 0..300 {
+            records.push(RefStateRecord::new(
+                &format!("refs/heads/live/{n:04}"),
+                RefExpectation {
+                    oid: Some(oid),
+                    version: 1,
+                },
+                format,
+            )?);
+        }
+        let tree = RefStateTree::new(store.clone(), format);
+        let mut old = snapshot(&f, 1);
+        old.default_branch = "refs/heads/live/0000".into();
+        old.root = tree
+            .build_sorted(operation(141), records.into_iter().map(Ok))
+            .await?;
+        install(&f, &store, base, 2, old).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store.clone(), &root, tasks.clone(), q.clone())?;
+        let view = pool.snapshot(Some("viewer".into())).await?;
+        let resolved = view.resolve_ref(None).await?;
+        assert_eq!(resolved.generation, 1);
+        assert_eq!(resolved.reference, "refs/heads/live/0000");
+        assert_eq!(
+            resolved.state,
+            Some(RefExpectation {
+                oid: Some(oid),
+                version: 1
+            })
+        );
+        assert!(
+            view.resolve_ref(Some("refs/heads/absent"))
+                .await?
+                .state
+                .is_none()
+        );
+        assert_eq!(
+            view.resolve_ref(Some("refs/heads/deleted/0000"))
+                .await?
+                .state,
+            Some(RefExpectation {
+                oid: None,
+                version: 2
+            })
+        );
+        let first = view.refs_page("", None, true).await?;
+        assert_eq!(first.refs.len(), 256);
+        assert!(first.has_more);
+        assert_eq!(first.refs[0].0, "refs/heads/live/0000");
+        let after = &first.refs.last().ok_or("empty first page")?.0;
+        let last = view.refs_page(after, Some(first.generation), true).await?;
+        assert_eq!(last.refs.len(), 44);
+        assert!(!last.has_more);
+        assert_eq!(
+            last.refs.last().ok_or("empty last page")?.0,
+            "refs/heads/live/0299"
+        );
+        let all = view.refs_page("", None, false).await?;
+        assert_eq!(all.refs.len(), 256);
+        assert!(all.refs.iter().all(|(_, state)| state.oid.is_none()));
+        assert!(matches!(
+            view.refs_page(after, Some(0), true).await,
+            Err(ServingReadError::Changed)
+        ));
+        assert!(view.refs_page(after, None, true).await.is_err());
+        assert!(
+            view.resolve_ref(Some("refs/heads/bad..name"))
+                .await
+                .is_err()
+        );
+        let mut new = snapshot(&f, 2);
+        new.default_branch = "refs/heads/new".into();
+        install(&f, &store, base, 3, new).await?;
+        let current = pool.snapshot(Some("owner".into())).await?;
+        assert_eq!(current.resolve_ref(None).await?.reference, "refs/heads/new");
+        assert_eq!(
+            view.resolve_ref(None).await?.reference,
+            "refs/heads/live/0000"
+        );
+        assert!(matches!(
+            current.refs_page(after, Some(1), true).await,
+            Err(ServingReadError::Changed)
+        ));
+        edit(&f, "UPDATE ref_generation SET visibility='public'").await?;
+        let public = pool.snapshot(None).await?;
+        assert_eq!(public.resolve_ref(None).await?.generation, 2);
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'; UPDATE ref_generation SET visibility='private'").await?;
+        assert!(view.resolve_ref(None).await.is_err());
+        assert!(view.refs_page("", None, true).await.is_err());
+        assert!(public.resolve_ref(None).await.is_err());
+        drop((view, current, public));
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn ref_page_byte_bound_continues_exactly_after_long_names_without_losing_entries() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let base = initialize(&f, store.clone()).await?;
+        let oid = missing(&f)?;
+        let names: Vec<_> = (0..9)
+            .map(|n| format!("refs/heads/{n:02}-{}", "x".repeat(65_000)))
+            .collect();
+        let records = names
+            .iter()
+            .map(|name| {
+                RefStateRecord::new(
+                    name,
+                    RefExpectation {
+                        oid: Some(oid),
+                        version: 1,
+                    },
+                    format,
+                )
+            })
+            .collect::<std::result::Result<Vec<_>, _>>()?;
+        let mut refs = snapshot(&f, 1);
+        refs.root = RefStateTree::new(store.clone(), format)
+            .build_sorted(operation(142), records.into_iter().map(Ok))
+            .await?;
+        install(&f, &store, base, 2, refs).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let view = pool.snapshot(Some("owner".into())).await?;
+        let first = view.refs_page("", None, true).await?;
+        assert_eq!(first.refs.len(), 8);
+        assert!(first.has_more);
+        assert!(
+            first
+                .refs
+                .iter()
+                .map(|(name, _)| name.len() + 64)
+                .sum::<usize>()
+                <= 512 * 1024
+        );
+        let after = &first.refs.last().ok_or("first page")?.0;
+        let last = view.refs_page(after, Some(first.generation), true).await?;
+        assert_eq!(last.refs.len(), 1);
+        assert!(!last.has_more);
+        assert_eq!(
+            first
+                .refs
+                .into_iter()
+                .chain(last.refs)
+                .map(|(name, _)| name)
+                .collect::<Vec<_>>(),
+            names
+        );
+        drop(view);
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn blocked_ref_download_survives_canceled_observation_and_refuses_early_pin_release() -> Result
+{
+    use std::sync::atomic::Ordering;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let view = pool.snapshot(Some("owner".into())).await?;
+        provider.armed.store(true, Ordering::Release);
+        let observer = tokio::spawn(async move { view.resolve_ref(None).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        observer.abort();
+        assert!(
+            observer
+                .await
+                .err()
+                .ok_or("ref observer finished")?
+                .is_cancelled()
+        );
+        assert!(!pool.quiesce().await?);
+        let mut drain = tokio::spawn({
+            let pool = pool.clone();
+            async move { pool.close_and_drain().await }
+        });
+        assert!(
+            timeout(Duration::from_millis(50), &mut drain)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        provider.proceed.add_permits(1);
+        timeout(Duration::from_secs(8), drain).await??;
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn ref_download_drains_but_never_returns_a_result_after_viewer_revocation() -> Result {
+    use std::sync::atomic::Ordering;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+        initialize(&f, store.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let view = pool.snapshot(Some("viewer".into())).await?;
+        provider.armed.store(true, Ordering::Release);
+        let observer = tokio::spawn(async move { view.resolve_ref(None).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+        provider.proceed.add_permits(1);
+        assert!(matches!(
+            timeout(Duration::from_secs(8), observer).await??,
+            Err(ServingReadError::Inactive)
+        ));
+        let authorized = pool.snapshot(Some("owner".into())).await?;
+        assert_eq!(
+            authorized.resolve_ref(None).await?.reference,
+            "refs/heads/main"
+        );
+        assert!(pool.snapshot(Some("viewer".into())).await.is_err());
+        drop(authorized);
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn ref_snapshot_context_mismatch_never_falls_back_to_legacy_sql() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        let base = initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store.clone(), &root, tasks.clone(), q.clone())?;
+        for (generation, other_format, ref_generation) in [
+            (2, format, 3),
+            (
+                3,
+                if format == ObjectFormat::Sha1 {
+                    ObjectFormat::Sha256
+                } else {
+                    ObjectFormat::Sha1
+                },
+                1,
+            ),
+        ] {
+            let mut bad = snapshot(&f, ref_generation);
+            bad.format = other_format;
+            install(&f, &store, base, generation, bad).await?;
+            let view = pool.snapshot(Some("owner".into())).await?;
+            assert!(matches!(
+                view.resolve_ref(None).await,
+                Err(ServingReadError::Context)
+            ));
+            assert!(matches!(
+                view.refs_page("", None, true).await,
+                Err(ServingReadError::Context)
+            ));
+            drop(view);
+        }
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/ref_state/mod.rs b/crates/canopy-server/src/packs/ref_state/mod.rs
index d3ad6c6a..51d88879 100644
--- a/crates/canopy-server/src/packs/ref_state/mod.rs
+++ b/crates/canopy-server/src/packs/ref_state/mod.rs
@@ -1,6 +1,7 @@
 //! Conditional immutable ref state; raw roots do not confer publication rights.
 //! Final owner/ACL/policy/root-CAS and durable outcome publication remain Cell
-//! responsibilities. This data plane is not selected by the serving path yet.
+//! responsibilities. Certified serving snapshots select this data plane; raw
+//! roots and standalone index clients confer neither Read nor retention authority.
 use super::directory::index::{IndexError, NodeRef, RangeCursor, RangeIndex, ReadStats};
 use crate::{ObjectFormat, PushPlan, RefExpectation};
 use canopy_object_storage::artifact::ArtifactStore;
diff --git a/crates/canopy-server/src/repository_http/browse.rs b/crates/canopy-server/src/repository_http/browse.rs
index de0ac3c8..5f22810c 100644
--- a/crates/canopy-server/src/repository_http/browse.rs
+++ b/crates/canopy-server/src/repository_http/browse.rs
@@ -2,6 +2,10 @@ use super::*;
 use crate::git_read::{ReadError, Reader};
 use std::time::Duration;
 
+// A legal 65,535-byte ref cursor can expand sixfold in JSON escapes. Keep
+// requests bounded while allowing clients to continue every supported ref page.
+const REQUEST_BYTES: usize = 512 * 1024;
+
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Input {
@@ -75,7 +79,7 @@ async fn serve(
         };
     let body = match tokio::time::timeout(
         Duration::from_secs(30),
-        to_bytes(request.into_body(), 32 * 1024),
+        to_bytes(request.into_body(), REQUEST_BYTES),
     )
     .await
     {
diff --git a/crates/canopy-server/src/server/residency/tests/serving.rs b/crates/canopy-server/src/server/residency/tests/serving.rs
index 94fab77d..f77cd6f2 100644
--- a/crates/canopy-server/src/server/residency/tests/serving.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving.rs
@@ -36,6 +36,92 @@ fn missing(format: ObjectFormat) -> ObjectId {
     }
 }
 
+#[tokio::test]
+async fn production_browser_refs_use_certified_joint_roots_and_ignore_legacy_ref_tables() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let manager = server.repositories.clone();
+        let entry = create(&manager, "browser-refs", format).await?;
+        let (repository, _, _) = loaded(&manager, entry.repository_id).await?;
+        // Trusted divergence isolates consumer authority. This old row must not
+        // become visible without publication of the immutable joint ref root.
+        repository.sql.batch(crate::server::mutation_identity()?, SqlBatch {
+            statements: vec![
+                SqlStatement { sql: "UPDATE ref_generation SET default_branch='refs/heads/legacy',generation=99 WHERE singleton=1".into(), parameters: vec![] },
+                SqlStatement { sql: "INSERT INTO refs(name,oid,version) VALUES('refs/heads/legacy',?1,1)".into(), parameters: vec![SqlValue::Blob(missing(format).to_vec())] },
+            ],
+        }).await?;
+        let client = reqwest::Client::new();
+        let url = format!(
+            "http://{}/api/repositories/browser-refs/browse",
+            server.address
+        );
+        for query in [
+            serde_json::json!({"kind":"resolve"}),
+            serde_json::json!({"kind":"refs"}),
+        ] {
+            let response = client
+                .post(&url)
+                .bearer_auth("local-recovery-test")
+                .json(&serde_json::json!({
+                    "repository_id": uuid::Uuid::from_bytes(entry.repository_id).to_string(), "query":query,
+                }))
+                .send()
+                .await?;
+            assert_eq!(response.status(), reqwest::StatusCode::OK);
+            let body: serde_json::Value = response.json().await?;
+            if query["kind"] == "resolve" {
+                assert_eq!(body["view"]["resolved"]["reference"], "refs/heads/main");
+                assert!(body["view"]["resolved"]["oid"].is_null());
+                assert!(body["view"]["resolved"]["version"].is_null());
+                assert_eq!(body["view"]["resolved"]["generation"], 0);
+            } else {
+                assert_eq!(body["view"]["refs"]["default_branch"], "refs/heads/main");
+                assert_eq!(body["view"]["refs"]["entries"], serde_json::json!([]));
+                assert_eq!(body["view"]["refs"]["generation"], 0);
+            }
+        }
+        let changed = client.post(&url).bearer_auth("local-recovery-test").json(&serde_json::json!({
+            "repository_id": uuid::Uuid::from_bytes(entry.repository_id).to_string(), "query":{"kind":"refs","generation":99},
+        })).send().await?;
+        assert_eq!(changed.status(), reqwest::StatusCode::CONFLICT);
+        let long = format!("refs/heads/{}", "\"".repeat(65_000));
+        let continued = client
+            .post(&url)
+            .bearer_auth("local-recovery-test")
+            .json(&serde_json::json!({
+                "repository_id": uuid::Uuid::from_bytes(entry.repository_id).to_string(),
+                "query":{"kind":"refs","generation":0,"after":long},
+            }))
+            .send()
+            .await?;
+        assert_eq!(continued.status(), reqwest::StatusCode::OK);
+        let oversized = format!("refs/heads/{}", "x".repeat(65_536));
+        let invalid = client
+            .post(&url)
+            .bearer_auth("local-recovery-test")
+            .json(&serde_json::json!({
+                "repository_id": uuid::Uuid::from_bytes(entry.repository_id).to_string(),
+                "query":{"kind":"refs","generation":0,"after":oversized},
+            }))
+            .send()
+            .await?;
+        assert_eq!(invalid.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
+        let anonymous = client
+            .post(&url)
+            .json(&serde_json::json!({
+                "repository_id": uuid::Uuid::from_bytes(entry.repository_id).to_string(), "query":{"kind":"resolve"},
+            }))
+            .send()
+            .await?;
+        assert_ne!(anonymous.status(), reqwest::StatusCode::OK);
+        drop(repository);
+        timeout(Duration::from_secs(10), server.shutdown()).await??;
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn shutdown_refuses_unpublished_serving_constructor_and_joins_it_before_workspace_release()
 -> Result {
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index 0dc4887b..f70e1350 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -269,6 +269,48 @@ and verifies that workspace/publication ownership remains until rejected
 construction cleanup joins. The regression fails against the preceding weak
 association ordering and passes with the registration barrier in both formats.
 
+## Certified immutable ref reads
+
+`ServingSnapshot::resolve_ref` and `refs_page` use only the ref snapshot in the
+accepted joint fact. The snapshot descriptor is loaded once per retained pin,
+validated against repository, object format and the joint generation, and shared
+by its viewers. The resident's existing `CatalogIndexes` also owns the shared
+`RefStateIndex`, so unchanged authenticated nodes reuse the same bounded cache.
+Public descriptors or a cache hit do not grant Read or retain a generation.
+
+Ref and canonical-header reads share a private admitted worker. Current access,
+owner and lease are checked before and after artifact work; expiry or revocation
+refuses the result. Observer cancellation detaches that worker without returning
+its admission or physical guard. Closing a pool cannot release its pin while a
+ref descriptor/index download is still pending. The worker finishes its actual
+I/O rather than dropping it to manufacture a timeout/drain result.
+
+The new path reuses `RefPage` and `RefExpectation`. Lookup distinguishes a name
+that never existed from a retained deletion with a version. Page size is at most
+256 records and 512 KiB of name/record charges. Live cursors skip authenticated
+zero-weight subtrees; other consumers can request deletion versions. Continuation
+requires the first page's ref generation, and a different selected ref generation
+returns an explicit changed result. An old borrowed snapshot continues to read
+its old immutable refs after the current head advances. Ref generation is the
+snapshot's counter, not the catalog counter; catalog-only changes can share refs.
+
+The local browser's `Refs` and `Resolve` operations select this service. Both the
+default branch and its tip come from the same immutable snapshot; legacy `refs`
+and `ref_generation` rows cannot override them. The HTTP request ceiling is
+512 KiB so even supported long ref cursors with JSON escapes can be submitted.
+Names above the index's 65,535-byte limit reject as invalid input. Changed page
+generations return HTTP 409. This does not yet convert remote owner routing,
+object bodies, tree/file/history browsing, native Git or policy/default-branch
+producers; those remain required for the full cutover.
+
+Five new ref families and one actual HTTP/manager family exercise both object
+formats: count/byte continuation, tombstones, old-generation immutability, cached
+and in-flight revocation, canceled real provider I/O, malformed snapshot context,
+and immutable authority despite deliberately conflicting legacy SQL. The ref
+inventory fixtures inject roots to isolate reader behavior; their tips do not
+qualify native graph publication or capacity. Final frozen-source totals are
+recorded in the [implementation status](../large-repository-implementation-status.md).
+
 ## Sticky closure and exact release
 
 Closure prevents new reads and waits for every owned drain guard. Notify
diff --git a/docs/evidence/serving-refs-20261004.json b/docs/evidence/serving-refs-20261004.json
new file mode 100644
index 00000000..68e64807
--- /dev/null
+++ b/docs/evidence/serving-refs-20261004.json
@@ -0,0 +1,256 @@
+{
+  "source_files": 474,
+  "rust_files": 460,
+  "source_hash_digest": "8f29f85e5224490ae647603bb51ebf64add25d4be3c1a748b559cf6418ce80f1",
+  "phases": [
+    {
+      "label": "clippy",
+      "exit_code": 0,
+      "log": "/tmp/canopy-serving-refs-clippy.log",
+      "preceding_unchanged_source": true,
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "clippy",
+        "--workspace",
+        "--all-targets",
+        "--locked",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "log_sha256": "2ef814fea8430b2d9875931a8da0eec6994f6db900678285b2abbca6b2610eb2"
+    },
+    {
+      "label": "focused",
+      "exit_code": 0,
+      "log": "/tmp/canopy-serving-refs-focused.log",
+      "preceding_unchanged_source": true,
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--lib",
+        "--locked",
+        "--",
+        "packs::publication::tests::serving",
+        "server::residency::tests::serving",
+        "server::residency::tests::recovery",
+        "--test-threads=4"
+      ],
+      "log_sha256": "38824abbd62d5575e20bd5da172f6a577484789398ee143e6329b5e5b764afd3"
+    },
+    {
+      "label": "library",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "--workspace",
+        "--lib",
+        "--locked",
+        "--",
+        "--test-threads=4"
+      ],
+      "exit_code": 101,
+      "seconds": 319.161,
+      "log": "/tmp/canopy-serving-refs-library.log",
+      "passed": 674,
+      "failed": 5,
+      "ignored": 0,
+      "publication_passed": 381,
+      "known_failures": [
+        "git_gateway::fetch::tests::reachability_stops_at_live_refs_without_scanning_other_history",
+        "object_reads::tests::byte_limited_page_advances_only_over_the_selected_prefix",
+        "object_reads::tests::duplicate_rollback_and_deletion_do_not_hide_subsequent_inserts",
+        "object_reads::tests::insertion_cursor_finds_lower_oids_and_excludes_later_publications",
+        "object_reads::tests::small_increment_uses_bounded_sql_work_after_large_history"
+      ],
+      "nested_summaries_excluded": 2,
+      "log_sha256": "fc0247c2f4bca0d77357470ff286b40886a169ab16f62bcdf6e18773098f5920"
+    },
+    {
+      "label": "workspace",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "workspace::",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 49.394,
+      "log": "/tmp/canopy-serving-refs-workspace.log",
+      "passed": 3,
+      "log_sha256": "a337ef4df179f5a331a9e5a4b57933eaac2d5c0d695ab1cd1a6c86eece61b56d"
+    },
+    {
+      "label": "lifecycle",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::fork::",
+        "lifecycle::cancelled_prebound_startup",
+        "lifecycle::runtime_destruction",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 2.4,
+      "log": "/tmp/canopy-serving-refs-lifecycle.log",
+      "passed": 2,
+      "log_sha256": "6acc35040ce2fe43604a266a74cb5872201853bf3f4b52b8a34871c2176c5052"
+    },
+    {
+      "label": "drain",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::cancelled_startup_keeps_workspace",
+        "lifecycle::dropped_handle_and_cancelled_shutdown",
+        "lifecycle::failed_drain_retains_workspace",
+        "lifecycle::startup_rejects_ignored_conditional",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.823,
+      "log": "/tmp/canopy-serving-refs-drain.log",
+      "passed": 4,
+      "log_sha256": "0a023f055205a8f1e78b323294adec111fe2706ad0b0b85ab279da45a058f220"
+    },
+    {
+      "label": "build",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "build",
+        "--locked",
+        "--bin",
+        "canopy"
+      ],
+      "exit_code": 0,
+      "seconds": 34.969,
+      "log": "/tmp/canopy-serving-refs-build.log",
+      "log_sha256": "b307219c288f74812291c45ea66b0e6286a48003bff3756a846d6ff8d429a545"
+    },
+    {
+      "label": "fmt",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 1.181,
+      "log": "/tmp/canopy-serving-refs-fmt.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "diff",
+      "command": [
+        "git",
+        "diff",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 0.054,
+      "log": "/tmp/canopy-serving-refs-diff.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "harness",
+      "command": [
+        "python3",
+        "-B",
+        "-m",
+        "unittest",
+        "discover",
+        "-s",
+        "scripts",
+        "-p",
+        "test_*.py"
+      ],
+      "exit_code": 0,
+      "seconds": 41.981,
+      "log": "/tmp/canopy-serving-refs-harness.log",
+      "log_sha256": "f8961ead9be0a4008e6c4f7837f0e66f80ba739d0b42551ca7aef8c97b6e133c"
+    }
+  ],
+  "release_qualified": false,
+  "unique_workspace_cases": 688,
+  "unique_workspace_passed": 683,
+  "unique_workspace_failed": 5,
+  "execution_complete": true,
+  "clippy_seconds": 28.37,
+  "harness_cases": 96,
+  "focused_cases": 62,
+  "focused_seconds": 20.59,
+  "pool_families": 6,
+  "production_manager_families": 4,
+  "new_ref_families": 5,
+  "new_production_manager_families": 1,
+  "draft_diagnostics": [
+    {
+      "log": "/tmp/canopy-serving-refs-initial-focused.log",
+      "exit_code": 101,
+      "log_sha256": "fb37089273f7a353780ce91979d4b2b38a8393d1a6aba4e4d010b1e6f79f6d9e",
+      "reason": "The new fixture supplied bare records to build_sorted, which requires Result records; fixed before qualification."
+    },
+    {
+      "log": "/tmp/canopy-serving-refs-new-focused.log",
+      "exit_code": 101,
+      "log_sha256": "c31fa05cb0010c07c177811e8d6862f481648b17e1fd57d03ff2cd68d626c6ee",
+      "reason": "Three new fixture roots used invalid artifact namespaces, and the HTTP fixture supplied hex rather than a canonical UUID; corrected before qualification."
+    }
+  ],
+  "scope": "Local browser ref conversion and owned immutable ref reads. Workspace library plus nine selected portable multi_server cases; focused lifecycle cases are included in the library total. This is not full production or capacity qualification.",
+  "platform": "macOS / Rust 1.98.0; Linux-only fork cases not executed locally",
+  "environment": {
+    "CARGO_INCREMENTAL": "0",
+    "CARGO_TARGET_DIR": "shared ignored build directory; no deployment/demo restart"
+  },
+  "sdk_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+  "sdk_manifest_pins": 5,
+  "sdk_lock_pins": 6,
+  "protected_hashes": {
+    "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "/Users/haipingfu/.codex/worktrees/packed-catalog-publication-pr/canopy/docs/archive/pr20-progress-through-8bb0ee7.md": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+  },
+  "validated_source_parent": "1e32347a411fe24245e34638221e79eb8968b241",
+  "fetched_main": "9438bb865959fb975d5349ba8b9908b461653821",
+  "prior_ci": {
+    "head": "1e32347a411fe24245e34638221e79eb8968b241",
+    "rust": "failed: five legacy objects readers",
+    "harness": "passed",
+    "runs": [
+      37224582653,
+      37224580445
+    ],
+    "not_qualification_for_new_source": true
+  },
+  "checked_local_documentation_links": 90
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 73fa4282..e4fcaa9f 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -3,7 +3,7 @@
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. At the preceding published pool head `02307fd`, GitHub reports
+directly against `main`. At the preceding published shutdown-fix head `1e32347`, GitHub reports
 no merge conflicts; both Rust CI runs fail on the same five unconverted
 legacy `objects` readers and both harness checks pass. The PR is currently marked
 ready for review, but production conversion and release requirements remain
@@ -14,6 +14,57 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Certified browser ref reads checkpoint
+
+The local browser's ref listing and resolution now select the accepted immutable
+joint ref root through `ServingSnapshot`; neither legacy ref rows nor their
+default branch/counter can override it. The implementation reuses `RefPage`,
+`RefExpectation` and the existing byte-ordered `RefStateIndex`. Its bounded node
+client is shared by the resident, and each pin coalesces ref-descriptor loading.
+Ref and metadata reads share admitted private work, current access/owner/lease
+checks before and after I/O, and physical-drain ownership across observer loss.
+
+Pages contain at most 256 records and 512 KiB of name/record charges. Live cursors
+skip deleted subtrees; version-preserving consumers can include tombstones.
+Continuations bind the ref snapshot's generation and return changed on mismatch.
+Old borrowed generations remain immutable while new heads are selected. HTTP
+requests remain bounded at 512 KiB, allowing legal long cursors with JSON escapes;
+overlong names reject as invalid rather than exceeding the index's byte limit.
+The [serving contract](design/certified-serving-pins.md#certified-immutable-ref-reads)
+defines these boundaries.
+
+Five new ref families and one actual browser HTTP/manager family exercise both
+formats. They cover count/byte continuation, retained deletion versions, old-head
+immutability, cached and in-flight access revocation, blocked real provider I/O
+after canceled observation, bad snapshot context, and deliberately conflicting
+legacy SQL. All 62 focused serving/recovery families pass in 20.59 seconds;
+warnings-denied workspace/all-target Clippy passes in 28.37 seconds. Inventory
+roots in the ref fixtures are trusted injection to isolate reader behavior,
+not proof of native graph publication or capacity.
+
+Final frozen-source library qualification executes 679 unique cases: 674 pass
+and the same five legacy `objects` readers fail. All 381 publication, seven
+startup, four resident recovery and four resident serving cases pass. Nine
+selected portable workspace/lifecycle cases pass: 688 unique Rust cases, 683
+passed and five failed. Nested subprocess summaries and focused cases are not
+counted twice; the driver's actual library exit 101 remains visible. Linux-only
+fork cases were not run locally. Source fingerprints, commands, log digests and
+corrected fixture diagnostics are retained in
+[certified ref evidence](evidence/serving-refs-20261004.json).
+The server build, formatting, diff checks and all 96 Python harness tests pass.
+Static qualification verifies 474 frozen source/schema/manifest files, including
+460 Rust files, exact SDK pins and the protected original index/archive.
+
+Highest next work is certified object/body/native serving and owner-aware remote
+routes, followed by conversion of all remaining ref/cache/graph/browser/policy/
+merge consumers and HTTP/SSH/generated producers. Default-branch and other
+policy producers still require immutable publication conversion. Physical
+adoption/quota recovery, admitted immutable custody history/exact lookup, final
+DDL, typed GC/backup/isolated restore, fault campaigns, OS containment, native
+acceleration/rewrite/fair maintenance, signed completion/cold clone, attribution
+and full-history/10,000-developer capacity qualification remain mandatory.
+The full objective remains open and the branch remains unreleasable.
+
 ## Serving construction/shutdown barrier checkpoint
 
 A deterministic regression exposed a resident constructor publishing its weak

From b1bd813a50b8b93b833d4006b20c0b90713470a2 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 12:51:27 -0700
Subject: [PATCH 24/55] Serve certified native bodies through shared owned pack
 caches

---
 .../canopy-server/src/git_cache/artifacts.rs  |  15 +
 crates/canopy-server/src/git_cache/cleanup.rs |   5 +
 crates/canopy-server/src/git_cache/mod.rs     |  38 +++
 crates/canopy-server/src/git_objects/mod.rs   |  91 +++++-
 crates/canopy-server/src/git_objects/tests.rs | 130 +++++++++
 crates/canopy-server/src/lib.rs               |   6 +
 .../canopy-server/src/packs/catalog/files.rs  |  34 +++
 crates/canopy-server/src/packs/catalog/mod.rs |   2 +
 .../canopy-server/src/packs/catalog/native.rs | 247 +++++++++++++++++
 .../src/packs/catalog/native/tests.rs         | 116 ++++++++
 .../packs/publication/serving/lifecycle.rs    |   7 +
 .../src/packs/publication/serving/session.rs  |  32 ++-
 .../packs/publication/serving/session/body.rs |  45 +++
 .../src/packs/publication/tests/serving.rs    |   1 +
 .../packs/publication/tests/serving/body.rs   | 258 ++++++++++++++++++
 .../src/server/residency/recovery.rs          |   7 +-
 docs/design/certified-serving-pins.md         |  47 ++++
 .../serving-native-bodies-20261004.json       | 247 +++++++++++++++++
 .../large-repository-implementation-status.md |  46 +++-
 19 files changed, 1356 insertions(+), 18 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/catalog/native.rs
 create mode 100644 crates/canopy-server/src/packs/catalog/native/tests.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/body.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/body.rs
 create mode 100644 docs/evidence/serving-native-bodies-20261004.json

diff --git a/crates/canopy-server/src/git_cache/artifacts.rs b/crates/canopy-server/src/git_cache/artifacts.rs
index e461dfe2..4fd97a14 100644
--- a/crates/canopy-server/src/git_cache/artifacts.rs
+++ b/crates/canopy-server/src/git_cache/artifacts.rs
@@ -6,6 +6,7 @@ use canopy_object_storage::artifact::{ArtifactKind, ArtifactStore};
 struct Writer {
     file: File,
     _cache: Arc<GitCache>,
+    _owner: crate::git_objects::ReadOwner,
 }
 impl GitCache {
     /// The isolated verifier calls this exactly once on its fresh private cache.
@@ -15,6 +16,16 @@ impl GitCache {
         self: &Arc<Self>,
         store: &ArtifactStore,
         descriptor: NativePackDescriptor,
+    ) -> Result<(), MetadataError> {
+        self.download_native_owned(store, descriptor, Arc::new(()))
+            .await
+    }
+
+    pub(crate) async fn download_native_owned(
+        self: &Arc<Self>,
+        store: &ArtifactStore,
+        descriptor: NativePackDescriptor,
+        owner: crate::git_objects::ReadOwner,
     ) -> Result<(), MetadataError> {
         descriptor
             .validate(store.repository(), self.object_format)
@@ -23,7 +34,9 @@ impl GitCache {
             return Err(MetadataError::Integrity);
         }
         let cache = Arc::clone(self);
+        let admission = Arc::clone(&owner);
         tokio::task::spawn_blocking(move || {
+            let _owner = admission;
             let size = descriptor
                 .pack
                 .size
@@ -38,6 +51,7 @@ impl GitCache {
             (ArtifactKind::Index, descriptor.index, "idx"),
         ] {
             let cache = Arc::clone(self);
+            let admission = Arc::clone(&owner);
             let mut writer = tokio::task::spawn_blocking(move || {
                 let path = cache.git_dir().join(format!(
                     "objects/pack/pack-{}.{}",
@@ -47,6 +61,7 @@ impl GitCache {
                 Ok::<_, MetadataError>(Writer {
                     file: File::create_new(path)?,
                     _cache: cache,
+                    _owner: admission,
                 })
             })
             .await??;
diff --git a/crates/canopy-server/src/git_cache/cleanup.rs b/crates/canopy-server/src/git_cache/cleanup.rs
index 62e1fa66..0c4f26fc 100644
--- a/crates/canopy-server/src/git_cache/cleanup.rs
+++ b/crates/canopy-server/src/git_cache/cleanup.rs
@@ -8,6 +8,7 @@ pub(super) struct Cleanup {
     pub(super) path: PathBuf,
     pub(super) reservation: Option<DiskReservation>,
     pub(super) objects: Option<Arc<GitCache>>,
+    pub(super) owner: Option<crate::git_objects::ReadOwner>,
 }
 
 impl Cleanup {
@@ -45,6 +46,7 @@ impl Cleanup {
                         // Successful removal permits normal field teardown.
                         self.reservation.take();
                         self.objects.take();
+                        self.owner.take();
                     }).await;
                     return;
                 }
@@ -68,6 +70,9 @@ impl Drop for Cleanup {
         if let Some(reservation) = self.reservation.take() {
             std::mem::forget(reservation);
         }
+        if let Some(owner) = self.owner.take() {
+            std::mem::forget(owner);
+        }
         if let Some(objects) = self.objects.take() {
             std::mem::forget(objects);
         }
diff --git a/crates/canopy-server/src/git_cache/mod.rs b/crates/canopy-server/src/git_cache/mod.rs
index e723b76f..947f5df3 100644
--- a/crates/canopy-server/src/git_cache/mod.rs
+++ b/crates/canopy-server/src/git_cache/mod.rs
@@ -50,11 +50,19 @@ pub(crate) enum ReceiveHook {
     PreReceive,
 }
 
+/// Creation work and retained file admission have different lifetimes. Only the
+/// cleanup charge belongs in an idle cached file; work may pin a generation.
+pub(crate) struct CacheOwnership {
+    pub(crate) work: crate::git_objects::ReadOwner,
+    pub(crate) cleanup: Option<crate::git_objects::ReadOwner>,
+}
+
 pub(crate) struct GitCache {
     pub(crate) object_format: crate::ObjectFormat,
     pub(crate) native: crate::native_resources::NativeScope,
     directory: tempfile::TempDir,
     reservation: Option<DiskReservation>,
+    cleanup_owner: Option<crate::git_objects::ReadOwner>,
     objects: Option<Arc<GitCache>>,
     // Only durable hydration writes this cache. Stripe by OID so concurrent
     // fetches share a completed loose object without serializing all objects.
@@ -87,12 +95,37 @@ impl GitCache {
         object_format: crate::ObjectFormat,
         objects: Option<Arc<GitCache>>,
         native: crate::native_resources::NativeScope,
+    ) -> Result<Arc<Self>, CacheError> {
+        Self::create_owned(
+            root,
+            budget,
+            head,
+            object_format,
+            objects,
+            native,
+            CacheOwnership {
+                work: Arc::new(()),
+                cleanup: None,
+            },
+        )
+        .await
+    }
+
+    pub(crate) async fn create_owned(
+        root: PathBuf,
+        budget: DiskBudget,
+        head: &str,
+        object_format: crate::ObjectFormat,
+        objects: Option<Arc<GitCache>>,
+        native: crate::native_resources::NativeScope,
+        owner: CacheOwnership,
     ) -> Result<Arc<Self>, CacheError> {
         if !crate::default_branch::valid_default_branch(head) {
             return Err(CacheError::InvalidHead);
         }
         let head = format!("ref: {head}\n");
         tokio::task::spawn_blocking(move || {
+            let CacheOwnership { work: _owner, cleanup } = owner;
             let cache = Arc::new(Self {
                 object_format,
                 native,
@@ -100,6 +133,7 @@ impl GitCache {
                 // absolute even when the node's data directory is relative.
                 directory: tempfile::Builder::new().prefix(CACHE_PREFIX).tempdir_in(fs::canonicalize(root)?)?,
                 reservation: Some(budget.try_reserve(0)?),
+                cleanup_owner: cleanup,
                 objects,
                 object_writes: OnceLock::new(),
                 packed: RwLock::new(Vec::new()),
@@ -487,6 +521,7 @@ impl Drop for GitCache {
                     path: self.root().to_path_buf(),
                     reservation: self.reservation.take(),
                     objects: self.objects.take(),
+                    owner: self.cleanup_owner.take(),
                 }
                 .defer();
                 return;
@@ -502,6 +537,9 @@ impl Drop for GitCache {
             if let Some(objects) = self.objects.take() {
                 std::mem::forget(objects);
             }
+            if let Some(owner) = self.cleanup_owner.take() {
+                std::mem::forget(owner);
+            }
             // TempDir must not retry deletion after a worker fence rejected it.
             // Startup reclaims this directory once all descendants have exited.
             self.directory.disable_cleanup(true);
diff --git a/crates/canopy-server/src/git_objects/mod.rs b/crates/canopy-server/src/git_objects/mod.rs
index 7e952953..e2980e69 100644
--- a/crates/canopy-server/src/git_objects/mod.rs
+++ b/crates/canopy-server/src/git_objects/mod.rs
@@ -33,8 +33,11 @@ pub enum ObjectReadError {
     Task(#[from] tokio::task::JoinError),
 }
 
+pub(crate) type ReadOwner = std::sync::Arc<dyn Send + Sync>;
+
 struct Process {
-    worker: crate::native_git::process::GitProcess<()>,
+    owner: ReadOwner,
+    worker: crate::native_git::process::GitProcess<ReadOwner>,
     output: BufReader<ChildStdout>,
     stderr: AbortOnDropHandle<Result<Vec<u8>, io::Error>>,
 }
@@ -44,6 +47,15 @@ impl Process {
         git_dir: &Path,
         args: &[&str],
         native: &crate::native_resources::NativeScope,
+    ) -> Result<(Self, ChildStdin), ObjectReadError> {
+        Self::start_owned(git_dir, args, native, std::sync::Arc::new(()))
+    }
+
+    fn start_owned(
+        git_dir: &Path,
+        args: &[&str],
+        native: &crate::native_resources::NativeScope,
+        owner: ReadOwner,
     ) -> Result<(Self, ChildStdin), ObjectReadError> {
         let mut command = crate::native_git::command(git_dir)?;
         command
@@ -55,7 +67,7 @@ impl Process {
             .stderr(Stdio::piped());
         let mut child = crate::native_git::process::GitProcess::spawn(
             command,
-            (),
+            std::sync::Arc::clone(&owner),
             native.try_admit(crate::native_resources::NativeWork::Read)?,
         )?;
         let input = child.child.stdin.take().ok_or(ObjectReadError::Malformed)?;
@@ -84,6 +96,7 @@ impl Process {
         }));
         Ok((
             Self {
+                owner,
                 worker: child,
                 output: BufReader::new(output),
                 stderr,
@@ -236,7 +249,18 @@ impl GitObjects {
         git_dir: &Path,
         native: &crate::native_resources::NativeScope,
     ) -> Result<Self, ObjectReadError> {
-        let (batch, requests) = Process::start(git_dir, &["cat-file", "--batch"], native)?;
+        Self::batch_owned(git_dir, native, std::sync::Arc::new(()))
+    }
+
+    /// Retain physical generation/cache admission through native descendants
+    /// and deferred reaping, including cancellation of the calling worker.
+    pub(crate) fn batch_owned(
+        git_dir: &Path,
+        native: &crate::native_resources::NativeScope,
+        owner: ReadOwner,
+    ) -> Result<Self, ObjectReadError> {
+        let (batch, requests) =
+            Process::start_owned(git_dir, &["cat-file", "--batch"], native, owner)?;
         Ok(Self {
             walk: None,
             inventory: None,
@@ -246,6 +270,34 @@ impl GitObjects {
         })
     }
 
+    /// Bounded canonical body read. A canceled, rejected or corrupt response
+    /// poisons the batch; only a fully verified frame permits reuse.
+    pub(crate) async fn read_verified(
+        &mut self,
+        expected: crate::packs::metadata::CanonicalObject,
+        limit: usize,
+    ) -> Result<Vec<u8>, ObjectReadError> {
+        if self.inspection_failed {
+            return Err(ObjectReadError::Malformed);
+        }
+        if expected.size > limit as u64 {
+            return Err(ObjectReadError::TooLarge);
+        }
+        self.inspection_failed = true;
+        let owner = std::sync::Arc::clone(&self.batch.owner);
+        let object = timeout(IO_TIMEOUT, async {
+            self.requests
+                .write_all(format!("{}\n", hex::encode(expected.oid)).as_bytes())
+                .await?;
+            open_object(&mut self.batch.output, expected.oid).await
+        })
+        .await
+        .map_err(|_| ObjectReadError::Timeout)??;
+        let body = object.body_verified(expected, limit, owner).await?;
+        self.inspection_failed = false;
+        Ok(body)
+    }
+
     /// Streams canonical hashing and typed structural extraction. Sink writes
     /// are private preparation; discard them if this returns an error or is
     /// canceled. Pack binding and graph closure remain verifier obligations.
@@ -455,6 +507,39 @@ impl<R: AsyncRead + Unpin> GitObject<'_, R> {
         Ok(())
     }
 
+    async fn body_verified(
+        mut self,
+        expected: crate::packs::metadata::CanonicalObject,
+        limit: usize,
+        owner: ReadOwner,
+    ) -> Result<Vec<u8>, ObjectReadError> {
+        if self.oid != expected.oid || self.kind != expected.kind || self.size != expected.size {
+            return Err(ObjectReadError::Malformed);
+        }
+        if self.size > limit as u64 || self.size > isize::MAX as u64 {
+            return Err(ObjectReadError::TooLarge);
+        }
+        let mut body = Vec::new();
+        body.try_reserve_exact(self.size as usize)
+            .map_err(ObjectReadError::Allocation)?;
+        body.resize(self.size as usize, 0);
+        timeout(IO_TIMEOUT, self.reader.read_exact(&mut body))
+            .await
+            .map_err(|_| ObjectReadError::Timeout)??;
+        self.finish().await?;
+        // Do not drop a detached hash job's physical owner at an observer timeout.
+        tokio::task::spawn_blocking(move || {
+            let _owner = owner;
+            if object_id(expected.oid.format(), expected.kind, &body) != expected.oid
+                || blake3::hash(&body).as_bytes() != &expected.digest
+            {
+                return Err(ObjectReadError::Malformed);
+            }
+            Ok(body)
+        })
+        .await?
+    }
+
     pub(crate) async fn body(mut self) -> Result<(ObjectKind, Vec<u8>), ObjectReadError> {
         let limit = if self.kind == ObjectKind::Blob {
             INLINE_OBJECT_LIMIT
diff --git a/crates/canopy-server/src/git_objects/tests.rs b/crates/canopy-server/src/git_objects/tests.rs
index b8726384..52b85028 100644
--- a/crates/canopy-server/src/git_objects/tests.rs
+++ b/crates/canopy-server/src/git_objects/tests.rs
@@ -342,3 +342,133 @@ async fn streamed_inspection_rejects_hash_mismatch_partial_bodies_bad_separators
     }
     Ok(())
 }
+
+#[tokio::test]
+async fn verified_body_checks_catalog_fingerprint_size_kind_and_limit_for_both_formats()
+-> TestResult {
+    for format in [crate::ObjectFormat::Sha1, crate::ObjectFormat::Sha256] {
+        let body = b"bounded canonical body";
+        let expected = crate::packs::metadata::CanonicalObject {
+            oid: object_id(format, ObjectKind::Blob, body),
+            kind: ObjectKind::Blob,
+            size: body.len() as u64,
+            digest: *blake3::hash(body).as_bytes(),
+        };
+        let frame = format!("{} blob {}\n", hex::encode(expected.oid), expected.size)
+            .into_bytes()
+            .into_iter()
+            .chain(body.iter().copied())
+            .chain(*b"\n")
+            .collect::<Vec<_>>();
+        let mut input = frame.as_slice();
+        let object = open_object(&mut input, expected.oid).await?;
+        assert_eq!(
+            object
+                .body_verified(expected, body.len(), std::sync::Arc::new(()))
+                .await?,
+            body
+        );
+        for variant in 0..4 {
+            let mut metadata = expected;
+            let mut limit = body.len();
+            match variant {
+                0 => metadata.digest[0] ^= 1,
+                1 => metadata.kind = ObjectKind::Tree,
+                2 => metadata.size += 1,
+                _ => limit -= 1,
+            }
+            let mut input = frame.as_slice();
+            let object = open_object(&mut input, expected.oid).await?;
+            assert!(
+                object
+                    .body_verified(metadata, limit, std::sync::Arc::new(()))
+                    .await
+                    .is_err()
+            );
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn verified_batch_reuses_only_complete_verified_frames_and_poison_refuses_finish()
+-> TestResult {
+    let directory = fixture().await?;
+    let blob = oid(directory.path(), "HEAD:file-0").await?;
+    let expected = crate::packs::metadata::CanonicalObject {
+        oid: blob,
+        kind: ObjectKind::Blob,
+        size: 3,
+        digest: *blake3::hash(b"0\0\n").as_bytes(),
+    };
+    let resources = crate::native_resources::NativeResources::default();
+    let scope = resources.scope(crate::native_resources::NativeClass::Foreground);
+    let mut reader = GitObjects::batch(&directory.path().join(".git"), &scope)?;
+    assert!(matches!(
+        reader.read_verified(expected, 2).await,
+        Err(ObjectReadError::TooLarge)
+    ));
+    assert_eq!(reader.read_verified(expected, 3).await?, b"0\0\n");
+    assert_eq!(reader.read_verified(expected, 3).await?, b"0\0\n");
+    reader.finish().await?;
+    let mut reader = GitObjects::batch(&directory.path().join(".git"), &scope)?;
+    let mut corrupt = expected;
+    corrupt.digest[0] ^= 1;
+    assert!(matches!(
+        reader.read_verified(corrupt, 3).await,
+        Err(ObjectReadError::Malformed)
+    ));
+    assert!(matches!(
+        reader.read_verified(expected, 3).await,
+        Err(ObjectReadError::Malformed)
+    ));
+    assert!(matches!(
+        reader.finish().await,
+        Err(ObjectReadError::Malformed)
+    ));
+    Ok(())
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn owned_batch_cancellation_releases_owner_only_after_native_reaping() -> TestResult {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicU32, Ordering},
+    };
+    struct Owner {
+        pid: Arc<AtomicU32>,
+        released: tokio::sync::oneshot::Sender<bool>,
+    }
+    impl Drop for Owner {
+        fn drop(&mut self) {
+            let pid = self.pid.load(Ordering::Acquire);
+            // SAFETY: signal zero only queries a PID assigned by this fixture.
+            let gone = unsafe { libc::kill(pid as i32, 0) } == -1
+                && io::Error::last_os_error().raw_os_error() == Some(libc::ESRCH);
+            let (unused, _) = tokio::sync::oneshot::channel();
+            let released = std::mem::replace(&mut self.released, unused);
+            let _ = released.send(gone);
+        }
+    }
+    let directory = fixture().await?;
+    let pid = Arc::new(AtomicU32::new(0));
+    let (released, observed) = tokio::sync::oneshot::channel();
+    let owner = Arc::new(Owner {
+        pid: Arc::clone(&pid),
+        released,
+    });
+    let reader = GitObjects::batch_owned(
+        &directory.path().join(".git"),
+        &crate::native_resources::NativeResources::default()
+            .scope(crate::native_resources::NativeClass::Foreground),
+        owner,
+    )?;
+    pid.store(
+        reader.batch.worker.child.id().ok_or("native PID")?,
+        Ordering::Release,
+    );
+    drop(reader);
+    assert!(timeout(Duration::from_secs(5), observed).await??);
+    Ok(())
+}
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 8e401374..fa1bf1b3 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -194,6 +194,11 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("object_reads/mod.rs"));
                 source.update(include_bytes!("pack_store.rs"));
                 source.update(include_bytes!("git_objects/mod.rs"));
+                source.update(include_bytes!("git_cache/artifacts.rs"));
+                source.update(include_bytes!("git_cache/cleanup.rs"));
+                source.update(include_bytes!("git_cache/mod.rs"));
+                source.update(include_bytes!("packs/catalog/native.rs"));
+                source.update(include_bytes!("packs/catalog/files.rs"));
                 source.update(include_bytes!("native_resources.rs"));
                 source.update(include_bytes!("native_git.rs"));
                 source.update(include_bytes!("native_git/process.rs"));
@@ -301,6 +306,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/serving/command_owner.rs"));
                 source.update(include_bytes!("packs/publication/serving/session.rs"));
                 source.update(include_bytes!("packs/publication/serving/session/reads.rs"));
+                source.update(include_bytes!("packs/publication/serving/session/body.rs"));
                 source.update(include_bytes!("packs/publication/serving/session/refs.rs"));
                 source.update(include_bytes!("packs/publication/serving/lifecycle.rs"));
                 source.update(include_bytes!("packs/publication/serving/pool.rs"));
diff --git a/crates/canopy-server/src/packs/catalog/files.rs b/crates/canopy-server/src/packs/catalog/files.rs
index 5be6fc8e..834472ee 100644
--- a/crates/canopy-server/src/packs/catalog/files.rs
+++ b/crates/canopy-server/src/packs/catalog/files.rs
@@ -46,6 +46,7 @@ pub struct CatalogFileStats {
 /// Shared across catalog generations in one worker. Creating a loader does not
 /// certify its catalogs, grant access, or pin remote generations against GC.
 pub struct CatalogFiles {
+    native: Option<super::native::NativeFiles>,
     root: Arc<tempfile::TempDir>,
     store: Arc<ArtifactStore>,
     format: ObjectFormat,
@@ -121,6 +122,7 @@ impl CatalogFiles {
             .prefix("canopy-catalog-files-")
             .tempdir_in(workspace)?;
         Ok(Self {
+            native: None,
             root: Arc::new(root),
             store,
             format,
@@ -133,6 +135,38 @@ impl CatalogFiles {
             downloaded_files: AtomicU64::new(0),
         })
     }
+    /// Configure native serving with the node's shared resource scope. Metadata
+    /// preparation alone does not need or implicitly create a native service.
+    pub(crate) fn with_native(mut self, native: crate::native_resources::NativeScope) -> Self {
+        self.native = Some(super::native::NativeFiles::new(
+            Arc::clone(&self.root),
+            self.budget.clone(),
+            Arc::clone(&self.store),
+            self.format,
+            native,
+        ));
+        self
+    }
+    pub(in crate::packs) async fn body(
+        &self,
+        object: ResolvedObject,
+        limit: usize,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Result<Vec<u8>, super::native::NativeReadError> {
+        self.native
+            .as_ref()
+            .ok_or(super::native::NativeReadError::Unavailable)?
+            .body(object, limit, owner)
+            .await
+    }
+    pub fn native_stats(
+        &self,
+    ) -> Result<Option<super::native::NativeFileStats>, super::native::NativeReadError> {
+        self.native
+            .as_ref()
+            .map(super::native::NativeFiles::stats)
+            .transpose()
+    }
     pub fn stats(&self) -> Result<CatalogFileStats, MetadataError> {
         Ok(CatalogFileStats {
             open_files: self.limits.open_files - self.slots.available_permits() as u32,
diff --git a/crates/canopy-server/src/packs/catalog/mod.rs b/crates/canopy-server/src/packs/catalog/mod.rs
index 0ee499b6..bf00b808 100644
--- a/crates/canopy-server/src/packs/catalog/mod.rs
+++ b/crates/canopy-server/src/packs/catalog/mod.rs
@@ -16,6 +16,8 @@ use canopy_object_storage::artifact::{
 use std::sync::Arc;
 
 mod codec;
+mod native;
+pub use native::{NativeFileStats, NativeReadError};
 mod files;
 pub use files::{CatalogFileLimits, CatalogFileStats, CatalogFiles, MAX_OPEN_CATALOG_FILES};
 mod reader;
diff --git a/crates/canopy-server/src/packs/catalog/native.rs b/crates/canopy-server/src/packs/catalog/native.rs
new file mode 100644
index 00000000..c5dd708a
--- /dev/null
+++ b/crates/canopy-server/src/packs/catalog/native.rs
@@ -0,0 +1,247 @@
+//! Bounded shared immutable pack copies. Callers supply certified selection and
+//! a physical generation guard; these files do not themselves grant authority.
+use super::*;
+use crate::{
+    git_cache::{CacheError, CacheOwnership, GitCache},
+    git_objects::{GitObjects, ObjectReadError, ReadOwner},
+    native_resources::NativeScope,
+    packs::{metadata::MetadataError, sources::NativePackDescriptor},
+};
+use cellule_ltx::DiskBudget;
+use std::{collections::VecDeque, sync::Mutex};
+use tokio::sync::{Mutex as AsyncMutex, OwnedSemaphorePermit, Semaphore};
+
+const OPEN_PACKS: usize = 8;
+const CACHED_PACKS: usize = 4;
+const LOAD_STRIPES: usize = 16;
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct NativeFileStats {
+    pub open_files: usize,
+    pub cached_files: usize,
+    pub cache_hits: u64,
+    pub downloaded_files: u64,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum NativeReadError {
+    #[error("native read service is unavailable")]
+    Unavailable,
+    #[error("native read file admission exhausted")]
+    Capacity,
+    #[error("native cache creation failed")]
+    Cache(#[from] CacheError),
+    #[error("native pack transfer failed")]
+    Metadata(#[from] MetadataError),
+    #[error("native pack binding failed")]
+    Binding(#[from] IndexError),
+    #[error("native object verification failed")]
+    Object(#[from] ObjectReadError),
+    #[error("native read job failed")]
+    Task(#[from] tokio::task::JoinError),
+}
+
+pub(super) struct NativeFiles {
+    root: Arc<tempfile::TempDir>,
+    budget: DiskBudget,
+    store: Arc<ArtifactStore>,
+    format: ObjectFormat,
+    native: NativeScope,
+    slots: Arc<Semaphore>,
+    cache: Mutex<VecDeque<(NativePackDescriptor, Arc<PackFile>)>>,
+    loads: [AsyncMutex<()>; LOAD_STRIPES],
+    hits: std::sync::atomic::AtomicU64,
+    downloads: std::sync::atomic::AtomicU64,
+}
+struct FileAdmission {
+    _root: Arc<tempfile::TempDir>,
+    _slot: OwnedSemaphorePermit,
+}
+struct PackFile {
+    cache: Arc<GitCache>,
+    _admission: Arc<FileAdmission>,
+}
+impl NativeFiles {
+    pub(super) fn new(
+        root: Arc<tempfile::TempDir>,
+        budget: DiskBudget,
+        store: Arc<ArtifactStore>,
+        format: ObjectFormat,
+        native: NativeScope,
+    ) -> Self {
+        Self {
+            root,
+            budget,
+            store,
+            format,
+            native,
+            slots: Arc::new(Semaphore::new(OPEN_PACKS)),
+            cache: Mutex::new(VecDeque::new()),
+            loads: std::array::from_fn(|_| AsyncMutex::new(())),
+            hits: std::sync::atomic::AtomicU64::new(0),
+            downloads: std::sync::atomic::AtomicU64::new(0),
+        }
+    }
+    pub(super) fn stats(&self) -> Result<NativeFileStats, NativeReadError> {
+        Ok(NativeFileStats {
+            open_files: OPEN_PACKS - self.slots.available_permits(),
+            cached_files: self
+                .cache
+                .lock()
+                .map_err(|_| NativeReadError::Capacity)?
+                .len(),
+            cache_hits: self.hits.load(std::sync::atomic::Ordering::Relaxed),
+            downloaded_files: self.downloads.load(std::sync::atomic::Ordering::Relaxed),
+        })
+    }
+    fn cached(
+        &self,
+        descriptor: NativePackDescriptor,
+    ) -> Result<Option<Arc<PackFile>>, NativeReadError> {
+        let mut cache = self.cache.lock().map_err(|_| NativeReadError::Capacity)?;
+        let Some(at) = cache.iter().position(|(key, _)| *key == descriptor) else {
+            return Ok(None);
+        };
+        let entry = cache.remove(at).ok_or(NativeReadError::Capacity)?;
+        let file = Arc::clone(&entry.1);
+        cache.push_back(entry);
+        self.hits.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        Ok(Some(file))
+    }
+    async fn admit(
+        &self,
+        owner: ReadOwner,
+        bytes: u64,
+    ) -> Result<Arc<FileAdmission>, NativeReadError> {
+        loop {
+            if self.budget.available() >= bytes
+                && let Ok(slot) = Arc::clone(&self.slots).try_acquire_owned()
+            {
+                return Ok(Arc::new(FileAdmission {
+                    _root: Arc::clone(&self.root),
+                    _slot: slot,
+                }));
+            }
+            let evicted = {
+                let mut cache = self.cache.lock().map_err(|_| NativeReadError::Capacity)?;
+                cache
+                    .iter()
+                    .position(|(_, file)| Arc::strong_count(file) == 1)
+                    .and_then(|at| cache.remove(at))
+            };
+            let Some(evicted) = evicted else {
+                return Err(NativeReadError::Capacity);
+            };
+            let owner = Arc::clone(&owner);
+            tokio::task::spawn_blocking(move || {
+                let _owner = owner;
+                drop(evicted);
+            })
+            .await?;
+        }
+    }
+    async fn load(
+        &self,
+        descriptor: NativePackDescriptor,
+        owner: ReadOwner,
+    ) -> Result<Arc<PackFile>, NativeReadError> {
+        descriptor.validate(self.store.repository(), self.format)?;
+        if let Some(file) = self.cached(descriptor)? {
+            return Ok(file);
+        }
+        let stripe = usize::from(descriptor.pack.digest[0]) % LOAD_STRIPES;
+        let _loading = self.loads[stripe].lock().await;
+        if let Some(file) = self.cached(descriptor)? {
+            return Ok(file);
+        }
+        let bytes = descriptor
+            .pack
+            .size
+            .checked_add(descriptor.index.size)
+            .and_then(|size| size.checked_add(4096))
+            .ok_or(NativeReadError::Capacity)?;
+        if bytes > self.budget.capacity() {
+            return Err(NativeReadError::Capacity);
+        }
+        let admission = self.admit(Arc::clone(&owner), bytes).await?;
+        let lifetime: ReadOwner = Arc::new((Arc::clone(&owner), Arc::clone(&admission)));
+        let cache = GitCache::create_owned(
+            self.root.path().to_owned(),
+            self.budget.clone(),
+            "refs/heads/main",
+            self.format,
+            None,
+            self.native.clone(),
+            CacheOwnership {
+                work: Arc::clone(&lifetime),
+                cleanup: Some(admission.clone()),
+            },
+        )
+        .await?;
+        cache
+            .download_native_owned(&self.store, descriptor, Arc::clone(&lifetime))
+            .await?;
+        let file = Arc::new(PackFile {
+            cache,
+            _admission: admission,
+        });
+        let verify = Arc::clone(&file);
+        let claim = self
+            .native
+            .try_admit(crate::native_resources::NativeWork::Read)
+            .map_err(ObjectReadError::from)?;
+        tokio::task::spawn_blocking(move || {
+            let (_owner, _claim) = (lifetime, claim);
+            let pack = verify.cache.git_dir().join(format!(
+                "objects/pack/pack-{}.pack",
+                hex::encode(descriptor.git_checksum)
+            ));
+            descriptor.verify_files(&pack, &pack.with_extension("idx"))?;
+            Ok::<_, IndexError>(())
+        })
+        .await??;
+        self.downloads
+            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        let evicted = {
+            let mut cache = self.cache.lock().map_err(|_| NativeReadError::Capacity)?;
+            cache.push_back((descriptor, Arc::clone(&file)));
+            if cache.len() > CACHED_PACKS {
+                cache.pop_front()
+            } else {
+                None
+            }
+        };
+        if let Some(evicted) = evicted {
+            tokio::task::spawn_blocking(move || {
+                let _owner = owner;
+                drop(evicted);
+            })
+            .await?;
+        }
+        Ok(file)
+    }
+    pub(super) async fn body(
+        &self,
+        object: ResolvedObject,
+        limit: usize,
+        owner: ReadOwner,
+    ) -> Result<Vec<u8>, NativeReadError> {
+        // Metadata was selected and verified through the certified catalog. No
+        // native lookup is attempted for guessed or unpublished object IDs.
+        let expected = object.entry.header.object;
+        if expected.size > limit as u64 {
+            return Err(ObjectReadError::TooLarge.into());
+        }
+        let file = self
+            .load(object.source.record.native(), Arc::clone(&owner))
+            .await?;
+        let process_owner: ReadOwner = Arc::new((owner, Arc::clone(&file)));
+        let mut objects =
+            GitObjects::batch_owned(&file.cache.git_dir(), &self.native, process_owner)?;
+        let body = objects.read_verified(expected, limit).await?;
+        objects.finish().await?;
+        Ok(body)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/canopy-server/src/packs/catalog/native/tests.rs b/crates/canopy-server/src/packs/catalog/native/tests.rs
new file mode 100644
index 00000000..42a654fc
--- /dev/null
+++ b/crates/canopy-server/src/packs/catalog/native/tests.rs
@@ -0,0 +1,116 @@
+use super::*;
+use crate::packs::verification::physical::tests::{Prepared, prepared_for_store};
+use object_store::memory::InMemory;
+type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error>>;
+
+async fn packs(format: ObjectFormat, counts: &[usize]) -> Result<Vec<Prepared>> {
+    let provider = Arc::new(InMemory::new());
+    let store = Arc::new(ArtifactStore::new(provider.clone(), [1; 16]));
+    let mut inputs = Vec::new();
+    for (n, count) in counts.iter().enumerate() {
+        let mut operation = *b"CANOPY0100000000";
+        operation[8..].copy_from_slice(&(n as u64 + 700).to_be_bytes());
+        inputs.push(
+            prepared_for_store(format, *count, operation, provider.clone(), store.clone()).await?,
+        );
+    }
+    Ok(inputs)
+}
+fn files(pack: &Prepared, budget: DiskBudget) -> Result<NativeFiles> {
+    Ok(NativeFiles::new(
+        Arc::new(tempfile::TempDir::new()?),
+        budget,
+        pack.store.clone(),
+        pack.descriptor.format,
+        crate::native_resources::NativeResources::default()
+            .scope(crate::native_resources::NativeClass::Foreground),
+    ))
+}
+#[tokio::test]
+async fn native_pack_cache_evicts_idle_files_for_disk_pressure_and_reuses_verified_downloads()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let inputs = packs(format, &[300, 301]).await?;
+        let size = inputs
+            .iter()
+            .map(|p| p.descriptor.pack.size + p.descriptor.index.size)
+            .max()
+            .ok_or("pair")?;
+        let budget = DiskBudget::new(size + 4096);
+        let files = files(&inputs[0], budget.clone())?;
+        drop(files.load(inputs[0].descriptor, Arc::new(())).await?);
+        drop(files.load(inputs[0].descriptor, Arc::new(())).await?);
+        assert_eq!(files.stats()?.downloaded_files, 1);
+        drop(files.load(inputs[1].descriptor, Arc::new(())).await?);
+        assert_eq!(files.stats()?.downloaded_files, 2);
+        assert_eq!(files.stats()?.cached_files, 1);
+        assert_eq!(files.stats()?.open_files, 1);
+        drop(files);
+        tokio::time::timeout(std::time::Duration::from_secs(5), async {
+            while budget.used() != 0 {
+                tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_pack_slots_include_borrowed_evicted_files_and_refuse_capacity_without_deadlock()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let inputs = packs(format, &[12, 13, 14, 15, 16, 17, 18, 19, 20]).await?;
+        let files = files(&inputs[0], DiskBudget::new(64 << 20))?;
+        let mut borrowed = Vec::new();
+        for pack in inputs.iter().take(OPEN_PACKS) {
+            borrowed.push(files.load(pack.descriptor, Arc::new(())).await?);
+        }
+        assert_eq!(files.stats()?.open_files, OPEN_PACKS);
+        assert_eq!(files.stats()?.cached_files, CACHED_PACKS);
+        assert!(matches!(
+            files.load(inputs[8].descriptor, Arc::new(())).await,
+            Err(NativeReadError::Capacity)
+        ));
+        borrowed.clear();
+        let last = files.load(inputs[8].descriptor, Arc::new(())).await?;
+        assert_eq!(files.stats()?.downloaded_files, 9);
+        drop(last);
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_pack_failure_never_enters_cache_and_file_slot_follows_native_cache_ownership()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let inputs = packs(format, &[16]).await?;
+        let descriptor = inputs[0].descriptor;
+        let files = files(&inputs[0], DiskBudget::new(64 << 20))?;
+        // Authenticated artifact bytes are intact; a false Git checksum must
+        // still fail pack/index binding before the cache remembers a file.
+        let mut wrong = descriptor;
+        wrong.git_checksum = match format {
+            ObjectFormat::Sha1 => crate::ObjectId::Sha1([9; 20]),
+            ObjectFormat::Sha256 => crate::ObjectId::Sha256([9; 32]),
+        };
+        assert!(files.load(wrong, Arc::new(())).await.is_err());
+        assert_eq!(files.stats()?.open_files, 0);
+        assert_eq!(files.stats()?.downloaded_files, 0);
+        let file = files.load(descriptor, Arc::new(())).await?;
+        let mut reader =
+            GitObjects::batch_owned(&file.cache.git_dir(), &files.native, file.cache.clone())?;
+        let expected = inputs[0].fixture.objects.values().next().ok_or("object")?.0;
+        reader.read_verified(expected, 1 << 20).await?;
+        files.cache.lock().map_err(|_| "cache")?.clear();
+        drop(file);
+        assert_eq!(files.stats()?.cached_files, 0);
+        assert_eq!(files.stats()?.open_files, 1);
+        reader.finish().await?;
+        tokio::time::timeout(std::time::Duration::from_secs(5), async {
+            while files.stats().expect("stats").open_files != 0 {
+                tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
index 55377586..c836bec6 100644
--- a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -125,6 +125,13 @@ impl ServingSnapshot {
     ) -> Result<Vec<Option<crate::packs::metadata::ObjectHeader>>, ServingReadError> {
         self.pin.headers(self.actor.clone(), ids).await
     }
+    pub async fn body(
+        &self,
+        oid: crate::ObjectId,
+        limit: usize,
+    ) -> Result<Option<Vec<u8>>, ServingReadError> {
+        self.pin.body(self.actor.clone(), oid, limit).await
+    }
     pub async fn resolve_ref(
         &self,
         reference: Option<&str>,
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index 138a7257..d4f418a2 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -11,6 +11,7 @@ use cellule_runtime::{Committed, InvocationError, Receipt, primitives::sql::SqlC
 use std::sync::Mutex;
 use tokio::{sync::Notify, time::Instant};
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
+mod body;
 mod handoff;
 mod reads;
 mod refs;
@@ -44,6 +45,10 @@ pub enum ServingReadError {
     Custody(#[source] Box<CustodyError>),
     #[error("serving encoding failed")]
     Codec(#[from] CodecError),
+    #[error("serving body exceeds its read limit")]
+    TooLarge,
+    #[error("serving native body failed")]
+    Native(#[from] crate::packs::catalog::NativeReadError),
     #[error("serving worker failed")]
     Task(#[from] tokio::task::JoinError),
     #[error("serving release proof query failed")]
@@ -334,19 +339,7 @@ impl ServingPin {
         }
         let ids = ids.to_vec();
         self.read_owned(actor, move |inner, deadline| async move {
-            let reader = {
-                let mut reader = inner.reader.lock().await;
-                if reader.is_none() {
-                    *reader = Some(Arc::new(
-                        CatalogReader::open(
-                            Arc::clone(&inner.context.indexes),
-                            inner.lease.fact.catalog.ok_or(ServingReadError::Context)?,
-                        )
-                        .await?,
-                    ));
-                }
-                Arc::clone(reader.as_ref().expect("opened serving catalog"))
-            };
+            let reader = inner.catalog().await?;
             if Instant::now() >= deadline {
                 return Err(ServingReadError::Inactive);
             }
@@ -475,6 +468,19 @@ impl ServingPin {
     }
 }
 impl Inner {
+    async fn catalog(&self) -> Result<Arc<CatalogReader>, ServingReadError> {
+        let mut reader = self.reader.lock().await;
+        if reader.is_none() {
+            *reader = Some(Arc::new(
+                CatalogReader::open(
+                    Arc::clone(&self.context.indexes),
+                    self.lease.fact.catalog.ok_or(ServingReadError::Context)?,
+                )
+                .await?,
+            ));
+        }
+        Ok(Arc::clone(reader.as_ref().expect("opened serving catalog")))
+    }
     async fn observe(&self, actor: Option<String>) -> Result<(Receipt, Instant), ServingReadError> {
         let ctx = &self.context;
         ctx.authority
diff --git a/crates/canopy-server/src/packs/publication/serving/session/body.rs b/crates/canopy-server/src/packs/publication/serving/session/body.rs
new file mode 100644
index 00000000..a2c50f7f
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/body.rs
@@ -0,0 +1,45 @@
+//! Certified object bodies with worker ownership through native physical drain.
+use super::*;
+
+/// Foreground copies are bounded independently of any object header. Streaming
+/// larger objects is a separate producer contract, never an unbounded Vec.
+const MAX_BODY_BYTES: usize = 64 << 20;
+impl ServingPin {
+    pub async fn body(
+        &self,
+        actor: Option<String>,
+        oid: crate::ObjectId,
+        limit: usize,
+    ) -> Result<Option<Vec<u8>>, ServingReadError> {
+        if oid.is_zero() || oid.format() != self.inner.lease.format {
+            return Err(ServingReadError::Context);
+        }
+        if limit == 0 || limit > MAX_BODY_BYTES {
+            return Err(ServingReadError::TooLarge);
+        }
+        self.read_owned(actor, move |inner, deadline| async move {
+            let reader = inner.catalog().await?;
+            let Some(object) = reader
+                .lookup(oid, &*inner.context.files, &*inner.context.files)
+                .await?
+            else {
+                return Ok(None);
+            };
+            if object.entry.header.object.size > limit as u64 {
+                return Err(ServingReadError::TooLarge);
+            }
+            if Instant::now() >= deadline {
+                return Err(ServingReadError::Inactive);
+            }
+            // This is a child of an already admitted worker. Closing refuses new
+            // workers but must not invalidate native drain ownership of this one.
+            let owner = {
+                let mut state = inner.state.lock().expect("serving workers");
+                state.active += 1;
+                Arc::new(Active(Arc::clone(&inner)))
+            };
+            Ok(Some(inner.context.files.body(object, limit, owner).await?))
+        })
+        .await
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index f943c0a4..c8538783 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -7,6 +7,7 @@ use cellule_ltx::DiskBudget;
 use cellule_runtime::{Committed, PreparedCommand};
 use tokio::time::{Duration, timeout};
 use tokio_util::task::TaskTracker;
+mod body;
 mod custody;
 mod lifecycle;
 mod pool;
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/body.rs b/crates/canopy-server/src/packs/publication/tests/serving/body.rs
new file mode 100644
index 00000000..e13a454f
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/body.rs
@@ -0,0 +1,258 @@
+//! Actual native packs/metadata with trusted catalog installation to isolate
+//! serving semantics. This is not end-to-end producer publication qualification.
+use super::*;
+use crate::packs::{
+    catalog::{CatalogSnapshot, StoredCatalog},
+    metadata::tests::limits,
+    verification::physical::tests::{Prepared, prepared_for_store},
+};
+use object_store::ObjectStore;
+
+async fn catalog(f: &Fixture, provider: Arc<dyn ObjectStore>) -> Result<(Prepared, StoredCatalog)> {
+    let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+    let (base, _, _) = super::super::prepare::opened(f, [71; 16], store.clone()).await?;
+    let native =
+        prepared_for_store(f.format, 32, base.context().operation, provider, store).await?;
+    let root = tempfile::TempDir::new()?;
+    let budget = DiskBudget::new(64 << 20);
+    let mut builder = CatalogPreparation::new(root.path(), budget.clone(), base, limits()).await?;
+    let (witness, segments) =
+        super::super::prepare::physical(&native, root.path(), budget.clone()).await?;
+    builder.begin_pack(witness)?;
+    for segment in segments {
+        builder.add_segment(segment).await?;
+    }
+    builder.finish_pack().await?;
+    let prepared = builder.finish().await?;
+    let stored = prepared.catalog();
+    drop(prepared);
+    super::super::prepare::cleaned(root.path(), &budget).await?;
+    let fact = initialize(f, native.store.clone()).await?;
+    f.install_generation(2, stored, fact.refs).await?;
+    Ok((native, stored))
+}
+fn serving_context(
+    f: &Fixture,
+    store: Arc<ArtifactStore>,
+    root: &tempfile::TempDir,
+    tasks: TaskTracker,
+) -> Result<(ServingContext, Arc<CatalogFiles>)> {
+    let files = CatalogFiles::new(
+        root.path(),
+        DiskBudget::new(64 << 20),
+        store.clone(),
+        f.format,
+        CatalogFileLimits::default(),
+    )?
+    .with_native(
+        crate::native_resources::NativeResources::default()
+            .scope(crate::native_resources::NativeClass::Foreground),
+    );
+    let files = Arc::new(files);
+    Ok((
+        ServingContext::new(
+            f.client(),
+            f.target.clone(),
+            f.authority(),
+            Arc::new(CatalogIndexes::new(store, f.format)),
+            files.clone(),
+            ServingReadBudget::new(32, tasks)?,
+            "owner".into(),
+        )?,
+        files,
+    ))
+}
+
+#[tokio::test]
+async fn certified_bodies_share_one_pack_across_parallel_readers_and_recheck_cached_access()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (native, _) = catalog(&f, Arc::new(InMemory::new())).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, files) = serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let view = pool.snapshot(Some("viewer".into())).await?;
+        let ids: Vec<_> = native.fixture.objects.keys().copied().collect();
+        let results =
+            futures_util::future::join_all(ids.iter().take(12).map(|oid| view.body(*oid, 1 << 20)))
+                .await;
+        for (oid, body) in ids.iter().zip(results) {
+            let body = body?.ok_or("body missing")?;
+            let expected = native.fixture.objects[oid].0;
+            assert_eq!(crate::object_id(format, expected.kind, &body), *oid);
+            assert_eq!(blake3::hash(&body).as_bytes(), &expected.digest);
+        }
+        for (oid, (expected, _)) in &native.fixture.objects {
+            let body = view.body(*oid, 1 << 20).await?.ok_or("body missing")?;
+            assert_eq!(body.len() as u64, expected.size);
+        }
+        let stats = files.native_stats()?.ok_or("native stats")?;
+        assert_eq!(stats.downloaded_files, 1);
+        assert_eq!(stats.open_files, 1);
+        assert_eq!(stats.cached_files, 1);
+        assert!(stats.cache_hits >= 12);
+        assert_eq!(view.body(missing(&f)?, 1024).await?, None);
+        let blob = native
+            .fixture
+            .objects
+            .values()
+            .find(|(o, _)| o.kind == crate::ObjectKind::Blob)
+            .ok_or("blob")?
+            .0;
+        assert!(matches!(
+            view.body(blob.oid, 1).await,
+            Err(ServingReadError::TooLarge)
+        ));
+        assert!(matches!(
+            view.body(blob.oid, 65 << 20).await,
+            Err(ServingReadError::TooLarge)
+        ));
+        assert_eq!(
+            files
+                .native_stats()?
+                .ok_or("native stats")?
+                .downloaded_files,
+            1
+        );
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+        assert!(matches!(
+            view.body(blob.oid, 1024).await,
+            Err(ServingReadError::Inactive)
+        ));
+        drop(view);
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cached_pack_never_exposes_objects_absent_from_the_selected_catalog() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (native, _) = catalog(&f, Arc::new(InMemory::new())).await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, _) = serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let old = pool.snapshot(Some("owner".into())).await?;
+        let oid = *native.fixture.objects.keys().next().ok_or("object")?;
+        assert!(old.body(oid, 1 << 20).await?.is_some());
+        let directory =
+            crate::packs::directory::snapshot::DirectorySnapshot::empty(f.repository, format)
+                .upload(&native.store, [181; 16])
+                .await?;
+        let empty = CatalogSnapshot {
+            directory,
+            sources: None,
+        }
+        .upload(&native.store, [182; 16])
+        .await?;
+        f.install_generation(3, empty, old.fact().refs).await?;
+        let current = pool.snapshot(Some("owner".into())).await?;
+        assert_eq!(current.body(oid, 1 << 20).await?, None);
+        assert!(old.body(oid, 1 << 20).await?.is_some());
+        drop((old, current));
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn blocked_native_pack_download_retains_pin_after_observer_cancellation() -> Result {
+    use std::sync::atomic::Ordering;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let (native, _) = catalog(&f, provider.clone()).await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, _) = serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let view = pool.snapshot(Some("owner".into())).await?;
+        let oid = *native.fixture.objects.keys().next().ok_or("object")?;
+        // Warm all metadata; the armed provider suspension is actual pack I/O.
+        assert!(view.headers(&[oid]).await?[0].is_some());
+        provider.armed.store(true, Ordering::Release);
+        let observer = tokio::spawn(async move { view.body(oid, 1 << 20).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        observer.abort();
+        assert!(observer.await.err().ok_or("observer")?.is_cancelled());
+        assert!(!pool.quiesce().await?);
+        let mut drain = tokio::spawn({
+            let pool = pool.clone();
+            async move { pool.close_and_drain().await }
+        });
+        assert!(
+            timeout(Duration::from_millis(50), &mut drain)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        provider.proceed.add_permits(1);
+        timeout(Duration::from_secs(8), drain).await??;
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_download_drain_finishes_but_body_is_refused_after_access_revocation() -> Result {
+    use std::sync::atomic::Ordering;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let (native, _) = catalog(&f, provider.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, files) = serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let view = pool.snapshot(Some("viewer".into())).await?;
+        let oid = *native.fixture.objects.keys().next().ok_or("object")?;
+        assert!(view.headers(&[oid]).await?[0].is_some());
+        provider.armed.store(true, Ordering::Release);
+        let observer = tokio::spawn(async move { view.body(oid, 1 << 20).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+        provider.proceed.add_permits(1);
+        assert!(matches!(
+            timeout(Duration::from_secs(8), observer).await??,
+            Err(ServingReadError::Inactive)
+        ));
+        let authorized = pool.snapshot(Some("owner".into())).await?;
+        assert!(authorized.body(oid, 1 << 20).await?.is_some());
+        assert_eq!(
+            files
+                .native_stats()?
+                .ok_or("native stats")?
+                .downloaded_files,
+            1
+        );
+        drop(authorized);
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/server/residency/recovery.rs b/crates/canopy-server/src/server/residency/recovery.rs
index 14e443e4..bfba765a 100644
--- a/crates/canopy-server/src/server/residency/recovery.rs
+++ b/crates/canopy-server/src/server/residency/recovery.rs
@@ -62,7 +62,12 @@ impl RecoveryServices {
                             entry.object_format,
                             CatalogFileLimits::default(),
                         )
-                        .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
+                        .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?
+                        .with_native(
+                            manager
+                                .native
+                                .scope(crate::native_resources::NativeClass::Foreground),
+                        ),
                     ),
                     manager.serving_reads.clone(),
                     entry.owner.clone(),
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index f70e1350..8f9ff688 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -410,3 +410,50 @@ campaigns, typed GC/backup/isolated restore, OS CPU/RSS/I/O/PID containment, nat
 acceleration/physical rewrite/fair maintenance, signed native completion/cold clone,
 [file attribution](file-attribution.md), and full Linux/Kubernetes/Chromium plus
 10,000-SDE mixed-load/recovery/capacity qualification remain mandatory.
+
+## Certified bounded native body reads
+
+`ServingSnapshot::body(oid, limit)` resolves the object through its accepted
+catalog and preferred source before opening native Git. A missing catalog entry
+returns absent even when an old cached pack physically contains that OID. The
+foreground copy limit is at most 64 MiB; larger objects require a separate owned
+streaming producer rather than increasing this allocation without bounds.
+
+Each resident's configured `CatalogFiles` shares immutable native pack copies
+across borrowed generations. Sixteen fixed load stripes coalesce equal misses;
+at most four completed copies are cached and eight file slots are live,
+including borrowed/evicted copies and deferred cleanup. Idle copies can be
+removed to make room under the shared disk budget. Fully authenticated pack and
+index bytes are reserved before download, and their Git checksum/index binding
+is checked before they enter the cache. Whole-pack verification occurs on a
+bounded admitted blocking job, once per retained copy.
+
+A native body must match the selected canonical kind, size, Git object ID and
+BLAKE3 body digest. Header mismatches and limits reject before allocation. The
+batch is poisoned across an incomplete, canceled or invalid read and becomes
+reusable only after a complete verified frame. Native process ownership includes
+its physical-generation guard and cache reference through descendants and
+leader reaping. Blocking creation, writes and hashing also retain their work
+owners independently of observers. A cache's file-slot/root owner follows failed
+or deferred cleanup; its generation guard is not retained by the idle cache.
+
+Resident configuration uses the node's shared foreground native resource scope.
+A metadata-only loader has no implicit native resource pool and refuses body
+reads. Native cache statistics expose live/cached files, cache hits and completed
+downloads. Authorization and conservative lease checks still run before and
+after work through the common serving read contract.
+
+This API is a prerequisite for browser, graph and transfer conversion. Existing
+browser body/commit consumers and remote routes still require conversion; it is
+not evidence of completed native streaming, OS containment, publication or
+large-repository capacity. Pack reuse reduces repeated downloads, but each
+bounded body currently starts a native batch process. Shared persistent readers
+and multi-object batching require separate bounded scheduling and qualification.
+
+A private source pack can omit graph parents that reside in other certified
+sources. It is sufficient for verified object-body decoding, but is not by itself
+a complete native history workspace for `git log` or attribution. Such producers
+must hydrate the required graph through certified source selection and retain
+all physical inputs through their owned lifetime. Cold load still reads and
+verifies a full pack/index pair; these tests establish reuse and bounded ownership,
+not a cold-read latency guarantee for multi-gigabyte packs.
diff --git a/docs/evidence/serving-native-bodies-20261004.json b/docs/evidence/serving-native-bodies-20261004.json
new file mode 100644
index 00000000..e3a20cb2
--- /dev/null
+++ b/docs/evidence/serving-native-bodies-20261004.json
@@ -0,0 +1,247 @@
+{
+  "source_files": 478,
+  "rust_files": 464,
+  "source_hash_digest": "12d0ec70f91b2c04ee503e559ae6873e3081d78203dca33419a80bc40280eb90",
+  "release_qualified": false,
+  "phases": [
+    {
+      "label": "clippy",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "clippy",
+        "--workspace",
+        "--all-targets",
+        "--locked",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "exit_code": 0,
+      "log": "/tmp/canopy-native-body-clippy.log",
+      "preceding_unchanged_source": true,
+      "log_sha256": "fa8bed2a74b1f40588bc0aca7c274ce9ab106db852e8db873ced48304c0fc86c"
+    },
+    {
+      "label": "focused-final",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--lib",
+        "--locked",
+        "--",
+        "serving::",
+        "server::residency::tests::serving::",
+        "server::residency::tests::recovery::",
+        "catalog::native::tests",
+        "native_git::process::tests",
+        "git_cache::tests",
+        "git_objects::tests",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 112.04,
+      "log": "/tmp/canopy-native-body-focused-final.log",
+      "passed": 97,
+      "log_sha256": "afc8a0e412e9ce2c2da7c04a7b869c67e7a7dd7051d3282dbaf0d4dd2df9854f"
+    },
+    {
+      "label": "library",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "--workspace",
+        "--lib",
+        "--locked",
+        "--",
+        "--test-threads=4"
+      ],
+      "exit_code": 101,
+      "seconds": 371.415,
+      "log": "/tmp/canopy-native-body-library.log",
+      "passed": 684,
+      "failed": 5,
+      "nested_summaries_excluded": 2,
+      "known_failures": [
+        "git_gateway::fetch::tests::reachability_stops_at_live_refs_without_scanning_other_history",
+        "object_reads::tests::byte_limited_page_advances_only_over_the_selected_prefix",
+        "object_reads::tests::duplicate_rollback_and_deletion_do_not_hide_subsequent_inserts",
+        "object_reads::tests::insertion_cursor_finds_lower_oids_and_excludes_later_publications",
+        "object_reads::tests::small_increment_uses_bounded_sql_work_after_large_history"
+      ],
+      "publication_passed": 385,
+      "log_sha256": "03748364c943d23c05df44bf766c58c5beff4830de63b44d73d4898b30b08a24"
+    },
+    {
+      "label": "workspace",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "workspace::",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 100.294,
+      "log": "/tmp/canopy-native-body-workspace.log",
+      "passed": 3,
+      "log_sha256": "8297fe2608c19658b122fb4db86da24931f2a71902083d9efd4fbe0e514a737a"
+    },
+    {
+      "label": "lifecycle",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::fork::",
+        "lifecycle::cancelled_prebound_startup",
+        "lifecycle::runtime_destruction",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.681,
+      "log": "/tmp/canopy-native-body-lifecycle.log",
+      "passed": 2,
+      "log_sha256": "5e25685141fa6a95aaa6c1cbf330ac34c2ca007876d676951168b6ff71018e10"
+    },
+    {
+      "label": "drain",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::cancelled_startup_keeps_workspace",
+        "lifecycle::dropped_handle_and_cancelled_shutdown",
+        "lifecycle::failed_drain_retains_workspace",
+        "lifecycle::startup_rejects_ignored_conditional",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.864,
+      "log": "/tmp/canopy-native-body-drain.log",
+      "passed": 4,
+      "log_sha256": "68263cb86ae10ea23f325c9f1917d7839e77bd030c1eeeebfd850fffb5b01e44"
+    },
+    {
+      "label": "build",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "build",
+        "--locked",
+        "--bin",
+        "canopy"
+      ],
+      "exit_code": 0,
+      "seconds": 37.246,
+      "log": "/tmp/canopy-native-body-build.log",
+      "log_sha256": "7f94f507a00c1784dc00f3407768cb4a833bf6a184c4881c2ba0d9af2dd1ac1b"
+    },
+    {
+      "label": "fmt",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 1.216,
+      "log": "/tmp/canopy-native-body-fmt.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "diff",
+      "command": [
+        "git",
+        "diff",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 0.056,
+      "log": "/tmp/canopy-native-body-diff.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "harness",
+      "command": [
+        "python3",
+        "-B",
+        "-m",
+        "unittest",
+        "discover",
+        "-s",
+        "scripts",
+        "-p",
+        "test_*.py"
+      ],
+      "exit_code": 0,
+      "seconds": 41.344,
+      "log": "/tmp/canopy-native-body-harness.log",
+      "log_sha256": "4c08a0a1ba770d431c13dcbcb9fc9f2578e0efea3754bc6d618fdc23c2015f5c"
+    }
+  ],
+  "execution_complete": true,
+  "unique_workspace_cases": 698,
+  "unique_workspace_passed": 693,
+  "unique_workspace_failed": 5,
+  "sdk_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+  "sdk_manifest_pins": 5,
+  "sdk_lock_pins": 6,
+  "protected_hashes": {
+    "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "/Users/haipingfu/.codex/worktrees/packed-catalog-publication-pr/canopy/docs/archive/pr20-progress-through-8bb0ee7.md": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+  },
+  "new_families": 10,
+  "harness_cases": 96,
+  "platform": "macOS / Rust 1.98.0; Linux-only fork cases not executed locally",
+  "scope": "Certified bounded native body API and resident pack reuse; callers beyond refs and remote routes remain to be converted. Native serving fixtures use trusted catalog installation; not producer/publication, cold HTTP latency or full capacity qualification.",
+  "validated_source_parent": "b89d92980fbc9ae515b4b5376ec93415f0f88d68",
+  "fetched_main": "9438bb865959fb975d5349ba8b9908b461653821",
+  "draft_diagnostics": [
+    {
+      "log": "/tmp/canopy-native-body-clippy-draft.log",
+      "exit_code": 101,
+      "reason": "Clippy byte_char_slices rejected a test-only newline iterator; corrected before frozen qualification.",
+      "log_sha256": "db1863bb164d3e296d34a171b1af6a10a094b5f36de57e461bb676fd300c1ee0"
+    }
+  ],
+  "clippy_seconds": 38.39,
+  "prior_ci": {
+    "head": "b89d92980fbc9ae515b4b5376ec93415f0f88d68",
+    "runs": [
+      37227358897,
+      37227355827
+    ],
+    "rust": "Both actual failed logs contain exactly five legacy objects reader failures; 654 server cases pass in each.",
+    "harness": "both pass",
+    "not_qualification_for_new_source": true,
+    "primary_log_sha256": "4dd14218fc7a8d57019e54782826794ea29a05ea96441d636a0acc3938d2e135",
+    "secondary_log_sha256": "0620c90b05f39addfd7589feab437c731387047107b250a30a3d4b103a8b5828"
+  },
+  "checked_local_documentation_links": 92
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index e4fcaa9f..228697cc 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -3,7 +3,7 @@
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. At the preceding published shutdown-fix head `1e32347`, GitHub reports
+directly against `main`. At the preceding published ref-reader head `b89d929`, GitHub reports
 no merge conflicts; both Rust CI runs fail on the same five unconverted
 legacy `objects` readers and both harness checks pass. The PR is currently marked
 ready for review, but production conversion and release requirements remain
@@ -14,6 +14,50 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Certified native object body checkpoint
+
+`ServingSnapshot::body` now resolves an object through the accepted catalog and
+verified preferred source. It returns absent for entries missing from that
+catalog even if a reused pack physically contains the object. Foreground copies
+are bounded to 64 MiB and must match canonical kind, size, Git OID and BLAKE3
+body digest; incomplete or corrupt batch frames poison the reader.
+
+Resident file services share authenticated, verified native pack copies across
+generations, coalesce cold misses with sixteen fixed stripes, and charge at most
+eight live file slots with four cached copies. Borrowed/evicted files and native
+processes retain slots. Idle cache eviction can relieve shared disk pressure;
+retention follows deferred/failed cleanup. Native work uses the node's shared
+foreground scope. Physical generation guards survive blocking creation, transfer,
+verification and hashing, plus process descendants/reaping after cancellation.
+Idle cache files retain file/root charges, not generation pins.
+
+The [serving contract](design/certified-serving-pins.md#certified-bounded-native-body-reads)
+defines these bounds. Actual pack fixtures cover both formats, parallel reuse,
+metadata/body integrity, disk-pressure eviction, live slot exhaustion, generation
+isolation, current access after cached/in-flight reads, canceled provider work,
+and process ownership. Their catalog installation is trusted fixture injection
+to isolate serving behavior; this is not producer/publication qualification.
+All 97 focused serving/cache/native families pass in 26.35 seconds on the final
+source. Workspace/all-target Clippy with warnings denied passes in 38.39 seconds.
+The workspace library runs 689 unique cases: 684 pass and the same five legacy
+`objects` readers fail. All 385 publication cases pass. Nine selected portable
+workspace/lifecycle cases pass, giving 698 unique Rust cases, 693 passes and five
+failures; nested subprocess summaries and focused reruns are not counted twice.
+The server build, formatting, diff checks and all 96 Python harness tests pass.
+The driver retains the actual library exit 101. Linux-only fork cases were not
+executed locally. Commands, source fingerprint and log digests are retained in
+[native body evidence](evidence/serving-native-bodies-20261004.json). The frozen
+inventory contains 478 source/schema/manifest files, including 464 Rust files.
+Exact SDK pins and protected original index/archive remain unchanged.
+
+Browser/tree/file/history/graph consumers and remote routes still require
+conversion to this API. Streaming larger bodies, a complete graph workspace for
+native history, persistent batch scheduling and cold-pack I/O optimization remain
+open. One private source pack is not necessarily a complete Git history workspace.
+Full producer/reader conversion, physical owner adoption, custody archival,
+final DDL, GC/backup/restore, OS containment, native maintenance, signed completion,
+attribution and full-history/large-team capacity qualification remain mandatory.
+
 ## Certified browser ref reads checkpoint
 
 The local browser's ref listing and resolution now select the accepted immutable

From cc4a963c750d03c22483d6a9f12099a525114385 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 13:30:40 -0700
Subject: [PATCH 25/55] Serve browser objects and ancestry through certified
 snapshots

---
 crates/canopy-server/src/git_read/browse.rs   |  20 +-
 crates/canopy-server/src/git_read/graph.rs    |  66 +--
 crates/canopy-server/src/git_read/mod.rs      |  84 +--
 .../canopy-server/src/git_read/patch/mod.rs   |   1 +
 crates/canopy-server/src/lib.rs               |   6 +
 crates/canopy-server/src/packs/catalog/mod.rs |   3 +
 .../src/packs/catalog/serving_fixture.rs      | 275 +++++++++
 .../canopy-server/src/packs/metadata/tests.rs |  33 +-
 .../src/packs/publication/mod.rs              |  16 +-
 .../src/packs/publication/serving.rs          |   4 +-
 .../packs/publication/serving/lifecycle.rs    |   7 +
 .../src/packs/publication/serving/session.rs  |   7 +
 .../packs/publication/serving/session/body.rs |   6 +-
 .../publication/serving/session/edges.rs      |  85 +++
 .../src/packs/publication/tests/serving.rs    |   1 +
 .../packs/publication/tests/serving/body.rs   |   7 +-
 .../packs/publication/tests/serving/edges.rs  |  96 +++
 .../src/server/residency/tests/serving.rs     |   2 +
 .../server/residency/tests/serving/browser.rs | 554 ++++++++++++++++++
 docs/README.md                                |   1 +
 docs/design/certified-serving-pins.md         |  61 +-
 .../serving-certified-browser-20261004.json   | 253 ++++++++
 .../large-repository-implementation-status.md |  60 +-
 23 files changed, 1519 insertions(+), 129 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/catalog/serving_fixture.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/edges.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/edges.rs
 create mode 100644 crates/canopy-server/src/server/residency/tests/serving/browser.rs
 create mode 100644 docs/evidence/serving-certified-browser-20261004.json

diff --git a/crates/canopy-server/src/git_read/browse.rs b/crates/canopy-server/src/git_read/browse.rs
index 5d3a0fdf..ebe0722f 100644
--- a/crates/canopy-server/src/git_read/browse.rs
+++ b/crates/canopy-server/src/git_read/browse.rs
@@ -120,19 +120,8 @@ impl Reader {
         // Only certified objects are browseable. Staged push bytes do not become
         // visible through a guessed OID before their complete graph is verified.
         for _ in 0..16 {
-            let rows = self.repository.sql.query(None,SqlBatch {statements:vec![SqlStatement {
-                sql:"SELECT o.kind FROM objects o JOIN object_closure c ON c.oid = o.oid WHERE o.oid = ?1".into(), parameters:vec![SqlValue::Blob(target.to_vec())],
-            }]}).await?;
-            let Some([SqlValue::Text(kind)]) = rows
-                .output
-                .first()
-                .and_then(|s| s.rows.first())
-                .map(Vec::as_slice)
-            else {
-                return Err(ReadError::Missing);
-            };
-            match kind.as_str() {
-                "commit" => {
+            match self.header(target).await?.object.kind {
+                ObjectKind::Commit => {
                     let body = self.body(target, ObjectKind::Commit).await?;
                     let admission = Arc::clone(&self.admission);
                     return tokio::task::spawn_blocking(move || {
@@ -141,7 +130,7 @@ impl Reader {
                     })
                     .await?;
                 }
-                "tag" => {
+                ObjectKind::Tag => {
                     let body = self.body(target, ObjectKind::Tag).await?;
                     let first = body
                         .split(|b| *b == b'\n')
@@ -168,6 +157,7 @@ impl Reader {
     ) -> Result<Directory, ReadError> {
         let actor = actor.into();
         self.member(actor).await?;
+        self.bind(actor).await?;
         let path = if encoded_path.is_empty() {
             Vec::new()
         } else {
@@ -224,6 +214,7 @@ impl Reader {
     ) -> Result<File, ReadError> {
         let actor = actor.into();
         self.member(actor).await?;
+        self.bind(actor).await?;
         let path = path(encoded_path)?;
         let commit = self.commit(oid(revision)?).await?;
         let entry = self
@@ -263,6 +254,7 @@ impl Reader {
     ) -> Result<History, ReadError> {
         let actor = actor.into();
         self.member(actor).await?;
+        self.bind(actor).await?;
         let mut target = Some(oid(revision)?);
         let mut commits = Vec::new();
         while let Some(current) = target {
diff --git a/crates/canopy-server/src/git_read/graph.rs b/crates/canopy-server/src/git_read/graph.rs
index c4f546ff..1502209b 100644
--- a/crates/canopy-server/src/git_read/graph.rs
+++ b/crates/canopy-server/src/git_read/graph.rs
@@ -3,13 +3,23 @@ use std::collections::{HashMap, HashSet};
 
 const MAX_COMMITS: usize = 100_000;
 const MAX_EDGES: usize = 250_000;
-const GROUP: usize = 128;
-const PAGE: usize = 512;
+const GROUP: usize = crate::packs::publication::MAX_EDGE_PARENTS;
 type Graph = HashMap<Oid, Vec<Oid>>;
 
 impl Reader {
     pub(super) async fn merge_base(&self, base: Oid, source: Oid) -> Result<Oid, ReadError> {
+        if base.format() != self.repository.object_format()
+            || source.format() != self.repository.object_format()
+        {
+            return Err(ReadError::Invalid);
+        }
+        if base.is_zero() || source.is_zero() {
+            return Err(ReadError::Missing);
+        }
         if base == source {
+            if self.header(base).await?.object.kind != ObjectKind::Commit {
+                return Err(ReadError::Malformed);
+            }
             return Ok(base);
         }
         let mut graph = Graph::new();
@@ -23,35 +33,20 @@ impl Reader {
             for oid in &group {
                 graph.insert(*oid, Vec::new());
             }
-            let mut cursor: Option<(Oid, Oid)> = None;
+            let mut ids = group;
+            ids.sort_unstable();
+            let mut cursor = None;
             loop {
-                let placeholders = (3..group.len() + 3)
-                    .map(|n| format!("?{n}"))
-                    .collect::<Vec<_>>()
-                    .join(",");
-                let mut parameters = vec![
-                    SqlValue::Blob(cursor.map_or_else(Vec::new, |(child, _)| child.to_vec())),
-                    SqlValue::Blob(cursor.map_or_else(Vec::new, |(_, parent)| parent.to_vec())),
-                ];
-                parameters.extend(group.iter().map(|oid| SqlValue::Blob(oid.to_vec())));
-                // Parent rows come only from verified commit certificates. Keyset
-                // paging includes every parent even for unusually wide merges.
-                let result = self.repository.sql.query(None,SqlBatch { statements:vec![SqlStatement {
-                    sql:format!("SELECT child, parent FROM commit_parents WHERE child IN ({placeholders}) AND (child > ?1 OR (child = ?1 AND parent > ?2)) ORDER BY child, parent LIMIT {PAGE}"),parameters,
-                }] }).await?;
-                let rows = &result.output.first().ok_or(ReadError::Malformed)?.rows;
-                for row in rows {
-                    let [SqlValue::Blob(child), SqlValue::Blob(parent)] = row.as_slice() else {
+                let page = self.snapshot()?.edges_page(&ids, cursor).await?;
+                for (_, header) in page.headers {
+                    if header.ok_or(ReadError::Missing)?.object.kind != ObjectKind::Commit {
                         return Err(ReadError::Malformed);
-                    };
-                    let child: Oid = child
-                        .as_slice()
-                        .try_into()
-                        .map_err(|_| ReadError::Malformed)?;
-                    let parent: Oid = parent
-                        .as_slice()
-                        .try_into()
-                        .map_err(|_| ReadError::Malformed)?;
+                    }
+                }
+                for (child, edge) in page.edges {
+                    if edge.expected_kind != ObjectKind::Commit {
+                        continue;
+                    }
                     edges += 1;
                     if edges > MAX_EDGES {
                         return Err(ReadError::TooLarge);
@@ -59,18 +54,19 @@ impl Reader {
                     graph
                         .get_mut(&child)
                         .ok_or(ReadError::Malformed)?
-                        .push(parent);
-                    cursor = Some((child, parent));
-                    if discovered.insert(parent) {
+                        .push(edge.child);
+                    if discovered.insert(edge.child) {
                         if discovered.len() > MAX_COMMITS {
                             return Err(ReadError::TooLarge);
                         }
-                        pending.push(parent);
+                        pending.push(edge.child);
                     }
                 }
-                if rows.len() < PAGE {
-                    break;
+                let Some(next) = page.next_after else { break };
+                if cursor.is_some_and(|old| old >= next) {
+                    return Err(ReadError::Malformed);
                 }
+                cursor = Some(next);
             }
         }
         let admission = Arc::clone(&self.admission);
diff --git a/crates/canopy-server/src/git_read/mod.rs b/crates/canopy-server/src/git_read/mod.rs
index 3f0d6c8c..d952f5c4 100644
--- a/crates/canopy-server/src/git_read/mod.rs
+++ b/crates/canopy-server/src/git_read/mod.rs
@@ -1,4 +1,4 @@
-//! Bounded repository browsing and PR comparison over verified Cell Git objects.
+//! Bounded repository browsing and comparison over certified immutable Git objects.
 
 use crate::ReadIdentity;
 
@@ -13,10 +13,7 @@ use crate::{
     pulls::{PullRevision, parse_oid},
 };
 use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
-use cellule_runtime::{
-    InvocationError, primitives::sql::SqlBatch, primitives::sql::SqlResultSet,
-    primitives::sql::SqlStatement, primitives::sql::SqlValue,
-};
+use cellule_runtime::{InvocationError, primitives::sql::SqlResultSet};
 use serde::{Deserialize, Serialize};
 use std::{collections::BTreeMap, sync::Arc};
 
@@ -123,6 +120,7 @@ pub(crate) struct FilePreview {
 pub(crate) struct Reader {
     repository: Arc<RepositoryCell>,
     admission: Arc<AdmissionPermit>,
+    snapshot: Option<crate::packs::publication::ServingSnapshot>,
     bytes: u64,
     entries: usize,
 }
@@ -131,10 +129,35 @@ impl Reader {
         Self {
             repository,
             admission,
+            snapshot: None,
             bytes: 0,
             entries: 0,
         }
     }
+    async fn bind(&mut self, actor: ReadIdentity<'_>) -> Result<(), ReadError> {
+        if self.snapshot.is_some() {
+            return Err(ReadError::Malformed);
+        }
+        self.snapshot = Some(self.repository.serving_snapshot(actor).await?);
+        Ok(())
+    }
+    fn snapshot(&self) -> Result<&crate::packs::publication::ServingSnapshot, ReadError> {
+        self.snapshot.as_ref().ok_or(ReadError::Malformed)
+    }
+    async fn header(&self, oid: Oid) -> Result<crate::packs::metadata::ObjectHeader, ReadError> {
+        if oid.format() != self.repository.object_format() {
+            return Err(ReadError::Invalid);
+        }
+        if oid.is_zero() {
+            return Err(ReadError::Missing);
+        }
+        self.snapshot()?
+            .headers(&[oid])
+            .await?
+            .pop()
+            .flatten()
+            .ok_or(ReadError::Missing)
+    }
     async fn authorize<'a>(
         &self,
         actor: impl Into<ReadIdentity<'a>>,
@@ -211,6 +234,7 @@ impl Reader {
         let actor = actor.into();
         let cursor = after.map(path).transpose()?;
         let revision = self.authorize(actor, number, &target).await?;
+        self.bind(actor).await?;
         let (base, source) = (oid(&revision.base_oid)?, oid(&revision.source_oid)?);
         let (merge_base, before, after) = self.roots(base, source).await?;
         let changes = self.changes(before, after).await?;
@@ -253,6 +277,7 @@ impl Reader {
         let actor = actor.into();
         let path = path(encoded_path)?;
         let revision = self.authorize(actor, number, &target).await?;
+        self.bind(actor).await?;
         let (base, source) = (oid(&revision.base_oid)?, oid(&revision.source_oid)?);
         let (merge_base, before, after) = self.roots(base, source).await?;
         let root = match side {
@@ -288,37 +313,11 @@ impl Reader {
         })
     }
     async fn size(&self, oid: Oid, kind: ObjectKind) -> Result<u64, ReadError> {
-        let result = self
-            .repository
-            .sql
-            .query(
-                None,
-                SqlBatch {
-                    statements: vec![SqlStatement {
-                        sql: "SELECT kind, size FROM objects WHERE oid = ?1".into(),
-                        parameters: vec![SqlValue::Blob(oid.to_vec())],
-                    }],
-                },
-            )
-            .await?;
-        let Some([SqlValue::Text(stored_kind), SqlValue::Integer(size)]) = result
-            .output
-            .first()
-            .and_then(|set| set.rows.first())
-            .map(Vec::as_slice)
-        else {
-            return Err(ReadError::Malformed);
-        };
-        let expected = match kind {
-            ObjectKind::Blob => "blob",
-            ObjectKind::Tree => "tree",
-            ObjectKind::Commit => "commit",
-            ObjectKind::Tag => "tag",
-        };
-        if stored_kind != expected {
+        let object = self.header(oid).await?.object;
+        if object.kind != kind {
             return Err(ReadError::Malformed);
         }
-        u64::try_from(*size).map_err(|_| ReadError::Malformed)
+        Ok(object.size)
     }
     async fn body(&mut self, oid: Oid, kind: ObjectKind) -> Result<Vec<u8>, ReadError> {
         let size = self.size(oid, kind).await?;
@@ -326,13 +325,16 @@ impl Reader {
             return Err(ReadError::TooLarge);
         }
         self.bytes += size;
-        let (stored_kind, body) = self
-            .repository
-            .object(oid, None)
-            .await?
-            .output
-            .ok_or(ReadError::Malformed)?;
-        if stored_kind != kind || body.len() as u64 != size {
+        let body = self
+            .snapshot()?
+            .body(oid, MAX_OBJECT_BYTES as usize)
+            .await
+            .map_err(|error| match error {
+                crate::packs::publication::ServingReadError::TooLarge => ReadError::TooLarge,
+                error => ReadError::Serving(error),
+            })?
+            .ok_or(ReadError::Missing)?;
+        if body.len() as u64 != size {
             return Err(ReadError::Malformed);
         }
         Ok(body)
diff --git a/crates/canopy-server/src/git_read/patch/mod.rs b/crates/canopy-server/src/git_read/patch/mod.rs
index 82d8b37b..3f890cd2 100644
--- a/crates/canopy-server/src/git_read/patch/mod.rs
+++ b/crates/canopy-server/src/git_read/patch/mod.rs
@@ -106,6 +106,7 @@ impl Reader {
         let actor = actor.into();
         let path = path(encoded_path)?;
         let revision = self.authorize(actor, number, &target).await?;
+        self.bind(actor).await?;
         let (merge_base, old_tree, new_tree) = self
             .roots(oid(&revision.base_oid)?, oid(&revision.source_oid)?)
             .await?;
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index fa1bf1b3..287cfa61 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -307,6 +307,12 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/serving/session.rs"));
                 source.update(include_bytes!("packs/publication/serving/session/reads.rs"));
                 source.update(include_bytes!("packs/publication/serving/session/body.rs"));
+                source.update(include_bytes!("packs/publication/serving/session/edges.rs"));
+                source.update(include_bytes!("git_read/mod.rs"));
+                source.update(include_bytes!("git_read/browse.rs"));
+                source.update(include_bytes!("git_read/graph.rs"));
+                source.update(include_bytes!("git_read/trees.rs"));
+                source.update(include_bytes!("git_read/patch/mod.rs"));
                 source.update(include_bytes!("packs/publication/serving/session/refs.rs"));
                 source.update(include_bytes!("packs/publication/serving/lifecycle.rs"));
                 source.update(include_bytes!("packs/publication/serving/pool.rs"));
diff --git a/crates/canopy-server/src/packs/catalog/mod.rs b/crates/canopy-server/src/packs/catalog/mod.rs
index bf00b808..96baf726 100644
--- a/crates/canopy-server/src/packs/catalog/mod.rs
+++ b/crates/canopy-server/src/packs/catalog/mod.rs
@@ -118,3 +118,6 @@ impl CatalogSnapshot {
 
 #[cfg(test)]
 pub(in crate::packs) mod tests;
+
+#[cfg(test)]
+pub(crate) mod serving_fixture;
diff --git a/crates/canopy-server/src/packs/catalog/serving_fixture.rs b/crates/canopy-server/src/packs/catalog/serving_fixture.rs
new file mode 100644
index 00000000..f8263f79
--- /dev/null
+++ b/crates/canopy-server/src/packs/catalog/serving_fixture.rs
@@ -0,0 +1,275 @@
+//! Physically verified native inputs for serving tests. Catalog installation in
+//! the caller is trusted injection, not qualification of the live publisher.
+use super::*;
+use crate::packs::{
+    directory::DirectoryBuilder,
+    metadata::{
+        PAGE_OBJECTS,
+        tests::{fixture_with_input, git, limits},
+    },
+    ref_state::{RefStateRecord, RefStateSnapshot, RefStateSnapshotRoot, RefStateTree},
+    sources::{SourceIndex, SourceRecord},
+    verification::{
+        PhysicalVerifier,
+        physical::tests::{physical_limits, upload_fixture},
+    },
+};
+use crate::{ObjectId, RefExpectation};
+use cellule_ltx::DiskBudget;
+use object_store::ObjectStore;
+
+type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error + Send + Sync>>;
+pub(crate) struct BrowseFixture {
+    pub catalog: StoredCatalog,
+    pub refs: RefStateSnapshotRoot,
+    pub main: ObjectId,
+    pub side: ObjectId,
+    pub root: ObjectId,
+    pub previous: ObjectId,
+    pub tag: ObjectId,
+    pub tree: ObjectId,
+    pub wide: Option<ObjectId>,
+    pub history: Vec<String>,
+    pub edges: std::collections::BTreeMap<ObjectId, Vec<crate::packs::metadata::TypedEdge>>,
+    pub large: Vec<u8>,
+}
+pub(crate) fn operation(n: u64) -> [u8; 16] {
+    let mut id = *b"CANOPY0100000000";
+    id[8..].copy_from_slice(&n.to_be_bytes());
+    id
+}
+fn file(input: &mut Vec<u8>, mode: &str, name: &str, body: &[u8]) {
+    input.extend_from_slice(format!("M {mode} inline {name}\ndata {}\n", body.len()).as_bytes());
+    input.extend_from_slice(body);
+    input.push(b'\n');
+}
+fn commit(input: &mut Vec<u8>, branch: &str, mark: u32, parents: &[u32]) {
+    input.extend_from_slice(format!("commit refs/heads/{branch}\nmark :{mark}\ncommitter Browse Test <browse@example.invalid> {mark} +0000\ndata 7\nfixture\n").as_bytes());
+    if let Some(first) = parents.first() {
+        input.extend_from_slice(format!("from :{first}\n").as_bytes());
+    }
+    for parent in parents.iter().skip(1) {
+        input.extend_from_slice(format!("merge :{parent}\n").as_bytes());
+    }
+}
+pub(crate) async fn prepare(
+    format: ObjectFormat,
+    provider: Arc<dyn ObjectStore>,
+    repository: [u8; 16],
+    regular_files: usize,
+) -> Result<BrowseFixture> {
+    let mut input = Vec::new();
+    commit(&mut input, "main", 1, &[]);
+    for n in 0..regular_files {
+        file(
+            &mut input,
+            "100644",
+            &format!("file-{n:04}"),
+            format!("original {n}\n").as_bytes(),
+        );
+    }
+    file(
+        &mut input,
+        "100644",
+        "src/lib.rs",
+        b"pub fn original() {}\n",
+    );
+    file(&mut input, "120000", "link", b"src/lib.rs");
+    file(&mut input, "100755", "executable", b"#!/bin/sh\nexit 0\n");
+    file(&mut input, "100644", "\"\\377name\"", b"raw name\n");
+    file(&mut input, "100644", "\"literal[?]*\"", b"literal path\n");
+    file(&mut input, "100644", "binary", b"a\0b\xff");
+    let large = vec![b'x'; 256 * 1024 + 1];
+    file(&mut input, "100644", "large", &large);
+    input.extend_from_slice(
+        format!("M 160000 {} submodule\n\n", "8".repeat(format.bytes() * 2)).as_bytes(),
+    );
+    for mark in 2..=40 {
+        commit(&mut input, "main", mark, &[mark - 1]);
+        file(
+            &mut input,
+            "100644",
+            "file-0000",
+            format!("version {mark}\n").as_bytes(),
+        );
+        input.push(b'\n');
+    }
+    commit(&mut input, "side", 41, &[1]);
+    file(&mut input, "100644", "side-file", b"side\n");
+    input.push(b'\n');
+    commit(&mut input, "main", 42, &[40, 41]);
+    file(&mut input, "100644", "side-file", b"side\n");
+    input.push(b'\n');
+    if regular_files >= 600 {
+        // An actual 532-parent Git merge exercises ancestry continuation beyond
+        // one 512-edge page. Empty auxiliary commits share the root content.
+        for mark in 50..580 {
+            commit(&mut input, "aux", mark, &[1]);
+            input.push(b'\n');
+        }
+        let mut parents = vec![1, 41];
+        parents.extend(50..580);
+        commit(&mut input, "wide", 600, &parents);
+        input.push(b'\n');
+    }
+    let fixture = fixture_with_input(format, input)
+        .await
+        .map_err(|e| e.to_string())?;
+    async fn oid(path: &std::path::Path, name: &str) -> Result<ObjectId> {
+        let bytes = git(path, &["rev-parse", name], None)
+            .await
+            .map_err(|e| e.to_string())?;
+        Ok(ObjectId::from_hex(std::str::from_utf8(&bytes)?.trim())?)
+    }
+    let main = oid(fixture.root.path(), "main").await?;
+    let side = oid(fixture.root.path(), "side").await?;
+    let root = oid(fixture.root.path(), "main~40").await?;
+    let previous = oid(fixture.root.path(), "main~1").await?;
+    let tag = oid(fixture.root.path(), "metadata").await?;
+    let tree = oid(fixture.root.path(), "main^{tree}").await?;
+    let wide = if regular_files >= 600 {
+        Some(oid(fixture.root.path(), "wide").await?)
+    } else {
+        None
+    };
+    let history = String::from_utf8(
+        git(
+            fixture.root.path(),
+            &["rev-list", "--first-parent", "main"],
+            None,
+        )
+        .await
+        .map_err(|e| e.to_string())?,
+    )?
+    .lines()
+    .map(str::to_owned)
+    .collect();
+    let edges = fixture
+        .objects
+        .iter()
+        .map(|(oid, (_, edges))| (*oid, edges.clone()))
+        .collect();
+    let store = Arc::new(ArtifactStore::new(provider.clone(), repository));
+    let native = upload_fixture(fixture, operation(100), provider, store.clone())
+        .await
+        .map_err(|e| e.to_string())?;
+    let work = tempfile::TempDir::new()?;
+    let budget = DiskBudget::new(128 << 20);
+    let mut verifier = PhysicalVerifier::download(
+        work.path(),
+        budget.clone(),
+        &store,
+        native.descriptor,
+        physical_limits(),
+        crate::native_resources::NativeResources::default()
+            .scope(crate::native_resources::NativeClass::Foreground),
+    )
+    .await?;
+    let mut segments = Vec::new();
+    let mut remaining = native.descriptor.object_count;
+    while remaining != 0 {
+        let count = remaining.min(PAGE_OBJECTS as u32);
+        segments.push(verifier.inspect_next_shard(count).await?);
+        remaining -= count;
+    }
+    verifier
+        .finish()
+        .await?
+        .verify_segments(segments.iter().map(|s| s.descriptor()))?;
+    let mut directory = DirectoryBuilder::new(
+        work.path(),
+        budget.clone(),
+        repository,
+        operation(101),
+        format,
+        limits(),
+    )?;
+    let index = SourceIndex::new(store.clone(), format);
+    let mut sources = None;
+    for segment in &segments {
+        directory.add_segment(segment)?;
+        sources = Some(
+            index
+                .insert(
+                    sources,
+                    operation(102),
+                    SourceRecord {
+                        metadata: segment.clone().upload(&store).await?,
+                        pack: native.descriptor.pack,
+                        index: native.descriptor.index,
+                        pack_object_count: native.descriptor.object_count,
+                    },
+                )
+                .await?,
+        );
+    }
+    let run = Arc::new(directory.seal()?).upload(&store).await?;
+    let ranges = RangeIndex::new(store.clone(), format);
+    let run_root = ranges.insert(None, operation(103), run).await?;
+    let mut directory = DirectorySnapshot::empty(repository, format);
+    directory.append(&ranges, run_root).await?;
+    let catalog = CatalogSnapshot {
+        directory: directory.upload(&store, operation(104)).await?,
+        sources,
+    }
+    .upload(&store, operation(105))
+    .await?;
+    let refs = RefStateTree::new(store.clone(), format)
+        .build_sorted(
+            operation(106),
+            [
+                RefStateRecord::new(
+                    "refs/heads/main",
+                    RefExpectation {
+                        oid: Some(main),
+                        version: 1,
+                    },
+                    format,
+                )?,
+                RefStateRecord::new(
+                    "refs/heads/side",
+                    RefExpectation {
+                        oid: Some(side),
+                        version: 1,
+                    },
+                    format,
+                )?,
+            ]
+            .into_iter()
+            .map(Ok),
+        )
+        .await?;
+    let refs = RefStateSnapshotRoot::upload(
+        &store,
+        operation(107),
+        RefStateSnapshot {
+            repository,
+            format,
+            generation: 1,
+            default_branch: "refs/heads/main".into(),
+            root: refs,
+        },
+    )
+    .await?;
+    drop(segments);
+    tokio::time::timeout(std::time::Duration::from_secs(8), async {
+        while budget.used() != 0 {
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
+    Ok(BrowseFixture {
+        catalog,
+        refs,
+        main,
+        side,
+        root,
+        previous,
+        tag,
+        tree,
+        wide,
+        history,
+        edges,
+        large,
+    })
+}
diff --git a/crates/canopy-server/src/packs/metadata/tests.rs b/crates/canopy-server/src/packs/metadata/tests.rs
index da9da7cb..ce668043 100644
--- a/crates/canopy-server/src/packs/metadata/tests.rs
+++ b/crates/canopy-server/src/packs/metadata/tests.rs
@@ -5,7 +5,11 @@ use tokio::{io::AsyncWriteExt, process::Command};
 
 type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error>>;
 
-async fn git(path: &Path, args: &[&str], input: Option<Vec<u8>>) -> Result<Vec<u8>> {
+pub(in crate::packs) async fn git(
+    path: &Path,
+    args: &[&str],
+    input: Option<Vec<u8>>,
+) -> Result<Vec<u8>> {
     let mut command = Command::new("git");
     command
         .env_clear()
@@ -43,6 +47,23 @@ pub(in crate::packs) struct Fixture {
     pub(in crate::packs) objects: BTreeMap<ObjectId, (CanonicalObject, Vec<TypedEdge>)>,
 }
 pub(in crate::packs) async fn fixture(format: ObjectFormat, blobs: usize) -> Result<Fixture> {
+    // fast-import avoids one process per fixture object. The input is a test
+    // fixture; production verification streams native bodies into bounded SQL.
+    let mut input = b"commit refs/heads/main\ncommitter Metadata Test <test@example.invalid> 1 +0000\ndata 7\nfixture\n".to_vec();
+    for n in 0..blobs {
+        let body = format!("fixture body {n}\n");
+        input.extend_from_slice(
+            format!("M 100644 inline file-{n}\ndata {}\n{body}", body.len()).as_bytes(),
+        );
+    }
+    input.extend_from_slice(b"\n");
+    fixture_with_input(format, input).await
+}
+
+pub(in crate::packs) async fn fixture_with_input(
+    format: ObjectFormat,
+    input: Vec<u8>,
+) -> Result<Fixture> {
     let root = tempfile::TempDir::new()?;
     git(
         root.path(),
@@ -54,16 +75,6 @@ pub(in crate::packs) async fn fixture(format: ObjectFormat, blobs: usize) -> Res
         None,
     )
     .await?;
-    // fast-import avoids one process per fixture object. The input is a test
-    // fixture; production verification streams native bodies into bounded SQL.
-    let mut input = b"commit refs/heads/main\ncommitter Metadata Test <test@example.invalid> 1 +0000\ndata 7\nfixture\n".to_vec();
-    for n in 0..blobs {
-        let body = format!("fixture body {n}\n");
-        input.extend_from_slice(
-            format!("M 100644 inline file-{n}\ndata {}\n{body}", body.len()).as_bytes(),
-        );
-    }
-    input.extend_from_slice(b"\n");
     git(root.path(), &["fast-import", "--quiet"], Some(input)).await?;
     git(
         root.path(),
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index efc61795..cee8da46 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -16,14 +16,14 @@ use cellule_runtime::{
 };
 mod serving;
 pub use serving::{
-    AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_SERVING_GENERATIONS,
-    MAX_SERVING_OWNERS, MAX_SERVING_PINS, ReadyServingCommand, ReadyServingRelease,
-    ReleaseServingPin, RenewServingPin, RenewServingRequest, ResolvedServingRef,
-    SelectServingGeneration, ServingCheck, ServingContext, ServingDenial, ServingDrainObserver,
-    ServingDrainProof, ServingLease, ServingOwner, ServingOwnerError, ServingOwnerPhase,
-    ServingOwnerStats, ServingPin, ServingPool, ServingPoolLimits, ServingReadBudget,
-    ServingReadError, ServingReleaseReply, ServingReply, ServingSelection, ServingSnapshot,
-    ServingToken,
+    AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_EDGE_PARENTS,
+    MAX_SERVING_GENERATIONS, MAX_SERVING_OWNERS, MAX_SERVING_PINS, ReadyServingCommand,
+    ReadyServingRelease, ReleaseServingPin, RenewServingPin, RenewServingRequest,
+    ResolvedServingRef, SelectServingGeneration, ServingCheck, ServingContext, ServingDenial,
+    ServingDrainObserver, ServingDrainProof, ServingEdgePage, ServingLease, ServingOwner,
+    ServingOwnerError, ServingOwnerPhase, ServingOwnerStats, ServingPin, ServingPool,
+    ServingPoolLimits, ServingReadBudget, ServingReadError, ServingReleaseReply, ServingReply,
+    ServingSelection, ServingSnapshot, ServingToken,
 };
 mod owner;
 pub(crate) mod registry;
diff --git a/crates/canopy-server/src/packs/publication/serving.rs b/crates/canopy-server/src/packs/publication/serving.rs
index f790e6f7..a4d4abd7 100644
--- a/crates/canopy-server/src/packs/publication/serving.rs
+++ b/crates/canopy-server/src/packs/publication/serving.rs
@@ -20,8 +20,8 @@ pub use commands::{
     AcquireServingPin, CheckServingPin, ReleaseServingPin, RenewServingPin, SelectServingGeneration,
 };
 pub use session::{
-    ReadyServingRelease, ResolvedServingRef, ServingContext, ServingPin, ServingReadBudget,
-    ServingReadError,
+    MAX_EDGE_PARENTS, ReadyServingRelease, ResolvedServingRef, ServingContext, ServingEdgePage,
+    ServingPin, ServingReadBudget, ServingReadError,
 };
 
 pub const MAX_SERVING_PINS: u64 = 4096;
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
index c836bec6..42d948e6 100644
--- a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -125,6 +125,13 @@ impl ServingSnapshot {
     ) -> Result<Vec<Option<crate::packs::metadata::ObjectHeader>>, ServingReadError> {
         self.pin.headers(self.actor.clone(), ids).await
     }
+    pub async fn edges_page(
+        &self,
+        ids: &[crate::ObjectId],
+        after: Option<(crate::ObjectId, crate::ObjectId)>,
+    ) -> Result<ServingEdgePage, ServingReadError> {
+        self.pin.edges_page(self.actor.clone(), ids, after).await
+    }
     pub async fn body(
         &self,
         oid: crate::ObjectId,
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index d4f418a2..a34ee024 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -12,6 +12,8 @@ use std::sync::Mutex;
 use tokio::{sync::Notify, time::Instant};
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 mod body;
+mod edges;
+pub use edges::{MAX_EDGE_PARENTS, ServingEdgePage};
 mod handoff;
 mod reads;
 mod refs;
@@ -468,6 +470,11 @@ impl ServingPin {
     }
 }
 impl Inner {
+    fn child(self: &Arc<Self>) -> Arc<Active> {
+        let mut state = self.state.lock().expect("serving workers");
+        state.active += 1;
+        Arc::new(Active(Arc::clone(self)))
+    }
     async fn catalog(&self) -> Result<Arc<CatalogReader>, ServingReadError> {
         let mut reader = self.reader.lock().await;
         if reader.is_none() {
diff --git a/crates/canopy-server/src/packs/publication/serving/session/body.rs b/crates/canopy-server/src/packs/publication/serving/session/body.rs
index a2c50f7f..984c49cc 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/body.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/body.rs
@@ -33,11 +33,7 @@ impl ServingPin {
             }
             // This is a child of an already admitted worker. Closing refuses new
             // workers but must not invalidate native drain ownership of this one.
-            let owner = {
-                let mut state = inner.state.lock().expect("serving workers");
-                state.active += 1;
-                Arc::new(Active(Arc::clone(&inner)))
-            };
+            let owner = inner.child();
             Ok(Some(inner.context.files.body(object, limit, owner).await?))
         })
         .await
diff --git a/crates/canopy-server/src/packs/publication/serving/session/edges.rs b/crates/canopy-server/src/packs/publication/serving/session/edges.rs
new file mode 100644
index 00000000..a8597b26
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/edges.rs
@@ -0,0 +1,85 @@
+//! Bounded typed graph pages from preferred certified metadata, never legacy SQL.
+use super::*;
+use crate::packs::metadata::TypedEdge;
+
+pub const MAX_EDGE_PARENTS: usize = 128;
+#[derive(Debug, PartialEq, Eq)]
+pub struct ServingEdgePage {
+    pub headers: Vec<(crate::ObjectId, Option<ObjectHeader>)>,
+    pub edges: Vec<(crate::ObjectId, TypedEdge)>,
+    /// Conservative continuation: an exact-full page may need one empty read.
+    pub next_after: Option<(crate::ObjectId, crate::ObjectId)>,
+}
+impl ServingPin {
+    pub async fn edges_page(
+        &self,
+        actor: Option<String>,
+        ids: &[crate::ObjectId],
+        after: Option<(crate::ObjectId, crate::ObjectId)>,
+    ) -> Result<ServingEdgePage, ServingReadError> {
+        if ids.is_empty()
+            || ids.len() > MAX_EDGE_PARENTS
+            || ids
+                .iter()
+                .any(|oid| oid.is_zero() || oid.format() != self.inner.lease.format)
+            || ids.windows(2).any(|pair| pair[0] >= pair[1])
+            || after.is_some_and(|(parent, child)| {
+                ids.binary_search(&parent).is_err()
+                    || child.is_zero()
+                    || child.format() != self.inner.lease.format
+            })
+        {
+            return Err(ServingReadError::Context);
+        }
+        let ids = ids.to_vec();
+        self.read_owned(actor, move |inner, deadline| async move {
+            let reader = inner.catalog().await?;
+            let mut output = ServingEdgePage {
+                headers: Vec::new(),
+                edges: Vec::new(),
+                next_after: None,
+            };
+            for parent in ids {
+                if after.is_some_and(|(cursor, _)| parent < cursor) {
+                    continue;
+                }
+                if Instant::now() >= deadline {
+                    return Err(ServingReadError::Inactive);
+                }
+                let Some(object) = reader
+                    .lookup(parent, &*inner.context.files, &*inner.context.files)
+                    .await?
+                else {
+                    output.headers.push((parent, None));
+                    continue;
+                };
+                output.headers.push((parent, Some(object.entry.header)));
+                let metadata = object.source.metadata;
+                let cursor = after
+                    .filter(|(cursor, _)| *cursor == parent)
+                    .map(|(_, child)| child);
+                let owner = inner.child();
+                let mut edges = tokio::task::spawn_blocking(move || {
+                    let _owner = owner;
+                    metadata.edges_after(parent, cursor)
+                })
+                .await?
+                .map_err(crate::packs::directory::index::IndexError::from)?;
+                let keep = edges.len().min(PAGE_OBJECTS - output.edges.len());
+                edges.truncate(keep);
+                output
+                    .edges
+                    .extend(edges.into_iter().map(|edge| (parent, edge)));
+                if output.edges.len() == PAGE_OBJECTS {
+                    output.next_after = output
+                        .edges
+                        .last()
+                        .map(|(parent, edge)| (*parent, edge.child));
+                    break;
+                }
+            }
+            Ok(output)
+        })
+        .await
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index c8538783..a108228c 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -9,6 +9,7 @@ use tokio::time::{Duration, timeout};
 use tokio_util::task::TaskTracker;
 mod body;
 mod custody;
+mod edges;
 mod lifecycle;
 mod pool;
 mod refs;
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/body.rs b/crates/canopy-server/src/packs/publication/tests/serving/body.rs
index e13a454f..4ddb0371 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/body.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/body.rs
@@ -8,7 +8,10 @@ use crate::packs::{
 };
 use object_store::ObjectStore;
 
-async fn catalog(f: &Fixture, provider: Arc<dyn ObjectStore>) -> Result<(Prepared, StoredCatalog)> {
+pub(super) async fn catalog(
+    f: &Fixture,
+    provider: Arc<dyn ObjectStore>,
+) -> Result<(Prepared, StoredCatalog)> {
     let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
     let (base, _, _) = super::super::prepare::opened(f, [71; 16], store.clone()).await?;
     let native =
@@ -31,7 +34,7 @@ async fn catalog(f: &Fixture, provider: Arc<dyn ObjectStore>) -> Result<(Prepare
     f.install_generation(2, stored, fact.refs).await?;
     Ok((native, stored))
 }
-fn serving_context(
+pub(super) fn serving_context(
     f: &Fixture,
     store: Arc<ArtifactStore>,
     root: &tempfile::TempDir,
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/edges.rs b/crates/canopy-server/src/packs/publication/tests/serving/edges.rs
new file mode 100644
index 00000000..2f65a439
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/edges.rs
@@ -0,0 +1,96 @@
+//! Typed graph reads retain the same owned lifetime as headers and bodies.
+use super::*;
+use std::sync::atomic::Ordering;
+
+#[tokio::test]
+async fn canceled_edge_page_keeps_generation_until_actual_provider_drain() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let (native, _) = super::body::catalog(&f, provider.clone()).await?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let q = super::pool::queue(&f)?;
+        let (context, _) =
+            super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(context, q.clone(), ServingPoolLimits::default())?;
+        let snapshot = pool.snapshot(Some("owner".into())).await?;
+        let id = *native.fixture.objects.keys().next().ok_or("object")?;
+        provider.armed.store(true, Ordering::Release);
+        let observer = tokio::spawn(async move { snapshot.edges_page(&[id], None).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        observer.abort();
+        assert!(observer.await.err().ok_or("observer")?.is_cancelled());
+        assert!(!pool.quiesce().await?);
+        let mut drain = tokio::spawn({
+            let pool = pool.clone();
+            async move { pool.close_and_drain().await }
+        });
+        assert!(
+            timeout(Duration::from_millis(50), &mut drain)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        provider.proceed.add_permits(1);
+        timeout(Duration::from_secs(8), drain).await??;
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn edge_pages_discard_revoked_in_flight_results_and_recheck_cache_hits() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let (native, _) = super::body::catalog(&f, provider.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let q = super::pool::queue(&f)?;
+        let (context, _) =
+            super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(context, q.clone(), ServingPoolLimits::default())?;
+        let viewer = pool.snapshot(Some("viewer".into())).await?;
+        let id = native
+            .fixture
+            .objects
+            .iter()
+            .find(|(_, (_, edges))| !edges.is_empty())
+            .ok_or("object with edges")?
+            .0;
+        let id = *id;
+        provider.armed.store(true, Ordering::Release);
+        let observer = tokio::spawn({
+            let viewer = viewer.clone();
+            async move { viewer.edges_page(&[id], None).await }
+        });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+        provider.proceed.add_permits(1);
+        assert!(matches!(
+            timeout(Duration::from_secs(8), observer).await??,
+            Err(ServingReadError::Inactive)
+        ));
+        let owner = pool.snapshot(Some("owner".into())).await?;
+        assert!(!owner.edges_page(&[id], None).await?.edges.is_empty());
+        assert!(matches!(
+            viewer.edges_page(&[id], None).await,
+            Err(ServingReadError::Inactive)
+        ));
+        drop((owner, viewer));
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/server/residency/tests/serving.rs b/crates/canopy-server/src/server/residency/tests/serving.rs
index f77cd6f2..efa5345c 100644
--- a/crates/canopy-server/src/server/residency/tests/serving.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving.rs
@@ -288,3 +288,5 @@ async fn production_shutdown_keeps_publication_cell_heartbeat_and_workspace_unti
     }
     Ok(())
 }
+
+mod browser;
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser.rs b/crates/canopy-server/src/server/residency/tests/serving/browser.rs
new file mode 100644
index 00000000..823444fe
--- /dev/null
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser.rs
@@ -0,0 +1,554 @@
+//! Actual HTTP reads against native, physically verified packs. Only the joint
+//! catalog fact and editorial pull records are installed by trusted test SQL;
+//! this does not qualify the still-unconverted live pull/ref producers.
+use super::*;
+use crate::packs::{
+    catalog::{
+        CatalogSnapshot, StoredCatalog,
+        serving_fixture::{BrowseFixture, operation, prepare},
+    },
+    directory::snapshot::DirectorySnapshot,
+    ref_state::RefStateSnapshotRoot,
+};
+use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+use canopy_object_storage::artifact::ArtifactStore;
+use cellule_runtime::codec::{BoundedEncoder, WireValue};
+use serde_json::{Value, json};
+
+async fn install(
+    repository: &RepositoryCell,
+    generation: i64,
+    catalog: StoredCatalog,
+    refs: RefStateSnapshotRoot,
+) -> Result {
+    let mut e = BoundedEncoder::new(256)?;
+    catalog.encode(&mut e)?;
+    let catalog = e.finish();
+    let mut e = BoundedEncoder::new(128)?;
+    refs.encode(&mut e)?;
+    repository.sql.batch(crate::server::mutation_identity()?, SqlBatch {statements: vec![
+        SqlStatement {sql:"INSERT INTO catalog_generations(generation,catalog,certificate,refs) VALUES(?1,?2,?3,?4)".into(),parameters:vec![SqlValue::Integer(generation),SqlValue::Blob(catalog),SqlValue::Blob(vec![42;32]),SqlValue::Blob(e.finish())]},
+        SqlStatement {sql:"UPDATE catalog_state SET generation=?1 WHERE singleton=1".into(),parameters:vec![SqlValue::Integer(generation)]},
+    ]}).await?;
+    Ok(())
+}
+async fn request(
+    server: &crate::server::RunningServer,
+    suffix: &str,
+    body: Value,
+) -> Result<reqwest::Response> {
+    Ok(reqwest::Client::new()
+        .post(format!(
+            "http://{}/api/repositories/native-browser/{suffix}",
+            server.address
+        ))
+        .bearer_auth("local-recovery-test")
+        .json(&body)
+        .send()
+        .await?)
+}
+async fn browse(server: &crate::server::RunningServer, id: &str, query: Value) -> Result<Value> {
+    let response = request(server, "browse", json!({"repository_id":id,"query":query})).await?;
+    let status = response.status();
+    let body = response.text().await?;
+    assert_eq!(status, reqwest::StatusCode::OK, "{body}");
+    Ok(serde_json::from_str::<Value>(&body)?["view"].clone())
+}
+fn tree(commit: ObjectId, path: &[u8], after: Option<Value>) -> Value {
+    json!({"kind":"tree","commit":hex::encode(commit),"path_base64":URL_SAFE_NO_PAD.encode(path),"after":after})
+}
+fn file(commit: ObjectId, path: &[u8]) -> Value {
+    json!({"kind":"file","commit":hex::encode(commit),"path_base64":URL_SAFE_NO_PAD.encode(path)})
+}
+async fn fixture(
+    server: &crate::server::RunningServer,
+    format: ObjectFormat,
+) -> Result<(Arc<RepositoryCell>, BrowseFixture, String)> {
+    let entry = create(&server.repositories, "native-browser", format).await?;
+    let (repository, _, _) = loaded(&server.repositories, entry.repository_id).await?;
+    let native = prepare(
+        format,
+        server.repositories.external_store.clone(),
+        entry.repository_id,
+        40,
+    )
+    .await?;
+    install(&repository, 2, native.catalog, native.refs).await?;
+    Ok((
+        repository,
+        native,
+        uuid::Uuid::from_bytes(entry.repository_id).to_string(),
+    ))
+}
+
+#[tokio::test]
+async fn production_native_browser_preserves_raw_paths_modes_pages_tags_and_ordered_history()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, id) = fixture(&server, format).await?;
+        let first = browse(&server, &id, tree(native.tag, b"", None)).await?;
+        assert_eq!(first["tree"]["commit"]["oid"], hex::encode(native.main));
+        assert_eq!(first["tree"]["tree_oid"], hex::encode(native.tree));
+        let mut entries = first["tree"]["entries"]
+            .as_array()
+            .ok_or("entries")?
+            .clone();
+        assert_eq!(entries.len(), 32);
+        let second = browse(
+            &server,
+            &id,
+            tree(native.main, b"", Some(first["tree"]["next_after"].clone())),
+        )
+        .await?;
+        assert!(second["tree"]["next_after"].is_null());
+        entries.extend(
+            second["tree"]["entries"]
+                .as_array()
+                .ok_or("entries")?
+                .clone(),
+        );
+        assert_eq!(entries.len(), 49);
+        let paths = entries
+            .iter()
+            .map(|e| -> Result<Vec<u8>> {
+                Ok(URL_SAFE_NO_PAD.decode(e["path_base64"].as_str().ok_or("path")?)?)
+            })
+            .collect::<Result<Vec<_>>>()?;
+        assert!(paths.windows(2).all(|p| p[0] < p[1]));
+        assert!(paths.contains(&b"\xffname".to_vec()));
+        let raw = entries
+            .iter()
+            .find(|e| e["path_base64"] == URL_SAFE_NO_PAD.encode(b"\xffname"))
+            .ok_or("raw entry")?;
+        assert!(raw["name"].is_null());
+        for (path, mode, body) in [
+            (b"link".as_slice(), "120000", b"src/lib.rs".as_slice()),
+            (b"executable", "100755", b"#!/bin/sh\nexit 0\n"),
+            (b"\xffname", "100644", b"raw name\n"),
+            (b"literal[?]*", "100644", b"literal path\n"),
+            (b"binary", "100644", b"a\0b\xff"),
+            (b"src/lib.rs", "100644", b"pub fn original() {}\n"),
+        ] {
+            let output = browse(&server, &id, file(native.main, path)).await?;
+            assert_eq!(output["file"]["mode"], mode);
+            assert_eq!(output["file"]["size"], body.len());
+            assert_eq!(
+                output["file"]["content_base64"],
+                URL_SAFE_NO_PAD.encode(body)
+            );
+        }
+        let directory = browse(&server, &id, tree(native.main, b"src", None)).await?;
+        assert_eq!(
+            directory["tree"]["entries"].as_array().ok_or("src")?.len(),
+            1
+        );
+        let large = browse(&server, &id, file(native.main, b"large")).await?;
+        assert_eq!(large["file"]["content_status"], "too_large");
+        assert_eq!(large["file"]["size"], native.large.len());
+        assert!(large["file"]["content_base64"].is_null());
+        let link = browse(&server, &id, file(native.main, b"submodule")).await?;
+        assert_eq!(link["file"]["content_status"], "gitlink");
+        assert!(link["file"]["size"].is_null());
+        let first = browse(
+            &server,
+            &id,
+            json!({"kind":"history","commit":hex::encode(native.tag)}),
+        )
+        .await?;
+        let first = &first["history"];
+        assert_eq!(first["commits"].as_array().ok_or("history")?.len(), 32);
+        assert_eq!(
+            first["commits"][0]["parents"],
+            json!([hex::encode(native.previous), hex::encode(native.side)])
+        );
+        let second = browse(
+            &server,
+            &id,
+            json!({"kind":"history","commit":first["next_commit"]}),
+        )
+        .await?;
+        assert_eq!(
+            second["history"]["commits"]
+                .as_array()
+                .ok_or("continued history")?
+                .len(),
+            9
+        );
+        assert!(second["history"]["next_commit"].is_null());
+        let actual: Vec<_> = first["commits"]
+            .as_array()
+            .ok_or("first")?
+            .iter()
+            .chain(second["history"]["commits"].as_array().ok_or("second")?)
+            .map(|c| c["oid"].as_str().unwrap_or_default().to_owned())
+            .collect();
+        assert_eq!(actual, native.history);
+        // These tables do not exist: success cannot come from a fallback.
+        let tables=repository.sql.query(None,SqlBatch{statements:vec![SqlStatement{sql:"SELECT name FROM sqlite_schema WHERE name IN ('objects','object_closure','object_edges','commit_parents')".into(),parameters:vec![]}]}).await?;
+        assert!(tables.output[0].rows.is_empty());
+        drop(repository);
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_native_browser_refuses_absent_generations_wrong_formats_and_revoked_cached_access()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, id) = fixture(&server, format).await?;
+        let old = repository
+            .serving_snapshot(ReadIdentity::Account("canopy"))
+            .await?;
+        assert!(old.body(native.main, 1 << 20).await?.is_some());
+        let _ = browse(&server, &id, tree(native.main, b"", None)).await?;
+        for (revision, status) in [
+            (missing(format), reqwest::StatusCode::NOT_FOUND),
+            (
+                match format {
+                    ObjectFormat::Sha1 => ObjectId::Sha1([0; 20]),
+                    ObjectFormat::Sha256 => ObjectId::Sha256([0; 32]),
+                },
+                reqwest::StatusCode::NOT_FOUND,
+            ),
+            (
+                match format {
+                    ObjectFormat::Sha1 => ObjectId::Sha256([7; 32]),
+                    ObjectFormat::Sha256 => ObjectId::Sha1([7; 20]),
+                },
+                reqwest::StatusCode::UNPROCESSABLE_ENTITY,
+            ),
+        ] {
+            assert_eq!(
+                request(
+                    &server,
+                    "browse",
+                    json!({"repository_id":id,"query":tree(revision,b"",None)})
+                )
+                .await?
+                .status(),
+                status
+            );
+        }
+        let store = ArtifactStore::new(
+            server.repositories.external_store.clone(),
+            repository.repository_id(),
+        );
+        let directory = DirectorySnapshot::empty(repository.repository_id(), format)
+            .upload(&store, operation(200))
+            .await?;
+        let empty = CatalogSnapshot {
+            directory,
+            sources: None,
+        }
+        .upload(&store, operation(201))
+        .await?;
+        install(&repository, 3, empty, native.refs).await?;
+        assert_eq!(
+            request(
+                &server,
+                "browse",
+                json!({"repository_id":id,"query":file(native.main,b"file-0000")})
+            )
+            .await?
+            .status(),
+            reqwest::StatusCode::NOT_FOUND
+        );
+        assert!(old.body(native.main, 1 << 20).await?.is_some());
+        drop(old);
+        // The cached pack must also obey current public/private authorization.
+        repository
+            .sql
+            .batch(
+                crate::server::mutation_identity()?,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "UPDATE ref_generation SET visibility='public' WHERE singleton=1"
+                            .into(),
+                        parameters: vec![],
+                    }],
+                },
+            )
+            .await?;
+        let public = repository.serving_snapshot(ReadIdentity::Anonymous).await?;
+        assert!(public.body(native.main, 1 << 20).await?.is_none());
+        repository
+            .sql
+            .batch(
+                crate::server::mutation_identity()?,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "UPDATE ref_generation SET visibility='private' WHERE singleton=1"
+                            .into(),
+                        parameters: vec![],
+                    }],
+                },
+            )
+            .await?;
+        assert!(public.body(native.main, 1 << 20).await.is_err());
+        let anonymous = reqwest::Client::new()
+            .post(format!(
+                "http://{}/api/repositories/native-browser/browse",
+                server.address
+            ))
+            .json(&json!({"repository_id":id,"query":tree(native.main,b"",None)}))
+            .send()
+            .await?;
+        assert_ne!(anonymous.status(), reqwest::StatusCode::OK);
+        drop((public, repository));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
+
+async fn editorial_pull(
+    repository: &RepositoryCell,
+    number: i64,
+    source: ObjectId,
+    base: ObjectId,
+) -> Result<Value> {
+    // Only editorial metadata remains on legacy refs. The compared bodies and
+    // ancestry must come from the certified catalog, never objects/parents SQL.
+    let source_ref = format!("refs/heads/source-{number}");
+    let base_ref = format!("refs/heads/base-{number}");
+    repository.sql.batch(crate::server::mutation_identity()?,SqlBatch{statements:vec![
+        SqlStatement{sql:"INSERT INTO refs(name,oid,version) VALUES(?1,?2,1),(?3,?4,1)".into(),parameters:vec![SqlValue::Text(source_ref.clone()),SqlValue::Blob(source.to_vec()),SqlValue::Text(base_ref.clone()),SqlValue::Blob(base.to_vec())]},
+        SqlStatement{sql:"INSERT INTO pull_requests(number,id,creation_digest,author,title,body,state,draft,version,source_ref,base_ref,initial_source_oid,initial_base_oid,created_ms,updated_ms) VALUES(?1,?2,?3,'canopy','native comparison','','open',0,1,?4,?5,?6,?7,0,0)".into(),parameters:vec![SqlValue::Integer(number),SqlValue::Blob(uuid::Uuid::new_v4().into_bytes().to_vec()),SqlValue::Blob(vec![42;32]),SqlValue::Text(source_ref),SqlValue::Text(base_ref),SqlValue::Blob(source.to_vec()),SqlValue::Blob(base.to_vec())]},
+    ]}).await?;
+    Ok(
+        json!({"kind":"current","revision":{"pull_version":1,"source_oid":hex::encode(source),"source_version":1,"base_oid":hex::encode(base),"base_version":1}}),
+    )
+}
+#[tokio::test]
+async fn production_native_comparisons_read_certified_ancestry_patches_and_previews() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, id) = fixture(&server, format).await?;
+        for (number, source, base, expected) in [
+            (1, native.previous, native.side, native.root),
+            (2, native.main, native.side, native.side),
+            (3, native.main, native.main, native.main),
+        ] {
+            let target = editorial_pull(&repository, number, source, base).await?;
+            let response = request(
+                &server,
+                &format!("pulls/{number}/comparison"),
+                json!({"repository_id":id,"target":target,"query":{"kind":"files"}}),
+            )
+            .await?;
+            let status = response.status();
+            let body = response.text().await?;
+            assert_eq!(status, reqwest::StatusCode::OK, "{body}");
+            let body: Value = serde_json::from_str(&body)?;
+            assert_eq!(body["comparison"]["merge_base"], hex::encode(expected));
+            if number == 3 {
+                assert_eq!(body["comparison"]["files"], json!([]));
+                continue;
+            }
+            assert_eq!(
+                body["comparison"]["files"]
+                    .as_array()
+                    .ok_or("changes")?
+                    .len(),
+                1
+            );
+            assert_eq!(body["comparison"]["files"][0]["path"], "file-0000");
+            for query in [
+                json!({"kind":"patch","path_base64":URL_SAFE_NO_PAD.encode(b"file-0000")}),
+                json!({"kind":"file","path_base64":URL_SAFE_NO_PAD.encode(b"file-0000"),"side":"after"}),
+            ] {
+                let response = request(
+                    &server,
+                    &format!("pulls/{number}/comparison"),
+                    json!({"repository_id":id,"target":target,"query":query}),
+                )
+                .await?;
+                let status = response.status();
+                let body = response.text().await?;
+                assert_eq!(status, reqwest::StatusCode::OK, "{body}");
+                let body: Value = serde_json::from_str(&body)?;
+                if query["kind"] == "patch" {
+                    assert_eq!(body["patch"]["status"], "text");
+                    assert_eq!(body["patch"]["merge_base"], hex::encode(expected));
+                    assert_eq!(body["patch"]["hunks"][0]["lines"][0]["kind"], "delete");
+                    assert_eq!(body["patch"]["hunks"][0]["lines"][1]["text"], "version 40");
+                } else {
+                    assert_eq!(
+                        body["file"]["content_base64"],
+                        URL_SAFE_NO_PAD.encode(b"version 40\n")
+                    );
+                }
+            }
+        }
+        // Equal non-commit tips must be refused even when merge_base can take
+        // its equal-input fast path. A catalog membership lookup is mandatory.
+        let blob = native.edges[&native.tree]
+            .iter()
+            .find(|edge| edge.expected_kind == crate::ObjectKind::Blob)
+            .ok_or("blob edge")?
+            .child;
+        let target = editorial_pull(&repository, 4, blob, blob).await?;
+        assert_eq!(
+            request(
+                &server,
+                "pulls/4/comparison",
+                json!({"repository_id":id,"target":target,"query":{"kind":"files"}})
+            )
+            .await?
+            .status(),
+            reqwest::StatusCode::SERVICE_UNAVAILABLE
+        );
+        let target = editorial_pull(&repository, 5, missing(format), missing(format)).await?;
+        assert_eq!(
+            request(
+                &server,
+                "pulls/5/comparison",
+                json!({"repository_id":id,"target":target,"query":{"kind":"files"}})
+            )
+            .await?
+            .status(),
+            reqwest::StatusCode::NOT_FOUND
+        );
+        drop(repository);
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_certified_edge_pages_cover_wide_trees_and_parent_boundaries() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let entry = create(&server.repositories, "native-browser", format).await?;
+        let (repository, _, _) = loaded(&server.repositories, entry.repository_id).await?;
+        let native = prepare(
+            format,
+            server.repositories.external_store.clone(),
+            entry.repository_id,
+            600,
+        )
+        .await?;
+        install(&repository, 2, native.catalog, native.refs).await?;
+        let snapshot = repository
+            .serving_snapshot(ReadIdentity::Account("canopy"))
+            .await?;
+        let root_tree = native.edges[&native.root]
+            .iter()
+            .find(|edge| edge.expected_kind == crate::ObjectKind::Tree)
+            .ok_or("root tree")?
+            .child;
+        let wide = native.wide.ok_or("wide merge")?;
+        let mut ids = vec![
+            native.main,
+            native.side,
+            wide,
+            native.tree,
+            root_tree,
+            missing(format),
+        ];
+        ids.sort_unstable();
+        let mut expected = Vec::new();
+        for id in &ids {
+            if let Some(edges) = native.edges.get(id) {
+                let mut edges = edges.clone();
+                edges.sort_by_key(|edge| edge.child);
+                edges.dedup_by_key(|edge| edge.child);
+                expected.extend(edges.into_iter().map(|edge| (*id, edge)));
+            }
+        }
+        assert!(expected.len() > 1024);
+        let mut cursor = None;
+        let mut actual = Vec::new();
+        let mut absent = false;
+        let mut pages = 0;
+        loop {
+            let page = snapshot.edges_page(&ids, cursor).await?;
+            assert!(page.edges.len() <= 512);
+            assert!(page.headers.len() <= ids.len());
+            absent |= page
+                .headers
+                .iter()
+                .any(|(id, header)| *id == missing(format) && header.is_none());
+            actual.extend(page.edges);
+            pages += 1;
+            let Some(next) = page.next_after else { break };
+            assert!(cursor.is_none_or(|old| old < next));
+            cursor = Some(next);
+        }
+        assert!(pages >= 3);
+        assert!(absent);
+        assert_eq!(actual, expected);
+        let context = |error| {
+            matches!(
+                error,
+                Err(crate::packs::publication::ServingReadError::Context)
+            )
+        };
+        assert!(context(snapshot.edges_page(&[], None).await));
+        assert!(context(
+            snapshot.edges_page(&[native.main; 129], None).await
+        ));
+        assert!(context(
+            snapshot.edges_page(&[native.main, native.main], None).await
+        ));
+        assert!(context(
+            snapshot
+                .edges_page(
+                    &ids,
+                    Some((
+                        match format {
+                            ObjectFormat::Sha1 => ObjectId::Sha1([0; 20]),
+                            ObjectFormat::Sha256 => ObjectId::Sha256([0; 32]),
+                        },
+                        native.main
+                    ))
+                )
+                .await
+        ));
+        assert!(context(
+            snapshot
+                .edges_page(
+                    &ids,
+                    Some((
+                        native.main,
+                        match format {
+                            ObjectFormat::Sha1 => ObjectId::Sha1([0; 20]),
+                            ObjectFormat::Sha256 => ObjectId::Sha256([0; 32]),
+                        }
+                    ))
+                )
+                .await
+        ));
+        let wrong = match format {
+            ObjectFormat::Sha1 => ObjectId::Sha256([9; 32]),
+            ObjectFormat::Sha256 => ObjectId::Sha1([9; 20]),
+        };
+        assert!(context(snapshot.edges_page(&[wrong], None).await));
+        assert!(context(
+            snapshot.edges_page(&ids, Some((native.main, wrong))).await
+        ));
+        let mut parents = native.edges[&wide].clone();
+        parents.sort_by_key(|edge| edge.child);
+        let (ordinal, last) = parents
+            .iter()
+            .enumerate()
+            .rev()
+            .find(|(_, edge)| {
+                edge.expected_kind == crate::ObjectKind::Commit && edge.child != native.root
+            })
+            .ok_or("last parent")?;
+        assert!(ordinal >= 512);
+        let target = editorial_pull(&repository, 1, wide, last.child).await?;
+        let response = request(&server,"pulls/1/comparison",json!({"repository_id":uuid::Uuid::from_bytes(entry.repository_id).to_string(),"target":target,"query":{"kind":"files"}})).await?;
+        let status = response.status();
+        let body = response.text().await?;
+        assert_eq!(status, reqwest::StatusCode::OK, "{body}");
+        let body: Value = serde_json::from_str(&body)?;
+        assert_eq!(body["comparison"]["merge_base"], hex::encode(last.child));
+        drop((snapshot, repository));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
diff --git a/docs/README.md b/docs/README.md
index 71320f82..5e2e7af2 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -16,6 +16,7 @@ Use this page to choose a document by task. Canopy's hosting core supports stock
 | Plan or evaluate capacity | [Repository density and latency](performance-plan.md) | Workloads, targets, measured results and limits of each result |
 | Recover an explicitly supported predecessor Cell contract | [Retained-contract maintenance recovery](performance/2026-10-02-retained-maintenance-recovery.md) | Recovery admission fix, regression scope and incomplete rebuild status |
 | Implement large-repository storage for a large team | [Packed storage design](large-repository-storage-design.md), [implementation plan](large-repository-implementation-plan.md) and [large-team amendment](large-team-scalability.md) | Hard-cutover design, required scalability changes and single-hot-repository release gates; capacity remains unqualified |
+| Inspect certified browser objects, refs and graph reads | [Serving contract](design/certified-serving-pins.md), [implementation status](large-repository-implementation-status.md) and [browser evidence](evidence/serving-certified-browser-20261004.json) | Owned local readers, bounded native bodies/edges, actual HTTP tests and remaining producer/remote/capacity gates |
 | Inspect the original RustFS corpus upgrade | [Full-corpus activation and remote verification](performance/2026-10-01-original-corpus-activation.md) | Admission of 10,003 Cells, full Git/LFS verification, failed diagnostic load windows and open owner-loss gates |
 | Track three nodes behind a proxy and the latest dependency candidate | [Three-node proxy qualification](performance/2026-09-30-three-node-proxy.md) | Baseline/candidate pins, complete-corpus recovery, failing load windows and open gates |
 | Inspect the merged workspace and RustFS verification | [Workspace and RustFS verification](performance/2026-09-30-workspace-rustfs.md) | The `70bd25f` revision, conflict resolution and end-to-end gates |
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index 8f9ff688..81d3c255 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -6,8 +6,8 @@ adds a bounded serving-pin receiver and an owned metadata-read capability. This
 is a foundation for production reader conversion. A service-owned producer now
 acquires, retains, renews and drains one generation independently of its callers;
 the production manager now creates a bounded resident pool and exposes its
-borrow through `RepositoryCell::serving_snapshot`. Existing product/native/body/
-stream consumers still require conversion to this capability.
+borrow through `RepositoryCell::serving_snapshot`. Local browser and comparison object reads now use this capability. Remaining
+product/native/stream consumers and remote routes still require conversion.
 The branch remains unreleasable until that conversion and the full cutover gates
 are complete.
 
@@ -114,7 +114,7 @@ bounded physical-read slot after read admission closes. A released, rebound or
 missing row fails handoff; duplicate physical ownership is rejected.
 
 `ServingSnapshot` carries a private borrow guard and exposes only the generation
-fact and admitted metadata headers. Clones share that guard until the last clone
+fact and admitted headers, bodies, refs and typed graph pages. Clones share that guard until the last clone
 drops. Closing a producer refuses new borrows while existing borrows retain their
 generation and continue renewal. Renewal is scheduled at one third of the
 conservatively observed remaining lease; this is a scheduling policy, not a
@@ -362,8 +362,8 @@ owner fence.
 
 The resident pool now integrates `ServingOwner` and its accepted acquisition
 handoff with manager residency. Command reconstruction alone does not establish
-physical ownership. The next serving layer must carry that
-ownership through native work, object bodies and response streams. Actual
+physical ownership. Native bodies and local browser/comparison reads now carry that ownership.
+Remaining transfer producers must carry it through complete response streams. Actual
 eviction and shutdown already own pool drain. A close must join all producers and
 workers before Cell/workspace/artifact release.
 
@@ -384,7 +384,7 @@ Consumer conversion must preserve these boundaries:
    administrator authority and publication admission remain usable. Only then
    may the node tracker/publication budget close and resident recovery/Cell/
    workspace drain finish. The current shutdown path enforces this ordering;
-   native/body/stream consumers still need to carry the snapshot guard.
+   remaining native/stream consumers still need to carry the snapshot guard.
 4. Actual process fencing and restored-owner adoption must precede releasing an
    abandoned pin. A historical lease or an expired deadline is insufficient.
    Quota recovery must use that authenticated lifecycle rather than reaping SQL
@@ -443,8 +443,8 @@ reads. Native cache statistics expose live/cached files, cache hits and complete
 downloads. Authorization and conservative lease checks still run before and
 after work through the common serving read contract.
 
-This API is a prerequisite for browser, graph and transfer conversion. Existing
-browser body/commit consumers and remote routes still require conversion; it is
+This API is a prerequisite for browser, graph and transfer conversion. Local
+browser body/commit consumers now use it; remote routes still require conversion; it is
 not evidence of completed native streaming, OS containment, publication or
 large-repository capacity. Pack reuse reduces repeated downloads, but each
 bounded body currently starts a native batch process. Shared persistent readers
@@ -457,3 +457,48 @@ must hydrate the required graph through certified source selection and retain
 all physical inputs through their owned lifetime. Cold load still reads and
 verifies a full pack/index pair; these tests establish reuse and bounded ownership,
 not a cold-read latency guarantee for multi-gigabyte packs.
+
+
+## Certified browser objects and typed ancestry
+
+A local browser tree, file or first-parent history request borrows one accepted
+joint generation for its whole view. Annotated tags, commit/tree parsing, sizes
+and file previews read only certified headers and verified native bodies through
+that snapshot. The selected catalog determines presence even when a reused pack
+contains more objects. The public 32-entry pages, literal raw-byte paths, mode
+handling and 256 KiB preview bound remain. Wrong-format inputs reject as invalid;
+zero or absent commit IDs return missing rather than a storage failure.
+
+Comparison files, previews and patches also borrow one generation for their
+object and ancestry reads. `ServingSnapshot::edges_page` accepts one to 128
+strictly sorted unique nonzero IDs in the repository format. It returns at most
+512 typed edges and headers for the parents visited, including explicit absent
+headers. A `(parent, child)` cursor resumes within a parent and then advances to
+later requested IDs; it must identify a parent in the same requested set.
+Continuation headers may repeat the cursor parent. An exact-full page returns a
+conservative continuation and can require one final empty read. These pages are
+not ordered Git parent lists; commit bodies retain ordered parents for history.
+
+Edge source selection uses the accepted preferred metadata, never legacy Cell
+object/parent tables. Local immutable SQLite edge queries run off the executor
+with a child physical guard. The common admitted read checks access, actual owner
+and conservative deadline before and after work. Observer cancellation detaches
+the tracked worker; generation release still waits for its real provider/query
+completion. Edges and headers use the same shared authenticated file/index cache.
+
+Merge-base traversal expands groups of at most 128 certified commits, consumes
+all edge continuations, and excludes tree edges by expected kind. It rejects
+missing/non-commit roots, including equal tips, and retains the existing bounds
+of 100,000 commits and 250,000 parent edges. Best common ancestors are computed on
+owned bounded graph data. It starts no native process per traversed commit.
+Current pull/review/thread metadata authorization still reads its existing Cell
+records and live legacy ref rows; their producer/authority conversion is open.
+This checkpoint does not establish a fully converted pull lifecycle.
+
+Production HTTP tests use native packs physically verified into metadata shards,
+then trusted installation of the joint catalog fact. They exercise both object
+formats, raw paths, directory/history continuation, modes, tags, file previews,
+merge comparisons and a 532-parent native merge whose relevant parent is beyond
+the first edge page. Suspended-provider and revocation tests qualify edge-worker
+ownership and cached authorization. This isolates consumer behavior and is not
+end-to-end live producer publication, cold latency or large-team qualification.
diff --git a/docs/evidence/serving-certified-browser-20261004.json b/docs/evidence/serving-certified-browser-20261004.json
new file mode 100644
index 00000000..ab2baa7a
--- /dev/null
+++ b/docs/evidence/serving-certified-browser-20261004.json
@@ -0,0 +1,253 @@
+{
+  "source_files": 482,
+  "rust_files": 468,
+  "source_hash_digest": "380bd07d069a113df8abcb24464e9d0a7f16c1db86558fea9d4b3b6fc325d422",
+  "release_qualified": false,
+  "phases": [
+    {
+      "label": "clippy",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "clippy",
+        "--workspace",
+        "--all-targets",
+        "--locked",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "exit_code": 0,
+      "seconds": 31.581,
+      "log": "/tmp/canopy-certified-browser-clippy.log",
+      "log_sha256": "1e0f4b4db116e6eda36a25a0af0901ab6934b363ca99f9db0c0ba886bd7b0e8f"
+    },
+    {
+      "label": "focused-final",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--lib",
+        "--locked",
+        "--",
+        "serving::",
+        "server::residency::tests::serving::",
+        "server::residency::tests::recovery::",
+        "catalog::native::tests",
+        "native_git::process::tests",
+        "git_cache::tests",
+        "git_objects::tests",
+        "git_read::",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 120.624,
+      "log": "/tmp/canopy-certified-browser-focused-final.log",
+      "passed": 112,
+      "log_sha256": "cc61c30b6c2a3e49b8ccbff12c1fae43aa141c646664c306f56f355756f1cfb3"
+    },
+    {
+      "label": "library",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "--workspace",
+        "--lib",
+        "--locked",
+        "--",
+        "--test-threads=4"
+      ],
+      "exit_code": 101,
+      "seconds": 311.84,
+      "log": "/tmp/canopy-certified-browser-library.log",
+      "passed": 690,
+      "failed": 5,
+      "nested_summaries_excluded": 2,
+      "known_failures": [
+        "git_gateway::fetch::tests::reachability_stops_at_live_refs_without_scanning_other_history",
+        "object_reads::tests::byte_limited_page_advances_only_over_the_selected_prefix",
+        "object_reads::tests::duplicate_rollback_and_deletion_do_not_hide_subsequent_inserts",
+        "object_reads::tests::insertion_cursor_finds_lower_oids_and_excludes_later_publications",
+        "object_reads::tests::small_increment_uses_bounded_sql_work_after_large_history"
+      ],
+      "publication_passed": 387,
+      "log_sha256": "bcd476cb8be246ff510b91076d41426485504571c6f31670b7ac90f76bdf0fd4"
+    },
+    {
+      "label": "workspace",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "workspace::",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 45.627,
+      "log": "/tmp/canopy-certified-browser-workspace.log",
+      "passed": 3,
+      "log_sha256": "c38692f1ad948ed734afd1c87f79e1ec31c9655fece366de402df580a8a8cc4e"
+    },
+    {
+      "label": "lifecycle",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::fork::",
+        "lifecycle::cancelled_prebound_startup",
+        "lifecycle::runtime_destruction",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.359,
+      "log": "/tmp/canopy-certified-browser-lifecycle.log",
+      "passed": 2,
+      "log_sha256": "85dcf71fbe3e23af617affd0ca9822434e0198c6ddf77e2d7c2732516e6dcf28"
+    },
+    {
+      "label": "drain",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::cancelled_startup_keeps_workspace",
+        "lifecycle::dropped_handle_and_cancelled_shutdown",
+        "lifecycle::failed_drain_retains_workspace",
+        "lifecycle::startup_rejects_ignored_conditional",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.693,
+      "log": "/tmp/canopy-certified-browser-drain.log",
+      "passed": 4,
+      "log_sha256": "5b19b8343b428cccf7772157c4c9a581b8763f828d1ee6f124ec6c03b81085d1"
+    },
+    {
+      "label": "build",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "build",
+        "--locked",
+        "--bin",
+        "canopy"
+      ],
+      "exit_code": 0,
+      "seconds": 42.322,
+      "log": "/tmp/canopy-certified-browser-build.log",
+      "log_sha256": "9f43a14a9559bb08a537ffaf92b8d16a41d9d0141e9a4142233eaf63d1895798"
+    },
+    {
+      "label": "fmt",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 2.521,
+      "log": "/tmp/canopy-certified-browser-fmt.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "diff",
+      "command": [
+        "git",
+        "diff",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 0.058,
+      "log": "/tmp/canopy-certified-browser-diff.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "harness",
+      "command": [
+        "python3",
+        "-B",
+        "-m",
+        "unittest",
+        "discover",
+        "-s",
+        "scripts",
+        "-p",
+        "test_*.py"
+      ],
+      "exit_code": 0,
+      "seconds": 42.561,
+      "log": "/tmp/canopy-certified-browser-harness.log",
+      "log_sha256": "a7176485db9a703c0bd8667e57658153b91ea6ad066df99f18ad012df27541e3"
+    }
+  ],
+  "execution_complete": true,
+  "unique_workspace_cases": 704,
+  "unique_workspace_passed": 699,
+  "unique_workspace_failed": 5,
+  "sdk_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+  "sdk_manifest_pins": 5,
+  "sdk_lock_pins": 6,
+  "protected_hashes": {
+    "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "/Users/haipingfu/.codex/worktrees/packed-catalog-publication-pr/canopy/docs/archive/pr20-progress-through-8bb0ee7.md": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+  },
+  "new_families": 6,
+  "harness_cases": 96,
+  "platform": "macOS / Rust 1.98.0; Linux-only fork cases not executed locally",
+  "scope": "Certified local browser and comparison object/ancestry consumers and bounded typed edge pages. Native fixtures physically verify pack sources, then install joint catalog facts and editorial pull metadata through trusted SQL. Not live producer/publication, remote routing, cold latency, streaming or full capacity qualification.",
+  "validated_source_parent": "b1bd813a50b8b93b833d4006b20c0b90713470a2",
+  "fetched_main": "9438bb865959fb975d5349ba8b9908b461653821",
+  "draft_diagnostics": [
+    {
+      "log": "/tmp/canopy-certified-browser-check.log",
+      "exit_code": 101,
+      "reason": "Prototype compile diagnostics in constant export and test fixture OID parsing; corrected before final frozen-source qualification.",
+      "log_sha256": "c00694af162517d6d09b87b55831725694838dd0d1522d7344d6dffc7cb92e07"
+    },
+    {
+      "log": "/tmp/canopy-certified-browser-focused-draft.log",
+      "exit_code": 101,
+      "reason": "Prototype compile diagnostics in constant export and test fixture OID parsing; corrected before final frozen-source qualification.",
+      "log_sha256": "f120600673a343d08dd9aaeb61d2415c1ffd78a99a31e4df3a1a23dea3bf08b8"
+    }
+  ],
+  "prior_ci": {
+    "head": "b1bd813a50b8b93b833d4006b20c0b90713470a2",
+    "runs": [
+      37229870509,
+      37229867975
+    ],
+    "rust": "Both actual failed logs contain exactly five legacy objects reader failures; 664 server cases pass in each.",
+    "harness": "both pass",
+    "not_qualification_for_new_source": true,
+    "primary_log_sha256": "0b50b178b53e857b4a413b1bd12f1349bda30b7c1541d7f268455bada8ca914a",
+    "secondary_log_sha256": "942955d03ba3f47a316cc4ec0e33200b42f2e858dc56c0a63c31225a1f213117"
+  },
+  "checked_local_documentation_links": 96
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 228697cc..21d15093 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -3,7 +3,7 @@
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. At the preceding published ref-reader head `b89d929`, GitHub reports
+directly against `main`. At the preceding published body-reader head `b1bd813`, GitHub reports
 no merge conflicts; both Rust CI runs fail on the same five unconverted
 legacy `objects` readers and both harness checks pass. The PR is currently marked
 ready for review, but production conversion and release requirements remain
@@ -14,6 +14,59 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Certified browser objects and ancestry checkpoint
+
+Local directory, file, tag and first-parent history views now borrow one accepted
+joint catalog generation for the whole request. Object presence, kind and size
+come from certified headers; bounded canonical bodies come from the shared
+verified native pack service. The reader no longer queries legacy `objects`,
+`object_closure`, `object_edges` or `commit_parents` tables. The existing raw path,
+mode, pagination and preview behavior remains. Zero/absent revision IDs return
+missing; wrong-format IDs reject as invalid.
+
+Comparison files, patches and previews also use this snapshot for their objects
+and merge-base graph. The new typed edge page accepts at most 128 sorted parent
+IDs and returns at most 512 edges with a tuple continuation. Preferred metadata
+queries run on admitted blocking work retaining a child physical guard. The
+shared private read contract rechecks current access/owner/lease and retains
+workers after observer cancellation. Ancestry filters commit edges, consumes all
+pages and keeps the existing bounded graph budget without a native process per
+commit. Equal tips still require certified commit membership. Live pull/review/
+thread editorial metadata and ref authority remain unconverted.
+
+Six new families exercise real HTTP reads in both object formats, 32-entry tree
+and history continuation, annotated tags, raw non-UTF-8 and literal paths,
+executable files, symlinks, gitlinks, bounded/binary previews, patches, merge bases,
+cached generation isolation, access revocation, and canceled suspended-provider
+work. A native 532-parent merge verifies a relevant parent beyond the first
+512-edge page. Fixtures physically verify actual native packs and metadata;
+their joint catalog facts and editorial records are installed by trusted SQL to
+isolate consumers. They do not qualify live producer/publication or capacity.
+
+All 112 focused cases pass (35.01 seconds test runtime;
+120.624 seconds command including compilation). Warnings-denied
+workspace/all-target Clippy passes in 31.581 seconds.
+The workspace library runs 695 unique cases:
+690 pass and the same five legacy object readers fail. All
+387 publication cases pass. Nine selected portable
+workspace/lifecycle cases pass, giving 704 unique Rust
+cases, 699 passes and five failures; focused reruns and
+nested subprocess summaries are excluded from that count. Build, formatting,
+diff checks and all 96 Python harness tests pass. The driver preserves library
+exit 101. Linux-only fork cases were not executed locally.
+Commands, source fingerprint and log digests are in
+[browser evidence](evidence/serving-certified-browser-20261004.json).
+The frozen inventory has 482 source/schema/manifest files,
+including 468 Rust files. Exact SDK pins and protected original
+index/archive remain unchanged.
+
+Next priorities are certified cache hydration and the five remaining legacy
+reader failures, followed by owned HTTP/SSH/generated producers and actual
+owner-aware remote routes. Complete-history native workspaces, efficient bounded
+batch reads/cold I/O, physical owner adoption, custody archival, final DDL,
+GC/backup/restore, OS containment, native maintenance, signed completion,
+attribution and full-history/10,000-SDE capacity qualification remain mandatory.
+
 ## Certified native object body checkpoint
 
 `ServingSnapshot::body` now resolves an object through the accepted catalog and
@@ -50,8 +103,9 @@ executed locally. Commands, source fingerprint and log digests are retained in
 inventory contains 478 source/schema/manifest files, including 464 Rust files.
 Exact SDK pins and protected original index/archive remain unchanged.
 
-Browser/tree/file/history/graph consumers and remote routes still require
-conversion to this API. Streaming larger bodies, a complete graph workspace for
+At this historical body checkpoint, browser/tree/file/history/graph consumers
+and remote routes still required conversion; the newer browser checkpoint above
+converts local object and comparison ancestry consumers. Streaming larger bodies, a complete graph workspace for
 native history, persistent batch scheduling and cold-pack I/O optimization remain
 open. One private source pack is not necessarily a complete Git history workspace.
 Full producer/reader conversion, physical owner adoption, custody archival,

From 6ab78d679839fa8e5fc80002fa529ca61e799874 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 14:59:07 -0700
Subject: [PATCH 26/55] Serve native fetch through owned certified history
 workspaces

---
 crates/canopy-server/src/git_cache/mod.rs     |   7 +-
 .../src/git_cache/serving_refs.rs             |  63 ++
 .../src/git_gateway/discovery.rs              |  62 --
 crates/canopy-server/src/git_gateway/fetch.rs | 335 +---------
 .../src/git_gateway/hydration.rs              |   1 +
 crates/canopy-server/src/git_gateway/mod.rs   |  65 +-
 crates/canopy-server/src/git_gateway/ssh.rs   |  27 +-
 crates/canopy-server/src/git_objects/mod.rs   |   1 +
 crates/canopy-server/src/lib.rs               |   8 +
 .../canopy-server/src/packs/catalog/files.rs  |  40 ++
 .../src/packs/catalog/graph_spool.rs          | 198 ++++++
 .../src/packs/catalog/graph_spool/tests.rs    | 191 ++++++
 crates/canopy-server/src/packs/catalog/mod.rs |   1 +
 .../canopy-server/src/packs/catalog/native.rs |  49 ++
 .../src/packs/catalog/serving_fixture.rs      |  12 +
 .../src/packs/publication/mod.rs              |  12 +-
 .../src/packs/publication/serving.rs          |   5 +-
 .../packs/publication/serving/lifecycle.rs    |  21 +
 .../src/packs/publication/serving/session.rs  |   4 +-
 .../packs/publication/serving/session/body.rs |   6 +-
 .../publication/serving/session/edges.rs      |   4 +-
 .../publication/serving/session/reads.rs      |  27 +-
 .../packs/publication/serving/session/refs.rs |   6 +-
 .../publication/serving/session/workspace.rs  | 391 ++++++++++++
 .../src/packs/publication/staging_service.rs  |  13 +
 .../packs/publication/tests/native_capture.rs |  17 +-
 .../src/packs/publication/tests/prepare.rs    |  38 ++
 .../src/packs/publication/tests/publishing.rs |  50 +-
 .../packs/publication/tests/root_dispatch.rs  |   7 +-
 .../src/packs/publication/tests/serving.rs    |   1 +
 .../publication/tests/serving/lifecycle.rs    |  12 +
 .../publication/tests/serving/workspace.rs    | 603 ++++++++++++++++++
 .../server/residency/tests/serving/browser.rs |  67 ++
 docs/README.md                                |   2 +-
 docs/design/certified-serving-pins.md         |  54 +-
 ...serving-certified-workspaces-20261004.json | 259 ++++++++
 .../large-repository-implementation-status.md |  72 ++-
 37 files changed, 2226 insertions(+), 505 deletions(-)
 create mode 100644 crates/canopy-server/src/git_cache/serving_refs.rs
 create mode 100644 crates/canopy-server/src/packs/catalog/graph_spool.rs
 create mode 100644 crates/canopy-server/src/packs/catalog/graph_spool/tests.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/workspace.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
 create mode 100644 docs/evidence/serving-certified-workspaces-20261004.json

diff --git a/crates/canopy-server/src/git_cache/mod.rs b/crates/canopy-server/src/git_cache/mod.rs
index 947f5df3..f42d627f 100644
--- a/crates/canopy-server/src/git_cache/mod.rs
+++ b/crates/canopy-server/src/git_cache/mod.rs
@@ -23,6 +23,7 @@ pub(crate) const CACHE_PREFIX: &str = "canopy-git-";
 
 mod artifacts;
 mod cleanup;
+mod serving_refs;
 
 #[derive(Debug, thiserror::Error)]
 pub enum CacheError {
@@ -176,12 +177,6 @@ impl GitCache {
         self.root().join("repo.git")
     }
 
-    pub(crate) fn object_cache(self: &Arc<Self>) -> Arc<Self> {
-        self.objects
-            .as_ref()
-            .map_or_else(|| Arc::clone(self), Arc::clone)
-    }
-
     pub(crate) fn hydration_guard(self: &Arc<Self>) -> HydrationGuard {
         self.hydrating
             .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
diff --git a/crates/canopy-server/src/git_cache/serving_refs.rs b/crates/canopy-server/src/git_cache/serving_refs.rs
new file mode 100644
index 00000000..7d7feffb
--- /dev/null
+++ b/crates/canopy-server/src/git_cache/serving_refs.rs
@@ -0,0 +1,63 @@
+//! Count-bounded ref pages streamed into one unpublished, admitted native cache.
+use super::*;
+use crate::git_objects::ReadOwner;
+
+pub(crate) struct ServingRefsWriter {
+    output: BufWriter<CacheWriter>,
+    last: String,
+    _owner: ReadOwner,
+}
+impl GitCache {
+    pub(crate) async fn serving_refs(
+        self: &Arc<Self>,
+        owner: ReadOwner,
+    ) -> Result<ServingRefsWriter, CacheError> {
+        let cache = self.clone();
+        tokio::task::spawn_blocking(move || {
+            let mut output = BufWriter::new(cache.writer(Path::new("packed-refs"))?);
+            output.write_all(b"# pack-refs with: sorted\n")?;
+            Ok(ServingRefsWriter {
+                output,
+                last: String::new(),
+                _owner: owner,
+            })
+        })
+        .await?
+    }
+}
+impl ServingRefsWriter {
+    pub(crate) async fn append(
+        mut self,
+        page: Vec<(String, RefExpectation)>,
+    ) -> Result<Self, CacheError> {
+        if page.len() > crate::refs::REF_PAGE_SIZE {
+            return Err(CacheError::InvalidHead);
+        }
+        tokio::task::spawn_blocking(move || {
+            for (name, state) in page {
+                let Some(oid) = state.oid else {
+                    return Err(CacheError::InvalidHead);
+                };
+                if name <= self.last
+                    || !valid_ref_name(&name)
+                    || oid.is_zero()
+                    || oid.format() != self.output.get_ref().cache.object_format
+                {
+                    return Err(CacheError::InvalidHead);
+                }
+                writeln!(self.output, "{} {name}", hex::encode(oid))?;
+                self.last = name;
+            }
+            Ok(self)
+        })
+        .await?
+    }
+    pub(crate) async fn finish(mut self) -> Result<(), CacheError> {
+        tokio::task::spawn_blocking(move || {
+            self.output.flush()?;
+            self.output.get_ref().file.sync_all()?;
+            Ok(())
+        })
+        .await?
+    }
+}
diff --git a/crates/canopy-server/src/git_gateway/discovery.rs b/crates/canopy-server/src/git_gateway/discovery.rs
index 4d65fac8..3b38b46f 100644
--- a/crates/canopy-server/src/git_gateway/discovery.rs
+++ b/crates/canopy-server/src/git_gateway/discovery.rs
@@ -1,5 +1,4 @@
 use super::*;
-use std::time::Instant;
 
 pub(super) async fn is_ref_discovery(request: &GitHttpRequest) -> Result<bool, InputError> {
     if request.method == "GET" && request.path_info == "/repo.git/info/refs" {
@@ -50,67 +49,6 @@ fn ls_refs(mut bytes: &[u8]) -> bool {
     }
 }
 
-impl GitGateway {
-    pub(super) async fn discovery_cache(
-        &self,
-        snapshot: RefSnapshot,
-    ) -> Result<GitHttpBackend, GatewayError> {
-        let started = Instant::now();
-        let backend = GitHttpBackend::initialize(
-            self.scratch_root.clone(),
-            self.disk_budget.clone(),
-            &snapshot.head,
-            self.repository.object_format(),
-            self.native.clone(),
-        )
-        .await?
-        .with_nonce(self.certificate_nonce().await?);
-        let mut pending: BTreeSet<_> = snapshot
-            .refs
-            .values()
-            .filter_map(|state| state.oid)
-            .collect();
-        let mut visited = BTreeSet::new();
-        let mut stats = Hydration::default();
-        while !pending.is_empty() {
-            let ids: Vec<_> = pending.iter().take(MAX_OBJECTS).copied().collect();
-            let page = self
-                .repository
-                .selected_objects(&ids)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-            if page.is_empty() {
-                return Err(GatewayError::MalformedCache);
-            }
-            for object in page {
-                pending.remove(&object.oid);
-                visited.insert(object.oid);
-                let tag = object.kind == ObjectKind::Tag;
-                let target = self
-                    .cache_object(&backend.cache, object, &mut stats)
-                    .await?;
-                if tag {
-                    let target = target.ok_or(GatewayError::MalformedCache)?;
-                    if !visited.contains(&target) {
-                        pending.insert(target);
-                    }
-                }
-            }
-        }
-        // Native discovery checks ref target existence and peels tag chains.
-        // Commit parents and tree contents are needed only by later transfer RPCs.
-        backend.cache.store_refs(&snapshot.refs).await?;
-        tracing::debug!(
-            repository = %hex::encode(self.repository.repository_id()),
-            objects = stats.objects,
-            bytes = stats.bytes,
-            elapsed_seconds = started.elapsed().as_secs_f64(),
-            "prepared Git ref discovery"
-        );
-        Ok(backend)
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::ls_refs;
diff --git a/crates/canopy-server/src/git_gateway/fetch.rs b/crates/canopy-server/src/git_gateway/fetch.rs
index 5b5d4a69..d73dfd7b 100644
--- a/crates/canopy-server/src/git_gateway/fetch.rs
+++ b/crates/canopy-server/src/git_gateway/fetch.rs
@@ -1,10 +1,6 @@
 use super::*;
 use cellule_runtime::primitives::sql::{SqlBatch, SqlStatement, SqlValue};
 
-// Correlate each ancestor lookup so SQLite can stop at the first live ref,
-// without materializing the entire reverse graph or scanning all refs.
-const REACHABLE_WANT: &str = "WITH RECURSIVE ancestors(oid) AS (VALUES (?1) UNION SELECT e.parent FROM object_edges e JOIN ancestors a ON e.child = a.oid) SELECT g.generation, EXISTS (SELECT 1 FROM ancestors a WHERE EXISTS (SELECT 1 FROM refs r WHERE r.oid = a.oid)) FROM ref_generation g WHERE g.singleton = 1";
-
 pub(super) struct FetchRequest {
     pub(super) wants: BTreeSet<crate::ObjectId>,
     pub(super) filter: Option<String>,
@@ -104,179 +100,43 @@ fn check_filter_policy(value: &str) -> Result<(), InputError> {
 }
 
 impl GitGateway {
-    pub(super) async fn prepare_fetch(
-        &self,
-        cached: &CachedRepository,
-        request: FetchRequest,
+    /// Validate every wanted object against the chosen live refs' complete
+    /// certified closure. Native pack presence never authorizes a guessed OID.
+    pub(crate) async fn validate_wants(
+        workspace: &crate::packs::publication::NativeWorkspace,
+        wants: &BTreeSet<crate::ObjectId>,
     ) -> Result<(), GatewayError> {
-        if request.wants.is_empty() {
-            return Ok(());
-        }
-        let started = std::time::Instant::now();
-        // The shared object cache publishes loose objects atomically and
-        // coordinates duplicate OID writes. Hold the gateway lock only long
-        // enough to borrow it; slow fetches must not queue behind each other.
-        let shared = cached.backend.cache.object_cache();
-        let _hydrating = shared.hydration_guard();
-        let through = {
-            let objects = self.objects.lock().await;
-            objects
-                .as_ref()
-                .filter(|objects| Arc::ptr_eq(&objects.cache, &shared))
-                .map_or(0, |objects| objects.through)
-        };
-        if self
-            .repository
-            .object_high_water()
-            .await
-            .map_err(|error| GatewayError::Cell(Box::new(error)))?
-            .output
-            <= through
-        {
-            shared
-                .prepared
-                .lock()
-                .await
-                .extend(request.wants.iter().map(|oid| (*oid, true)));
-            return Ok(());
-        }
-        let roots: Vec<_> = request.wants.iter().copied().collect();
-        let unfiltered = request.filter.is_none();
-        if roots.iter().all(|oid| {
-            shared.prepared.try_lock().ok().is_some_and(|prepared| {
-                prepared.contains(&(*oid, true))
-                    || (request.filter.as_deref() == Some("blob:none")
-                        && prepared.contains(&(*oid, false)))
-            })
-        }) {
-            return Ok(());
-        }
-        let _selection = shared.selection.lock().await;
-        // A concurrent cold request may have completed while we waited.
-        if (unfiltered || request.filter.as_deref() == Some("blob:none"))
-            && roots.iter().all(|oid| {
-                shared.prepared.try_lock().ok().is_some_and(|prepared| {
-                    prepared.contains(&(*oid, true))
-                        || (!unfiltered && prepared.contains(&(*oid, false)))
-                })
-            })
+        if wants
+            .iter()
+            .any(|id| id.is_zero() || id.format() != workspace.object_format())
         {
-            return Ok(());
+            return Err(GatewayError::UnreachableWant);
         }
-        self.hydrate_selected(&shared, request.wants).await?;
-        // The certified Cell graph already names every reachable blob. A full
-        // fetch can hydrate those bodies during the structural walk and avoid
-        // a second native traversal over the same cold history.
-        self.hydrate_structure(&shared, &roots, unfiltered, through)
-            .await?;
-        if unfiltered || request.filter.as_deref() == Some("blob:none") {
-            shared
-                .prepared
-                .lock()
+        // Even an empty discovery/negotiation group rechecks current access.
+        if wants.is_empty() {
+            workspace
+                .contains(&[])
                 .await
-                .extend(roots.iter().map(|oid| (*oid, unfiltered)));
-            // Per-root preparation above is a coverage certificate. Physical
-            // index counts include cross-pack duplicates and cannot certify a
-            // whole-repository watermark. Durable covering packs are handled by
-            // hydrate_selected using their committed covered_through metadata.
+                .map_err(|e| GatewayError::Cell(Box::new(e)))?;
             return Ok(());
         }
-        // Use the same native filter as upload-pack. Structure is present, so
-        // tree/type filters can omit missing blobs without reading their bodies.
-        // Git conservatively includes missing blobs under size filters.
-        let mut walk = crate::git_objects::GitObjectWalk::missing(
-            &cached.backend.git_dir(),
-            roots,
-            request.filter.as_deref(),
-            &cached.backend.cache.native,
-        )?;
-        let mut stats = Hydration::default();
+        let mut ids = wants.iter().copied();
         loop {
-            let mut ids = Vec::with_capacity(MAX_OBJECTS);
-            for _ in 0..MAX_OBJECTS {
-                let Some(oid) = walk.next().await? else {
-                    break;
-                };
-                ids.push(oid);
-            }
-            if ids.is_empty() {
+            let page: Vec<_> = ids
+                .by_ref()
+                .take(crate::packs::metadata::PAGE_OBJECTS)
+                .collect();
+            if page.is_empty() {
                 break;
             }
-            self.hydrate_objects(&shared, ids, &mut stats).await?;
-        }
-        walk.finish().await?;
-        tracing::debug!(
-            repository = %hex::encode(self.repository.repository_id()),
-            objects = stats.objects,
-            bytes = stats.bytes,
-            elapsed_seconds = started.elapsed().as_secs_f64(),
-            "prepared reachable Git blobs"
-        );
-        Ok(())
-    }
-
-    pub(super) async fn fetch_cache(
-        &self,
-        wants: &BTreeSet<crate::ObjectId>,
-    ) -> Result<Arc<CachedRepository>, GatewayError> {
-        if let Some(cached) = self.current_cache().await? {
-            self.validate_wants(&cached.snapshot, wants).await?;
-            return Ok(cached);
-        }
-        let live_refs = self.cell_refs().await?;
-        self.validate_wants(&live_refs, wants).await?;
-        let mut cache = self.cache.lock().await;
-        if cache
-            .as_ref()
-            .is_none_or(|cached| cached.snapshot != live_refs)
-        {
-            *cache = None;
-            *cache = Some(Arc::new(self.build_cache(live_refs, false).await?));
-        }
-        Ok(Arc::clone(
-            cache.as_ref().ok_or(GatewayError::MalformedCache)?,
-        ))
-    }
-
-    pub(super) async fn validate_wants(
-        &self,
-        snapshot: &RefSnapshot,
-        wants: &BTreeSet<crate::ObjectId>,
-    ) -> Result<(), GatewayError> {
-        // Native reachable-want validation walks commits only. Reverse edges
-        // certified by the Cell also fence trees and blobs, including cached
-        // objects retained after a ref deletion. Generation binds every batch.
-        let ids: Vec<_> = wants.iter().collect();
-        for ids in ids.chunks(MAX_OBJECTS) {
-            let result = self
-                .repository
-                .sql
-                .query(
-                    None,
-                    SqlBatch {
-                        statements: ids
-                            .iter()
-                            .map(|oid| SqlStatement {
-                                sql: REACHABLE_WANT.into(),
-                                parameters: vec![SqlValue::Blob(oid.to_vec())],
-                            })
-                            .collect(),
-                    },
-                )
+            if workspace
+                .contains(&page)
                 .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-            for set in result.output {
-                let Some([SqlValue::Integer(generation), SqlValue::Integer(reachable)]) =
-                    set.rows.first().map(Vec::as_slice)
-                else {
-                    return Err(GatewayError::MalformedCache);
-                };
-                if *generation != snapshot.generation {
-                    return Err(GatewayError::RefSnapshotBusy);
-                }
-                if *reachable != 1 {
-                    return Err(GatewayError::UnreachableWant);
-                }
+                .map_err(|e| GatewayError::Cell(Box::new(e)))?
+                .iter()
+                .any(|present| !present)
+            {
+                return Err(GatewayError::UnreachableWant);
             }
         }
         Ok(())
@@ -329,94 +189,6 @@ impl GitGateway {
         Ok(())
     }
 
-    async fn hydrate_structure(
-        &self,
-        cache: &Arc<GitCache>,
-        roots: &[crate::ObjectId],
-        include_blobs: bool,
-        through: i64,
-    ) -> Result<(), GatewayError> {
-        let mut pending: BTreeSet<_> = roots.iter().copied().collect();
-        let mut visited = BTreeSet::new();
-        let mut stats = Hydration::default();
-        while !pending.is_empty() {
-            let ids: Vec<_> = pending.iter().take(MAX_OBJECTS).copied().collect();
-            for oid in &ids {
-                pending.remove(oid);
-                visited.insert(*oid);
-            }
-            let placeholders = vec!["?"; ids.len()].join(",");
-            let kind_filter = if include_blobs {
-                ""
-            } else {
-                "AND o.kind != 'blob'"
-            };
-            let mut after_parent = Vec::new();
-            let mut after_child = Vec::new();
-            loop {
-                // Certified edges supply only reachable structure. Page both
-                // parents and children so a large tree stays within SQL wire bounds.
-                let mut parameters: Vec<_> =
-                    ids.iter().map(|oid| SqlValue::Blob(oid.to_vec())).collect();
-                parameters.extend([
-                    SqlValue::Integer(through),
-                    SqlValue::Blob(after_parent.clone()),
-                    SqlValue::Blob(after_parent.clone()),
-                    SqlValue::Blob(after_child.clone()),
-                    SqlValue::Integer(MAX_OBJECTS as i64),
-                ]);
-                let result = self.repository.sql.query(None, SqlBatch { statements: vec![SqlStatement {
-                    sql: format!("SELECT e.parent, e.child, o.kind FROM object_edges e JOIN objects o ON o.oid = e.child JOIN objects p ON p.oid = e.parent WHERE e.parent IN ({placeholders}) AND p.sequence > ? {kind_filter} AND (e.parent > ? OR (e.parent = ? AND e.child > ?)) ORDER BY e.parent, e.child LIMIT ?"),
-                    parameters,
-                }] }).await.map_err(|error| GatewayError::Cell(Box::new(error)))?;
-                let rows = &result
-                    .output
-                    .first()
-                    .ok_or(GatewayError::MalformedCache)?
-                    .rows;
-                let mut blobs = Vec::new();
-                for row in rows {
-                    let [
-                        SqlValue::Blob(parent),
-                        SqlValue::Blob(child),
-                        SqlValue::Text(kind),
-                    ] = row.as_slice()
-                    else {
-                        return Err(GatewayError::MalformedCache);
-                    };
-                    after_parent.clone_from(parent);
-                    after_child.clone_from(child);
-                    let oid = child
-                        .as_slice()
-                        .try_into()
-                        .map_err(|_| GatewayError::MalformedCache)?;
-                    if kind == "blob" {
-                        if include_blobs && visited.insert(oid) {
-                            blobs.push(oid);
-                        }
-                    } else if !visited.contains(&oid) {
-                        pending.insert(oid);
-                    }
-                }
-                if !blobs.is_empty() {
-                    self.hydrate_objects(cache, blobs, &mut stats).await?;
-                }
-                if rows.len() < MAX_OBJECTS {
-                    break;
-                }
-            }
-            self.hydrate_objects(cache, ids, &mut stats).await?;
-        }
-        tracing::debug!(
-            repository = %hex::encode(self.repository.repository_id()),
-            objects = stats.objects,
-            bytes = stats.bytes,
-            include_blobs,
-            "prepared reachable Git structure"
-        );
-        Ok(())
-    }
-
     async fn hydrate_objects(
         &self,
         cache: &Arc<GitCache>,
@@ -447,59 +219,6 @@ impl GitGateway {
 mod tests {
     use super::*;
 
-    #[test]
-    fn reachability_stops_at_live_refs_without_scanning_other_history()
-    -> Result<(), Box<dyn std::error::Error>> {
-        use cellule_ltx::rusqlite::{Connection, StatementStatus, params};
-        let db = Connection::open_in_memory()?;
-        db.execute_batch(crate::SCHEMA)?;
-        let oid = |n: u32| {
-            let mut oid = [0; 20];
-            oid[..4].copy_from_slice(&n.to_be_bytes());
-            oid
-        };
-        db.execute_batch("BEGIN")?;
-        for n in 0..10_000 {
-            db.execute("INSERT INTO objects (oid, kind, size, digest, storage, body) VALUES (?1, 'blob', 0, zeroblob(32), 'inline', X'')", [oid(n).as_slice()])?;
-            db.execute(
-                "INSERT INTO refs (name, oid, version) VALUES (?1, ?2, 1)",
-                params![format!("refs/tags/{n}"), oid(n).as_slice()],
-            )?;
-            if n > 0 {
-                db.execute(
-                    "INSERT INTO object_edges (parent, child) VALUES (?1, ?2)",
-                    params![oid(n).as_slice(), oid(n - 1).as_slice()],
-                )?;
-            }
-        }
-        db.execute_batch("COMMIT")?;
-        // A directly referenced object has thousands of reverse ancestors;
-        // removing its ref makes the next ancestor the nearest live root.
-        for direct_ref in [true, false] {
-            if !direct_ref {
-                db.execute("DELETE FROM refs WHERE name = 'refs/tags/0'", [])?;
-            }
-            let mut query = db.prepare(REACHABLE_WANT)?;
-            assert_eq!(
-                query.query_row([oid(0).as_slice()], |row| row.get::<_, i64>(1))?,
-                1
-            );
-            assert!(query.get_status(StatementStatus::VmStep) < 500);
-            assert_eq!(query.get_status(StatementStatus::FullscanStep), 0);
-        }
-        db.execute("DELETE FROM refs", [])?;
-        let mut query = db.prepare(REACHABLE_WANT)?;
-        assert_eq!(
-            query.query_row([oid(0).as_slice()], |row| row.get::<_, i64>(1))?,
-            0
-        );
-        assert_eq!(
-            query.query_row([oid(10_000).as_slice()], |row| row.get::<_, i64>(1))?,
-            0
-        );
-        Ok(())
-    }
-
     fn packet(line: &str) -> Vec<u8> {
         format!("{:04x}{line}", line.len() + 4).into_bytes()
     }
diff --git a/crates/canopy-server/src/git_gateway/hydration.rs b/crates/canopy-server/src/git_gateway/hydration.rs
index 6e646be1..1d93dc19 100644
--- a/crates/canopy-server/src/git_gateway/hydration.rs
+++ b/crates/canopy-server/src/git_gateway/hydration.rs
@@ -42,6 +42,7 @@ impl GitGateway {
     pub(super) async fn hydrate(&self, shared: &mut CachedObjects) -> Result<(), GatewayError> {
         let started = Instant::now();
         let cache = &shared.cache;
+        let _hydration = cache.hydration_guard();
         let _selection = cache.selection.lock().await;
         let cursor = &mut shared.through;
         let from_sequence = *cursor;
diff --git a/crates/canopy-server/src/git_gateway/mod.rs b/crates/canopy-server/src/git_gateway/mod.rs
index ee395661..76332732 100644
--- a/crates/canopy-server/src/git_gateway/mod.rs
+++ b/crates/canopy-server/src/git_gateway/mod.rs
@@ -250,41 +250,43 @@ impl GitGateway {
             .receive(request, Some(MAX_FETCH_REQUEST_BYTES), admission)
             .await?;
         let request = self.decode(request, Some(MAX_FETCH_REQUEST_BYTES)).await?;
+        let snapshot = self
+            .repository
+            .serving_snapshot(actor)
+            .await
+            .map_err(|e| GatewayError::Cell(Box::new(e)))?;
         let capabilities = request.protocol_v2
             && request.method == "GET"
             && request.path_info == "/repo.git/info/refs"
             && url::form_urlencoded::parse(request.query.as_bytes())
                 .eq([("service".into(), "git-upload-pack".into())]);
         let response = if capabilities {
-            // Git v2 discovery advertises capabilities, not refs or objects.
-            // Native Git still owns the wire response and capability policy.
-            let head = self
-                .repository
-                .default_branch(None)
+            let head = snapshot
+                .resolve_ref(None)
                 .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
+                .map_err(|e| GatewayError::Cell(Box::new(e)))?;
             let backend = GitHttpBackend::initialize(
                 self.scratch_root.clone(),
                 self.disk_budget.clone(),
-                &head.output.reference,
+                &head.reference,
                 self.repository.object_format(),
                 self.native.clone(),
             )
             .await?
             .with_nonce(self.certificate_nonce().await?);
-            backend.stream(request, ()).await?
-        } else if discovery::is_ref_discovery(&request).await? {
-            if let Some(cached) = self.current_cache().await? {
-                cached.backend.stream(request, Arc::clone(&cached)).await?
-            } else {
-                let backend = self.discovery_cache(self.cell_refs().await?).await?;
-                backend.stream(request, ()).await?
-            }
+            backend.stream(request, snapshot).await?
         } else {
+            let discovery = discovery::is_ref_discovery(&request).await?;
             let fetch = fetch::FetchRequest::read(&request).await?;
-            let cached = self.fetch_cache(&fetch.wants).await?;
-            self.prepare_fetch(&cached, fetch).await?;
-            cached.backend.stream(request, Arc::clone(&cached)).await?
+            let workspace = snapshot
+                .ref_workspace(crate::packs::publication::WorkspaceLimits::default())
+                .await
+                .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+            Self::validate_wants(&workspace, &fetch.wants).await?;
+            tracing::debug!(discovery,filter=?fetch.filter,generation=workspace.fact().generation,
+                "prepared certified Git transport");
+            let backend = workspace.backend(self.certificate_nonce().await?);
+            backend.stream(request, workspace.read_owner()).await?
         };
         Ok(GitHttpResponse {
             status: response.status,
@@ -293,33 +295,6 @@ impl GitGateway {
         })
     }
 
-    async fn current_cache(&self) -> Result<Option<Arc<CachedRepository>>, GatewayError> {
-        // Hydration holds this mutex across storage I/O. Discovery must stay
-        // independent, so inspect only a ready snapshot and release before SQL.
-        let cached = self.cache.try_lock().ok().and_then(|cache| cache.clone());
-        let Some(cached) = cached else {
-            return Ok(None);
-        };
-        // Ref mutations, deletion/recreation and HEAD changes advance the same
-        // generation transactionally. Matching it avoids scanning every ref page.
-        let head = self
-            .repository
-            .default_branch(None)
-            .await
-            .map_err(|error| GatewayError::Cell(Box::new(error)))?
-            .output;
-        let current =
-            cached.snapshot.generation == head.generation && cached.snapshot.head == head.reference;
-        if current {
-            tracing::debug!(
-                repository = %hex::encode(self.repository.repository_id()),
-                generation = head.generation,
-                "reused Git ref snapshot"
-            );
-        }
-        Ok(current.then_some(cached))
-    }
-
     async fn receive(
         &self,
         request: GitHttpRequest<Body>,
diff --git a/crates/canopy-server/src/git_gateway/ssh.rs b/crates/canopy-server/src/git_gateway/ssh.rs
index e7160455..217b9c30 100644
--- a/crates/canopy-server/src/git_gateway/ssh.rs
+++ b/crates/canopy-server/src/git_gateway/ssh.rs
@@ -20,14 +20,20 @@ impl GitGateway {
         if self.access_level(actor).await?.is_none() {
             return Err(GatewayError::Unauthorized);
         }
-        // Advertisements need structure and ref/tag targets, not ordinary blobs.
-        // Retain one ref snapshot, then hydrate each request before forwarding
-        // its wants; native Git can begin object traversal as soon as it reads them.
-        let cached = self.fetch_cache(&BTreeSet::new()).await?;
-        let mut command = cached.backend.transport_command()?;
+        let snapshot = self
+            .repository
+            .serving_snapshot(ReadIdentity::Account(actor))
+            .await
+            .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+        let workspace = snapshot
+            .ref_workspace(crate::packs::publication::WorkspaceLimits::default())
+            .await
+            .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+        let backend = workspace.backend(self.certificate_nonce().await?);
+        let mut command = backend.transport_command()?;
         command
             .arg("upload-pack")
-            .arg(cached.backend.git_dir())
+            .arg(backend.git_dir())
             .stdin(Stdio::piped())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
@@ -36,9 +42,8 @@ impl GitGateway {
         }
         let mut process = GitProcess::spawn(
             command,
-            (Arc::clone(&cached), admission),
-            cached
-                .backend
+            (workspace.read_owner(), admission),
+            backend
                 .cache
                 .native
                 .try_admit(crate::native_resources::NativeWork::Pack)?,
@@ -68,9 +73,7 @@ impl GitGateway {
                     };
                     remaining -= group.len();
                     let request = fetch::FetchRequest::parse(&group)?;
-                    self.validate_wants(&cached.snapshot, &request.wants)
-                        .await?;
-                    self.prepare_fetch(&cached, request).await?;
+                    Self::validate_wants(&workspace, &request.wants).await?;
                     stdin.write_all(&group).await?;
                     stdin.flush().await?;
                     if !protocol_v2 {
diff --git a/crates/canopy-server/src/git_objects/mod.rs b/crates/canopy-server/src/git_objects/mod.rs
index e2980e69..fe593e9f 100644
--- a/crates/canopy-server/src/git_objects/mod.rs
+++ b/crates/canopy-server/src/git_objects/mod.rs
@@ -125,6 +125,7 @@ pub(crate) struct GitObjectWalk {
 }
 
 impl GitObjectWalk {
+    #[cfg(test)]
     pub(crate) fn missing(
         git_dir: &Path,
         included: Vec<crate::ObjectId>,
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 287cfa61..88c3bbb9 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -195,15 +195,20 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("pack_store.rs"));
                 source.update(include_bytes!("git_objects/mod.rs"));
                 source.update(include_bytes!("git_cache/artifacts.rs"));
+                source.update(include_bytes!("git_cache/serving_refs.rs"));
                 source.update(include_bytes!("git_cache/cleanup.rs"));
                 source.update(include_bytes!("git_cache/mod.rs"));
                 source.update(include_bytes!("packs/catalog/native.rs"));
+                source.update(include_bytes!("packs/catalog/graph_spool.rs"));
                 source.update(include_bytes!("packs/catalog/files.rs"));
                 source.update(include_bytes!("native_resources.rs"));
                 source.update(include_bytes!("native_git.rs"));
                 source.update(include_bytes!("native_git/process.rs"));
                 source.update(include_bytes!("native_git/process/fence.rs"));
                 source.update(include_bytes!("git_gateway/mod.rs"));
+                source.update(include_bytes!("git_gateway/fetch.rs"));
+                source.update(include_bytes!("git_gateway/discovery.rs"));
+                source.update(include_bytes!("git_gateway/ssh.rs"));
                 source.update(include_bytes!("git_gateway/preflight.rs"));
                 source.update(include_bytes!("git_gateway/preflight/retention.rs"));
                 source.update(include_bytes!("git_gateway/branch_policy.rs"));
@@ -308,6 +313,9 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/serving/session/reads.rs"));
                 source.update(include_bytes!("packs/publication/serving/session/body.rs"));
                 source.update(include_bytes!("packs/publication/serving/session/edges.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/serving/session/workspace.rs"
+                ));
                 source.update(include_bytes!("git_read/mod.rs"));
                 source.update(include_bytes!("git_read/browse.rs"));
                 source.update(include_bytes!("git_read/graph.rs"));
diff --git a/crates/canopy-server/src/packs/catalog/files.rs b/crates/canopy-server/src/packs/catalog/files.rs
index 834472ee..8b25b9c4 100644
--- a/crates/canopy-server/src/packs/catalog/files.rs
+++ b/crates/canopy-server/src/packs/catalog/files.rs
@@ -147,6 +147,46 @@ impl CatalogFiles {
         ));
         self
     }
+    pub(in crate::packs) async fn workspace(
+        &self,
+        owner: crate::git_objects::ReadOwner,
+        cleanup: crate::git_objects::ReadOwner,
+        head: String,
+    ) -> Result<Arc<crate::git_cache::GitCache>, super::native::NativeReadError> {
+        self.native
+            .as_ref()
+            .ok_or(super::native::NativeReadError::Unavailable)?
+            .workspace(owner, cleanup, head)
+            .await
+    }
+    pub(in crate::packs) async fn install_workspace(
+        &self,
+        cache: Arc<crate::git_cache::GitCache>,
+        source: super::super::sources::NativePackDescriptor,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Result<(), super::native::NativeReadError> {
+        self.native
+            .as_ref()
+            .ok_or(super::native::NativeReadError::Unavailable)?
+            .install(cache, source, owner)
+            .await
+    }
+    pub(in crate::packs) async fn graph_spool(
+        &self,
+        maximum: u64,
+        cache_kib: u32,
+        owner: crate::git_objects::ReadOwner,
+        cleanup: crate::git_objects::ReadOwner,
+    ) -> Result<Arc<Mutex<super::graph_spool::GraphSpool>>, MetadataError> {
+        let (root, budget) = (self.root.clone(), self.budget.clone());
+        tokio::task::spawn_blocking(move || {
+            let _owner = owner;
+            Ok(Arc::new(Mutex::new(super::graph_spool::GraphSpool::new(
+                root, budget, maximum, cache_kib, cleanup,
+            )?)))
+        })
+        .await?
+    }
     pub(in crate::packs) async fn body(
         &self,
         object: ResolvedObject,
diff --git a/crates/canopy-server/src/packs/catalog/graph_spool.rs b/crates/canopy-server/src/packs/catalog/graph_spool.rs
new file mode 100644
index 00000000..da9cad15
--- /dev/null
+++ b/crates/canopy-server/src/packs/catalog/graph_spool.rs
@@ -0,0 +1,198 @@
+//! Disposable, admitted graph frontier and source deduplication. No repository
+//! SQL rows, history-sized Rust sets, or authority are stored here.
+use crate::git_objects::ReadOwner;
+use crate::packs::{
+    metadata::{AdmittedFile, MetadataError, growth},
+    sources::NativePackDescriptor,
+};
+use crate::{ObjectId, ObjectKind};
+use cellule_ltx::DiskBudget;
+use rusqlite::{Connection, OptionalExtension, params};
+use std::sync::Arc;
+
+type PackBinding = (Vec<u8>, Vec<u8>, u64, u64, u32);
+
+pub(in crate::packs) struct GraphSpool {
+    db: Connection,
+    file: AdmittedFile,
+    maximum: u64,
+    // Drops after SQLite, journal and file cleanup, including blocking jobs.
+    _owner: ReadOwner,
+}
+impl GraphSpool {
+    pub(in crate::packs) fn new(
+        root: Arc<tempfile::TempDir>,
+        budget: DiskBudget,
+        maximum: u64,
+        cache_kib: u32,
+        owner: ReadOwner,
+    ) -> Result<Self, MetadataError> {
+        let reservation = growth::reserve(&budget, maximum)?;
+        let mut file = AdmittedFile::new(
+            tempfile::Builder::new()
+                .prefix("canopy-graph-")
+                .tempfile_in(root.path())?,
+            reservation,
+        );
+        file.retain_workspace(root);
+        let mut db = Connection::open(file.file().path())?;
+        db.execute_batch("PRAGMA page_size=4096; PRAGMA journal_mode=DELETE; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON; PRAGMA trusted_schema=OFF; PRAGMA mmap_size=0; PRAGMA temp_store=MEMORY;")?;
+        db.pragma_update(None, "cache_size", -(i64::from(cache_kib)))?;
+        growth::configure(&db, &mut file)?;
+        growth::transaction(&mut db, &mut file, maximum, |tx| {
+            tx.execute_batch("CREATE TABLE nodes(oid BLOB PRIMARY KEY,kind TEXT,done INTEGER NOT NULL DEFAULT 0 CHECK(done IN (0,1))) WITHOUT ROWID; CREATE INDEX pending ON nodes(done,oid); CREATE TABLE packs(checksum BLOB PRIMARY KEY,pack BLOB NOT NULL,idx BLOB NOT NULL,pack_bytes INTEGER NOT NULL,idx_bytes INTEGER NOT NULL,objects INTEGER NOT NULL) WITHOUT ROWID;")?;
+            Ok::<_, MetadataError>(())
+        })?;
+        Ok(Self {
+            db,
+            file,
+            maximum,
+            _owner: owner,
+        })
+    }
+    pub(in crate::packs) fn add(
+        &mut self,
+        ids: &[(ObjectId, Option<ObjectKind>)],
+    ) -> Result<(), MetadataError> {
+        if ids.len() > 512 {
+            return Err(MetadataError::Limit);
+        }
+        growth::transaction(&mut self.db, &mut self.file, self.maximum, |tx| {
+            let mut insert = tx.prepare_cached(
+                "INSERT INTO nodes(oid,kind) VALUES(?1,?2) ON CONFLICT DO NOTHING",
+            )?;
+            let mut read = tx.prepare_cached("SELECT kind FROM nodes WHERE oid=?1")?;
+            let mut update =
+                tx.prepare_cached("UPDATE nodes SET kind=?2 WHERE oid=?1 AND kind IS NULL")?;
+            for (id, kind) in ids {
+                insert.execute(params![id.as_ref(), kind.map(ObjectKind::git_name)])?;
+                if let Some(kind) = kind {
+                    let existing: Option<String> = read.query_row([id.as_ref()], |r| r.get(0))?;
+                    if existing
+                        .as_deref()
+                        .is_some_and(|old| old != kind.git_name())
+                    {
+                        return Err(MetadataError::Integrity);
+                    }
+                    update.execute(params![id.as_ref(), kind.git_name()])?;
+                }
+            }
+            Ok::<_, MetadataError>(())
+        })
+    }
+    pub(in crate::packs) fn pending(
+        &self,
+    ) -> Result<Vec<(ObjectId, Option<ObjectKind>)>, MetadataError> {
+        let mut query = self
+            .db
+            .prepare_cached("SELECT oid,kind FROM nodes WHERE done=0 ORDER BY oid LIMIT 128")?;
+        query
+            .query_map([], |row| {
+                let id: Vec<u8> = row.get(0)?;
+                let name: Option<String> = row.get(1)?;
+                let kind = name
+                    .as_deref()
+                    .map(|name| match name {
+                        "blob" => Ok(ObjectKind::Blob),
+                        "tree" => Ok(ObjectKind::Tree),
+                        "commit" => Ok(ObjectKind::Commit),
+                        "tag" => Ok(ObjectKind::Tag),
+                        _ => Err(rusqlite::Error::InvalidQuery),
+                    })
+                    .transpose()?;
+                Ok((
+                    ObjectId::try_from(id).map_err(|_| rusqlite::Error::InvalidQuery)?,
+                    kind,
+                ))
+            })?
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
+    pub(in crate::packs) fn done(
+        &mut self,
+        ids: &[(ObjectId, Option<ObjectKind>)],
+    ) -> Result<(), MetadataError> {
+        growth::transaction(&mut self.db, &mut self.file, self.maximum, |tx| {
+            let mut update =
+                tx.prepare_cached("UPDATE nodes SET done=1 WHERE oid=?1 AND kind IS NOT NULL")?;
+            for (id, _) in ids {
+                if update.execute([id.as_ref()])? != 1 {
+                    return Err(MetadataError::Integrity);
+                }
+            }
+            Ok::<_, MetadataError>(())
+        })
+    }
+    pub(in crate::packs) fn pack_seen(
+        &self,
+        p: NativePackDescriptor,
+    ) -> Result<bool, MetadataError> {
+        let old: Option<PackBinding> = self
+            .db
+            .query_row(
+                "SELECT pack,idx,pack_bytes,idx_bytes,objects FROM packs WHERE checksum=?1",
+                [p.git_checksum.as_ref()],
+                |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?, r.get(4)?)),
+            )
+            .optional()?;
+        let Some((pack, idx, pack_bytes, idx_bytes, objects)) = old else {
+            return Ok(false);
+        };
+        if pack != p.pack.digest
+            || idx != p.index.digest
+            || pack_bytes != p.pack.size
+            || idx_bytes != p.index.size
+            || objects != p.object_count
+        {
+            return Err(MetadataError::IdentityConflict);
+        }
+        Ok(true)
+    }
+    pub(in crate::packs) fn imported(
+        &mut self,
+        p: NativePackDescriptor,
+    ) -> Result<(), MetadataError> {
+        growth::transaction(&mut self.db, &mut self.file, self.maximum, |tx| {
+            tx.execute(
+                "INSERT INTO packs VALUES(?1,?2,?3,?4,?5,?6)",
+                params![
+                    p.git_checksum.as_ref(),
+                    p.pack.digest.as_slice(),
+                    p.index.digest.as_slice(),
+                    p.pack.size,
+                    p.index.size,
+                    p.object_count
+                ],
+            )?;
+            Ok::<_, MetadataError>(())
+        })
+    }
+    pub(in crate::packs) fn contains(&self, ids: &[ObjectId]) -> Result<Vec<bool>, MetadataError> {
+        let mut q = self
+            .db
+            .prepare_cached("SELECT done FROM nodes WHERE oid=?1")?;
+        ids.iter()
+            .map(|id| {
+                Ok(q.query_row([id.as_ref()], |r| r.get::<_, bool>(0))
+                    .optional()?
+                    .unwrap_or(false))
+            })
+            .collect()
+    }
+    #[cfg(test)]
+    fn counts(&self) -> Result<(u64, u64), MetadataError> {
+        Ok((
+            self.db
+                .query_row("SELECT count(*) FROM nodes WHERE done=1", [], |r| r.get(0))?,
+            self.db
+                .query_row("SELECT count(*) FROM packs", [], |r| r.get(0))?,
+        ))
+    }
+    #[cfg(test)]
+    fn path(&self) -> &std::path::Path {
+        self.file.file().path()
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/canopy-server/src/packs/catalog/graph_spool/tests.rs b/crates/canopy-server/src/packs/catalog/graph_spool/tests.rs
new file mode 100644
index 00000000..bbe5e6e4
--- /dev/null
+++ b/crates/canopy-server/src/packs/catalog/graph_spool/tests.rs
@@ -0,0 +1,191 @@
+use super::*;
+use crate::ObjectFormat;
+use canopy_object_storage::artifact::ArtifactDescriptor;
+type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error>>;
+
+fn id(format: ObjectFormat, n: u64) -> ObjectId {
+    let mut bytes = vec![0; format.bytes()];
+    bytes[format.bytes() - 8..].copy_from_slice(&n.to_be_bytes());
+    ObjectId::try_from(bytes).unwrap()
+}
+fn spool(budget: &DiskBudget, maximum: u64) -> Result<GraphSpool> {
+    Ok(GraphSpool::new(
+        Arc::new(tempfile::TempDir::new()?),
+        budget.clone(),
+        maximum,
+        16,
+        Arc::new(()),
+    )?)
+}
+
+#[test]
+fn frontier_is_indexed_paged_deduplicated_and_only_complete_members_are_visible() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let budget = DiskBudget::new(3 << 20);
+        let mut s = spool(&budget, 1 << 20)?;
+        let path = s.path().to_owned();
+        let ids: Vec<_> = (1..=2500)
+            .map(|n| (id(format, n), Some(ObjectKind::Blob)))
+            .collect();
+        for page in ids.chunks(512).rev() {
+            s.add(page)?;
+            s.add(page)?;
+        }
+        assert!(budget.used() > growth::INITIAL_BYTES * 3);
+        assert!(budget.used() < budget.capacity());
+        let plan: String = s.db.query_row(
+            "EXPLAIN QUERY PLAN SELECT oid,kind FROM nodes WHERE done=0 ORDER BY oid LIMIT 128",
+            [],
+            |r| r.get(3),
+        )?;
+        assert!(plan.contains("pending"), "{plan}");
+        assert!(!plan.contains("TEMP"), "{plan}");
+        let mut completed = 0;
+        loop {
+            let page = s.pending()?;
+            if page.is_empty() {
+                break;
+            }
+            assert!(page.len() <= 128);
+            assert!(page.windows(2).all(|p| p[0].0 < p[1].0));
+            assert_eq!(page[0].0, id(format, completed + 1));
+            let keys: Vec<_> = page.iter().map(|(id, _)| *id).collect();
+            assert!(s.contains(&keys)?.iter().all(|present| !present));
+            s.done(&page)?;
+            assert!(s.contains(&keys)?.iter().all(|present| *present));
+            completed += page.len() as u64;
+        }
+        assert_eq!(completed, 2500);
+        assert_eq!(s.counts()?, (2500, 0));
+        assert_eq!(
+            s.contains(&[id(format, 2), id(format, 2501), id(format, 1)])?,
+            [true, false, true]
+        );
+        {
+            use rusqlite::StatementStatus;
+            let mut lookup = s.db.prepare_cached("SELECT done FROM nodes WHERE oid=?1")?;
+            lookup.reset_status(StatementStatus::VmStep);
+            assert!(lookup.query_row([id(format, 1).as_ref()], |r| r.get::<_, bool>(0))?);
+            assert!(lookup.get_status(StatementStatus::VmStep) < 50);
+            assert_eq!(lookup.get_status(StatementStatus::FullscanStep), 0);
+        }
+        drop(s);
+        assert!(!path.exists());
+        assert_eq!(budget.used(), 0);
+    }
+    Ok(())
+}
+
+#[test]
+fn kind_conflict_and_incomplete_done_roll_back_the_entire_batch() -> Result {
+    let budget = DiskBudget::new(3 << 20);
+    let mut s = spool(&budget, 1 << 20)?;
+    let (a, b, c) = (
+        id(ObjectFormat::Sha256, 1),
+        id(ObjectFormat::Sha256, 2),
+        id(ObjectFormat::Sha256, 3),
+    );
+    s.add(&[(a, None), (b, Some(ObjectKind::Tree))])?;
+    assert!(matches!(
+        s.add(&[(c, Some(ObjectKind::Blob)), (b, Some(ObjectKind::Commit))]),
+        Err(MetadataError::Integrity)
+    ));
+    assert_eq!(s.pending()?, [(a, None), (b, Some(ObjectKind::Tree))]);
+    assert!(matches!(
+        s.done(&[(b, Some(ObjectKind::Tree)), (a, None)]),
+        Err(MetadataError::Integrity)
+    ));
+    assert_eq!(s.contains(&[a, b, c])?, [false, false, false]);
+    s.add(&[(a, Some(ObjectKind::Commit))])?;
+    s.done(&[(a, None), (b, None)])?;
+    assert_eq!(s.counts()?, (2, 0));
+    Ok(())
+}
+
+#[test]
+fn failed_growth_retains_prior_membership_without_a_partial_frontier() -> Result {
+    let budget = DiskBudget::new(growth::INITIAL_BYTES * 3);
+    let mut s = spool(&budget, 1 << 20)?;
+    let initial = id(ObjectFormat::Sha256, 1);
+    s.add(&[(initial, Some(ObjectKind::Commit))])?;
+    s.done(&[(initial, None)])?;
+    let mut accepted = 0;
+    loop {
+        let page: Vec<_> = (0..512)
+            .map(|n| {
+                (
+                    id(ObjectFormat::Sha256, accepted + n + 2),
+                    Some(ObjectKind::Blob),
+                )
+            })
+            .collect();
+        match s.add(&page) {
+            Ok(()) => accepted += 512,
+            Err(MetadataError::Budget(_)) => {
+                let count: u64 =
+                    s.db.query_row("SELECT count(*) FROM nodes", [], |r| r.get(0))?;
+                assert_eq!(count, accepted + 1);
+                assert!(s.db.is_autocommit());
+                assert_eq!(
+                    s.contains(&[initial, page[0].0, page[511].0])?,
+                    [true, false, false]
+                );
+                break;
+            }
+            Err(e) => return Err(e.into()),
+        }
+        assert!(accepted < 10_000);
+    }
+    assert_eq!(budget.used(), growth::INITIAL_BYTES * 3);
+    drop(s);
+    assert_eq!(budget.used(), 0);
+    let denied = DiskBudget::new(growth::INITIAL_BYTES * 3 - 1);
+    assert!(spool(&denied, 1 << 20).is_err());
+    assert_eq!(denied.used(), 0);
+    Ok(())
+}
+
+#[test]
+fn physical_input_dedup_ignores_namespace_but_rejects_conflicting_bindings() -> Result {
+    let budget = DiskBudget::new(3 << 20);
+    let mut s = spool(&budget, 1 << 20)?;
+    let p = NativePackDescriptor {
+        repository: [1; 16],
+        operation: [2; 16],
+        format: ObjectFormat::Sha1,
+        git_checksum: id(ObjectFormat::Sha1, 1),
+        object_count: 1,
+        pack: ArtifactDescriptor {
+            size: 100,
+            digest: [3; 32],
+            manifest_digest: [4; 32],
+        },
+        index: ArtifactDescriptor {
+            size: 1100,
+            digest: [5; 32],
+            manifest_digest: [6; 32],
+        },
+    };
+    assert!(!s.pack_seen(p)?);
+    s.imported(p)?;
+    let mut other = p;
+    other.operation = [7; 16];
+    other.pack.manifest_digest = [8; 32];
+    assert!(s.pack_seen(other)?);
+    for mutation in 0..5 {
+        let mut conflict = other;
+        match mutation {
+            0 => conflict.pack.digest[0] ^= 1,
+            1 => conflict.index.digest[0] ^= 1,
+            2 => conflict.pack.size += 1,
+            3 => conflict.index.size += 1,
+            _ => conflict.object_count += 1,
+        }
+        assert!(matches!(
+            s.pack_seen(conflict),
+            Err(MetadataError::IdentityConflict)
+        ));
+    }
+    assert_eq!(s.counts()?, (0, 1));
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/catalog/mod.rs b/crates/canopy-server/src/packs/catalog/mod.rs
index 96baf726..5d4904aa 100644
--- a/crates/canopy-server/src/packs/catalog/mod.rs
+++ b/crates/canopy-server/src/packs/catalog/mod.rs
@@ -16,6 +16,7 @@ use canopy_object_storage::artifact::{
 use std::sync::Arc;
 
 mod codec;
+pub(in crate::packs) mod graph_spool;
 mod native;
 pub use native::{NativeFileStats, NativeReadError};
 mod files;
diff --git a/crates/canopy-server/src/packs/catalog/native.rs b/crates/canopy-server/src/packs/catalog/native.rs
index c5dd708a..d231503d 100644
--- a/crates/canopy-server/src/packs/catalog/native.rs
+++ b/crates/canopy-server/src/packs/catalog/native.rs
@@ -219,6 +219,55 @@ impl NativeFiles {
         }
         Ok(file)
     }
+    pub(super) async fn workspace(
+        &self,
+        owner: ReadOwner,
+        cleanup: ReadOwner,
+        head: String,
+    ) -> Result<Arc<GitCache>, NativeReadError> {
+        let admission = self.admit(owner.clone(), 4096).await?;
+        let lifetime: ReadOwner = Arc::new((cleanup, admission));
+        Ok(GitCache::create_owned(
+            self.root.path().to_owned(),
+            self.budget.clone(),
+            &head,
+            self.format,
+            None,
+            self.native.clone(),
+            CacheOwnership {
+                work: Arc::new((owner, lifetime.clone())),
+                cleanup: Some(lifetime),
+            },
+        )
+        .await?)
+    }
+    pub(super) async fn install(
+        &self,
+        cache: Arc<GitCache>,
+        descriptor: NativePackDescriptor,
+        owner: ReadOwner,
+    ) -> Result<(), NativeReadError> {
+        cache
+            .download_native_owned(&self.store, descriptor, owner.clone())
+            .await?;
+        let claim = self
+            .native
+            .try_admit(crate::native_resources::NativeWork::Read)
+            .map_err(ObjectReadError::from)?;
+        tokio::task::spawn_blocking(move || {
+            let (_owner, _claim) = (owner, claim);
+            let pack = cache.git_dir().join(format!(
+                "objects/pack/pack-{}.pack",
+                hex::encode(descriptor.git_checksum)
+            ));
+            descriptor.verify_files(&pack, &pack.with_extension("idx"))?;
+            Ok::<_, IndexError>(())
+        })
+        .await??;
+        self.downloads
+            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        Ok(())
+    }
     pub(super) async fn body(
         &self,
         object: ResolvedObject,
diff --git a/crates/canopy-server/src/packs/catalog/serving_fixture.rs b/crates/canopy-server/src/packs/catalog/serving_fixture.rs
index f8263f79..c7134f6f 100644
--- a/crates/canopy-server/src/packs/catalog/serving_fixture.rs
+++ b/crates/canopy-server/src/packs/catalog/serving_fixture.rs
@@ -273,3 +273,15 @@ pub(crate) async fn prepare(
         large,
     })
 }
+
+/// Managed test-only Git invocation shared by native serving and HTTP fixtures.
+/// Production commands use the admitted native service and physical owners.
+pub(crate) async fn run_git(
+    path: &std::path::Path,
+    args: &[&str],
+    input: Option<Vec<u8>>,
+) -> Result<Vec<u8>> {
+    git(path, args, input)
+        .await
+        .map_err(|error| error.to_string().into())
+}
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index cee8da46..ff422d05 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -17,13 +17,13 @@ use cellule_runtime::{
 mod serving;
 pub use serving::{
     AcquireServingPin, AcquireServingRequest, CheckServingPin, MAX_EDGE_PARENTS,
-    MAX_SERVING_GENERATIONS, MAX_SERVING_OWNERS, MAX_SERVING_PINS, ReadyServingCommand,
-    ReadyServingRelease, ReleaseServingPin, RenewServingPin, RenewServingRequest,
-    ResolvedServingRef, SelectServingGeneration, ServingCheck, ServingContext, ServingDenial,
-    ServingDrainObserver, ServingDrainProof, ServingEdgePage, ServingLease, ServingOwner,
-    ServingOwnerError, ServingOwnerPhase, ServingOwnerStats, ServingPin, ServingPool,
+    MAX_SERVING_GENERATIONS, MAX_SERVING_OWNERS, MAX_SERVING_PINS, NativeWorkspace,
+    ReadyServingCommand, ReadyServingRelease, ReleaseServingPin, RenewServingPin,
+    RenewServingRequest, ResolvedServingRef, SelectServingGeneration, ServingCheck, ServingContext,
+    ServingDenial, ServingDrainObserver, ServingDrainProof, ServingEdgePage, ServingLease,
+    ServingOwner, ServingOwnerError, ServingOwnerPhase, ServingOwnerStats, ServingPin, ServingPool,
     ServingPoolLimits, ServingReadBudget, ServingReadError, ServingReleaseReply, ServingReply,
-    ServingSelection, ServingSnapshot, ServingToken,
+    ServingSelection, ServingSnapshot, ServingToken, WorkspaceLimits, WorkspaceStats,
 };
 mod owner;
 pub(crate) mod registry;
diff --git a/crates/canopy-server/src/packs/publication/serving.rs b/crates/canopy-server/src/packs/publication/serving.rs
index a4d4abd7..0a524ae9 100644
--- a/crates/canopy-server/src/packs/publication/serving.rs
+++ b/crates/canopy-server/src/packs/publication/serving.rs
@@ -20,8 +20,9 @@ pub use commands::{
     AcquireServingPin, CheckServingPin, ReleaseServingPin, RenewServingPin, SelectServingGeneration,
 };
 pub use session::{
-    MAX_EDGE_PARENTS, ReadyServingRelease, ResolvedServingRef, ServingContext, ServingEdgePage,
-    ServingPin, ServingReadBudget, ServingReadError,
+    MAX_EDGE_PARENTS, NativeWorkspace, ReadyServingRelease, ResolvedServingRef, ServingContext,
+    ServingEdgePage, ServingPin, ServingReadBudget, ServingReadError, WorkspaceLimits,
+    WorkspaceStats,
 };
 
 pub const MAX_SERVING_PINS: u64 = 4096;
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
index 42d948e6..662f26d7 100644
--- a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -116,6 +116,27 @@ pub struct ServingSnapshot {
     _borrow: Arc<Borrow>,
 }
 impl ServingSnapshot {
+    /// Build a complete forward closure from certified roots. Callers choosing
+    /// fetch roots must independently bind them to this snapshot's live refs.
+    pub async fn workspace(
+        &self,
+        roots: &[crate::ObjectId],
+        limits: WorkspaceLimits,
+    ) -> Result<NativeWorkspace, ServingReadError> {
+        self.pin
+            .workspace(self.actor.clone(), Some(roots), limits, self.clone())
+            .await
+    }
+    /// Build native refs and their exact forward closure from this accepted joint
+    /// generation. No live SQL refs or caller-supplied object roots are consulted.
+    pub async fn ref_workspace(
+        &self,
+        limits: WorkspaceLimits,
+    ) -> Result<NativeWorkspace, ServingReadError> {
+        self.pin
+            .workspace(self.actor.clone(), None, limits, self.clone())
+            .await
+    }
     pub fn fact(&self) -> GenerationFact {
         self.pin.fact()
     }
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index a34ee024..a477a0e3 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -13,7 +13,9 @@ use tokio::{sync::Notify, time::Instant};
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 mod body;
 mod edges;
+mod workspace;
 pub use edges::{MAX_EDGE_PARENTS, ServingEdgePage};
+pub use workspace::{NativeWorkspace, WorkspaceLimits, WorkspaceStats};
 mod handoff;
 mod reads;
 mod refs;
@@ -340,7 +342,7 @@ impl ServingPin {
             return Err(ServingReadError::Context);
         }
         let ids = ids.to_vec();
-        self.read_owned(actor, move |inner, deadline| async move {
+        self.read_owned(actor, move |inner, deadline, _permit| async move {
             let reader = inner.catalog().await?;
             if Instant::now() >= deadline {
                 return Err(ServingReadError::Inactive);
diff --git a/crates/canopy-server/src/packs/publication/serving/session/body.rs b/crates/canopy-server/src/packs/publication/serving/session/body.rs
index 984c49cc..20d253f0 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/body.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/body.rs
@@ -3,7 +3,7 @@ use super::*;
 
 /// Foreground copies are bounded independently of any object header. Streaming
 /// larger objects is a separate producer contract, never an unbounded Vec.
-const MAX_BODY_BYTES: usize = 64 << 20;
+pub(super) const MAX_BODY_BYTES: usize = 64 << 20;
 impl ServingPin {
     pub async fn body(
         &self,
@@ -17,7 +17,7 @@ impl ServingPin {
         if limit == 0 || limit > MAX_BODY_BYTES {
             return Err(ServingReadError::TooLarge);
         }
-        self.read_owned(actor, move |inner, deadline| async move {
+        self.read_owned(actor, move |inner, deadline, permit| async move {
             let reader = inner.catalog().await?;
             let Some(object) = reader
                 .lookup(oid, &*inner.context.files, &*inner.context.files)
@@ -33,7 +33,7 @@ impl ServingPin {
             }
             // This is a child of an already admitted worker. Closing refuses new
             // workers but must not invalidate native drain ownership of this one.
-            let owner = inner.child();
+            let owner: crate::git_objects::ReadOwner = Arc::new((inner.child(), permit));
             Ok(Some(inner.context.files.body(object, limit, owner).await?))
         })
         .await
diff --git a/crates/canopy-server/src/packs/publication/serving/session/edges.rs b/crates/canopy-server/src/packs/publication/serving/session/edges.rs
index a8597b26..1821bada 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/edges.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/edges.rs
@@ -32,7 +32,7 @@ impl ServingPin {
             return Err(ServingReadError::Context);
         }
         let ids = ids.to_vec();
-        self.read_owned(actor, move |inner, deadline| async move {
+        self.read_owned(actor, move |inner, deadline, permit| async move {
             let reader = inner.catalog().await?;
             let mut output = ServingEdgePage {
                 headers: Vec::new(),
@@ -58,7 +58,7 @@ impl ServingPin {
                 let cursor = after
                     .filter(|(cursor, _)| *cursor == parent)
                     .map(|(_, child)| child);
-                let owner = inner.child();
+                let owner = (inner.child(), permit.clone());
                 let mut edges = tokio::task::spawn_blocking(move || {
                     let _owner = owner;
                     metadata.edges_after(parent, cursor)
diff --git a/crates/canopy-server/src/packs/publication/serving/session/reads.rs b/crates/canopy-server/src/packs/publication/serving/session/reads.rs
index 331c3d9e..d8233e13 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/reads.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/reads.rs
@@ -11,7 +11,24 @@ impl ServingPin {
     where
         T: Send + 'static,
         F: Future<Output = Result<T, ServingReadError>> + Send,
-        Work: FnOnce(Arc<Inner>, Instant) -> F + Send + 'static,
+        Work: FnOnce(Arc<Inner>, Instant, Arc<crate::AdmissionPermit>) -> F + Send + 'static,
+    {
+        self.read_session(actor, work, false).await
+    }
+
+    /// A renewable producer retains its borrow/admission and refreshes the exact
+    /// lease before each bounded I/O step. Renewal cannot resurrect an expired
+    /// pin; the final fresh observation must still prove current authority.
+    pub(super) async fn read_session<T, F, Work>(
+        &self,
+        actor: Option<String>,
+        work: Work,
+        renewable: bool,
+    ) -> Result<T, ServingReadError>
+    where
+        T: Send + 'static,
+        F: Future<Output = Result<T, ServingReadError>> + Send,
+        Work: FnOnce(Arc<Inner>, Instant, Arc<crate::AdmissionPermit>) -> F + Send + 'static,
     {
         if self.inner.context.budget.inner.stop.is_cancelled() {
             return Err(ServingReadError::Inactive);
@@ -40,16 +57,16 @@ impl ServingPin {
             .context
             .tasks()
             .spawn(async move {
-                let (_permit, _guard) = (permit, guard);
+                let (permit, _guard) = (Arc::new(permit), guard);
                 let (_, deadline) = inner.observe(actor.clone()).await?;
                 if Instant::now() >= deadline {
                     return Err(ServingReadError::Inactive);
                 }
                 // Observer cancellation only detaches this task. Do not time out by
                 // dropping provider work and misreporting that its roots drained.
-                let output = work(inner.clone(), deadline).await?;
-                inner.observe(actor).await?;
-                if Instant::now() >= deadline {
+                let output = work(inner.clone(), deadline, permit.clone()).await?;
+                let (_, current) = inner.observe(actor).await?;
+                if Instant::now() >= current || !renewable && Instant::now() >= deadline {
                     return Err(ServingReadError::Inactive);
                 }
                 Ok(output)
diff --git a/crates/canopy-server/src/packs/publication/serving/session/refs.rs b/crates/canopy-server/src/packs/publication/serving/session/refs.rs
index 757d6af1..012e64a2 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/refs.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/refs.rs
@@ -13,7 +13,7 @@ pub struct ResolvedServingRef {
 }
 
 impl Inner {
-    async fn ref_snapshot(&self) -> Result<&RefStateSnapshot, ServingReadError> {
+    pub(super) async fn ref_snapshot(&self) -> Result<&RefStateSnapshot, ServingReadError> {
         self.refs
             .get_or_try_init(|| async {
                 let fact = self.lease.fact;
@@ -44,7 +44,7 @@ impl ServingPin {
             return Err(ServingReadError::Context);
         }
         let reference = reference.map(RefNameKey::new).transpose()?;
-        self.read_owned(actor, move |inner, deadline| async move {
+        self.read_owned(actor, move |inner, deadline, _permit| async move {
             let snapshot = inner.ref_snapshot().await?;
             if Instant::now() >= deadline {
                 return Err(ServingReadError::Inactive);
@@ -84,7 +84,7 @@ impl ServingPin {
         let after = (!after.is_empty())
             .then(|| RefNameKey::new(after))
             .transpose()?;
-        self.read_owned(actor, move |inner, deadline| async move {
+        self.read_owned(actor, move |inner, deadline, _permit| async move {
             let snapshot = inner.ref_snapshot().await?;
             if Instant::now() >= deadline {
                 return Err(ServingReadError::Inactive);
diff --git a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
new file mode 100644
index 00000000..cdf41465
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
@@ -0,0 +1,391 @@
+//! Complete certified forward graph in admitted disk, with owned native inputs.
+//! The cache may physically contain extra pack objects. Only the retained
+//! membership spool authorizes wants; file presence never grants reachability.
+use super::*;
+use crate::packs::{catalog::graph_spool::GraphSpool, metadata::MetadataError};
+use crate::{
+    ObjectId,
+    git_cache::GitCache,
+    git_objects::{GitObjects, ReadOwner},
+};
+
+#[derive(Clone, Copy, Debug)]
+pub struct WorkspaceLimits {
+    pub max_spool_bytes: u64,
+    pub cache_kib: u32,
+}
+impl Default for WorkspaceLimits {
+    fn default() -> Self {
+        Self {
+            max_spool_bytes: 1 << 30,
+            cache_kib: 256,
+        }
+    }
+}
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct WorkspaceStats {
+    pub objects: u64,
+    pub packs: u64,
+    pub input_bytes: u64,
+}
+#[derive(Clone)]
+pub struct NativeWorkspace {
+    core: Arc<Core>,
+}
+struct Core {
+    cache: Arc<GitCache>,
+    spool: Arc<Mutex<GraphSpool>>,
+    pin: ServingPin,
+    actor: Option<String>,
+    stats: WorkspaceStats,
+}
+impl NativeWorkspace {
+    pub(crate) fn backend(&self, nonce_seed: Option<[u8; 32]>) -> crate::git_http::GitHttpBackend {
+        crate::git_http::GitHttpBackend {
+            cache: self.core.cache.clone(),
+            nonce_seed,
+            signers: None,
+        }
+    }
+    pub fn object_format(&self) -> crate::ObjectFormat {
+        self.core.pin.inner.lease.format
+    }
+    pub fn fact(&self) -> GenerationFact {
+        self.core.pin.fact()
+    }
+    pub fn stats(&self) -> WorkspaceStats {
+        self.core.stats
+    }
+    // Raw paths/owners stay crate-private. A decoded DTO cannot mint a native
+    // read capability; producers must authorize requests and use contains.
+    pub(crate) fn git_dir(&self) -> std::path::PathBuf {
+        self.core.cache.git_dir()
+    }
+    pub(crate) fn read_owner(&self) -> ReadOwner {
+        self.core.clone()
+    }
+    /// Snapshot-specific forward membership, in caller order, including blobs
+    /// and trees. Cache presence, future refs and unrelated histories are ignored.
+    pub async fn contains(&self, ids: &[ObjectId]) -> Result<Vec<bool>, ServingReadError> {
+        if ids.len() > PAGE_OBJECTS
+            || ids
+                .iter()
+                .any(|id| id.is_zero() || id.format() != self.core.pin.inner.lease.format)
+        {
+            return Err(ServingReadError::Context);
+        }
+        let ids = ids.to_vec();
+        let core = self.core.clone();
+        self.core
+            .pin
+            .read_owned(
+                self.core.actor.clone(),
+                move |inner, _, permit| async move {
+                    let owner = (core.clone(), inner.child(), permit);
+                    tokio::task::spawn_blocking(move || {
+                        let _owner = owner;
+                        core.spool
+                            .lock()
+                            .map_err(|_| MetadataError::Integrity)?
+                            .contains(&ids)
+                    })
+                    .await?
+                    .map_err(|error| crate::packs::directory::index::IndexError::from(error).into())
+                },
+            )
+            .await
+    }
+    /// Read only objects in the completed forward closure, even when downloaded
+    /// packs contain other certified objects. Verify every returned native body.
+    pub async fn body(
+        &self,
+        oid: ObjectId,
+        limit: usize,
+    ) -> Result<Option<Vec<u8>>, ServingReadError> {
+        if oid.is_zero() || oid.format() != self.core.pin.inner.lease.format {
+            return Err(ServingReadError::Context);
+        }
+        if limit == 0 || limit > super::body::MAX_BODY_BYTES {
+            return Err(ServingReadError::TooLarge);
+        }
+        let core = self.core.clone();
+        let workspace = self.clone();
+        self.core
+            .pin
+            .read_owned(
+                self.core.actor.clone(),
+                move |inner, _, permit| async move {
+                    let owner: ReadOwner =
+                        Arc::new((inner.child(), permit, workspace.read_owner()));
+                    if !job(&core.spool, owner.clone(), move |s| s.contains(&[oid])).await?[0] {
+                        return Ok(None);
+                    }
+                    let reader = inner.catalog().await?;
+                    let object = reader
+                        .lookup(oid, &*inner.context.files, &*inner.context.files)
+                        .await?
+                        .ok_or(ServingReadError::Context)?;
+                    let expected = object.entry.header.object;
+                    if expected.size > limit as u64 {
+                        return Err(ServingReadError::TooLarge);
+                    }
+                    let mut objects =
+                        GitObjects::batch_owned(&workspace.git_dir(), &core.cache.native, owner)
+                            .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    let body = objects
+                        .read_verified(expected, limit)
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    objects
+                        .finish()
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    Ok(Some(body))
+                },
+            )
+            .await
+    }
+}
+impl ServingPin {
+    pub(in crate::packs::publication::serving) async fn workspace(
+        &self,
+        actor: Option<String>,
+        roots: Option<&[ObjectId]>,
+        limits: WorkspaceLimits,
+        snapshot: ServingSnapshot,
+    ) -> Result<NativeWorkspace, ServingReadError> {
+        if roots.is_some_and(|roots| {
+            roots.is_empty()
+                || roots.len() > MAX_EDGE_PARENTS
+                || roots.windows(2).any(|p| p[0] >= p[1])
+                || roots
+                    .iter()
+                    .any(|id| id.is_zero() || id.format() != self.inner.lease.format)
+        }) {
+            return Err(ServingReadError::Context);
+        }
+        if limits.max_spool_bytes < 16 << 10
+            || limits.max_spool_bytes > canopy_object_storage::external::MAX_ARTIFACT_BYTES
+            || !limits.max_spool_bytes.is_multiple_of(4096)
+            || limits.cache_kib == 0
+            || limits.cache_kib > 256
+        {
+            return Err(ServingReadError::Context);
+        }
+        let roots = roots.map(<[ObjectId]>::to_vec);
+        let pin = self.clone();
+        self.read_session(
+            actor.clone(),
+            move |inner, deadline, permit| async move {
+                let mut observation = Observation {
+                    deadline,
+                    next: Instant::now(),
+                };
+                // The borrow sustains producer renewal during long construction and
+                // through returned native workers, descendants and cache cleanup.
+                let refs = if roots.is_none() {
+                    Some(inner.ref_snapshot().await?.clone())
+                } else {
+                    None
+                };
+                let head = refs
+                    .as_ref()
+                    .map_or("refs/heads/main", |refs| refs.default_branch.as_str())
+                    .to_owned();
+                let cleanup: ReadOwner = Arc::new((inner.child(), snapshot));
+                let owner: ReadOwner = Arc::new((cleanup.clone(), permit));
+                let cache = inner
+                    .context
+                    .files
+                    .workspace(owner.clone(), cleanup.clone(), head)
+                    .await?;
+                let spool = inner
+                    .context
+                    .files
+                    .graph_spool(
+                        limits.max_spool_bytes,
+                        limits.cache_kib,
+                        owner.clone(),
+                        cleanup,
+                    )
+                    .await
+                    .map_err(crate::packs::directory::index::IndexError::from)?;
+                if let Some(roots) = roots {
+                    job(&spool, owner.clone(), move |s| {
+                        s.add(&roots.into_iter().map(|id| (id, None)).collect::<Vec<_>>())
+                    })
+                    .await?;
+                } else {
+                    let refs = refs.ok_or(ServingReadError::Context)?;
+                    let mut cursor =
+                        inner
+                            .context
+                            .indexes
+                            .refs()
+                            .cursor(refs.root.clone(), None, true)?;
+                    let mut writer = cache
+                        .serving_refs(owner.clone())
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    loop {
+                        observation.refresh(&inner, &actor).await?;
+                        let mut page = Vec::with_capacity(crate::refs::REF_PAGE_SIZE);
+                        for _ in 0..crate::refs::REF_PAGE_SIZE {
+                            let Some(record) = cursor.next().await? else {
+                                break;
+                            };
+                            page.push((record.name().to_owned(), record.state().clone()));
+                        }
+                        if page.is_empty() {
+                            break;
+                        }
+                        let roots = page
+                            .iter()
+                            .map(|(_, state)| state.oid.map(|id| (id, None)))
+                            .collect::<Option<Vec<_>>>()
+                            .ok_or(ServingReadError::Context)?;
+                        job(&spool, owner.clone(), move |s| s.add(&roots)).await?;
+                        writer = writer
+                            .append(page)
+                            .await
+                            .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    }
+                    writer
+                        .finish()
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
+                }
+                let reader = inner.catalog().await?;
+                let mut stats = WorkspaceStats {
+                    objects: 0,
+                    packs: 0,
+                    input_bytes: 0,
+                };
+                loop {
+                    observation.refresh(&inner, &actor).await?;
+                    let pending = job(&spool, owner.clone(), |s| s.pending()).await?;
+                    if pending.is_empty() {
+                        break;
+                    }
+                    for (id, expected) in &pending {
+                        observation.refresh(&inner, &actor).await?;
+                        let object = reader
+                            .lookup(*id, &*inner.context.files, &*inner.context.files)
+                            .await?
+                            .ok_or(ServingReadError::Context)?;
+                        let kind = object.entry.header.object.kind;
+                        if expected.is_some_and(|expected| expected != kind) {
+                            return Err(ServingReadError::Context);
+                        }
+                        let id = *id;
+                        job(&spool, owner.clone(), move |s| s.add(&[(id, Some(kind))])).await?;
+                        let source = object.source.record.native();
+                        source.validate(inner.context.repository(), inner.lease.format)?;
+                        if !job(&spool, owner.clone(), move |s| s.pack_seen(source)).await? {
+                            inner
+                                .context
+                                .files
+                                .install_workspace(cache.clone(), source, owner.clone())
+                                .await?;
+                            observation.refresh(&inner, &actor).await?;
+                            job(&spool, owner.clone(), move |s| s.imported(source)).await?;
+                            stats.packs = stats
+                                .packs
+                                .checked_add(1)
+                                .ok_or(ServingReadError::TooLarge)?;
+                            stats.input_bytes = stats
+                                .input_bytes
+                                .checked_add(source.pack.size)
+                                .and_then(|n| n.checked_add(source.index.size))
+                                .ok_or(ServingReadError::TooLarge)?;
+                        }
+                        let metadata = object.source.metadata;
+                        let mut cursor = None;
+                        loop {
+                            observation.refresh(&inner, &actor).await?;
+                            let metadata = metadata.clone();
+                            let keep = owner.clone();
+                            let edges = tokio::task::spawn_blocking(move || {
+                                let _owner = keep;
+                                metadata.edges_after(id, cursor)
+                            })
+                            .await?
+                            .map_err(crate::packs::directory::index::IndexError::from)?;
+                            if edges.is_empty() {
+                                break;
+                            }
+                            cursor = edges.last().map(|edge| edge.child);
+                            let count = edges.len();
+                            job(&spool, owner.clone(), move |s| {
+                                s.add(
+                                    &edges
+                                        .into_iter()
+                                        .map(|edge| (edge.child, Some(edge.expected_kind)))
+                                        .collect::<Vec<_>>(),
+                                )
+                            })
+                            .await?;
+                            if count < PAGE_OBJECTS {
+                                break;
+                            }
+                        }
+                    }
+                    let count = pending.len() as u64;
+                    job(&spool, owner.clone(), move |s| s.done(&pending)).await?;
+                    stats.objects = stats
+                        .objects
+                        .checked_add(count)
+                        .ok_or(ServingReadError::TooLarge)?;
+                }
+                inner.observe(actor.clone()).await?;
+                Ok(NativeWorkspace {
+                    core: Arc::new(Core {
+                        cache,
+                        spool,
+                        pin,
+                        actor,
+                        stats,
+                    }),
+                })
+            },
+            true,
+        )
+        .await
+    }
+}
+async fn job<T: Send + 'static>(
+    spool: &Arc<Mutex<GraphSpool>>,
+    owner: ReadOwner,
+    body: impl FnOnce(&mut GraphSpool) -> Result<T, MetadataError> + Send + 'static,
+) -> Result<T, ServingReadError> {
+    let spool = spool.clone();
+    tokio::task::spawn_blocking(move || {
+        let _owner = owner;
+        let mut spool = spool.lock().map_err(|_| MetadataError::Integrity)?;
+        body(&mut spool)
+    })
+    .await?
+    .map_err(|error| crate::packs::directory::index::IndexError::from(error).into())
+}
+
+/// Amortize authority queries across bounded graph steps, rather than issuing
+/// repository SQL per object. Long provider suspensions still force a fresh check
+/// before the next step, and construction always rechecks before returning.
+struct Observation {
+    deadline: Instant,
+    next: Instant,
+}
+impl Observation {
+    async fn refresh(
+        &mut self,
+        inner: &Inner,
+        actor: &Option<String>,
+    ) -> Result<(), ServingReadError> {
+        let now = Instant::now();
+        if now >= self.next || now >= self.deadline {
+            self.deadline = inner.observe(actor.clone()).await?.1;
+            self.next = (Instant::now() + std::time::Duration::from_millis(250)).min(self.deadline);
+        }
+        Ok(())
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index be65295c..52377348 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -1247,6 +1247,19 @@ impl StagingTicket {
         self.job.changed.notify_one();
         Ok(())
     }
+    /// Inject a short custody ceiling only after a test reaches its intended
+    /// recovery phase. The real clock and normal fence/drain path still run.
+    #[cfg(test)]
+    pub(super) fn expire_bound_for_test(&self) -> Result<Instant, StagingError> {
+        let mut local = self.job.local.lock().expect("staging local");
+        let session = local.bound.as_ref().ok_or(StagingError::NotReady)?;
+        let deadline = (Instant::now() + Duration::from_millis(100)).min(session.live_lease()?.1);
+        *session.deadline.lock().expect("bound deadline") = deadline;
+        local.deadline = deadline;
+        local.lifetime = local.lifetime.min(deadline);
+        self.job.changed.notify_one();
+        Ok(deadline)
+    }
     #[cfg(test)]
     pub(super) fn renew_for_test(&self) {
         self.job.local.lock().expect("staging local").renew = true;
diff --git a/crates/canopy-server/src/packs/publication/tests/native_capture.rs b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
index 918c1461..1d1fa5b8 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_capture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
@@ -576,18 +576,11 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
     )
     .await?;
     let request_digest = encoded.identity().request_digest;
-    let mut staging_limits = StagingLimits::default();
-    if matches!(
-        mode,
-        CompletionMode::Dispatch {
-            loss: super::root_dispatch::Loss::Expiry,
-            ..
-        }
-    ) {
-        staging_limits.bound_lifetime_ms = 5000;
-    }
-    let coordinator =
-        StagingCoordinator::new(fixture.target.clone(), staging_limits, fixture.authority())?;
+    let coordinator = StagingCoordinator::new(
+        fixture.target.clone(),
+        StagingLimits::default(),
+        fixture.authority(),
+    )?;
     let ready = ReadyStaging::new(
         fixture.client(),
         fixture.target.clone(),
diff --git a/crates/canopy-server/src/packs/publication/tests/prepare.rs b/crates/canopy-server/src/packs/publication/tests/prepare.rs
index 9dd4b5bd..40dd82aa 100644
--- a/crates/canopy-server/src/packs/publication/tests/prepare.rs
+++ b/crates/canopy-server/src/packs/publication/tests/prepare.rs
@@ -74,6 +74,44 @@ pub(super) async fn opened(
     );
     Ok((base, files, indexes))
 }
+/// Keep fixture construction under actual service-owned custody renewals.
+/// A long native history must not consume the lease before the tested action.
+pub(super) async fn renewing<T>(
+    fixture: &Fixture,
+    base: &PreparationBaseResolver,
+    work: impl std::future::Future<Output = Result<T>>,
+) -> Result<T> {
+    let coordinator = PublicationCoordinator::new(
+        fixture.target.clone(),
+        PublicationLimits::default(),
+        fixture.publication_budget.clone(),
+    )?;
+    tokio::pin!(work);
+    let mut ticks = tokio::time::interval(Duration::from_secs(10));
+    ticks.tick().await;
+    let result = loop {
+        tokio::select! {
+            result = &mut work => break result,
+            _ = ticks.tick() => {
+                let renewed = async {
+                    let ready = base.ready_renew(identity()?, DEFAULT_LEASE_MS).await?;
+                    let ticket = coordinator.submit(ready).await?;
+                    match ticket.wait().await {
+                        PublicationState::Finished(Ok(PublicationOutcome::Preparation(value))) => {
+                            value.session.map_err(|error| error.to_string())?;
+                            Ok(())
+                        }
+                        other => Err(format!("fixture renewal: {other:?}").into()),
+                    }
+                }.await;
+                if let Err(error) = renewed { break Err(error); }
+            }
+        }
+    };
+    assert!(coordinator.close_and_drain().await.is_empty());
+    result
+}
+
 pub(super) async fn physical(
     prepared: &Prepared,
     root: &Path,
diff --git a/crates/canopy-server/src/packs/publication/tests/publishing.rs b/crates/canopy-server/src/packs/publication/tests/publishing.rs
index 91d05b5d..f508b4ba 100644
--- a/crates/canopy-server/src/packs/publication/tests/publishing.rs
+++ b/crates/canopy-server/src/packs/publication/tests/publishing.rs
@@ -57,30 +57,34 @@ pub(super) async fn assembled(
         .ok_or("blob")?
         .0
         .oid;
-    let (tip, other) = if depth == 0 {
-        (initial, initial)
-    } else {
-        history(&mut native, initial, depth).await?
-    };
-    let root = tempfile::TempDir::new()?;
-    let budget = DiskBudget::new(256 << 20);
-    let mut builder = CatalogPreparation::new(root.path(), budget.clone(), base, limits()).await?;
-    let (witness, segments) = physical(&native, root.path(), budget.clone()).await?;
-    builder.begin_pack(witness)?;
-    for segment in segments {
-        builder.add_segment(segment).await?;
-    }
-    builder.finish_pack().await?;
-    Ok(Graph {
-        prepared: builder.finish().await?,
-        root,
-        budget,
-        initial,
-        tip,
-        other,
-        blob,
-        store: native.store,
+    super::prepare::renewing(fixture, &base, async {
+        let (tip, other) = if depth == 0 {
+            (initial, initial)
+        } else {
+            history(&mut native, initial, depth).await?
+        };
+        let root = tempfile::TempDir::new()?;
+        let budget = DiskBudget::new(256 << 20);
+        let mut builder =
+            CatalogPreparation::new(root.path(), budget.clone(), base.clone(), limits()).await?;
+        let (witness, segments) = physical(&native, root.path(), budget.clone()).await?;
+        builder.begin_pack(witness)?;
+        for segment in segments {
+            builder.add_segment(segment).await?;
+        }
+        builder.finish_pack().await?;
+        Ok(Graph {
+            prepared: builder.finish().await?,
+            root,
+            budget,
+            initial,
+            tip,
+            other,
+            blob,
+            store: native.store,
+        })
     })
+    .await
 }
 async fn history(
     native: &mut Prepared,
diff --git a/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs b/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
index 838de0b5..9be8299d 100644
--- a/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
@@ -251,12 +251,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
             Loss::Expiry => {
                 // Cellule's SQL deadlines use the real monotonic clock. Wait
                 // for this shared local ceiling without shifting Tokio time.
-                let deadline = weak
-                    .upgrade()
-                    .ok_or("root custody lost")?
-                    .base
-                    .live_lease()?
-                    .1;
+                let deadline = ticket.expire_bound_for_test()?;
                 tokio::time::sleep_until(deadline + Duration::from_millis(1)).await;
                 assert!(
                     weak.upgrade()
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index a108228c..b585ddcf 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -14,6 +14,7 @@ mod lifecycle;
 mod pool;
 mod refs;
 mod selection_drain;
+mod workspace;
 
 async fn initialize(f: &Fixture, store: Arc<ArtifactStore>) -> Result<GenerationFact> {
     let (prepared, root, budget) = Box::pin(empty(f, [241; 16], store.clone())).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
index 709f5829..0aaab02d 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
@@ -350,6 +350,18 @@ async fn closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clo
             Err(ServingReadError::Inactive)
         ));
         tokio::time::sleep(Duration::from_millis(1_500)).await;
+        timeout(Duration::from_secs(8), async {
+            while owner.stats().renewals < 2 {
+                assert_eq!(
+                    owner.stats().phase,
+                    ServingOwnerPhase::Ready,
+                    "{:?}",
+                    owner.stats()
+                );
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
         assert!(owner.stats().renewals >= 2, "{:?}", owner.stats());
         assert_eq!(owner.stats().token, Some(token));
         assert_eq!(snapshot.fact(), fact);
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
new file mode 100644
index 00000000..239747ce
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
@@ -0,0 +1,603 @@
+//! Native forward closures use physically verified packs. Trusted generation
+//! installation isolates serving from the still-incomplete live publisher.
+use super::*;
+use crate::packs::catalog::serving_fixture::{operation, prepare};
+use crate::{ObjectId, ObjectKind};
+use std::collections::BTreeSet;
+use std::sync::atomic::Ordering;
+
+#[tokio::test]
+async fn complete_native_history_crosses_shards_and_wide_parent_pages_without_loose_copies()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(InMemory::new());
+        // Wide fixtures exercise metadata shards, large trees and >512 parents.
+        let fixture = prepare(format, provider.clone(), f.repository, 600)
+            .await
+            .map_err(|e| e.to_string())?;
+        let store = Arc::new(ArtifactStore::new(provider, f.repository));
+        initialize(&f, store.clone()).await?;
+        f.install_generation(2, fixture.catalog, Some(fixture.refs))
+            .await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, files) = super::body::serving_context(&f, store, &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let view = pool.snapshot(Some("owner".into())).await?;
+        let wide = fixture.wide.ok_or("wide merge")?;
+        let workspace = timeout(
+            Duration::from_secs(60),
+            view.workspace(&[wide], WorkspaceLimits::default()),
+        )
+        .await??;
+        let mut pending = vec![wide];
+        let mut expected = BTreeSet::new();
+        while let Some(id) = pending.pop() {
+            if expected.insert(id) {
+                pending.extend(fixture.edges[&id].iter().map(|e| e.child));
+            }
+        }
+        assert_eq!(workspace.stats().objects, expected.len() as u64);
+        assert_eq!(workspace.stats().packs, 1);
+        for page in expected.into_iter().collect::<Vec<_>>().chunks(512) {
+            assert!(
+                workspace
+                    .contains(page)
+                    .await?
+                    .iter()
+                    .all(|present| *present)
+            );
+        }
+        assert_eq!(
+            workspace
+                .contains(&[fixture.tag, fixture.main, missing(&f)?])
+                .await?,
+            [false, false, false]
+        );
+        assert!(workspace.body(fixture.tag, 1024).await?.is_none());
+        assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 1);
+        let path = workspace.git_dir();
+        assert_eq!(std::fs::read_dir(path.join("objects/pack"))?.count(), 2);
+        assert_eq!(std::fs::read_dir(path.join("objects"))?.count(), 2); // info + pack, no loose shards
+        // A native walk needs all ordered parents, not just the tip pack object.
+        let commits = crate::packs::metadata::tests::git(
+            &path,
+            &["rev-list", "--count", &hex::encode(wide)],
+            None,
+        )
+        .await?;
+        assert_eq!(String::from_utf8(commits)?.trim(), "533");
+        let body = workspace.body(wide, 64 << 10).await?.ok_or("wide body")?;
+        assert_eq!(crate::object_id(format, ObjectKind::Commit, &body), wide);
+        drop(view);
+        let mut drain = tokio::spawn({
+            let pool = pool.clone();
+            async move { pool.close_and_drain().await }
+        });
+        assert!(
+            timeout(Duration::from_millis(50), &mut drain)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        drop(workspace);
+        timeout(Duration::from_secs(8), drain).await??;
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        assert!(!path.exists());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn closure_reads_reject_unselected_physical_objects_limits_and_revoked_access() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (native, _) = super::body::catalog(&f, Arc::new(InMemory::new())).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, _) =
+            super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let view = pool.snapshot(Some("viewer".into())).await?;
+        let (id, (expected, _)) = native
+            .fixture
+            .objects
+            .iter()
+            .find(|(_, (o, _))| o.kind == ObjectKind::Blob)
+            .ok_or("blob")?;
+        let workspace = view.workspace(&[*id], WorkspaceLimits::default()).await?;
+        assert_eq!(workspace.stats().objects, 1);
+        let other = *native
+            .fixture
+            .objects
+            .keys()
+            .find(|oid| *oid != id)
+            .ok_or("other")?;
+        assert_eq!(
+            workspace.contains(&[*id, other, *id, missing(&f)?]).await?,
+            [true, false, true, false]
+        );
+        assert_eq!(workspace.body(other, 1 << 20).await?, None);
+        assert_eq!(
+            workspace.body(*id, 1 << 20).await?,
+            view.body(*id, 1 << 20).await?
+        );
+        assert!(matches!(
+            workspace.body(*id, expected.size as usize - 1).await,
+            Err(ServingReadError::TooLarge)
+        ));
+        assert!(matches!(
+            workspace.body(*id, 65 << 20).await,
+            Err(ServingReadError::TooLarge)
+        ));
+        let wrong =
+            ObjectId::try_from(vec![1; if format == ObjectFormat::Sha1 { 32 } else { 20 }])?;
+        assert!(matches!(
+            workspace.contains(&[wrong]).await,
+            Err(ServingReadError::Context)
+        ));
+        assert!(matches!(
+            view.workspace(&[*id, *id], WorkspaceLimits::default())
+                .await,
+            Err(ServingReadError::Context)
+        ));
+        assert!(matches!(
+            view.workspace(&[], WorkspaceLimits::default()).await,
+            Err(ServingReadError::Context)
+        ));
+        assert!(matches!(
+            view.workspace(
+                &[*id],
+                WorkspaceLimits {
+                    cache_kib: 257,
+                    ..WorkspaceLimits::default()
+                }
+            )
+            .await,
+            Err(ServingReadError::Context)
+        ));
+        assert!(matches!(
+            view.workspace(&[missing(&f)?], WorkspaceLimits::default())
+                .await,
+            Err(ServingReadError::Context)
+        ));
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+        assert!(matches!(
+            workspace.contains(&[*id]).await,
+            Err(ServingReadError::Inactive)
+        ));
+        assert!(matches!(
+            workspace.body(*id, 1 << 20).await,
+            Err(ServingReadError::Inactive)
+        ));
+        drop((view, workspace));
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn cancelled_construction_keeps_pin_and_admission_until_suspended_provider_drains() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let (native, _) = super::body::catalog(&f, provider.clone()).await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, files) =
+            super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let view = pool.snapshot(Some("owner".into())).await?;
+        let oid = native
+            .fixture
+            .objects
+            .iter()
+            .find(|(_, (o, _))| o.kind == ObjectKind::Commit)
+            .ok_or("commit")?
+            .0;
+        let oid = *oid;
+        assert!(view.headers(&[oid]).await?[0].is_some());
+        provider.armed.store(true, Ordering::Release);
+        let observer =
+            tokio::spawn(async move { view.workspace(&[oid], WorkspaceLimits::default()).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        observer.abort();
+        assert!(observer.await.err().ok_or("cancelled")?.is_cancelled());
+        let mut drain = tokio::spawn({
+            let pool = pool.clone();
+            async move { pool.close_and_drain().await }
+        });
+        assert!(
+            timeout(Duration::from_millis(50), &mut drain)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 1);
+        provider.proceed.add_permits(1);
+        timeout(Duration::from_secs(8), drain).await??;
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 0);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn closed_producer_renews_during_long_construction_and_returned_workspace_lifetime() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let (native, _) = super::body::catalog(&f, provider.clone()).await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, _) =
+            super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        // Warm immutable metadata before acquiring the short lease. Cold file
+        // hashing is covered by the separate construction/cancellation cases.
+        let oid = *native.fixture.objects.keys().next().ok_or("object")?;
+        let warm =
+            ServingOwner::start(ctx.clone(), q.clone(), f.begin([118; 16]), identity()?).await?;
+        timeout(Duration::from_secs(8), async {
+            while warm.stats().phase != ServingOwnerPhase::Ready {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        let view = warm.snapshot(Some("owner".into())).await?;
+        assert!(view.headers(&[oid]).await?[0].is_some());
+        drop(view);
+        assert_eq!(
+            warm.close_and_drain().await.phase,
+            ServingOwnerPhase::Released
+        );
+        let mut input = f.begin([119; 16]);
+        input.lease_ms = 1000;
+        let owner = ServingOwner::start(ctx, q.clone(), input, identity()?).await?;
+        timeout(Duration::from_secs(8), async {
+            while owner.stats().phase != ServingOwnerPhase::Ready {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        let view = owner.snapshot(Some("owner".into())).await?;
+        assert!(
+            view.headers(&[oid])
+                .await
+                .map_err(|e| format!("warm short-lease headers: {e}"))?[0]
+                .is_some()
+        );
+        provider.armed.store(true, Ordering::Release);
+        let observer =
+            tokio::spawn(async move { view.workspace(&[oid], WorkspaceLimits::default()).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        owner.close();
+        tokio::time::sleep(Duration::from_millis(1500)).await;
+        timeout(Duration::from_secs(8), async {
+            while owner.stats().renewals < 2 {
+                assert_eq!(
+                    owner.stats().phase,
+                    ServingOwnerPhase::Ready,
+                    "{:?}",
+                    owner.stats()
+                );
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        assert!(owner.stats().renewals >= 2, "{:?}", owner.stats());
+        provider.proceed.add_permits(1);
+        let workspace = timeout(Duration::from_secs(8), observer)
+            .await??
+            .map_err(|e| format!("renewed constructor: {e}"))?;
+        // Construction's final fresh authority check proves the complete result;
+        // short body/membership reads are exercised with their own deadline tests.
+        assert!(workspace.stats().objects > 0);
+        assert_eq!(pin_count(&f).await?, 1);
+        let mut drain = tokio::spawn({
+            let owner = owner.clone();
+            async move { owner.close_and_drain().await }
+        });
+        assert!(
+            timeout(Duration::from_millis(50), &mut drain)
+                .await
+                .is_err()
+        );
+        drop(workspace);
+        assert_eq!(
+            timeout(Duration::from_secs(8), drain).await??.phase,
+            ServingOwnerPhase::Released
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        tasks.wait().await;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn reachability_stops_at_live_refs_without_scanning_other_history() -> Result {
+    use crate::git_gateway::{GatewayError, GitGateway};
+    use crate::packs::ref_state::{RefStateSnapshot, RefStateSnapshotRoot};
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(InMemory::new());
+        let fixture = prepare(format, provider.clone(), f.repository, 600)
+            .await
+            .map_err(|e| e.to_string())?;
+        let store = Arc::new(ArtifactStore::new(provider, f.repository));
+        initialize(&f, store.clone()).await?;
+        f.install_generation(2, fixture.catalog, Some(fixture.refs))
+            .await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, _) = super::body::serving_context(&f, store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let old = pool.snapshot(Some("owner".into())).await?;
+        let workspace = old.ref_workspace(WorkspaceLimits::default()).await?;
+        assert!(fixture.edges.len() as u64 > workspace.stats().objects + 500);
+        let wants = BTreeSet::from([fixture.main, fixture.root, fixture.side, fixture.tree]);
+        GitGateway::validate_wants(&workspace, &wants).await?;
+        for unrelated in [fixture.tag, fixture.wide.ok_or("wide")?, missing(&f)?] {
+            assert!(matches!(
+                GitGateway::validate_wants(&workspace, &BTreeSet::from([unrelated])).await,
+                Err(GatewayError::UnreachableWant)
+            ));
+        }
+        let refs = crate::packs::metadata::tests::git(
+            &workspace.git_dir(),
+            &["for-each-ref", "--format=%(refname)"],
+            None,
+        )
+        .await?;
+        assert_eq!(
+            String::from_utf8(refs)?,
+            "refs/heads/main\nrefs/heads/side\n"
+        );
+        let empty = RefStateSnapshotRoot::upload(
+            &store,
+            operation(122),
+            RefStateSnapshot {
+                repository: f.repository,
+                format,
+                generation: 2,
+                default_branch: "refs/heads/main".into(),
+                root: None,
+            },
+        )
+        .await?;
+        f.install_generation(3, fixture.catalog, Some(empty))
+            .await?;
+        let current = pool.snapshot(Some("owner".into())).await?;
+        let empty_workspace = current.ref_workspace(WorkspaceLimits::default()).await?;
+        assert_eq!(empty_workspace.stats().objects, 0);
+        assert_eq!(empty_workspace.stats().packs, 0);
+        assert!(matches!(
+            GitGateway::validate_wants(&empty_workspace, &wants).await,
+            Err(GatewayError::UnreachableWant)
+        ));
+        GitGateway::validate_wants(&workspace, &wants).await?; // admitted old snapshot retains its roots
+        drop((old, current, workspace, empty_workspace));
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn returned_workspace_releases_read_credit_while_retaining_physical_generation() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let (native, _) = super::body::catalog(&f, Arc::new(InMemory::new())).await?;
+    let q = super::pool::queue(&f)?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let (_, files) = super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+    let ctx = ServingContext::new(
+        f.client(),
+        f.target.clone(),
+        f.authority(),
+        Arc::new(CatalogIndexes::new(native.store.clone(), f.format)),
+        files,
+        ServingReadBudget::new(2, tasks.clone())?,
+        "owner".into(),
+    )?;
+    let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+    let view = pool.snapshot(Some("owner".into())).await?;
+    let oid = *native.fixture.objects.keys().next().ok_or("object")?;
+    let workspace = view.workspace(&[oid], WorkspaceLimits::default()).await?;
+    assert_eq!(workspace.contains(&[oid]).await?, [true]);
+    assert!(workspace.body(oid, 1 << 20).await?.is_some());
+    drop(view);
+    assert_eq!(workspace.contains(&[oid]).await?, [true]);
+    assert_eq!(pin_count(&f).await?, 1);
+    drop(workspace);
+    super::pool::finish(&f, &pool, &q, tasks).await?;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn suspended_construction_refuses_revoked_access_after_real_transfer_finishes() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let (native, _) = super::body::catalog(&f, provider.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+        )
+        .await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, files) =
+            super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let view = pool.snapshot(Some("viewer".into())).await?;
+        let oid = *native.fixture.objects.keys().next().ok_or("object")?;
+        assert!(view.headers(&[oid]).await?[0].is_some());
+        provider.armed.store(true, Ordering::Release);
+        let observer =
+            tokio::spawn(async move { view.workspace(&[oid], WorkspaceLimits::default()).await });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+        assert_eq!(pin_count(&f).await?, 1);
+        provider.proceed.add_permits(1);
+        assert!(matches!(
+            timeout(Duration::from_secs(8), observer).await??,
+            Err(ServingReadError::Inactive)
+        ));
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 0);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn expired_lease_does_not_resurrect_or_release_suspended_construction() -> Result {
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let provider = Arc::new(super::blocked::Gate::new());
+    let (native, _) = super::body::catalog(&f, provider.clone()).await?;
+    let q = super::pool::queue(&f)?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let (ctx, files) =
+        super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+    let mut input = f.begin([123; 16]);
+    input.lease_ms = 1000;
+    let owner = ServingOwner::start(ctx, q.clone(), input, identity()?).await?;
+    timeout(Duration::from_secs(8), async {
+        while owner.stats().phase != ServingOwnerPhase::Ready {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
+    let view = owner.snapshot(Some("owner".into())).await?;
+    let oid = *native.fixture.objects.keys().next().ok_or("object")?;
+    assert!(view.headers(&[oid]).await?[0].is_some());
+    let (dispatch, entered) = q.pause_for_test().await;
+    provider.armed.store(true, Ordering::Release);
+    let observer =
+        tokio::spawn(async move { view.workspace(&[oid], WorkspaceLimits::default()).await });
+    timeout(Duration::from_secs(8), provider.entered.acquire())
+        .await??
+        .forget();
+    timeout(Duration::from_secs(8), entered).await??;
+    tokio::time::sleep(Duration::from_millis(1100)).await;
+    assert_eq!(owner.stats().renewals, 0);
+    assert_eq!(pin_count(&f).await?, 1);
+    assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 1);
+    provider.proceed.add_permits(1);
+    assert!(matches!(
+        timeout(Duration::from_secs(8), observer).await??,
+        Err(ServingReadError::Inactive)
+    ));
+    dispatch.send(()).map_err(|_| "dispatcher lost")?;
+    assert_eq!(
+        timeout(Duration::from_secs(8), owner.close_and_drain())
+            .await?
+            .phase,
+        ServingOwnerPhase::Released
+    );
+    assert_eq!(pin_count(&f).await?, 0);
+    assert!(q.close_and_drain().await.is_empty());
+    tasks.close();
+    tasks.wait().await;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn joint_ref_pages_stream_ten_thousand_names_without_an_object_root_limit() -> Result {
+    use crate::packs::ref_state::{
+        RefStateRecord, RefStateSnapshot, RefStateSnapshotRoot, RefStateTree,
+    };
+    let f = Fixture::new(ObjectFormat::Sha256).await?;
+    let (native, catalog) = super::body::catalog(&f, Arc::new(InMemory::new())).await?;
+    let oid = *native
+        .fixture
+        .objects
+        .iter()
+        .find(|(_, (o, _))| o.kind == ObjectKind::Blob)
+        .ok_or("blob")?
+        .0;
+    let refs = RefStateTree::new(native.store.clone(), f.format)
+        .build_sorted(
+            operation(124),
+            (0..10_000).map(|n| {
+                RefStateRecord::new(
+                    &format!("refs/tags/item-{n:05}"),
+                    crate::RefExpectation {
+                        oid: Some(oid),
+                        version: 1,
+                    },
+                    f.format,
+                )
+            }),
+        )
+        .await?;
+    let refs = RefStateSnapshotRoot::upload(
+        &native.store,
+        operation(125),
+        RefStateSnapshot {
+            repository: f.repository,
+            format: f.format,
+            generation: 2,
+            default_branch: "refs/heads/main".into(),
+            root: refs,
+        },
+    )
+    .await?;
+    f.install_generation(3, catalog, Some(refs)).await?;
+    let q = super::pool::queue(&f)?;
+    let root = tempfile::TempDir::new()?;
+    let tasks = TaskTracker::new();
+    let (ctx, _) = super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+    let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+    let view = pool.snapshot(Some("owner".into())).await?;
+    let workspace = timeout(
+        Duration::from_secs(30),
+        view.ref_workspace(WorkspaceLimits::default()),
+    )
+    .await??;
+    assert_eq!(workspace.stats().objects, 1);
+    assert_eq!(workspace.stats().packs, 1);
+    let names = crate::packs::metadata::tests::git(
+        &workspace.git_dir(),
+        &["for-each-ref", "--format=%(refname)"],
+        None,
+    )
+    .await?;
+    let names = String::from_utf8(names)?;
+    assert_eq!(names.lines().count(), 10_000);
+    assert_eq!(names.lines().next(), Some("refs/tags/item-00000"));
+    assert_eq!(names.lines().last(), Some("refs/tags/item-09999"));
+    drop((view, workspace));
+    super::pool::finish(&f, &pool, &q, tasks).await?;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser.rs b/crates/canopy-server/src/server/residency/tests/serving/browser.rs
index 823444fe..5cd449d0 100644
--- a/crates/canopy-server/src/server/residency/tests/serving/browser.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser.rs
@@ -552,3 +552,70 @@ async fn production_certified_edge_pages_cover_wide_trees_and_parent_boundaries(
     }
     Ok(())
 }
+
+#[tokio::test]
+async fn certified_http_clone_and_discovery_use_joint_refs_without_legacy_objects() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let work = tempfile::TempDir::new()?;
+        let url = format!("http://{}/canopy/native-browser.git", server.address);
+        let args = [
+            "-c",
+            "http.extraHeader=Authorization: Bearer local-recovery-test",
+            "clone",
+            "--bare",
+            &url,
+            "clone.git",
+        ];
+        crate::packs::catalog::serving_fixture::run_git(work.path(), &args, None)
+            .await
+            .map_err(|e| e.to_string())?;
+        let path = work.path().join("clone.git");
+        let git = |args: Vec<String>| {
+            let path = path.clone();
+            async move {
+                let refs: Vec<_> = args.iter().map(String::as_str).collect();
+                crate::packs::catalog::serving_fixture::run_git(&path, &refs, None)
+                    .await
+                    .map_err(|e| e.to_string())
+            }
+        };
+        assert_eq!(
+            String::from_utf8(git(vec!["rev-parse".into(), "HEAD".into()]).await?)?.trim(),
+            hex::encode(native.main)
+        );
+        assert_eq!(
+            String::from_utf8(
+                git(vec!["rev-list".into(), "--count".into(), "HEAD".into()]).await?
+            )?
+            .trim(),
+            "42"
+        );
+        assert_eq!(
+            git(vec!["show".into(), "HEAD:src/lib.rs".into()]).await?,
+            b"pub fn original() {}\n"
+        );
+        git(vec!["fsck".into(), "--full".into()]).await?;
+        // Guessing a physically present, certified but unreferenced tag must be
+        // rejected by the HTTP gateway before native upload-pack sees the want.
+        let line = format!("want {}\n", hex::encode(native.tag));
+        let body = format!("{:04x}{line}00000009done\n", line.len() + 4);
+        let refused = reqwest::Client::new()
+            .post(format!("{url}/git-upload-pack"))
+            .bearer_auth("local-recovery-test")
+            .header("Content-Type", "application/x-git-upload-pack-request")
+            .body(body)
+            .send()
+            .await?;
+        assert_eq!(
+            refused.status(),
+            reqwest::StatusCode::BAD_REQUEST,
+            "{}",
+            refused.text().await?
+        );
+        drop(repository);
+        server.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/docs/README.md b/docs/README.md
index 5e2e7af2..11df3ac2 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -16,7 +16,7 @@ Use this page to choose a document by task. Canopy's hosting core supports stock
 | Plan or evaluate capacity | [Repository density and latency](performance-plan.md) | Workloads, targets, measured results and limits of each result |
 | Recover an explicitly supported predecessor Cell contract | [Retained-contract maintenance recovery](performance/2026-10-02-retained-maintenance-recovery.md) | Recovery admission fix, regression scope and incomplete rebuild status |
 | Implement large-repository storage for a large team | [Packed storage design](large-repository-storage-design.md), [implementation plan](large-repository-implementation-plan.md) and [large-team amendment](large-team-scalability.md) | Hard-cutover design, required scalability changes and single-hot-repository release gates; capacity remains unqualified |
-| Inspect certified browser objects, refs and graph reads | [Serving contract](design/certified-serving-pins.md), [implementation status](large-repository-implementation-status.md) and [browser evidence](evidence/serving-certified-browser-20261004.json) | Owned local readers, bounded native bodies/edges, actual HTTP tests and remaining producer/remote/capacity gates |
+| Inspect certified browser and native transport reads | [Serving contract](design/certified-serving-pins.md), [implementation status](large-repository-implementation-status.md) and [workspace evidence](evidence/serving-certified-workspaces-20261004.json) | Owned local readers and native fetch workspaces, bounded bodies/edges, actual HTTP clones and remaining producer/remote/capacity gates |
 | Inspect the original RustFS corpus upgrade | [Full-corpus activation and remote verification](performance/2026-10-01-original-corpus-activation.md) | Admission of 10,003 Cells, full Git/LFS verification, failed diagnostic load windows and open owner-loss gates |
 | Track three nodes behind a proxy and the latest dependency candidate | [Three-node proxy qualification](performance/2026-09-30-three-node-proxy.md) | Baseline/candidate pins, complete-corpus recovery, failing load windows and open gates |
 | Inspect the merged workspace and RustFS verification | [Workspace and RustFS verification](performance/2026-09-30-workspace-rustfs.md) | The `70bd25f` revision, conflict resolution and end-to-end gates |
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index 81d3c255..1e2ff3c3 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -6,8 +6,10 @@ adds a bounded serving-pin receiver and an owned metadata-read capability. This
 is a foundation for production reader conversion. A service-owned producer now
 acquires, retains, renews and drains one generation independently of its callers;
 the production manager now creates a bounded resident pool and exposes its
-borrow through `RepositoryCell::serving_snapshot`. Local browser and comparison object reads now use this capability. Remaining
-product/native/stream consumers and remote routes still require conversion.
+borrow through `RepositoryCell::serving_snapshot`. Local browser and comparison object reads now use this capability. The native
+workspace conversion also routes local HTTP/SSH discovery and fetch through
+accepted joint refs and their certified forward graph. Remaining generated/write
+producers, product consumers and remote routes still require conversion.
 The branch remains unreleasable until that conversion and the full cutover gates
 are complete.
 
@@ -502,3 +504,51 @@ merge comparisons and a 532-parent native merge whose relevant parent is beyond
 the first edge page. Suspended-provider and revocation tests qualify edge-worker
 ownership and cached authorization. This isolates consumer behavior and is not
 end-to-end live producer publication, cold latency or large-team qualification.
+
+## Complete native read workspaces
+
+`ServingSnapshot::workspace` takes a bounded sorted set of certified object roots;
+its caller must independently authorize those roots. `ref_workspace` instead
+chooses every live ref directly from the retained joint ref index. It streams
+32-name pages into admitted native `packed-refs` and the graph frontier, with no
+repository-sized Rust ref map or root-count cap. Empty live refs yield an empty
+native repository. HEAD uses the same immutable ref snapshot's default branch.
+
+Construction resolves preferred object sources through the certified catalog.
+It downloads each distinct, authenticated native pack/index pair once directly
+into one unpublished cache and verifies its physical binding. It never decodes
+all blobs into loose files. A disposable admitted SQLite spool tracks frontier,
+expected types, completed membership and input deduplication. Frontier batches
+are at most 128 objects; typed edges and membership lookups are bounded to 512.
+Gitlinks do not become graph dependencies. A physical pack may include unrelated
+objects, so `contains` and bounded verified bodies use completed graph membership,
+not native pack presence. Local HTTP/SSH wants use this membership before Git
+receives them. Filters remain validated before native traversal.
+
+The spool reuses admitted SQLite growth: reserve database, journal and overhead
+before allowing additional pages, replay only rolled-back transactions, and
+refuse growth without retaining a successful prefix. Its maximum and page cache
+are explicit. Input deduplication requires identical pack/index digests, sizes
+and object count for a shared native checksum; a namespace change alone does not
+require a second physical copy.
+
+Long construction retains a producer borrow and exact pin. Bounded steps refresh
+lease/owner/access observations at most every 250 ms, and always reobserve before
+returning. Valid renewals can carry construction beyond its initial conservative
+read deadline; an expired exact pin cannot be resurrected. Ordinary short reads
+retain their existing original deadline. Cancellation detaches the observer and
+keeps provider jobs owned until real completion.
+
+Construction read admission covers the worker and its blocking/provider jobs.
+Completed workspaces release that read credit while retaining snapshot ownership,
+physical guards, native file admission and disk reservations. Subsequent reads
+acquire fresh read admission. Native subprocess owners retain the workspace
+through descendants and physical cleanup, including deferred/quarantined cache
+removal. Lease expiry alone is never physical drain.
+
+This is a correct bounded construction path, not a demonstrated hot repository
+cache or large-team capacity result. Each transfer currently constructs its own
+workspace and downloads selected inputs. Sharing/coalescing authorized generation
+workspaces, cold I/O acceleration, fair scheduling and history-sized workload
+qualification remain required. Legacy generated/write producers still have
+object-table hydration and publication paths to replace.
diff --git a/docs/evidence/serving-certified-workspaces-20261004.json b/docs/evidence/serving-certified-workspaces-20261004.json
new file mode 100644
index 00000000..a958df9a
--- /dev/null
+++ b/docs/evidence/serving-certified-workspaces-20261004.json
@@ -0,0 +1,259 @@
+{
+  "source_files": 487,
+  "rust_files": 473,
+  "source_hash_digest": "e618d9b235bdb2ad6b67c0168b8c6a65cf824c23196c54fb1aab0ad0d4ee1063",
+  "release_qualified": false,
+  "execution_complete": true,
+  "phases": [
+    {
+      "label": "clippy",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "clippy",
+        "--workspace",
+        "--all-targets",
+        "--locked",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "exit_code": 0,
+      "seconds": 37.712,
+      "log": "/tmp/canopy-certified-workspace-clippy.log",
+      "log_sha256": "07eb3a24ed1f02c718862c62e27198d6464d8d5c009ccd20d84d0ee18a91ac00"
+    },
+    {
+      "label": "focused-final",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--lib",
+        "--locked",
+        "--",
+        "graph_spool::",
+        "serving::workspace::",
+        "certified_http_clone",
+        "native_receive_root_dispatch_preserves_known",
+        "final_current_policies_use",
+        "closed_owner_keeps_borrowed_generation",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 107.869,
+      "log": "/tmp/canopy-certified-workspace-focused-final.log",
+      "log_sha256": "420662234ec1a0de1f0f0b624b3644b505ee80bac92e228f0f73335346bbd188",
+      "passed": 17
+    },
+    {
+      "label": "library",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "--workspace",
+        "--lib",
+        "--locked"
+      ],
+      "exit_code": 101,
+      "seconds": 249.575,
+      "log": "/tmp/canopy-certified-workspace-library.log",
+      "log_sha256": "14961c459967e3e27007b4b4e2d8d55a596171e4016ed333f0d01af59078af4f",
+      "passed": 704,
+      "failed": 4,
+      "known_failures": [
+        "object_reads::tests::byte_limited_page_advances_only_over_the_selected_prefix",
+        "object_reads::tests::duplicate_rollback_and_deletion_do_not_hide_subsequent_inserts",
+        "object_reads::tests::insertion_cursor_finds_lower_oids_and_excludes_later_publications",
+        "object_reads::tests::small_increment_uses_bounded_sql_work_after_large_history"
+      ],
+      "nested_summaries_excluded": 2,
+      "publication_passed": 396
+    },
+    {
+      "label": "workspace",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "workspace::",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 53.432,
+      "log": "/tmp/canopy-certified-workspace-workspace.log",
+      "log_sha256": "73b6822d72f4082f55f1e7e9a41b391505acdcd32135bd96cade3328ffb7764e",
+      "passed": 3
+    },
+    {
+      "label": "lifecycle",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::fork::",
+        "lifecycle::cancelled_prebound_startup",
+        "lifecycle::runtime_destruction",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.329,
+      "log": "/tmp/canopy-certified-workspace-lifecycle.log",
+      "log_sha256": "0b4f00db1414c119cb201e5c2a0f6aaa128b669858235b5da46bea25dfce9116",
+      "passed": 2
+    },
+    {
+      "label": "drain",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--test",
+        "multi_server",
+        "--locked",
+        "--",
+        "lifecycle::cancelled_startup_keeps_workspace",
+        "lifecycle::dropped_handle_and_cancelled_shutdown",
+        "lifecycle::failed_drain_retains_workspace",
+        "lifecycle::startup_rejects_ignored_conditional",
+        "--test-threads=4"
+      ],
+      "exit_code": 0,
+      "seconds": 1.741,
+      "log": "/tmp/canopy-certified-workspace-drain.log",
+      "log_sha256": "bd7b880b7b6c18aa2c032b4a8e8a9ea49264c27be7f8d470e77d35eaf7115142",
+      "passed": 4
+    },
+    {
+      "label": "build",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "build",
+        "--locked",
+        "--bin",
+        "canopy"
+      ],
+      "exit_code": 0,
+      "seconds": 45.288,
+      "log": "/tmp/canopy-certified-workspace-build.log",
+      "log_sha256": "7eb95615ce99baf93cad6677aa35eee0068d1b026c92548557f1e9bf85c41e08"
+    },
+    {
+      "label": "fmt",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 2.254,
+      "log": "/tmp/canopy-certified-workspace-fmt.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "diff",
+      "command": [
+        "git",
+        "diff",
+        "--check"
+      ],
+      "exit_code": 0,
+      "seconds": 0.175,
+      "log": "/tmp/canopy-certified-workspace-diff.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "label": "harness",
+      "command": [
+        "python3",
+        "-B",
+        "-m",
+        "unittest",
+        "discover",
+        "-s",
+        "scripts",
+        "-p",
+        "test_*.py"
+      ],
+      "exit_code": 0,
+      "seconds": 42.079,
+      "log": "/tmp/canopy-certified-workspace-harness.log",
+      "log_sha256": "5c8dac6c3a6376c2b124e1f6299548a0bed36a10123d54d3d403631f18b8633f"
+    }
+  ],
+  "unique_workspace_cases": 717,
+  "unique_workspace_passed": 713,
+  "unique_workspace_failed": 4,
+  "sdk_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+  "sdk_manifest_pins": 5,
+  "sdk_lock_pins": 6,
+  "protected_hashes": {
+    "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "/Users/haipingfu/.codex/worktrees/packed-catalog-publication-pr/canopy/docs/archive/pr20-progress-through-8bb0ee7.md": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+  },
+  "new_families": 13,
+  "relocated_cases": 1,
+  "harness_cases": 96,
+  "platform": "macOS / Rust 1.98.0; Linux-only fork cases not executed locally",
+  "scope": "Owned complete native forward workspaces and local HTTP/SSH fetch consumers. Real HTTP clones cover both formats; 10,000 ref names and a 532-parent merge qualify bounded traversal. Physical native verification plus trusted joint-fact installation isolates consumer semantics; not live write production, remote routing, large-history cold latency, workspace coalescing or large-team capacity.",
+  "validated_source_parent": "cc4a963c750d03c22483d6a9f12099a525114385",
+  "fetched_main": "9438bb865959fb975d5349ba8b9908b461653821",
+  "draft_diagnostics": [
+    {
+      "source_hash_digest": "29c7cf4dcf3a11e828bcdbccbfee3798be2fad6e745ba8b94618d16fe787caff",
+      "exit_code": 101,
+      "server_passed": 683,
+      "server_failed": 5,
+      "reason": "Four legacy object readers and new short-lease workspace renewal case failed under broad parallel load. Metadata warmup moved before the short lease; returned workspace lifetime and completed construction remain asserted; ordinary body/membership reads have separate deadline tests.",
+      "log_sha256": "94125f6d417dc0c0f6d9e326af7d1f7ea38c8e49d2a3b5071c6ea0ea8c60e723"
+    },
+    {
+      "source_hash_digest": "9618001776be59674c040b4f5a7df9b9ab4759043d8bf6a2bd286dbbaff40f4b",
+      "exit_code": 101,
+      "server_passed": 681,
+      "server_failed": 7,
+      "reason": "Initial full library run exposed three existing lease-setup/renewal timing assumptions beyond four legacy readers. Actual owned fixture renewal, controlled real-clock expiry injection at recovery, and event-based renewal assertions replace those assumptions.",
+      "log_sha256": "987a5aa5410a0a5bac22ac825bd53abb0b48d3566a6a72b784e156b3d6477a91"
+    }
+  ],
+  "isolated_timing_diagnostic": {
+    "passed": 3,
+    "exit_code": 0,
+    "log_sha256": "b183db4c52e2c7e051fea2837594765f115e580754e079dbaf0e809c693888cd",
+    "not_replacement_for_failed_broad_run": true
+  },
+  "prior_ci": {
+    "head": "cc4a963c750d03c22483d6a9f12099a525114385",
+    "runs": [
+      37232379168,
+      37232376754
+    ],
+    "rust": "Both actual failed logs contain exactly five legacy objects reader failures; 670 server cases pass in each.",
+    "harness": "both pass",
+    "not_qualification_for_new_source": true,
+    "primary_log_sha256": "0d45c1f7145930e379d62f4c82ca68f9b7c4d067f122f2221e5507abb90005e9",
+    "secondary_log_sha256": "335496d75b03b7e0efae9ba7221a8a9dfcaffcab505d95854634dd23b2a242c3"
+  },
+  "checked_local_documentation_links": 97
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 21d15093..a0f88408 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -3,17 +3,77 @@
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. At the preceding published body-reader head `b1bd813`, GitHub reports
-no merge conflicts; both Rust CI runs fail on the same five unconverted
-legacy `objects` readers and both harness checks pass. The PR is currently marked
-ready for review, but production conversion and release requirements remain
-incomplete. Older local/unpublished checkpoint
-notes describe their historical states, not the current publication state.
+directly against `main`. The native workspace checkpoint below replaces the
+legacy fetch reader; four legacy object-page readers still fail locally. At the
+preceding published head `cc4a963`, both actual Rust CI logs report 670 server
+passes and the same five legacy-reader failures; both harness checks pass.
+Those CI runs do not qualify this newer source. Conflict freedom is checked at
+publication independently of incomplete release gates. The PR is ready for
+review, but not ready to merge or deploy. Older checkpoint notes describe their
+historical states.
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Certified native transport workspace checkpoint
+
+Local HTTP and SSH fetch now use complete native forward workspaces from an
+accepted joint snapshot. Live refs stream from the immutable ref index in
+32-name pages, including the same default branch, without a history-sized ref
+map or the explicit-object-root cap. An admitted SQLite spool tracks typed
+frontier, completed membership and distinct physical pack inputs. Each selected
+pack/index pair is authenticated, installed once and physically verified;
+blobs remain packed. Frontier batches have at most 128 objects and edge/
+membership pages have at most 512. Physical pack presence cannot authorize an
+unreferenced want. HTTP and SSH validate every wanted OID against the retained
+refs' completed closure before forwarding it to Git.
+
+Construction retains a producer borrow and physical generation guard, refreshes
+exact lease/owner/access observations during bounded steps, and rechecks before
+returning. Renewal can carry construction past its initial read deadline; an
+expired pin cannot be resurrected. Cancellation detaches observers while actual
+provider/blocking/native work and descendants remain owned. A completed workspace
+releases construction read credit while retaining file/disk admission and its
+snapshot until physical cleanup. The two-credit regression covers that lifetime
+separation.
+
+All 17 focused cases pass (107.869 seconds command,
+13.14 seconds test runtime). They cover both object formats, actual HTTP clones,
+complete 532-parent native history, unrelated physical objects, 10,000 streamed
+ref names, admission/size/type refusals, cancellation, revocation, expired pins,
+and real drain. Fixtures physically verify native packs then install joint facts
+through trusted SQL; they qualify consumers, not live write publication. Existing
+lease tests now use service-owned renewal during expensive fixture construction,
+observed renewal milestones, and short real-clock expiry injected at the intended
+recovery phase. No production lease duration is increased.
+
+The frozen workspace library runs 708 unique cases:
+704 pass and four legacy `object_reads` cursor/rollback/byte-bound cases
+fail on `no such table: objects`. All 396 publication cases
+pass. Nine selected portable workspace/lifecycle cases pass, giving
+717 unique Rust cases, 713
+passes and four failures; focused reruns and nested subprocess summaries are not
+counted twice. Workspace/all-target Clippy with warnings denied passes
+(37.712 seconds), as do server build, formatting, diff checks and all
+96 Python harness tests. The driver preserves the actual library exit 101.
+Linux-only fork cases and the full workspace integration/provider campaign were
+not run locally. Source fingerprint, command results, log digests and earlier
+failed diagnostic runs are in
+[workspace evidence](evidence/serving-certified-workspaces-20261004.json).
+Protected original index/archive and exact SDK pins remain unchanged.
+
+Highest next priority is replacing legacy write/cache object-page readers and
+their real callers with immutable catalog/native APIs, preserving paging,
+rollback and bounded incremental-work coverage. Then finish owned HTTP/SSH/
+generated write producers, live pull/editorial ref authority and owner-aware
+remote routes. Current transfers build their own workspace and download inputs;
+coalescing authorized generation workspaces, bulk graph scheduling and cold I/O
+remain required for large-repository latency. Physical owner adoption, custody
+history/rollover, final DDL, GC/backup/restore, OS containment, native maintenance,
+signed completion, attribution and full-history/10,000-SDE capacity qualification
+remain mandatory. This checkpoint does not establish capacity or latency targets.
+
 ## Certified browser objects and ancestry checkpoint
 
 Local directory, file, tag and first-parent history views now borrow one accepted

From 6101d5869f71dd836876266ba8d5aec0ac7965b0 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 15:55:42 -0700
Subject: [PATCH 27/55] Replace retired hydration cursor with pinned native
 catalog inputs

---
 .../src/git_cache/maintenance.rs              |   9 +-
 crates/canopy-server/src/git_cache/mod.rs     |  51 ++-
 crates/canopy-server/src/git_cache/tests.rs   |   1 -
 .../src/git_gateway/branch_policy.rs          |  11 +
 .../src/git_gateway/candidates/mod.rs         |  14 +-
 crates/canopy-server/src/git_gateway/fetch.rs |  73 ----
 .../src/git_gateway/hydration.rs              | 179 --------
 .../src/git_gateway/maintenance.rs            |  59 ---
 crates/canopy-server/src/git_gateway/mod.rs   | 392 ++++++++----------
 crates/canopy-server/src/git_gateway/push.rs  |   7 +-
 crates/canopy-server/src/lib.rs               |   7 +
 crates/canopy-server/src/object_reads/mod.rs  |  61 +--
 .../canopy-server/src/object_reads/tests.rs   | 127 ------
 crates/canopy-server/src/pack_store.rs        |  23 +-
 .../canopy-server/src/packs/catalog/files.rs  |  13 +
 .../canopy-server/src/packs/catalog/native.rs |  12 +-
 .../canopy-server/src/packs/catalog/reader.rs |  12 +
 .../src/packs/directory/index/changes.rs      | 200 +++++++++
 .../src/packs/directory/index/mod.rs          |   2 +
 .../packs/publication/serving/lifecycle.rs    |  13 +
 .../src/packs/publication/serving/session.rs  |   1 +
 .../serving/session/native_base.rs            | 107 +++++
 .../packs/publication/serving/session/refs.rs |  38 ++
 .../publication/serving/session/workspace.rs  |  10 +-
 .../publication/tests/serving/workspace.rs    | 135 ++++++
 .../canopy-server/src/packs/sources/tests.rs  |   1 +
 .../src/packs/sources/tests/changes.rs        | 184 ++++++++
 crates/canopy-server/src/server/mod.rs        |   2 -
 .../canopy-server/src/server/residency/mod.rs |  52 +--
 .../serving-native-write-base-20261004.json   | 357 ++++++++++++++++
 docs/large-repository-implementation-plan.md  |   2 +-
 .../large-repository-implementation-status.md |  91 +++-
 32 files changed, 1419 insertions(+), 827 deletions(-)
 delete mode 100644 crates/canopy-server/src/git_gateway/hydration.rs
 delete mode 100644 crates/canopy-server/src/git_gateway/maintenance.rs
 delete mode 100644 crates/canopy-server/src/object_reads/tests.rs
 create mode 100644 crates/canopy-server/src/packs/directory/index/changes.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/native_base.rs
 create mode 100644 crates/canopy-server/src/packs/sources/tests/changes.rs
 create mode 100644 docs/evidence/serving-native-write-base-20261004.json

diff --git a/crates/canopy-server/src/git_cache/maintenance.rs b/crates/canopy-server/src/git_cache/maintenance.rs
index 09028b84..4193a43a 100644
--- a/crates/canopy-server/src/git_cache/maintenance.rs
+++ b/crates/canopy-server/src/git_cache/maintenance.rs
@@ -1,9 +1,13 @@
 //! Immutable cache generations: never repack/delete files beneath an active reader.
 use super::*;
+#[cfg(test)]
 use crate::git_http::{GitHttpError, GitProcess, WORKER_DEADLINE, read_bounded};
+#[cfg(test)]
 use std::process::Stdio;
+#[cfg(test)]
 use tokio::io::AsyncWriteExt;
 
+#[cfg(test)]
 fn worker_error(error: GitHttpError) -> CacheError {
     io::Error::other(error).into()
 }
@@ -247,6 +251,7 @@ impl GitCache {
     }
     /// Reuse only packs whose *every* object was verified and durably recorded
     /// during this ingestion. Extra/unverified objects disable this optimization.
+    #[cfg(test)]
     pub(crate) async fn retain_verified_packs(
         self: &Arc<Self>,
         source: Arc<Self>,
@@ -318,6 +323,7 @@ impl GitCache {
 
     /// Enumerate a captured cache into a new self-contained pack. Old objects
     /// and packs are untouched; dropping the last old reader reclaims them.
+    #[cfg(test)]
     pub(crate) async fn repacked(
         self: &Arc<Self>,
         root: PathBuf,
@@ -346,7 +352,6 @@ impl GitCache {
         next.reservation()?
             .try_grow(reserve)
             .map_err(io::Error::other)?;
-        let coverage = self.prepared.lock().await.clone();
         let durable = self
             .durable_packs
             .read()
@@ -497,7 +502,6 @@ impl GitCache {
         result.map_err(worker_error)?;
         next.pack_files
             .store(1, std::sync::atomic::Ordering::Relaxed);
-        *next.prepared.lock().await = coverage;
         *next
             .durable_packs
             .write()
@@ -506,6 +510,7 @@ impl GitCache {
     }
 }
 
+#[cfg(test)]
 async fn finish<T: Send + 'static>(
     process: &mut GitProcess<T>,
     stderr: Vec<u8>,
diff --git a/crates/canopy-server/src/git_cache/mod.rs b/crates/canopy-server/src/git_cache/mod.rs
index f42d627f..eecbd95a 100644
--- a/crates/canopy-server/src/git_cache/mod.rs
+++ b/crates/canopy-server/src/git_cache/mod.rs
@@ -1,7 +1,7 @@
 //! Disposable Git files charged to the node's shared disk budget.
 
 use std::{
-    collections::{BTreeMap, BTreeSet, HashSet},
+    collections::HashSet,
     fs::{self, File, OpenOptions},
     io::{self, BufWriter, Write},
     path::{Path, PathBuf},
@@ -9,16 +9,21 @@ use std::{
 };
 
 use cellule_ltx::{DiskBudget, DiskReservation, LtxError};
+#[cfg(test)]
 use flate2::{Compression, write::ZlibEncoder};
+#[cfg(test)]
+use std::collections::BTreeMap;
 use tokio::sync::Mutex;
 
 use crate::{
-    ObjectKind, RefExpectation,
     blob::{LargeBlobError, LargeBlobRead},
-    object_id,
     refs::valid_ref_name,
 };
 
+#[cfg(test)]
+use crate::object_id;
+use crate::{ObjectKind, RefExpectation};
+
 pub(crate) const CACHE_PREFIX: &str = "canopy-git-";
 
 mod artifacts;
@@ -67,14 +72,14 @@ pub(crate) struct GitCache {
     objects: Option<Arc<GitCache>>,
     // Only durable hydration writes this cache. Stripe by OID so concurrent
     // fetches share a completed loose object without serializing all objects.
+    #[cfg(test)]
     object_writes: OnceLock<[Arc<Mutex<()>>; 64]>,
     packed: RwLock<Vec<crate::git_format::pack_index::PackIndex>>,
     durable_packs: RwLock<HashSet<[u8; 32]>>,
     pub(crate) selection: Mutex<()>,
-    pub(crate) prepared: Mutex<BTreeSet<(crate::ObjectId, bool)>>,
+    #[cfg(test)]
     pub(crate) loose_objects: std::sync::atomic::AtomicU64,
     pub(crate) pack_files: std::sync::atomic::AtomicU64,
-    pub(crate) hydrating: std::sync::atomic::AtomicU64,
     pub(crate) write_generation: std::sync::atomic::AtomicU64,
 }
 
@@ -136,14 +141,14 @@ impl GitCache {
                 reservation: Some(budget.try_reserve(0)?),
                 cleanup_owner: cleanup,
                 objects,
-                object_writes: OnceLock::new(),
+                #[cfg(test)]
+    object_writes: OnceLock::new(),
                 packed: RwLock::new(Vec::new()),
                 durable_packs: RwLock::new(HashSet::new()),
                 selection: Mutex::new(()),
-                prepared: Mutex::new(BTreeSet::new()),
+                #[cfg(test)]
                 loose_objects: std::sync::atomic::AtomicU64::new(0),
                 pack_files: std::sync::atomic::AtomicU64::new(0),
-                hydrating: std::sync::atomic::AtomicU64::new(0),
                 write_generation: std::sync::atomic::AtomicU64::new(0),
             });
             for directory in ["objects/info", "objects/pack", "refs/heads", "refs/tags", "hooks"] {
@@ -177,18 +182,13 @@ impl GitCache {
         self.root().join("repo.git")
     }
 
-    pub(crate) fn hydration_guard(self: &Arc<Self>) -> HydrationGuard {
-        self.hydrating
-            .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-        HydrationGuard(Arc::clone(self))
-    }
-
     fn reservation(&self) -> io::Result<&DiskReservation> {
         self.reservation
             .as_ref()
             .ok_or_else(|| io::Error::other("Git cache accounting is closed"))
     }
 
+    #[cfg(test)]
     pub(crate) fn bytes(&self) -> io::Result<u64> {
         Ok(self.reservation()?.bytes())
     }
@@ -208,6 +208,7 @@ impl GitCache {
         self.writer(Path::new(relative))?.write_all(bytes)
     }
 
+    #[cfg(test)]
     pub(crate) async fn missing_objects(
         self: &Arc<Self>,
         ids: Vec<crate::ObjectId>,
@@ -225,6 +226,7 @@ impl GitCache {
         .await?
     }
 
+    #[cfg(test)]
     fn object_path(&self, oid: crate::ObjectId) -> PathBuf {
         let hex = hex::encode(oid);
         self.git_dir()
@@ -233,6 +235,7 @@ impl GitCache {
             .join(&hex[2..])
     }
 
+    #[cfg(test)]
     fn object_present(&self, oid: crate::ObjectId) -> io::Result<bool> {
         for index in self
             .packed
@@ -255,6 +258,7 @@ impl GitCache {
         }
     }
 
+    #[cfg(test)]
     fn object_write_lock(&self, oid: crate::ObjectId) -> Arc<Mutex<()>> {
         let stripes = self
             .object_writes
@@ -262,6 +266,7 @@ impl GitCache {
         Arc::clone(&stripes[oid[0] as usize % stripes.len()])
     }
 
+    #[cfg(test)]
     fn object_writer(
         self: &Arc<Self>,
         oid: crate::ObjectId,
@@ -320,6 +325,7 @@ impl GitCache {
         .await?
     }
 
+    #[cfg(test)]
     pub(crate) async fn store_object(
         self: &Arc<Self>,
         oid: crate::ObjectId,
@@ -354,18 +360,21 @@ impl GitCache {
         .await?
     }
 
+    #[cfg(test)]
     pub(crate) async fn store_blob(
         self: &Arc<Self>,
         reader: LargeBlobRead,
     ) -> Result<(), CacheError> {
         self.store_blob_reader(BlobReader::External(reader)).await
     }
+    #[cfg(test)]
     pub(crate) async fn store_native_blob(
         self: &Arc<Self>,
         reader: crate::pack_store::NativePackedRead,
     ) -> Result<(), CacheError> {
         self.store_blob_reader(BlobReader::Packed(reader)).await
     }
+    #[cfg(test)]
     async fn store_blob_reader(self: &Arc<Self>, mut reader: BlobReader) -> Result<(), CacheError> {
         let (oid, size) = reader.metadata();
         let write = self.object_write_lock(oid).lock_owned().await;
@@ -416,6 +425,7 @@ impl GitCache {
         .await?
     }
 
+    #[cfg(test)]
     pub(crate) async fn store_refs(
         self: &Arc<Self>,
         refs: &BTreeMap<String, RefExpectation>,
@@ -459,6 +469,7 @@ impl GitCache {
 
     /// Physical index entries, including duplicates across packs. This is an
     /// admission/telemetry bound, never a proof of canonical object coverage.
+    #[cfg(test)]
     pub(crate) fn indexed_entries(&self) -> u64 {
         self.packed
             .read()
@@ -473,6 +484,7 @@ impl GitCache {
             )
     }
 
+    #[cfg(test)]
     fn register_index(&self, path: &Path) -> io::Result<()> {
         self.register_checked_index(crate::git_format::pack_index::PackIndex::open(
             path,
@@ -591,19 +603,12 @@ mod tests;
 
 mod maintenance;
 
-pub(crate) struct HydrationGuard(Arc<GitCache>);
-impl Drop for HydrationGuard {
-    fn drop(&mut self) {
-        self.0
-            .hydrating
-            .fetch_sub(1, std::sync::atomic::Ordering::SeqCst);
-    }
-}
-
+#[cfg(test)]
 enum BlobReader {
     External(LargeBlobRead),
     Packed(crate::pack_store::NativePackedRead),
 }
+#[cfg(test)]
 impl BlobReader {
     fn metadata(&self) -> (crate::ObjectId, u64) {
         match self {
diff --git a/crates/canopy-server/src/git_cache/tests.rs b/crates/canopy-server/src/git_cache/tests.rs
index b25a8df2..8fba281e 100644
--- a/crates/canopy-server/src/git_cache/tests.rs
+++ b/crates/canopy-server/src/git_cache/tests.rs
@@ -629,7 +629,6 @@ async fn incomplete_pack_extracts_verified_large_blobs_without_admitting_foreign
         pack: reader.upload(pack).await?,
         index: reader.upload(index).await?,
         approved: false,
-        covered_through: 0,
     };
     let target = GitCache::create(
         root.path().into(),
diff --git a/crates/canopy-server/src/git_gateway/branch_policy.rs b/crates/canopy-server/src/git_gateway/branch_policy.rs
index 725dc51b..c6c12352 100644
--- a/crates/canopy-server/src/git_gateway/branch_policy.rs
+++ b/crates/canopy-server/src/git_gateway/branch_policy.rs
@@ -23,6 +23,17 @@ pub(super) enum PushCommands {
 }
 
 impl PushCommands {
+    pub(super) fn names(&self) -> Vec<String> {
+        match self {
+            Self::Parsed { updates, .. } => {
+                let mut names: Vec<_> = updates.iter().map(|update| update.name.clone()).collect();
+                names.sort();
+                names
+            }
+            Self::OtherMedia | Self::Limited => Vec::new(),
+        }
+    }
+
     pub(super) async fn read(
         request: &GitHttpRequest,
         format: crate::ObjectFormat,
diff --git a/crates/canopy-server/src/git_gateway/candidates/mod.rs b/crates/canopy-server/src/git_gateway/candidates/mod.rs
index 292e9b33..91b65ade 100644
--- a/crates/canopy-server/src/git_gateway/candidates/mod.rs
+++ b/crates/canopy-server/src/git_gateway/candidates/mod.rs
@@ -52,7 +52,7 @@ impl GitGateway {
         }) {
             return Ok(CandidateOutcome::Conflict);
         }
-        let cached = self.build_cache(self.cell_refs().await?, true).await?;
+        let cached = self.build_cache(actor, &[]).await?;
         let result = prepare_native(&self.repository, &cached.backend, &candidate).await?;
         if !valid_result(&result) {
             return Err(GitHttpError::TooLarge.into());
@@ -67,7 +67,7 @@ impl GitGateway {
                     new_oid: Some(parse_oid(oid)?),
                 }],
             };
-            self.persist_objects(&cached.backend, &cached.snapshot.refs, &plan)
+            self.persist_objects(&cached.backend, &cached.refs, &plan)
                 .await?;
             self.repository
                 .prepare_graph(&plan)
@@ -220,13 +220,13 @@ fn merge_output(bytes: &[u8]) -> Result<(String, Vec<&[u8]>), GatewayError> {
     Ok((tree.into(), paths))
 }
 
-struct Output {
-    status: ExitStatus,
-    stdout: Vec<u8>,
+pub(super) struct Output {
+    pub(super) status: ExitStatus,
+    pub(super) stdout: Vec<u8>,
     stderr: Vec<u8>,
 }
 impl Output {
-    fn error(self) -> GatewayError {
+    pub(super) fn error(self) -> GatewayError {
         GitHttpError::GitExit {
             status: self.status,
             stderr: String::from_utf8_lossy(&self.stderr).into_owned(),
@@ -234,7 +234,7 @@ impl Output {
         .into()
     }
 }
-async fn run(
+pub(super) async fn run(
     backend: &GitHttpBackend,
     args: &[&str],
     input: &[u8],
diff --git a/crates/canopy-server/src/git_gateway/fetch.rs b/crates/canopy-server/src/git_gateway/fetch.rs
index d73dfd7b..85318d67 100644
--- a/crates/canopy-server/src/git_gateway/fetch.rs
+++ b/crates/canopy-server/src/git_gateway/fetch.rs
@@ -1,5 +1,4 @@
 use super::*;
-use cellule_runtime::primitives::sql::{SqlBatch, SqlStatement, SqlValue};
 
 pub(super) struct FetchRequest {
     pub(super) wants: BTreeSet<crate::ObjectId>,
@@ -141,78 +140,6 @@ impl GitGateway {
         }
         Ok(())
     }
-
-    pub(super) async fn hydrate_selected(
-        &self,
-        cache: &Arc<GitCache>,
-        mut pending: BTreeSet<crate::ObjectId>,
-    ) -> Result<(), GatewayError> {
-        let mut visited = BTreeSet::new();
-        let mut stats = Hydration::default();
-        while !pending.is_empty() {
-            let ids: Vec<_> = pending.iter().take(MAX_OBJECTS).copied().collect();
-            // Advertisements peel tags even with blob filtering. Follow only
-            // tag edges here; ordinary tree descendants stay omitted.
-            let placeholders = vec!["?"; ids.len()].join(",");
-            let result = self.repository.sql.query(None, SqlBatch { statements: vec![SqlStatement {
-                sql: format!("SELECT e.child FROM object_edges e JOIN objects o ON o.oid = e.parent WHERE o.kind = 'tag' AND e.parent IN ({placeholders})"),
-                parameters: ids.iter().map(|oid| SqlValue::Blob(oid.to_vec())).collect(),
-            }] }).await.map_err(|error| GatewayError::Cell(Box::new(error)))?;
-            for oid in &ids {
-                pending.remove(oid);
-                visited.insert(*oid);
-            }
-            for row in &result
-                .output
-                .first()
-                .ok_or(GatewayError::MalformedCache)?
-                .rows
-            {
-                let [SqlValue::Blob(oid)] = row.as_slice() else {
-                    return Err(GatewayError::MalformedCache);
-                };
-                let oid = oid
-                    .as_slice()
-                    .try_into()
-                    .map_err(|_| GatewayError::MalformedCache)?;
-                if !visited.contains(&oid) {
-                    pending.insert(oid);
-                }
-            }
-            self.hydrate_objects(cache, ids, &mut stats).await?;
-        }
-        tracing::debug!(
-            objects = stats.objects,
-            bytes = stats.bytes,
-            "hydrated explicit Git objects"
-        );
-        Ok(())
-    }
-
-    async fn hydrate_objects(
-        &self,
-        cache: &Arc<GitCache>,
-        ids: Vec<crate::ObjectId>,
-        stats: &mut Hydration,
-    ) -> Result<(), GatewayError> {
-        let mut missing: BTreeSet<_> = cache.missing_objects(ids).await?.into_iter().collect();
-        while !missing.is_empty() {
-            let selected: Vec<_> = missing.iter().copied().collect();
-            let page = self
-                .repository
-                .selected_objects(&selected)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-            if page.is_empty() {
-                return Err(GatewayError::MalformedCache);
-            }
-            for object in page {
-                missing.remove(&object.oid);
-                self.cache_object(cache, object, stats).await?;
-            }
-        }
-        Ok(())
-    }
 }
 
 #[cfg(test)]
diff --git a/crates/canopy-server/src/git_gateway/hydration.rs b/crates/canopy-server/src/git_gateway/hydration.rs
deleted file mode 100644
index 1d93dc19..00000000
--- a/crates/canopy-server/src/git_gateway/hydration.rs
+++ /dev/null
@@ -1,179 +0,0 @@
-use super::*;
-use crate::blob::LargeBlobReference;
-use std::time::{Duration, Instant};
-
-#[derive(Default)]
-pub(super) struct Hydration {
-    pub(super) objects: u64,
-    pub(super) bytes: u64,
-    pub(super) body_time: Duration,
-    pub(super) cache_time: Duration,
-}
-
-impl GitGateway {
-    pub(super) async fn restore_packs(
-        &self,
-        shared: &mut CachedObjects,
-    ) -> Result<(), GatewayError> {
-        let mut after = Vec::new();
-        loop {
-            let page = self
-                .repository
-                .approved_packs(&after)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-            if page.is_empty() {
-                break;
-            }
-            for record in &page {
-                self.pack_reader.install(&shared.cache, record).await?;
-                shared.through = shared.through.max(record.covered_through);
-            }
-            after = page
-                .last()
-                .ok_or(GatewayError::MalformedCache)?
-                .pack
-                .sha256
-                .to_vec();
-        }
-        Ok(())
-    }
-
-    pub(super) async fn hydrate(&self, shared: &mut CachedObjects) -> Result<(), GatewayError> {
-        let started = Instant::now();
-        let cache = &shared.cache;
-        let _hydration = cache.hydration_guard();
-        let _selection = cache.selection.lock().await;
-        let cursor = &mut shared.through;
-        let from_sequence = *cursor;
-        // Bound this refresh even when other writers keep appending objects.
-        // The read follows the chosen ref snapshot, whose objects are durable.
-        let high_water = self
-            .repository
-            .object_high_water()
-            .await
-            .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-        let mut page_time = Duration::ZERO;
-        let mut stats = Hydration::default();
-        let mut scanned = 0_u64;
-        while *cursor < high_water.output {
-            let queried = Instant::now();
-            let mut headers = self
-                .repository
-                .object_headers(*cursor, &high_water)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-            if headers.objects.output.is_empty() {
-                return Err(GatewayError::MalformedCache);
-            }
-            scanned += headers.objects.output.len() as u64;
-            headers.objects.output = cache.missing_objects(headers.objects.output).await?;
-            let page = self
-                .repository
-                .object_records(headers.objects)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?
-                .output;
-            page_time += queried.elapsed();
-            for object in page {
-                self.cache_object(cache, object, &mut stats).await?;
-            }
-            // Failed or cancelled pages retain their previous cursor. Verified
-            // files can be reused on retry, but no missing body is skipped.
-            *cursor = headers.through;
-        }
-        tracing::debug!(
-            repository = %hex::encode(self.repository.repository_id()),
-            objects = stats.objects,
-            scanned,
-            from_sequence,
-            through_sequence = *cursor,
-            reused = scanned - stats.objects,
-            bytes = stats.bytes,
-            cache_bytes = cache.bytes()?,
-            elapsed_seconds = started.elapsed().as_secs_f64(),
-            page_seconds = page_time.as_secs_f64(),
-            body_seconds = stats.body_time.as_secs_f64(),
-            cache_seconds = stats.cache_time.as_secs_f64(),
-            "hydrated Git cache"
-        );
-        Ok(())
-    }
-
-    pub(super) async fn cache_object(
-        &self,
-        cache: &Arc<GitCache>,
-        object: StoredObject,
-        stats: &mut Hydration,
-    ) -> Result<Option<crate::ObjectId>, GatewayError> {
-        let read = Instant::now();
-        let body = match object.storage {
-            ObjectStorage::Inline(body) => body,
-            ObjectStorage::Packed { pack, size, blake3 } => {
-                let record = self
-                    .repository
-                    .pack_record(pack)
-                    .await
-                    .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-                if record.approved {
-                    self.pack_reader.install(cache, &record).await?;
-                    return Ok(None);
-                }
-                let reader = self
-                    .pack_reader
-                    .native_reader(record, object.oid, size, blake3)
-                    .await?;
-                stats.body_time += read.elapsed();
-                let written = Instant::now();
-                cache.store_native_blob(reader).await?;
-                stats.cache_time += written.elapsed();
-                stats.objects += 1;
-                stats.bytes += size;
-                return Ok(None);
-            }
-            ObjectStorage::Chunked {
-                upload,
-                size,
-                blake3,
-            } => self
-                .repository
-                .chunked_body(object.oid, object.kind, upload, size, blake3)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?,
-            ObjectStorage::External {
-                size,
-                blake3,
-                sha256,
-            } => {
-                let reference = LargeBlobReference {
-                    oid: object.oid,
-                    size,
-                    blake3,
-                    sha256,
-                };
-                let reader = self.large_blobs.read(&reference).await?;
-                stats.body_time += read.elapsed();
-                let written = Instant::now();
-                cache.store_blob(reader).await?;
-                stats.cache_time += written.elapsed();
-                stats.objects += 1;
-                stats.bytes += reference.size;
-                return Ok(None);
-            }
-        };
-        stats.body_time += read.elapsed();
-        stats.objects += 1;
-        stats.bytes += body.len() as u64;
-        let target = (object.kind == ObjectKind::Tag)
-            .then(|| {
-                crate::graph::tag_edge(&body)
-                    .map(|(oid, _)| oid)
-                    .filter(|target| target.format() == object.oid.format())
-            })
-            .flatten();
-        let written = Instant::now();
-        cache.store_object(object.oid, object.kind, body).await?;
-        stats.cache_time += written.elapsed();
-        Ok(target)
-    }
-}
diff --git a/crates/canopy-server/src/git_gateway/maintenance.rs b/crates/canopy-server/src/git_gateway/maintenance.rs
deleted file mode 100644
index fd28c88f..00000000
--- a/crates/canopy-server/src/git_gateway/maintenance.rs
+++ /dev/null
@@ -1,59 +0,0 @@
-use super::*;
-use std::sync::atomic::Ordering;
-
-impl GitGateway {
-    /// Best-effort maintenance has separate process admission and never owns a
-    /// user transfer slot. A failed job leaves the previous generation serving.
-    pub(crate) async fn maintain(&self) -> Result<(), GatewayError> {
-        static JOBS: tokio::sync::Semaphore = tokio::sync::Semaphore::const_new(1);
-        let Ok(_job) = JOBS.try_acquire() else {
-            return Ok(());
-        };
-        let (old, through, generation) = {
-            let Ok(objects) = self.objects.try_lock() else {
-                return Ok(());
-            };
-            let Some(objects) = objects.as_ref() else {
-                return Ok(());
-            };
-            if objects.cache.hydrating.load(Ordering::SeqCst) > 0 {
-                return Ok(());
-            }
-            if objects.cache.loose_objects.load(Ordering::Relaxed) < 1024
-                && objects.cache.pack_files.load(Ordering::Relaxed) < 8
-            {
-                return Ok(());
-            }
-            (
-                Arc::clone(&objects.cache),
-                objects.through,
-                objects.cache.write_generation.load(Ordering::SeqCst),
-            )
-        };
-        let started = std::time::Instant::now();
-        let next = old
-            .repacked(self.scratch_root.clone(), self.disk_budget.clone())
-            .await?;
-        // Same lock order as fetch_cache/build_cache. Foreground requests are
-        // never locked out while pack-objects runs. Changed inventories retry.
-        let mut refs = self.cache.lock().await;
-        let mut objects = self.objects.lock().await;
-        let Some(objects) = objects.as_mut() else {
-            return Ok(());
-        };
-        if !Arc::ptr_eq(&objects.cache, &old)
-            || objects.through != through
-            || old.hydrating.load(Ordering::SeqCst) > 0
-            || old.write_generation.load(Ordering::SeqCst) != generation
-        {
-            return Ok(());
-        }
-        tracing::info!(repository = %hex::encode(self.repository.repository_id()),
-            index_entries = next.indexed_entries(), previous_bytes = old.bytes()?, packed_bytes = next.bytes()?,
-            elapsed_seconds = started.elapsed().as_secs_f64(), "published background Git repack generation");
-        self.pack_reader.replace(&old, Arc::clone(&next)).await;
-        objects.cache = next;
-        *refs = None;
-        Ok(())
-    }
-}
diff --git a/crates/canopy-server/src/git_gateway/mod.rs b/crates/canopy-server/src/git_gateway/mod.rs
index 76332732..600bf224 100644
--- a/crates/canopy-server/src/git_gateway/mod.rs
+++ b/crates/canopy-server/src/git_gateway/mod.rs
@@ -22,28 +22,22 @@ use crate::{
     RefUpdate, RepositoryCell, StoredObject,
     blob::{LargeBlobError, LargeBlobStore},
     directory::TokenScope,
-    git_cache::{CacheError, GitCache},
+    git_cache::CacheError,
     git_http::{GitHttpBackend, GitHttpError, GitHttpRequest, GitHttpResponse},
     git_input::{GitInput, InputError, MAX_FETCH_REQUEST_BYTES},
     git_objects::GitObjects,
     lfs::LfsService,
-    object_batch::MAX_OBJECTS,
     push::{PushCompletion, PushError},
-    refs::RefReadError,
 };
 
 mod branch_policy;
 mod candidates;
 mod discovery;
 mod fetch;
-mod hydration;
-mod maintenance;
 pub mod preflight;
 mod push;
 mod ssh;
 
-use hydration::Hydration;
-
 pub use crate::git_objects::ObjectReadError;
 
 type CellError = Box<dyn StdError + Send + Sync>;
@@ -82,21 +76,9 @@ pub enum GatewayError {
     Task(#[from] tokio::task::JoinError),
 }
 
-struct CachedObjects {
-    cache: Arc<GitCache>,
-    through: i64,
-}
-
 struct CachedRepository {
     backend: GitHttpBackend,
-    snapshot: RefSnapshot,
-}
-
-#[derive(PartialEq, Eq)]
-struct RefSnapshot {
     refs: BTreeMap<String, RefExpectation>,
-    head: String,
-    generation: i64,
 }
 
 /// Serves Git requests from a warm, disposable cache of durable Cell state.
@@ -110,8 +92,6 @@ pub struct GitGateway {
     scratch_root: PathBuf,
     disk_budget: DiskBudget,
     native: crate::native_resources::NativeScope,
-    cache: Mutex<Option<Arc<CachedRepository>>>,
-    objects: Mutex<Option<CachedObjects>>,
     push: Mutex<()>,
 }
 
@@ -154,8 +134,6 @@ impl GitGateway {
             scratch_root,
             disk_budget,
             native,
-            cache: Mutex::new(None),
-            objects: Mutex::new(None),
             push: Mutex::new(()),
         }
     }
@@ -348,87 +326,35 @@ impl GitGateway {
 
     async fn build_cache(
         &self,
-        snapshot: RefSnapshot,
-        include_blobs: bool,
+        actor: &str,
+        names: &[String],
     ) -> Result<CachedRepository, GatewayError> {
-        // Only hydration writes the shared cache, and only from durable Cell
-        // records. Native pushes/merges write into their private generation.
-        let mut objects = self.objects.lock().await;
-        if objects.is_none() {
-            *objects = Some(CachedObjects {
-                cache: self.pack_reader.cache().await?,
-                through: 0,
-            });
-        }
-        let shared = objects.as_mut().ok_or(GatewayError::MalformedCache)?;
-        self.restore_packs(shared).await?;
-        if include_blobs {
-            self.hydrate(shared).await?;
-        } else {
-            // Native ref advertisement only needs tips and peeled tags. Fetch
-            // hydrates the requested structural graph after validating wants.
-            self.hydrate_selected(
-                &shared.cache,
-                snapshot
-                    .refs
-                    .values()
-                    .filter_map(|state| state.oid)
-                    .collect(),
-            )
-            .await?;
+        if !valid_ref_names(names) {
+            return Err(GatewayError::MalformedCache);
         }
-        let backend = GitHttpBackend {
-            cache: GitCache::create_with_objects(
-                self.scratch_root.clone(),
-                self.disk_budget.clone(),
-                &snapshot.head,
-                self.repository.object_format(),
-                Some(Arc::clone(&shared.cache)),
-                self.native.clone(),
-            )
-            .await?,
-            nonce_seed: self.certificate_nonce().await?,
-            signers: None,
-        };
-        backend.cache.store_refs(&snapshot.refs).await?;
-        Ok(CachedRepository { backend, snapshot })
-    }
-
-    async fn cell_refs(&self) -> Result<RefSnapshot, GatewayError> {
-        for _ in 0..3 {
-            let mut refs = BTreeMap::new();
-            let mut after = String::new();
-            let mut generation = None;
-            loop {
-                let page = match self.repository.refs_page(&after, generation).await {
-                    Ok(page) => page.output,
-                    Err(RefReadError::Changed) => break,
-                    Err(RefReadError::Cell(error)) => {
-                        return Err(GatewayError::Cell(Box::new(error)));
-                    }
-                };
-                generation = Some(page.generation);
-                let complete = !page.has_more;
-                for (name, state) in page.refs {
-                    after = name.clone();
-                    refs.insert(name, state);
-                }
-                if complete {
-                    tracing::debug!(
-                        repository = %hex::encode(self.repository.repository_id()),
-                        generation = page.generation,
-                        refs = refs.len(),
-                        "read Git ref snapshot"
-                    );
-                    return Ok(RefSnapshot {
-                        refs,
-                        head: page.default_branch,
-                        generation: page.generation,
-                    });
+        let snapshot = self
+            .repository
+            .serving_snapshot(ReadIdentity::Account(actor))
+            .await
+            .map_err(|error| GatewayError::Cell(Box::new(error)))?;
+        let mut refs = BTreeMap::new();
+        for page in ref_pages(names, 128, 256 << 10) {
+            for resolved in snapshot
+                .resolve_refs(page)
+                .await
+                .map_err(|error| GatewayError::Cell(Box::new(error)))?
+            {
+                if let Some(state) = resolved.state {
+                    refs.insert(resolved.reference, state);
                 }
             }
         }
-        Err(GatewayError::RefSnapshotBusy)
+        let backend = snapshot
+            .native_base()
+            .await
+            .map_err(|error| GatewayError::Cell(Box::new(error)))?
+            .with_nonce(self.certificate_nonce().await?);
+        Ok(CachedRepository { backend, refs })
     }
 
     async fn persist_objects(
@@ -449,12 +375,6 @@ impl GitGateway {
         // re-reading old history; the final Cell transaction still verifies every new tip.
         let excluded = before.values().filter_map(|state| state.oid).collect();
         let started = std::time::Instant::now();
-        let initial_high_water = self
-            .repository
-            .object_high_water()
-            .await
-            .map_err(|error| GatewayError::Cell(Box::new(error)))?
-            .output;
         let mut sources = backend.cache.pack_sources().await?;
         let mut archive = None;
         let mut packed_ids = None;
@@ -465,7 +385,6 @@ impl GitGateway {
                 pack: self.pack_reader.upload(pack).await?,
                 index: self.pack_reader.upload(index).await?,
                 approved: false,
-                covered_through: 0,
             };
             self.repository
                 .register_pack(new_identity()?, &record)
@@ -609,42 +528,6 @@ impl GitGateway {
                 .await
                 .map_err(|error| GatewayError::Cell(Box::new(error)))?;
         }
-        let mut shared = self.objects.lock().await;
-        if let Some(shared) = shared.as_mut() {
-            let count = verified.len();
-            match shared
-                .cache
-                .retain_verified_packs(Arc::clone(&backend.cache), verified)
-                .await
-            {
-                Ok(retained) if retained == count && shared.through == initial_high_water => {
-                    if let Some(record) = &archive {
-                        shared.cache.mark_durable_pack(record.pack.sha256);
-                    }
-                    shared.through = self
-                        .repository
-                        .object_high_water()
-                        .await
-                        .map_err(|error| GatewayError::Cell(Box::new(error)))?
-                        .output;
-                    tracing::info!(
-                        objects = retained,
-                        through = shared.through,
-                        "retained verified receive pack for immediate fetch"
-                    );
-                }
-                Ok(retained) => {
-                    if retained == count
-                        && let Some(record) = &archive
-                    {
-                        shared.cache.mark_durable_pack(record.pack.sha256);
-                    }
-                }
-                Err(error) => {
-                    tracing::warn!(error = ?error, "receive pack cache reuse skipped; durable hydration remains available")
-                }
-            }
-        }
         tracing::info!(
             elapsed_seconds = started.elapsed().as_secs_f64(),
             "persisted Git objects"
@@ -669,79 +552,80 @@ fn with_push_id(mut response: GitHttpResponse, id: [u8; 16]) -> GitHttpResponse
     response
 }
 
-async fn git_output(
-    git_dir: &Path,
-    args: &[&str],
-    native: &crate::native_resources::NativeScope,
-) -> Result<Vec<u8>, GatewayError> {
-    use crate::git_http::{GitProcess, WORKER_DEADLINE, read_bounded};
-    use tokio::io::AsyncReadExt;
-    let mut command = crate::native_git::command(git_dir)?;
-    command
-        .arg("--git-dir")
-        .arg(git_dir)
-        .args(args)
-        .stdin(std::process::Stdio::null())
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped());
-    let mut process = GitProcess::spawn(
-        command,
-        (),
-        native.try_admit(crate::native_resources::NativeWork::Read)?,
-    )?;
-    let mut stdout = process
-        .child
-        .stdout
-        .take()
-        .ok_or(GatewayError::MalformedCache)?;
-    let stderr = process
-        .child
-        .stderr
-        .take()
-        .ok_or(GatewayError::MalformedCache)?;
-    let run = async {
-        let mut bytes = Vec::new();
-        let read_stdout = async {
-            stdout.read_to_end(&mut bytes).await?;
-            Ok::<_, GitHttpError>(())
-        };
-        let ((), stderr) = tokio::try_join!(read_stdout, read_bounded(stderr, 64 << 10))?;
-        let status = process.wait().await?;
-        if !status.success() {
-            return Err(GatewayError::Git(
-                String::from_utf8_lossy(&stderr).into_owned(),
-            ));
+fn valid_ref_names(names: &[String]) -> bool {
+    names.len() <= crate::refs::MAX_UPDATES
+        && names.windows(2).all(|p| p[0] < p[1])
+        && names.iter().all(|name| {
+            name.len() <= crate::packs::ref_state::MAX_NAME_BYTES
+                && crate::refs::valid_ref_name(name)
+        })
+}
+
+fn ref_pages(names: &[String], count: usize, bytes: usize) -> impl Iterator<Item = &[String]> {
+    let mut at = 0;
+    std::iter::from_fn(move || {
+        if at == names.len() {
+            return None;
         }
-        Ok(bytes)
-    };
-    tokio::time::timeout(WORKER_DEADLINE, run)
-        .await
-        .map_err(|_| GitHttpError::Timeout)?
+        let start = at;
+        let mut used = 0;
+        while at < names.len() && at - start < count {
+            let charge = names[at].len() + 1;
+            if charge > bytes - used {
+                break;
+            }
+            used += charge;
+            at += 1;
+        }
+        // Callers validate names against MAX_NAME_BYTES, so one always fits.
+        Some(&names[start..at])
+    })
 }
 
+// Exact requested names only. for-each-ref patterns can scan entire subtrees
+// when an absent requested name prefixes existing refs; cat-file resolves each
+// validated literal ref independently and reports missing names in order.
 async fn git_refs(
-    git_dir: &Path,
-    native: &crate::native_resources::NativeScope,
+    backend: &GitHttpBackend,
+    names: &[String],
 ) -> Result<BTreeMap<String, crate::ObjectId>, GatewayError> {
-    let listing = git_output(
-        git_dir,
-        &["for-each-ref", "--format=%(refname)%00%(objectname)"],
-        native,
-    )
-    .await?;
+    if !valid_ref_names(names) {
+        return Err(GatewayError::MalformedCache);
+    }
     let mut refs = BTreeMap::new();
-    for line in listing
-        .split(|byte| *byte == b'\n')
-        .filter(|line| !line.is_empty())
-    {
-        let Some(separator) = line.iter().position(|byte| *byte == 0) else {
+    for page in ref_pages(names, 32, 64 << 10) {
+        let mut input = page.join("\n").into_bytes();
+        input.push(b'\n');
+        let output = candidates::run(
+            backend,
+            &["cat-file", "--batch-check=%(objectname)"],
+            &input,
+            &[],
+        )
+        .await?;
+        if !output.status.success() {
+            return Err(output.error());
+        }
+        let text = std::str::from_utf8(&output.stdout).map_err(|_| GatewayError::MalformedCache)?;
+        let lines = text
+            .strip_suffix('\n')
+            .ok_or(GatewayError::MalformedCache)?
+            .split('\n')
+            .collect::<Vec<_>>();
+        if lines.len() != page.len() {
             return Err(GatewayError::MalformedCache);
-        };
-        let name =
-            std::str::from_utf8(&line[..separator]).map_err(|_| GatewayError::MalformedCache)?;
-        let oid = std::str::from_utf8(&line[separator + 1..])
-            .map_err(|_| GatewayError::MalformedCache)?;
-        refs.insert(name.to_owned(), parse_oid(oid)?);
+        }
+        for (name, line) in page.iter().zip(lines) {
+            if line == format!("{name} missing") {
+                continue;
+            }
+            let id = crate::ObjectId::from_hex(line.as_bytes())
+                .map_err(|_| GatewayError::MalformedCache)?;
+            if id.is_zero() || id.format() != backend.cache.object_format {
+                return Err(GatewayError::MalformedCache);
+            }
+            refs.insert(name.clone(), id);
+        }
     }
     Ok(refs)
 }
@@ -798,3 +682,95 @@ fn new_identity() -> Result<MutationIdentity, GatewayError> {
         expires_at_ms: now_ms + 60_000,
     })
 }
+
+#[cfg(test)]
+mod native_refs_tests {
+    use super::*;
+    #[tokio::test]
+    async fn native_ref_reads_resolve_only_exact_requested_names_in_both_formats()
+    -> Result<(), Box<dyn std::error::Error>> {
+        for format in [crate::ObjectFormat::Sha1, crate::ObjectFormat::Sha256] {
+            let root = tempfile::TempDir::new()?;
+            let backend = GitHttpBackend::initialize(
+                root.path().to_owned(),
+                DiskBudget::new(8 << 20),
+                "refs/heads/main",
+                format,
+                crate::native_resources::NativeResources::default()
+                    .scope(crate::native_resources::NativeClass::Foreground),
+            )
+            .await?;
+            let body = b"native ref lookup";
+            let id = crate::object_id(format, ObjectKind::Blob, body);
+            backend
+                .cache
+                .store_object(id, ObjectKind::Blob, body.to_vec())
+                .await?;
+            backend
+                .cache
+                .store_refs(&BTreeMap::from([
+                    (
+                        "refs/heads/main".into(),
+                        RefExpectation {
+                            oid: Some(id),
+                            version: 1,
+                        },
+                    ),
+                    (
+                        "refs/heads/absent/child".into(),
+                        RefExpectation {
+                            oid: Some(id),
+                            version: 1,
+                        },
+                    ),
+                    (
+                        "refs/tags/tag".into(),
+                        RefExpectation {
+                            oid: Some(id),
+                            version: 1,
+                        },
+                    ),
+                ]))
+                .await?;
+            let names = vec![
+                "refs/heads/absent".into(),
+                "refs/heads/main".into(),
+                "refs/tags/missing".into(),
+                "refs/tags/tag".into(),
+            ];
+            assert_eq!(
+                git_refs(&backend, &names).await?,
+                BTreeMap::from([("refs/heads/main".into(), id), ("refs/tags/tag".into(), id)])
+            );
+            assert!(matches!(
+                git_refs(&backend, &["HEAD".into()]).await,
+                Err(GatewayError::MalformedCache)
+            ));
+        }
+        Ok(())
+    }
+    #[test]
+    fn ref_pages_bound_names_and_bytes_and_reject_non_literal_input() {
+        let long = format!(
+            "refs/heads/{}",
+            "x".repeat(crate::packs::ref_state::MAX_NAME_BYTES - 11)
+        );
+        let names = vec![long, "refs/tags/a".into(), "refs/tags/b".into()];
+        assert!(valid_ref_names(&names));
+        let pages: Vec<_> = ref_pages(&names, 32, 64 << 10).collect();
+        assert_eq!(pages.iter().map(|p| p.len()).collect::<Vec<_>>(), [1, 2]);
+        assert_eq!(pages.concat(), names);
+        for name in [
+            "HEAD",
+            "refs/heads/a^",
+            "refs/heads/a\n",
+            "refs/heads/a:foo",
+        ] {
+            assert!(!valid_ref_names(&[name.into()]));
+        }
+        assert!(!valid_ref_names(&[format!(
+            "refs/heads/{}",
+            "x".repeat(65_536)
+        )]));
+    }
+}
diff --git a/crates/canopy-server/src/git_gateway/push.rs b/crates/canopy-server/src/git_gateway/push.rs
index 97816093..0fca0d64 100644
--- a/crates/canopy-server/src/git_gateway/push.rs
+++ b/crates/canopy-server/src/git_gateway/push.rs
@@ -24,10 +24,11 @@ impl GitGateway {
                     .ok_or(GatewayError::MalformedCache)?;
                 return Ok::<_, GatewayError>((response, None, None));
             }
-            let cached = self.build_cache(self.cell_refs().await?, true).await?;
+            let names = commands.names();
+            let cached = self.build_cache(actor, &names).await?;
             self.install_branch_policy(&cached, &commands).await?;
             let signers = self.install_certificate_policy(&cached, &commands, actor).await?;
-            let before = cached.snapshot.refs.clone();
+            let before = cached.refs.clone();
             let backend = signers.map_or_else(
                 || cached.backend.clone(),
                 |path| cached.backend.with_signers(path),
@@ -37,7 +38,7 @@ impl GitGateway {
             // Git may accept some refs and reject others unless atomic was requested.
             // Publish its actual changes before returning any successful per-ref report.
             let plan = if response.status == 200 {
-                let after = git_refs(&cached.backend.git_dir(), &cached.backend.cache.native).await?;
+                let after = git_refs(&cached.backend, &names).await?;
                 let plan = diff_refs(&before, &after, actor);
                 if plan.updates.is_empty() {
                     None
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 88c3bbb9..4835645b 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -198,7 +198,9 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("git_cache/serving_refs.rs"));
                 source.update(include_bytes!("git_cache/cleanup.rs"));
                 source.update(include_bytes!("git_cache/mod.rs"));
+                source.update(include_bytes!("git_cache/maintenance.rs"));
                 source.update(include_bytes!("packs/catalog/native.rs"));
+                source.update(include_bytes!("packs/catalog/reader.rs"));
                 source.update(include_bytes!("packs/catalog/graph_spool.rs"));
                 source.update(include_bytes!("packs/catalog/files.rs"));
                 source.update(include_bytes!("native_resources.rs"));
@@ -206,6 +208,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("native_git/process.rs"));
                 source.update(include_bytes!("native_git/process/fence.rs"));
                 source.update(include_bytes!("git_gateway/mod.rs"));
+                source.update(include_bytes!("git_gateway/candidates/mod.rs"));
                 source.update(include_bytes!("git_gateway/fetch.rs"));
                 source.update(include_bytes!("git_gateway/discovery.rs"));
                 source.update(include_bytes!("git_gateway/ssh.rs"));
@@ -221,6 +224,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/directory/index/record.rs"));
                 source.update(include_bytes!("packs/directory/index/codec.rs"));
                 source.update(include_bytes!("packs/directory/index/cursor.rs"));
+                source.update(include_bytes!("packs/directory/index/changes.rs"));
                 source.update(include_bytes!("packs/directory/index/update.rs"));
                 source.update(include_bytes!("packs/directory/index/bulk.rs"));
                 source.update(include_bytes!("packs/directory/index/rewrite.rs"));
@@ -316,6 +320,9 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!(
                     "packs/publication/serving/session/workspace.rs"
                 ));
+                source.update(include_bytes!(
+                    "packs/publication/serving/session/native_base.rs"
+                ));
                 source.update(include_bytes!("git_read/mod.rs"));
                 source.update(include_bytes!("git_read/browse.rs"));
                 source.update(include_bytes!("git_read/graph.rs"));
diff --git a/crates/canopy-server/src/object_reads/mod.rs b/crates/canopy-server/src/object_reads/mod.rs
index e8d6dee2..5562563d 100644
--- a/crates/canopy-server/src/object_reads/mod.rs
+++ b/crates/canopy-server/src/object_reads/mod.rs
@@ -1,8 +1,8 @@
 //! Bounded immutable object pages for cold cache hydration.
 
 use cellule_runtime::{
-    Error, InvocationError, Observed, Receipt, primitives::sql::SqlBatch,
-    primitives::sql::SqlResultSet, primitives::sql::SqlStatement, primitives::sql::SqlValue,
+    Error, InvocationError, Observed, primitives::sql::SqlBatch, primitives::sql::SqlResultSet,
+    primitives::sql::SqlStatement, primitives::sql::SqlValue,
 };
 
 use crate::{
@@ -12,11 +12,8 @@ use crate::{
 
 pub(crate) struct ObjectHeaders {
     pub(crate) objects: Observed<Vec<crate::ObjectId>>,
-    pub(crate) through: i64,
 }
 
-const CHANGED_HEADERS: &str = "SELECT sequence, oid, CASE WHEN storage = 'inline' THEN size ELSE 0 END FROM objects WHERE sequence > ?1 AND sequence <= ?2 ORDER BY sequence LIMIT ?3";
-
 impl RepositoryCell {
     /// Reads at most 128 objects and 768 KiB of inline bodies, in OID order.
     ///
@@ -50,55 +47,9 @@ impl RepositoryCell {
         Ok(self.object_records(headers.objects).await?.output)
     }
 
-    pub(crate) async fn object_high_water(
-        &self,
-    ) -> Result<Observed<i64>, InvocationError<Vec<SqlResultSet>>> {
-        let result = self
-            .sql
-            .query(
-                None,
-                SqlBatch {
-                    statements: vec![SqlStatement {
-                        sql: "SELECT COALESCE(MAX(sequence), 0) FROM objects".into(),
-                        parameters: vec![],
-                    }],
-                },
-            )
-            .await?;
-        let row = result.output.first().and_then(|set| set.rows.first());
-        let Some([SqlValue::Integer(sequence)]) = row.map(Vec::as_slice) else {
-            return Err(InvocationError::NotStarted(Error::Command(
-                "invalid object high water",
-            )));
-        };
-        Ok(Observed {
-            output: *sequence,
-            receipt: result.receipt,
-        })
-    }
-
-    pub(crate) async fn object_headers(
-        &self,
-        after: i64,
-        high_water: &Observed<i64>,
-    ) -> Result<ObjectHeaders, InvocationError<Vec<SqlResultSet>>> {
-        self.read_object_headers(
-            Some(high_water.receipt),
-            SqlStatement {
-                sql: CHANGED_HEADERS.into(),
-                parameters: vec![
-                    SqlValue::Integer(after),
-                    SqlValue::Integer(high_water.output),
-                    SqlValue::Integer(MAX_OBJECTS as i64),
-                ],
-            },
-        )
-        .await
-    }
-
     async fn read_object_headers(
         &self,
-        minimum: Option<Receipt>,
+        minimum: Option<cellule_runtime::Receipt>,
         statement: SqlStatement,
     ) -> Result<ObjectHeaders, InvocationError<Vec<SqlResultSet>>> {
         let headers = self
@@ -114,13 +65,12 @@ impl RepositoryCell {
             .output
             .first()
             .ok_or_else(|| InvocationError::NotStarted(Error::Command("missing object headers")))?;
-        let (ids, through) = decode_headers(&rows.rows).map_err(InvocationError::NotStarted)?;
+        let (ids, _) = decode_headers(&rows.rows).map_err(InvocationError::NotStarted)?;
         Ok(ObjectHeaders {
             objects: Observed {
                 output: ids,
                 receipt: headers.receipt,
             },
-            through,
         })
     }
 
@@ -290,6 +240,3 @@ fn decode_object(row: Vec<SqlValue>) -> cellule_runtime::Result<StoredObject> {
     };
     Ok(StoredObject { oid, kind, storage })
 }
-
-#[cfg(test)]
-mod tests;
diff --git a/crates/canopy-server/src/object_reads/tests.rs b/crates/canopy-server/src/object_reads/tests.rs
deleted file mode 100644
index 384d9352..00000000
--- a/crates/canopy-server/src/object_reads/tests.rs
+++ /dev/null
@@ -1,127 +0,0 @@
-use super::*;
-use cellule_ltx::rusqlite::{Connection, StatementStatus, params};
-
-type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error>>;
-
-fn database() -> Result<Connection> {
-    let db = Connection::open_in_memory()?;
-    db.execute_batch(crate::SCHEMA)?;
-    Ok(db)
-}
-
-fn insert(db: &Connection, body: &[u8]) -> Result<crate::ObjectId> {
-    let oid = object_id(crate::ObjectFormat::Sha1, ObjectKind::Blob, body);
-    db.execute(
-        "INSERT INTO objects (oid, kind, size, digest, storage, body) VALUES (?1, 'blob', ?2, ?3, 'inline', ?4) ON CONFLICT(oid) DO NOTHING",
-        params![oid.as_ref(), body.len() as i64, blake3::hash(body).as_bytes().as_slice(), body],
-    )?;
-    Ok(oid)
-}
-
-fn high_water(db: &Connection) -> Result<i64> {
-    Ok(db.query_row(
-        "SELECT COALESCE(MAX(sequence), 0) FROM objects",
-        [],
-        |row| row.get(0),
-    )?)
-}
-
-fn page(db: &Connection, after: i64, high: i64) -> Result<(Vec<crate::ObjectId>, i64)> {
-    let mut statement = db.prepare(CHANGED_HEADERS)?;
-    let rows = statement
-        .query_map(params![after, high, MAX_OBJECTS as i64], |row| {
-            Ok(vec![
-                SqlValue::Integer(row.get(0)?),
-                SqlValue::Blob(row.get(1)?),
-                SqlValue::Integer(row.get(2)?),
-            ])
-        })?
-        .collect::<std::result::Result<Vec<_>, _>>()?;
-    // An indexed range must neither walk the old history nor sort it anew.
-    assert_eq!(statement.get_status(StatementStatus::FullscanStep), 0);
-    assert_eq!(statement.get_status(StatementStatus::Sort), 0);
-    Ok(decode_headers(&rows)?)
-}
-
-#[test]
-fn insertion_cursor_finds_lower_oids_and_excludes_later_publications() -> Result {
-    let db = database()?;
-    let mut bodies: Vec<_> = (0..260)
-        .map(|n| format!("cursor-{n}").into_bytes())
-        .collect();
-    bodies.sort_by_key(|body| {
-        std::cmp::Reverse(object_id(crate::ObjectFormat::Sha1, ObjectKind::Blob, body))
-    });
-    let mut expected = Vec::new();
-    for body in &bodies[..259] {
-        expected.push(insert(&db, body)?);
-    }
-    let high = high_water(&db)?;
-    let late = insert(&db, &bodies[259])?;
-    assert!(late < *expected.last().ok_or("missing object")?);
-    let mut after = 0;
-    let mut actual = Vec::new();
-    while after < high {
-        let (ids, through) = page(&db, after, high)?;
-        assert!(!ids.is_empty());
-        assert!(ids.len() <= MAX_OBJECTS);
-        actual.extend(ids);
-        after = through;
-    }
-    assert_eq!(actual, expected);
-    assert!(page(&db, after, high)?.0.is_empty());
-    assert_eq!(page(&db, after, high_water(&db)?)?.0, vec![late]);
-    Ok(())
-}
-
-#[test]
-fn byte_limited_page_advances_only_over_the_selected_prefix() -> Result {
-    let db = database()?;
-    let first = insert(&db, &vec![1; INLINE_OBJECT_LIMIT / 2])?;
-    let second = insert(&db, &vec![2; INLINE_OBJECT_LIMIT])?;
-    let third = insert(&db, b"third")?;
-    let high = high_water(&db)?;
-    let (ids, after) = page(&db, 0, high)?;
-    assert_eq!(ids, vec![first]);
-    let (ids, after) = page(&db, after, high)?;
-    assert_eq!(ids, vec![second]);
-    assert_eq!(page(&db, after, high)?.0, vec![third]);
-    Ok(())
-}
-
-#[test]
-fn duplicate_rollback_and_deletion_do_not_hide_subsequent_inserts() -> Result {
-    let db = database()?;
-    let original = insert(&db, b"original")?;
-    let after = high_water(&db)?;
-    insert(&db, b"original")?;
-    assert_eq!(high_water(&db)?, after);
-    db.execute_batch("SAVEPOINT failed_batch")?;
-    insert(&db, b"rolled back")?;
-    db.execute_batch("ROLLBACK TO failed_batch; RELEASE failed_batch")?;
-    assert_eq!(high_water(&db)?, after);
-    db.execute("DELETE FROM objects WHERE oid = ?1", [original.as_ref()])?;
-    // The product has no collector yet. Never reusing a committed cursor also
-    // protects a future fenced collection from hiding newly inserted rows.
-    let next = insert(&db, b"after deletion")?;
-    assert!(high_water(&db)? > after);
-    assert_eq!(page(&db, after, high_water(&db)?)?.0, vec![next]);
-    Ok(())
-}
-
-#[test]
-fn small_increment_uses_bounded_sql_work_after_large_history() -> Result {
-    let db = database()?;
-    db.execute_batch("BEGIN")?;
-    for n in 0..10_000 {
-        insert(&db, format!("history-{n}").as_bytes())?;
-    }
-    db.execute_batch("COMMIT")?;
-    let after = high_water(&db)?;
-    let mut expected = Vec::new();
-    for body in [b"one".as_slice(), b"two", b"three"] {
-        expected.push(insert(&db, body)?);
-    }
-    assert_eq!(page(&db, after, high_water(&db)?)?.0, expected);
-    Ok(())
-}
diff --git a/crates/canopy-server/src/pack_store.rs b/crates/canopy-server/src/pack_store.rs
index 6968a69b..368e303b 100644
--- a/crates/canopy-server/src/pack_store.rs
+++ b/crates/canopy-server/src/pack_store.rs
@@ -21,7 +21,6 @@ pub(crate) struct PackRecord {
     pub pack: LargeBlobReference,
     pub index: LargeBlobReference,
     pub approved: bool,
-    pub covered_through: i64,
 }
 
 pub(crate) struct PackReader {
@@ -72,12 +71,6 @@ impl PackReader {
             cache.as_ref().ok_or(GatewayError::MalformedCache)?,
         ))
     }
-    pub(crate) async fn replace(&self, old: &Arc<GitCache>, next: Arc<GitCache>) {
-        let mut cache = self.cache.lock().await;
-        if cache.as_ref().is_some_and(|cache| Arc::ptr_eq(cache, old)) {
-            *cache = Some(next);
-        }
-    }
     pub(crate) async fn install(
         &self,
         cache: &Arc<GitCache>,
@@ -155,6 +148,7 @@ impl PackReader {
             process,
             output,
             oid,
+            #[cfg(test)]
             size,
             remaining: size,
             expected: digest,
@@ -219,6 +213,7 @@ pub(crate) struct NativePackedRead {
     process: GitProcess<Arc<GitCache>>,
     output: tokio::process::ChildStdout,
     pub(crate) oid: ObjectId,
+    #[cfg(test)]
     pub(crate) size: u64,
     remaining: u64,
     expected: [u8; 32],
@@ -294,7 +289,7 @@ fn decode(row: &[SqlValue]) -> Result<PackRecord, ReadError> {
         SqlValue::Blob(index_digest),
         SqlValue::Blob(index_sha),
         SqlValue::Integer(approved),
-        SqlValue::Integer(covered_through),
+        SqlValue::Integer(_covered_through),
     ] = row
     else {
         return Err(invalid());
@@ -314,7 +309,6 @@ fn decode(row: &[SqlValue]) -> Result<PackRecord, ReadError> {
             sha256: index_sha.as_slice().try_into().map_err(|_| invalid())?,
         },
         approved: *approved == 1,
-        covered_through: *covered_through,
     })
 }
 impl RepositoryCell {
@@ -339,17 +333,6 @@ impl RepositoryCell {
                 .ok_or_else(invalid)?,
         )
     }
-    pub(crate) async fn approved_packs(&self, after: &[u8]) -> Result<Vec<PackRecord>, ReadError> {
-        let result = self.sql.query(None, SqlBatch { statements: vec![SqlStatement { sql: format!("SELECT {COLUMNS} FROM git_packs WHERE approved = 1 AND sha256 > ?1 ORDER BY sha256 LIMIT 128"), parameters: vec![SqlValue::Blob(after.to_vec())] }] }).await?;
-        result
-            .output
-            .first()
-            .ok_or_else(invalid)?
-            .rows
-            .iter()
-            .map(|row| decode(row))
-            .collect()
-    }
     pub(crate) async fn register_pack(
         &self,
         identity: MutationIdentity,
diff --git a/crates/canopy-server/src/packs/catalog/files.rs b/crates/canopy-server/src/packs/catalog/files.rs
index 8b25b9c4..76606ce9 100644
--- a/crates/canopy-server/src/packs/catalog/files.rs
+++ b/crates/canopy-server/src/packs/catalog/files.rs
@@ -159,6 +159,19 @@ impl CatalogFiles {
             .workspace(owner, cleanup, head)
             .await
     }
+    pub(in crate::packs) async fn write_workspace(
+        &self,
+        owner: crate::git_objects::ReadOwner,
+        cleanup: crate::git_objects::ReadOwner,
+        head: String,
+        objects: Arc<crate::git_cache::GitCache>,
+    ) -> Result<Arc<crate::git_cache::GitCache>, super::native::NativeReadError> {
+        self.native
+            .as_ref()
+            .ok_or(super::native::NativeReadError::Unavailable)?
+            .workspace_with_objects(owner, cleanup, head, Some(objects))
+            .await
+    }
     pub(in crate::packs) async fn install_workspace(
         &self,
         cache: Arc<crate::git_cache::GitCache>,
diff --git a/crates/canopy-server/src/packs/catalog/native.rs b/crates/canopy-server/src/packs/catalog/native.rs
index d231503d..72ed5052 100644
--- a/crates/canopy-server/src/packs/catalog/native.rs
+++ b/crates/canopy-server/src/packs/catalog/native.rs
@@ -224,6 +224,16 @@ impl NativeFiles {
         owner: ReadOwner,
         cleanup: ReadOwner,
         head: String,
+    ) -> Result<Arc<GitCache>, NativeReadError> {
+        self.workspace_with_objects(owner, cleanup, head, None)
+            .await
+    }
+    pub(super) async fn workspace_with_objects(
+        &self,
+        owner: ReadOwner,
+        cleanup: ReadOwner,
+        head: String,
+        objects: Option<Arc<GitCache>>,
     ) -> Result<Arc<GitCache>, NativeReadError> {
         let admission = self.admit(owner.clone(), 4096).await?;
         let lifetime: ReadOwner = Arc::new((cleanup, admission));
@@ -232,7 +242,7 @@ impl NativeFiles {
             self.budget.clone(),
             &head,
             self.format,
-            None,
+            objects,
             self.native.clone(),
             CacheOwnership {
                 work: Arc::new((owner, lifetime.clone())),
diff --git a/crates/canopy-server/src/packs/catalog/reader.rs b/crates/canopy-server/src/packs/catalog/reader.rs
index 04ab4e96..f8755954 100644
--- a/crates/canopy-server/src/packs/catalog/reader.rs
+++ b/crates/canopy-server/src/packs/catalog/reader.rs
@@ -106,6 +106,18 @@ impl CatalogReader {
     pub(in crate::packs) fn source_root(&self) -> Option<SourceRoot> {
         self.source_root
     }
+    pub(in crate::packs) fn source_changes(
+        &self,
+        before: Option<SourceRoot>,
+        after: Option<super::super::directory::SegmentKey>,
+    ) -> Result<
+        super::super::directory::index::RangeChanges<'_, super::super::sources::SourceRecord>,
+        IndexError,
+    > {
+        self.indexes
+            .sources
+            .changes(before, self.source_root, after)
+    }
     pub async fn lookup(
         &self,
         oid: ObjectId,
diff --git a/crates/canopy-server/src/packs/directory/index/changes.rs b/crates/canopy-server/src/packs/directory/index/changes.rs
new file mode 100644
index 00000000..f47b8f50
--- /dev/null
+++ b/crates/canopy-server/src/packs/directory/index/changes.rs
@@ -0,0 +1,200 @@
+//! Ordered additions/replacements between retained immutable roots. Equal
+//! authenticated subtrees are skipped; no historical key set is materialized.
+use super::*;
+
+#[derive(Clone)]
+enum Item<R: IndexRecord> {
+    Node(NodeRef<R>),
+    Record(R),
+}
+impl<R: IndexRecord> Item<R> {
+    fn first(&self) -> R::Key {
+        match self {
+            Self::Node(n) => n.first_key.clone(),
+            Self::Record(r) => r.first_key(),
+        }
+    }
+    fn last(&self) -> R::Key {
+        match self {
+            Self::Node(n) => n.last_key.clone(),
+            Self::Record(r) => r.last_key(),
+        }
+    }
+}
+
+/// Differences are defined by record first key and full record equality.
+/// Deletions are omitted. A canceled/failed page poisons the cursor; restart
+/// with the same root pair and the last *returned* record's first key.
+pub struct RangeChanges<'a, R: IndexRecord> {
+    index: &'a RangeIndex<R>,
+    before: Vec<Item<R>>,
+    after: Vec<Item<R>>,
+    resume: Option<R::Key>,
+    pending: Option<R>,
+    initialized: bool,
+    poisoned: bool,
+}
+impl<R: IndexRecord> RangeIndex<R> {
+    pub fn changes(
+        &self,
+        before: Option<NodeRef<R>>,
+        after: Option<NodeRef<R>>,
+        resume: Option<R::Key>,
+    ) -> Result<RangeChanges<'_, R>, IndexError> {
+        for root in [&before, &after].into_iter().flatten() {
+            root.validate(self.format)?;
+        }
+        if resume.as_ref().is_some_and(|key| !key.valid(self.format)) {
+            return Err(IndexError::Integrity);
+        }
+        Ok(RangeChanges {
+            index: self,
+            before: before.into_iter().map(Item::Node).collect(),
+            after: after.into_iter().map(Item::Node).collect(),
+            resume,
+            pending: None,
+            initialized: false,
+            poisoned: false,
+        })
+    }
+}
+impl<R: IndexRecord> RangeChanges<'_, R> {
+    async fn expand(index: &RangeIndex<R>, stack: &mut Vec<Item<R>>) -> Result<(), IndexError> {
+        let Some(Item::Node(reference)) = stack.pop() else {
+            return Err(IndexError::Integrity);
+        };
+        let node = index.load(reference).await?;
+        match &node.contents {
+            Contents::Children(v) => stack.extend(v.iter().rev().cloned().map(Item::Node)),
+            Contents::Runs(v) => stack.extend(v.iter().rev().cloned().map(Item::Record)),
+        }
+        // At most one path's unvisited siblings per level, including its leaf.
+        if stack.len() > (usize::from(R::MAX_HEIGHT) + 1) * R::FANOUT {
+            return Err(IndexError::Limit);
+        }
+        Ok(())
+    }
+    async fn next_inner(&mut self) -> Result<Option<R>, IndexError> {
+        if !self.initialized {
+            self.initialized = true;
+            // Authenticate root context even when the entire pair is equal.
+            for stack in [&self.before, &self.after] {
+                if let Some(Item::Node(root)) = stack.last() {
+                    self.index.validate_root(root.clone()).await?;
+                }
+            }
+        }
+        if let Some(record) = self.pending.take() {
+            return Ok(Some(record));
+        }
+        loop {
+            let Some(new) = self.after.last() else {
+                return Ok(None);
+            };
+            if self.resume.as_ref().is_some_and(|key| new.last() <= *key) {
+                self.after.pop();
+                continue;
+            }
+            if let Some(old) = self.before.last() {
+                if let (Item::Node(a), Item::Node(b)) = (old, new)
+                    && a == b
+                {
+                    self.before.pop();
+                    self.after.pop();
+                    continue;
+                }
+                if old.last() < new.first() {
+                    self.before.pop();
+                    continue;
+                }
+                if old.first() <= new.last() {
+                    match (old, new) {
+                        (Item::Node(a), Item::Node(b)) if a.height >= b.height => {
+                            Self::expand(self.index, &mut self.before).await?;
+                            continue;
+                        }
+                        (_, Item::Node(_)) => {
+                            Self::expand(self.index, &mut self.after).await?;
+                            continue;
+                        }
+                        (Item::Node(_), _) => {
+                            Self::expand(self.index, &mut self.before).await?;
+                            continue;
+                        }
+                        (Item::Record(a), Item::Record(b)) => {
+                            // Range overlap is allowed between generations. Matching
+                            // is by first key, rather than by enclosing interval.
+                            if a.first_key() < b.first_key() {
+                                self.before.pop();
+                                continue;
+                            }
+                            if a.first_key() == b.first_key() {
+                                let equal = a == b;
+                                self.before.pop();
+                                if equal {
+                                    self.after.pop();
+                                    continue;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            match self.after.last() {
+                Some(Item::Node(_)) => Self::expand(self.index, &mut self.after).await?,
+                Some(Item::Record(_)) => {
+                    let Some(Item::Record(record)) = self.after.pop() else {
+                        return Err(IndexError::Integrity);
+                    };
+                    if self
+                        .resume
+                        .as_ref()
+                        .is_none_or(|key| record.first_key() > *key)
+                    {
+                        return Ok(Some(record));
+                    }
+                }
+                None => return Ok(None),
+            }
+        }
+    }
+    /// Bound both record count and encoded descriptor bytes. Native input bytes
+    /// are separately admitted before downloads. Never advance over a record
+    /// excluded by the byte limit, including when a short page is returned.
+    pub async fn page(&mut self, count: usize, bytes: usize) -> Result<Vec<R>, IndexError> {
+        if self.poisoned {
+            return Err(IndexError::Integrity);
+        }
+        if count == 0 || count > R::FANOUT || bytes == 0 || bytes > R::NODE_BYTES as usize {
+            return Err(IndexError::Limit);
+        }
+        self.poisoned = true;
+        let result = self.page_inner(count, bytes).await;
+        if result.is_ok() {
+            self.poisoned = false;
+        }
+        result
+    }
+    async fn page_inner(&mut self, count: usize, bytes: usize) -> Result<Vec<R>, IndexError> {
+        let mut page = Vec::with_capacity(count);
+        let mut used = 0;
+        while page.len() < count {
+            let Some(record) = self.next_inner().await? else {
+                break;
+            };
+            let mut encoder = BoundedEncoder::new(R::NODE_BYTES)?;
+            record.encode_record(&mut encoder)?;
+            let size = encoder.finish().len();
+            if size > bytes - used {
+                if page.is_empty() {
+                    return Err(IndexError::Limit);
+                }
+                self.pending = Some(record);
+                break;
+            }
+            used += size;
+            page.push(record);
+        }
+        Ok(page)
+    }
+}
diff --git a/crates/canopy-server/src/packs/directory/index/mod.rs b/crates/canopy-server/src/packs/directory/index/mod.rs
index 7fe9cf56..7410100f 100644
--- a/crates/canopy-server/src/packs/directory/index/mod.rs
+++ b/crates/canopy-server/src/packs/directory/index/mod.rs
@@ -14,9 +14,11 @@ pub(in crate::packs) mod codec;
 pub(in crate::packs) mod record;
 pub use record::{IndexKey, IndexRecord};
 mod bulk;
+mod changes;
 mod cursor;
 mod rewrite;
 mod update;
+pub use changes::RangeChanges;
 pub use cursor::RangeCursor;
 
 pub const FANOUT: usize = 128;
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
index 662f26d7..4cdbe315 100644
--- a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -116,6 +116,19 @@ pub struct ServingSnapshot {
     _borrow: Arc<Borrow>,
 }
 impl ServingSnapshot {
+    pub(crate) async fn resolve_refs(
+        &self,
+        names: &[String],
+    ) -> Result<Vec<ResolvedServingRef>, ServingReadError> {
+        self.pin.resolve_refs(self.actor.clone(), names).await
+    }
+    /// Internal write-preparation inputs. Publication still needs a separately
+    /// authorized staged producer; this API grants no forward membership proof.
+    pub(crate) async fn native_base(
+        &self,
+    ) -> Result<crate::git_http::GitHttpBackend, ServingReadError> {
+        self.pin.native_base(self.actor.clone(), self.clone()).await
+    }
     /// Build a complete forward closure from certified roots. Callers choosing
     /// fetch roots must independently bind them to this snapshot's live refs.
     pub async fn workspace(
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index a477a0e3..2e1a51d6 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -13,6 +13,7 @@ use tokio::{sync::Notify, time::Instant};
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 mod body;
 mod edges;
+mod native_base;
 mod workspace;
 pub use edges::{MAX_EDGE_PARENTS, ServingEdgePage};
 pub use workspace::{NativeWorkspace, WorkspaceLimits, WorkspaceStats};
diff --git a/crates/canopy-server/src/packs/publication/serving/session/native_base.rs b/crates/canopy-server/src/packs/publication/serving/session/native_base.rs
new file mode 100644
index 00000000..2969b1e7
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/native_base.rs
@@ -0,0 +1,107 @@
+//! Disposable native base for write preparation. Catalog presence supplies
+//! inputs, never fetch reachability or authority to publish mutations.
+use super::workspace::{Observation, job};
+use super::*;
+use crate::git_objects::ReadOwner;
+
+impl ServingPin {
+    pub(in crate::packs::publication::serving) async fn native_base(
+        &self,
+        actor: Option<String>,
+        snapshot: ServingSnapshot,
+    ) -> Result<crate::git_http::GitHttpBackend, ServingReadError> {
+        self.read_session(
+            actor.clone(),
+            move |inner, deadline, permit| async move {
+                let mut observation = Observation {
+                    deadline,
+                    next: Instant::now(),
+                };
+                let refs = inner.ref_snapshot().await?.clone();
+                let cleanup: ReadOwner = Arc::new((inner.child(), snapshot));
+                let owner: ReadOwner = Arc::new((cleanup.clone(), permit));
+                let cache = inner
+                    .context
+                    .files
+                    .workspace(owner.clone(), cleanup.clone(), refs.default_branch.clone())
+                    .await?;
+                let limits = WorkspaceLimits::default();
+                let spool = inner
+                    .context
+                    .files
+                    .graph_spool(
+                        limits.max_spool_bytes,
+                        limits.cache_kib,
+                        owner.clone(),
+                        cleanup.clone(),
+                    )
+                    .await
+                    .map_err(crate::packs::directory::index::IndexError::from)?;
+                let reader = inner.catalog().await?;
+                let mut sources = reader.source_changes(None, None)?;
+                loop {
+                    observation.refresh(&inner, &actor).await?;
+                    let page = sources.page(128, 64 << 10).await?;
+                    if page.is_empty() {
+                        break;
+                    }
+                    for record in page {
+                        observation.refresh(&inner, &actor).await?;
+                        let native = record.native();
+                        native.validate(inner.context.repository(), inner.lease.format)?;
+                        if !job(&spool, owner.clone(), move |s| s.pack_seen(native)).await? {
+                            inner
+                                .context
+                                .files
+                                .install_workspace(cache.clone(), native, owner.clone())
+                                .await?;
+                            observation.refresh(&inner, &actor).await?;
+                            job(&spool, owner.clone(), move |s| s.imported(native)).await?;
+                        }
+                    }
+                }
+                // Writable native results have their own pack directory. Baseline
+                // catalog inputs remain immutable alternates, never incoming packs.
+                let cache = inner
+                    .context
+                    .files
+                    .write_workspace(owner.clone(), cleanup, refs.default_branch.clone(), cache)
+                    .await?;
+                let mut names = inner.context.indexes.refs().cursor(refs.root, None, true)?;
+                let mut writer = cache
+                    .serving_refs(owner.clone())
+                    .await
+                    .map_err(crate::packs::catalog::NativeReadError::from)?;
+                loop {
+                    observation.refresh(&inner, &actor).await?;
+                    let mut page = Vec::with_capacity(crate::refs::REF_PAGE_SIZE);
+                    for _ in 0..crate::refs::REF_PAGE_SIZE {
+                        let Some(record) = names.next().await? else {
+                            break;
+                        };
+                        page.push((record.name().to_owned(), record.state().clone()));
+                    }
+                    if page.is_empty() {
+                        break;
+                    }
+                    writer = writer
+                        .append(page)
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
+                }
+                writer
+                    .finish()
+                    .await
+                    .map_err(crate::packs::catalog::NativeReadError::from)?;
+                inner.observe(actor).await?;
+                Ok(crate::git_http::GitHttpBackend {
+                    cache,
+                    nonce_seed: None,
+                    signers: None,
+                })
+            },
+            true,
+        )
+        .await
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/session/refs.rs b/crates/canopy-server/src/packs/publication/serving/session/refs.rs
index 012e64a2..379f1e34 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/refs.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/refs.rs
@@ -35,6 +35,44 @@ impl Inner {
 }
 
 impl ServingPin {
+    pub(in crate::packs::publication::serving) async fn resolve_refs(
+        &self,
+        actor: Option<String>,
+        names: &[String],
+    ) -> Result<Vec<ResolvedServingRef>, ServingReadError> {
+        if names.len() > 128
+            || names.iter().any(|name| !valid_ref_name(name))
+            || names.iter().map(String::len).sum::<usize>() > PAGE_BYTES
+            || names.windows(2).any(|p| p[0] >= p[1])
+        {
+            return Err(ServingReadError::Context);
+        }
+        let names = names
+            .iter()
+            .map(|name| RefNameKey::new(name))
+            .collect::<Result<Vec<_>, _>>()?;
+        self.read_owned(actor, move |inner, deadline, _permit| async move {
+            let snapshot = inner.ref_snapshot().await?;
+            let mut result = Vec::with_capacity(names.len());
+            for name in names {
+                if Instant::now() >= deadline {
+                    return Err(ServingReadError::Inactive);
+                }
+                result.push(ResolvedServingRef {
+                    generation: snapshot.generation as i64,
+                    state: inner
+                        .context
+                        .indexes
+                        .refs()
+                        .read(snapshot.root.clone(), name.as_str())
+                        .await?,
+                    reference: name.as_str().to_owned(),
+                });
+            }
+            Ok(result)
+        })
+        .await
+    }
     pub async fn resolve_ref(
         &self,
         actor: Option<String>,
diff --git a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
index cdf41465..ab672874 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
@@ -353,7 +353,7 @@ impl ServingPin {
         .await
     }
 }
-async fn job<T: Send + 'static>(
+pub(super) async fn job<T: Send + 'static>(
     spool: &Arc<Mutex<GraphSpool>>,
     owner: ReadOwner,
     body: impl FnOnce(&mut GraphSpool) -> Result<T, MetadataError> + Send + 'static,
@@ -371,12 +371,12 @@ async fn job<T: Send + 'static>(
 /// Amortize authority queries across bounded graph steps, rather than issuing
 /// repository SQL per object. Long provider suspensions still force a fresh check
 /// before the next step, and construction always rechecks before returning.
-struct Observation {
-    deadline: Instant,
-    next: Instant,
+pub(super) struct Observation {
+    pub(super) deadline: Instant,
+    pub(super) next: Instant,
 }
 impl Observation {
-    async fn refresh(
+    pub(super) async fn refresh(
         &mut self,
         inner: &Inner,
         actor: &Option<String>,
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
index 239747ce..d0fe9b7d 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
@@ -1,6 +1,141 @@
 //! Native forward closures use physically verified packs. Trusted generation
 //! installation isolates serving from the still-incomplete live publisher.
 use super::*;
+
+#[tokio::test]
+async fn native_write_base_streams_catalog_inputs_and_isolates_new_native_outputs() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (native, _) = super::body::catalog(&f, Arc::new(InMemory::new())).await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, files) =
+            super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+        let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+        let view = pool.snapshot(Some("owner".into())).await?;
+        let backend = view.native_base().await?;
+        assert!(backend.cache.pack_sources().await?.is_empty());
+        assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 2);
+        let mut objects = crate::git_objects::GitObjects::batch_owned(
+            &backend.git_dir(),
+            &backend.cache.native,
+            backend.cache.clone(),
+        )?;
+        for (id, (expected, _)) in &native.fixture.objects {
+            let body = objects.read_verified(*expected, 1 << 20).await?;
+            assert_eq!(crate::object_id(format, expected.kind, &body), *id);
+        }
+        objects.finish().await?;
+        let path = backend.git_dir();
+        assert_eq!(std::fs::read_dir(path.join("objects/pack"))?.count(), 0);
+        assert!(path.join("objects/info/alternates").exists());
+        let body = b"new generated native object";
+        let written = crate::packs::metadata::tests::git(
+            &path,
+            &["hash-object", "-w", "--stdin"],
+            Some(body.to_vec()),
+        )
+        .await?;
+        let id = crate::object_id(format, ObjectKind::Blob, body);
+        assert_eq!(String::from_utf8(written)?.trim(), hex::encode(id));
+        let input = format!("{}\n", hex::encode(id));
+        let pack = crate::packs::metadata::tests::git(
+            &path,
+            &["pack-objects", "--stdout"],
+            Some(input.into_bytes()),
+        )
+        .await?;
+        crate::packs::metadata::tests::git(&path, &["index-pack", "--stdin"], Some(pack)).await?;
+        let incoming = backend.cache.pack_sources().await?;
+        assert_eq!(incoming.len(), 1);
+        assert_eq!(incoming[0].3, [id]); // baseline history must never be ingested as the new pack
+        drop(view);
+        let mut drain = tokio::spawn({
+            let pool = pool.clone();
+            async move { pool.close_and_drain().await }
+        });
+        assert!(
+            timeout(Duration::from_millis(50), &mut drain)
+                .await
+                .is_err()
+        );
+        assert_eq!(pin_count(&f).await?, 1);
+        drop(backend);
+        timeout(Duration::from_secs(8), drain).await??;
+        super::pool::finish(&f, &pool, &q, tasks).await?;
+        assert!(!path.exists());
+        assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 0);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_write_base_cancellation_and_revocation_retain_real_provider_work_until_drain()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for cancel in [false, true] {
+            let f = Fixture::new(format).await?;
+            let provider = Arc::new(super::blocked::Gate::new());
+            let (native, _) = super::body::catalog(&f, provider.clone()).await?;
+            edit(
+                &f,
+                "INSERT INTO repository_members(account,role) VALUES('viewer','read')",
+            )
+            .await?;
+            let q = super::pool::queue(&f)?;
+            let root = tempfile::TempDir::new()?;
+            let tasks = TaskTracker::new();
+            let (ctx, files) =
+                super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+            let pool = ServingPool::new(ctx, q.clone(), ServingPoolLimits::default())?;
+            let view = pool.snapshot(Some("viewer".into())).await?;
+            assert!(
+                view.headers(&[*native.fixture.objects.keys().next().ok_or("object")?])
+                    .await?[0]
+                    .is_some()
+            );
+            // Warm immutable ref-root metadata so the gate below suspends the
+            // native pack transfer after file admission, not ref-root loading.
+            view.resolve_ref(None).await?;
+            provider.armed.store(true, Ordering::Release);
+            let observer = tokio::spawn(async move { view.native_base().await });
+            timeout(Duration::from_secs(8), provider.entered.acquire())
+                .await??
+                .forget();
+            if cancel {
+                observer.abort();
+                assert!(observer.await.err().ok_or("cancelled")?.is_cancelled());
+                let mut drain = tokio::spawn({
+                    let pool = pool.clone();
+                    async move { pool.close_and_drain().await }
+                });
+                assert!(
+                    timeout(Duration::from_millis(50), &mut drain)
+                        .await
+                        .is_err()
+                );
+                assert_eq!(pin_count(&f).await?, 1);
+                assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 1);
+                provider.proceed.add_permits(1);
+                timeout(Duration::from_secs(8), drain).await??;
+            } else {
+                edit(&f, "DELETE FROM repository_members WHERE account='viewer'").await?;
+                assert_eq!(pin_count(&f).await?, 1);
+                provider.proceed.add_permits(1);
+                assert!(matches!(
+                    timeout(Duration::from_secs(8), observer).await??,
+                    Err(ServingReadError::Inactive)
+                ));
+            }
+            super::pool::finish(&f, &pool, &q, tasks).await?;
+            assert_eq!(files.native_stats()?.ok_or("stats")?.open_files, 0);
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
 use crate::packs::catalog::serving_fixture::{operation, prepare};
 use crate::{ObjectId, ObjectKind};
 use std::collections::BTreeSet;
diff --git a/crates/canopy-server/src/packs/sources/tests.rs b/crates/canopy-server/src/packs/sources/tests.rs
index c7c18785..b537df90 100644
--- a/crates/canopy-server/src/packs/sources/tests.rs
+++ b/crates/canopy-server/src/packs/sources/tests.rs
@@ -3,6 +3,7 @@ use super::super::metadata::{
     tests::{builder, fill, fixture},
 };
 use super::*;
+mod changes;
 use canopy_object_storage::artifact::ArtifactStore;
 use canopy_object_storage::external::MAX_ARTIFACT_BYTES;
 use cellule_ltx::DiskBudget;
diff --git a/crates/canopy-server/src/packs/sources/tests/changes.rs b/crates/canopy-server/src/packs/sources/tests/changes.rs
new file mode 100644
index 00000000..3337fa66
--- /dev/null
+++ b/crates/canopy-server/src/packs/sources/tests/changes.rs
@@ -0,0 +1,184 @@
+//! Coverage transferred from the retired SQL hydration sequence to the actual
+//! source descriptor cursor used by native write-base construction.
+use super::*;
+use crate::packs::directory::index::IndexRecord;
+use cellule_runtime::codec::BoundedEncoder;
+
+async fn collect(
+    index: &SourceIndex,
+    before: Option<SourceRoot>,
+    after: Option<SourceRoot>,
+) -> Result<Vec<SourceRecord>> {
+    let mut cursor = index.changes(before, after, None)?;
+    let mut records = Vec::new();
+    loop {
+        let page = cursor.page(7, 64 << 10).await?;
+        if page.is_empty() {
+            break;
+        }
+        records.extend(page);
+    }
+    Ok(records)
+}
+
+#[tokio::test]
+async fn lower_keys_are_found_and_later_publications_are_excluded() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (store, _) = store();
+        let index = SourceIndex::new(store, format);
+        let before = index
+            .build_sorted([5; 16], (200..460).map(|n| Ok(source(n, format))))
+            .await?;
+        let selected = Some(index.insert(before, [6; 16], source(1, format)).await?);
+        let future = Some(index.insert(selected, [7; 16], source(0, format)).await?);
+        assert_eq!(
+            collect(&index, before, selected).await?,
+            [source(1, format)]
+        );
+        assert_eq!(
+            collect(&index, selected, future).await?,
+            [source(0, format)]
+        );
+        assert_eq!(collect(&index, selected, selected).await?, []);
+        assert_eq!(collect(&index, future, before).await?, []); // removals need no new native input
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn byte_limited_pages_and_restart_advance_only_over_returned_prefix() -> Result {
+    let format = ObjectFormat::Sha256;
+    let (store, _) = store();
+    let index = SourceIndex::new(store, format);
+    let root = index
+        .build_sorted([5; 16], (0..270).map(|n| Ok(source(n, format))))
+        .await?;
+    let mut encoder = BoundedEncoder::new(64 << 10)?;
+    source(0, format).encode_record(&mut encoder)?;
+    let size = encoder.finish().len();
+    let mut cursor = index.changes(None, root, None)?;
+    let mut returned = Vec::new();
+    for n in 0..270 {
+        let page = cursor.page(128, size * 2 - 1).await?;
+        assert_eq!(page, [source(n, format)]);
+        // A stateless restart cannot skip the prefetched but excluded descriptor.
+        let mut retry = index.changes(None, root, Some(page[0].key()))?;
+        let next = retry.page(1, size).await?;
+        assert_eq!(
+            next,
+            if n == 269 {
+                vec![]
+            } else {
+                vec![source(n + 1, format)]
+            }
+        );
+        returned.extend(page);
+    }
+    assert!(cursor.page(128, size).await?.is_empty());
+    assert_eq!(returned.len(), 270);
+    let mut cursor = index.changes(None, root, None)?;
+    assert!(matches!(
+        cursor.page(1, size - 1).await,
+        Err(IndexError::Limit)
+    ));
+    assert!(matches!(
+        cursor.page(1, size).await,
+        Err(IndexError::Integrity)
+    ));
+    Ok(())
+}
+
+#[tokio::test]
+async fn duplicate_failed_update_deletion_and_replacement_preserve_changes() -> Result {
+    let format = ObjectFormat::Sha1;
+    let (store, _) = store();
+    let index = SourceIndex::new(store, format);
+    let before = Some(index.insert(None, [5; 16], source(10, format)).await?);
+    assert_eq!(
+        Some(index.insert(before, [6; 16], source(10, format)).await?),
+        before
+    );
+    let mut changed = source(10, format);
+    changed.index.manifest_digest[0] ^= 1;
+    assert!(index.insert(before, [6; 16], changed).await.is_err());
+    assert!(collect(&index, before, before).await?.is_empty());
+    let removed = index.remove(before, [7; 16], source(10, format)).await?;
+    let after = Some(index.insert(removed, [8; 16], source(1, format)).await?);
+    assert_eq!(collect(&index, before, after).await?, [source(1, format)]);
+    let replaced = Some(
+        index
+            .replace(before.ok_or("root")?, [9; 16], source(10, format), changed)
+            .await?,
+    );
+    assert_eq!(collect(&index, before, replaced).await?, [changed]);
+    assert_eq!(
+        index.find(before, source(10, format).key()).await?,
+        Some(source(10, format))
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn small_increment_skips_unchanged_subtrees_after_ten_thousand_sources() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (store, _) = store();
+        let index = SourceIndex::new(store, format);
+        let before = index
+            .build_sorted([5; 16], (100..10_100).map(|n| Ok(source(n, format))))
+            .await?;
+        let mut after = before;
+        for n in [0, 50, 20_000] {
+            after = Some(index.insert(after, [6; 16], source(n, format)).await?);
+        }
+        index.clear_cache()?;
+        let initial = index.stats();
+        assert_eq!(
+            collect(&index, before, after).await?,
+            [
+                source(0, format),
+                source(50, format),
+                source(20_000, format)
+            ]
+        );
+        assert!(index.stats().loaded_nodes - initial.loaded_nodes < 24);
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn different_tree_shapes_and_rewrites_match_independent_key_difference() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (store, _) = store();
+        let index = SourceIndex::new(store, format);
+        for count in [1, 127, 128, 129, 300] {
+            let old: Vec<_> = (0..count).map(|n| source(n * 3, format)).collect();
+            let mut new: Vec<_> = old
+                .iter()
+                .enumerate()
+                .filter(|(n, _)| n % 5 != 0)
+                .map(|(n, r)| {
+                    let mut r = *r;
+                    if n % 7 == 0 {
+                        r.index.manifest_digest[0] ^= 1;
+                    }
+                    r
+                })
+                .collect();
+            new.extend(
+                (0..count)
+                    .filter(|n| n % 4 == 0)
+                    .map(|n| source(n * 3 + 1, format)),
+            );
+            new.sort_by_key(|r| r.key());
+            let before = index
+                .build_sorted([5; 16], old.iter().copied().map(Ok))
+                .await?;
+            let after = index
+                .build_sorted([6; 16], new.iter().copied().map(Ok))
+                .await?;
+            let expected: Vec<_> = new.iter().copied().filter(|r| !old.contains(r)).collect();
+            assert_eq!(collect(&index, before, after).await?, expected);
+        }
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/server/mod.rs b/crates/canopy-server/src/server/mod.rs
index c32f26da..3ab1e1e9 100644
--- a/crates/canopy-server/src/server/mod.rs
+++ b/crates/canopy-server/src/server/mod.rs
@@ -203,7 +203,6 @@ pub(crate) struct RepositoryManager {
     residency_admission: AccountAdmission,
     transfers: AccountAdmission,
     tasks: TaskTracker,
-    maintenance_stop: CancellationToken,
     publication_budget: crate::packs::publication::PublicationBudget,
     recovery_scans: crate::packs::publication::RecoveryScanBudget,
     serving_reads: crate::packs::publication::ServingReadBudget,
@@ -656,7 +655,6 @@ impl RunningServer {
                     "account repository activations",
                 ),
                 tasks: tasks.clone(),
-                maintenance_stop: maintenance_stop.clone(),
                 publication_budget: crate::packs::publication::PublicationBudget::new(
                     crate::packs::publication::PublicationLimits::default(),
                 )
diff --git a/crates/canopy-server/src/server/residency/mod.rs b/crates/canopy-server/src/server/residency/mod.rs
index b7996884..224cca71 100644
--- a/crates/canopy-server/src/server/residency/mod.rs
+++ b/crates/canopy-server/src/server/residency/mod.rs
@@ -44,19 +44,6 @@ pub(super) struct LoadedRepository {
     state: ResidencyState,
     slot: Arc<OwnedSemaphorePermit>,
     recovery: Option<Arc<RecoveryServices>>,
-    maintenance: Option<MaintenanceWorker>,
-}
-struct MaintenanceWorker {
-    stop: tokio_util::sync::CancellationToken,
-    task: tokio::task::JoinHandle<()>,
-}
-impl MaintenanceWorker {
-    async fn shutdown(self) {
-        self.stop.cancel();
-        if let Err(error) = self.task.await {
-            tracing::error!(?error, "repository Git maintenance failed during drain");
-        }
-    }
 }
 
 enum EvictionAction {
@@ -214,10 +201,7 @@ impl RepositoryManager {
             // Remote cache ownership is disposable. Reacquire idle/expired Cell
             // authority locally before binding a new route after owner loss.
             let removed = self.loaded.lock().await.remove(&entry.repository_id);
-            if let Some(mut repository) = removed {
-                if let Some(maintenance) = repository.maintenance.take() {
-                    maintenance.shutdown().await;
-                }
+            if let Some(repository) = removed {
                 reclaimed = Some(repository.slot);
             }
         }
@@ -544,15 +528,6 @@ impl RepositoryManager {
                 rejected.insert(id);
                 continue;
             }
-            let maintenance = self
-                .loaded
-                .lock()
-                .await
-                .get_mut(&id)
-                .and_then(|repository| repository.maintenance.take());
-            if let Some(maintenance) = maintenance {
-                maintenance.shutdown().await;
-            }
             let (cell, _) = match action {
                 EvictionAction::DropRemote => {
                     let removed = self.loaded.lock().await.remove(&id);
@@ -682,27 +657,6 @@ impl RepositoryManager {
         );
         let router = self.router_for(entry, Arc::clone(&gateway))?;
         let pin = Arc::new(());
-        let weak_gateway = Arc::downgrade(&gateway);
-        let weak_pin = Arc::downgrade(&pin);
-        let stop = self.maintenance_stop.child_token();
-        let maintenance_stop = stop.clone();
-        let task = self.tasks.spawn(async move {
-            let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
-            interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
-            interval.tick().await;
-            loop {
-                tokio::select! {
-                    () = stop.cancelled() => return,
-                    _ = interval.tick() => {},
-                }
-                let (Some(gateway), Some(_pin)) = (weak_gateway.upgrade(), weak_pin.upgrade()) else { return; };
-                // Stop between owned rounds. Cancellation does not abandon
-                // cache/provider work after eviction has selected this owner.
-                if let Err(error) = gateway.maintain().await {
-                    tracing::warn!(error = ?error, "background Git maintenance failed; previous cache retained");
-                }
-            }
-        });
         Ok(LoadedRepository {
             repository,
             client,
@@ -716,10 +670,6 @@ impl RepositoryManager {
             state: ResidencyState::Serving,
             slot,
             recovery: None,
-            maintenance: Some(MaintenanceWorker {
-                stop: maintenance_stop,
-                task,
-            }),
         })
     }
 
diff --git a/docs/evidence/serving-native-write-base-20261004.json b/docs/evidence/serving-native-write-base-20261004.json
new file mode 100644
index 00000000..1be22d04
--- /dev/null
+++ b/docs/evidence/serving-native-write-base-20261004.json
@@ -0,0 +1,357 @@
+{
+  "checkpoint": "immutable source cursor and native write-base conversion",
+  "parent": "6ab78d679839fa8e5fc80002fa529ca61e799874",
+  "validation": {
+    "source_files": 487,
+    "rust_files": 473,
+    "source_hash_digest": "5be32a60d63d87754e87f1b2fd0112ad5c2223d85da480b74446f22733c0511e",
+    "release_qualified": false,
+    "execution_complete": true,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 36.465,
+        "log": "/tmp/canopy-source-cursor-clippy-final.log",
+        "log_sha256": "a3e34c494a21d34d1eef4ea02466734e69238fe85b33491412b29da6b03805db",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "sources::tests::changes::",
+          "native_write_base",
+          "native_refs_tests",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "seconds": 114.256,
+        "log": "/tmp/canopy-source-cursor-focused-final.log",
+        "log_sha256": "2da7defefb14a3d7c43569684ab19689da2d175f0e604d30e76a1058554070d5",
+        "summaries": [
+          [
+            9,
+            0,
+            0,
+            0,
+            684
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked"
+        ],
+        "exit_code": 101,
+        "seconds": 326.624,
+        "log": "/tmp/canopy-source-cursor-workspace-final.log",
+        "log_sha256": "538d0ddf6ccb4121a02fd4050d5861f2bf6967f57281c04805eefbab8158ab3b",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            14,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            692
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            692
+          ],
+          [
+            693,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            12,
+            1,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": [
+          "directory_reservations_recover_two_distinct_repository_cells"
+        ]
+      },
+      {
+        "label": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 45.072,
+        "log": "/tmp/canopy-source-cursor-build-final.log",
+        "log_sha256": "07d38a1434fc1584b81ac2432db3cf79c5f089b92432961cfbb7ac57f5421f98",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.262,
+        "log": "/tmp/canopy-source-cursor-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.063,
+        "log": "/tmp/canopy-source-cursor-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 50.538,
+        "log": "/tmp/canopy-source-cursor-harness-final.log",
+        "log_sha256": "df4c5131cbc670755c8370851cdc37d11d296cf66378163bdb944d790dda7bdd",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "selected_lifecycle",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "multi_server",
+          "--locked",
+          "--",
+          "workspace::",
+          "lifecycle::fork::",
+          "lifecycle::cancelled_prebound_startup",
+          "lifecycle::runtime_destruction",
+          "lifecycle::cancelled_startup_keeps_workspace",
+          "lifecycle::dropped_handle_and_cancelled_shutdown",
+          "lifecycle::failed_drain_retains_workspace",
+          "lifecycle::startup_rejects_ignored_conditional",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "log": "/tmp/canopy-source-cursor-lifecycle-final.log",
+        "log_sha256": "db9c91ccc85d41f0c15282b6f66309c68ec6f5e0540a303f5ce87e7158b28bfd",
+        "passed": 9,
+        "test_seconds": 6.64
+      }
+    ],
+    "unique_library_cases": 713,
+    "library_passed": 713,
+    "library_failed": 0,
+    "server_library_passed": 693,
+    "publication_library_passed": 398,
+    "binary_passed": 2,
+    "directory_passed": 12,
+    "directory_failed": 1,
+    "selected_lifecycle_passed": 9,
+    "unique_executed_rust_cases": 737,
+    "unique_executed_rust_passed": 736,
+    "unique_executed_rust_failed": 1,
+    "nested_and_focused_runs_excluded": true,
+    "full_workspace_halted_at": "directory_cell",
+    "unrun_after_halt": [
+      "multi_server full suite",
+      "owner_restart",
+      "repository_cell",
+      "smart_http",
+      "doc tests"
+    ],
+    "provider_qualification_run": false,
+    "linux_only_cases_run": false,
+    "source_unchanged": true
+  },
+  "static": {
+    "source_digest": "5be32a60d63d87754e87f1b2fd0112ad5c2223d85da480b74446f22733c0511e",
+    "source_unchanged": true,
+    "original_index_sha256": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "archive_sha256": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e",
+    "sdk_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+    "dependency_declarations": 5,
+    "locked_sources": 6
+  },
+  "preceding_actual_ci": [
+    {
+      "head": "6ab78d679839fa8e5fc80002fa529ca61e799874",
+      "run": 37238249979,
+      "job": 111541595278,
+      "conclusion": "FAILURE",
+      "server_passed": 684,
+      "server_failed": 4,
+      "log": "/tmp/canopy-pr34-6ab-failed.log",
+      "sha256": "15297c8d83aef2f27c756463d628fb67a80c3450ae8a2e51fb8783ea8ce2b048"
+    },
+    {
+      "head": "6ab78d679839fa8e5fc80002fa529ca61e799874",
+      "run": 37238247841,
+      "job": 111541588793,
+      "conclusion": "FAILURE",
+      "server_passed": 684,
+      "server_failed": 4,
+      "log": "/tmp/canopy-pr34-6ab-secondary-failed.log",
+      "sha256": "704efd84fb15b9ce9ab15dfa1c910dc3a6f233aaad3088227e67751e509506af"
+    }
+  ],
+  "failed_draft_diagnostics": {
+    "source_files": 487,
+    "rust_files": 473,
+    "source_hash_digest": "ccc988e21dfdb7a4b00a49fcd661afa5a26efab74228b0c0ed9b99881a37ef9c",
+    "release_qualified": false,
+    "execution_complete": false,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 48.598,
+        "log": "/tmp/canopy-source-cursor-clippy-final.log",
+        "log_sha256": "f9d77bb384c10451e2713eb5be727738229fd24499c1cba23ffe234ccc090fc8",
+        "summaries": [],
+        "failed_cases": [],
+        "historical_log_path_reused": true,
+        "digest_only_retained": true
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "sources::tests::changes::",
+          "native_write_base",
+          "native_refs_tests",
+          "--test-threads=4"
+        ],
+        "exit_code": 101,
+        "seconds": 89.736,
+        "log": "/tmp/canopy-source-cursor-focused-before-ref-warm.log",
+        "log_sha256": "6a513f8d80ab1d590e513dca0b8ed2c74a8bc94b19ddd1323e000ce395a4e4a7",
+        "summaries": [
+          [
+            8,
+            1,
+            0,
+            0,
+            684
+          ]
+        ],
+        "failed_cases": [
+          "packs::publication::tests::serving::workspace::native_write_base_cancellation_and_revocation_retain_real_provider_work_until_drain"
+        ]
+      }
+    ],
+    "log_note": "failed focused log is preserved at /tmp/canopy-source-cursor-focused-before-ref-warm.log; original final-log path was reused only after source repair",
+    "preserved_focused_log_sha256": "6a513f8d80ab1d590e513dca0b8ed2c74a8bc94b19ddd1323e000ce395a4e4a7"
+  },
+  "scope_limits": [
+    "Owned HTTP/SSH/generated write publication remains unconverted",
+    "Cold native baseline still downloads and verifies the selected catalog per request",
+    "Difference cursor supports root-pair increments but production cold constructor starts at None",
+    "Physical native fixtures qualify consumers, not live producer publication",
+    "Full integration/provider and capacity gates remain open",
+    "No compatibility table, command fallback or skipped test added"
+  ]
+}
diff --git a/docs/large-repository-implementation-plan.md b/docs/large-repository-implementation-plan.md
index 4cf0645a..17a52499 100644
--- a/docs/large-repository-implementation-plan.md
+++ b/docs/large-repository-implementation-plan.md
@@ -172,7 +172,7 @@ The earlier [SQL fixture](design/packed-repository-schema.sql) is not the releas
 
 **Shared publication dispatch implemented:** `ready_compaction` issues the existing maintenance certificate and retains the exact SDK command. `PublicationCoordinator` admits push/compaction variants with typed outcomes, reserved class counts/encoded bytes, per-class actor counts, bounded foreground bursts and maintenance concurrency. Both classes share cancellation-safe retention, supervision, pending lookup, original-receipt resolution and close/drain. Defaults reserve four maintenance operations and two of eight durability waits; the geometric native fixture now uses this dispatcher for every publication. Continuous preparation, whole-process CPU/I/O shares, renewal/reaping, durable reconstruction and production invocation remain required. See the [shared dispatch contract](design/shared-publication-dispatch.md).
 
-**Files:** new `crates/canopy-server/src/packs/maintenance.rs`, D's commands, existing `crates/canopy-server/src/git_gateway/maintenance.rs`, node maintenance/admission scheduling.
+**Files:** new `crates/canopy-server/src/packs/maintenance.rs`, D's commands, owned native workspaces in `crates/canopy-server/src/packs/publication/serving/session/`, and node maintenance/admission scheduling. The legacy shared-loose-cache repack loop is retired; its replacement must schedule native generations under the existing fair admission and physical pins.
 
 1. Begin a durable compaction operation and pin its selected catalog generation and exact input descriptors. Initial selection: at most 32 packs or 8 GiB compressed; prioritize small/duplicate packs, leave large stable history alone. A single over-budget pack requires a separately admitted job, not an unbounded default repack. Account for directory-run compaction separately from physical pack rewriting.
 2. Stream selected preferred objects into structural/blob OID spools. Pack each with native settings from the design, verify and upload outputs. Preserve all canonical objects, including unreachable ones.
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index a0f88408..baf88924 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -3,19 +3,94 @@
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. The native workspace checkpoint below replaces the
-legacy fetch reader; four legacy object-page readers still fail locally. At the
-preceding published head `cc4a963`, both actual Rust CI logs report 670 server
-passes and the same five legacy-reader failures; both harness checks pass.
-Those CI runs do not qualify this newer source. Conflict freedom is checked at
-publication independently of incomplete release gates. The PR is ready for
-review, but not ready to merge or deploy. Older checkpoint notes describe their
-historical states.
+directly against `main`. The cursor/native-base conversion below passes its focused and library
+qualification; the full CI workflow still fails in a legacy integration caller. Both actual `6ab78d6` Rust runs fail on four obsolete SQL cursor tests
+(`objects` is absent); both harness checks pass. The change below replaces their
+production hydration caller before transferring coverage to the immutable source
+index. Passing that coverage will not by itself qualify the whole CI workflow or
+complete owned write publication. The PR is ready for review, but not ready to
+merge or deploy. Older checkpoint notes describe their historical states.
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Immutable source cursor and native write-base conversion
+
+The private cache constructor used by HTTP push and generated candidate
+preparation now takes one retained joint snapshot. It reads only requested ref
+expectations in batches of at most 128 names and 256 KiB, including tombstone
+versions; the native baseline streams all live refs directly into packed-refs.
+Post-receive comparison resolves exact requested names with owned native cat-file
+batches (32 names / 64 KiB input), avoiding prefix enumeration and changes to
+unrequested refs. Candidate preparation requests no repository-wide ref map.
+
+Catalog inputs now stream from the immutable source index in count/descriptor-
+byte-bounded pages. The shared range-tree difference cursor compares full records
+at matching first keys, emits additions/replacements, omits deletions and skips
+identical authenticated subtrees. Fixed old/new roots exclude later publications;
+new lower keys are found by starting a new root-pair difference, rather than
+continuing an OID or retired SQL sequence. A byte-excluded descriptor is retained
+for the next page. Cancellation/error poisons the cursor; callers restart with
+the same root pair after their last returned key. Its two frontier stacks retain
+only bounded-height paths and siblings. Source shard descriptors reuse the existing
+range-tree structure and physical pack bindings.
+
+Native write-base construction currently enumerates `None -> selected sources`:
+it is a cold per-request baseline, not a coalesced incremental cache. Admitted
+disk stores physical pack deduplication. Authenticated pack/index inputs remain
+native, and a separate writable sibling cache uses that baseline as an alternate.
+This prevents accepted catalog packs from being mistaken for new receive outputs.
+Both cache owners retain the snapshot, physical generation and cleanup admission;
+construction refreshes current read authority and lease observations and rechecks
+before returning. This internal base grants neither fetch reachability nor mutation
+publication authority. Fetch continues to require its distinct completed closure.
+
+The retired sequence/high-water hydration caller, shared loose-cache reuse and
+its obsolete periodic repack loop are removed. Unused loose-object/repack helpers
+are confined to unit-test fixtures to preserve native cache mechanism coverage.
+Legacy object ingestion, graph preparation, candidate reservation/completion and
+HTTP/SSH write publication still require their owned staged-producer conversion.
+Some legacy object APIs remain genuine callers and are not relabeled as converted.
+Native generation maintenance, workspace sharing and cold-history performance
+qualification remain open.
+
+Nine focused replacement cases pass: lower-key/future-root isolation, byte-prefix
+restart, duplicate/failed/deleted/replaced records, subtree-read bounds after
+10,000 sources, independent differential results across tree shapes, native
+baseline/incoming-pack isolation, literal ref lookup, and real provider
+cancellation/revocation through drain. The focused command takes 114.256 seconds
+(including compilation); test runtime is 2.70 seconds. A failed draft cancellation
+test suspended at ref-root loading before file admission; it is preserved in the
+evidence. Warming that immutable metadata moves the gate to its intended native
+pack-transfer phase without relaxing the physical retention assertion.
+
+The exact full workspace command runs all 713 library cases successfully,
+including 693 server cases and all 398 publication cases, plus two binary cases.
+It then passes 12 directory integration cases and fails
+`directory_reservations_recover_two_distinct_repository_cells` with
+`Registry("operation descriptor is unavailable")`: its fixture still invokes the
+retired loose-object ingestion command. Later integration binaries and provider
+qualification have not run. Nine selected portable workspace/startup/drain cases
+pass independently, including production packed-repository initialization.
+Total executed Rust coverage is 737 unique cases: 736 pass, one fails; focused
+reruns and two nested subprocess summaries are excluded. Linux-only fork cases
+were not run locally. This is progress on CI, not a green full workflow.
+
+Workspace/all-target Clippy with warnings denied (36.465 seconds), server build
+(45.072 seconds), formatting, diff checks and all 96 Python harness cases pass.
+The protected original index/archive, clean read-only SDK and exact dependency
+pins are unchanged. Frozen source includes 487 files / 473 Rust files; its
+fingerprint, commands, log digests and preceding CI diagnostics are in
+[evidence](evidence/serving-native-write-base-20261004.json).
+
+Highest next priorities are the real owned HTTP/SSH/generated write producers,
+then integration-fixture conversion against those producers and complete
+workflow/provider qualification. Authority, recovery, custody history/rollover,
+final DDL, GC/backup/restore, resource containment, fair native maintenance,
+workspace sharing, full-history/team capacity and file attribution remain
+mandatory scope.
+
 ## Certified native transport workspace checkpoint
 
 Local HTTP and SSH fetch now use complete native forward workspaces from an

From d86f3152e450eb97b1b8db6d5968322f49703b0d Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 16:46:09 -0700
Subject: [PATCH 28/55] Retain staging worker admission through physical native
 work

---
 .../canopy-server/src/git_cache/artifacts.rs  |   1 +
 crates/canopy-server/src/git_cache/mod.rs     |   8 +
 crates/canopy-server/src/git_http/capture.rs  |   7 +-
 crates/canopy-server/src/git_http/mod.rs      |  27 +-
 crates/canopy-server/src/lib.rs               |   4 +
 .../src/packs/publication/staging_service.rs  |  50 +-
 .../tests/compaction/coordinator.rs           |   2 +-
 .../packs/publication/tests/durable_policy.rs |   4 +-
 .../packs/publication/tests/native_capture.rs |  39 +-
 .../publication/tests/policy_dispatch.rs      |   2 +-
 .../packs/publication/tests/policy_refusal.rs |   2 +-
 .../packs/publication/tests/root_dispatch.rs  |   6 +-
 .../packs/publication/tests/staged_durable.rs |   6 +-
 .../publication/tests/staging_service.rs      |   3 +-
 .../tests/staging_service/bound.rs            |  32 +-
 .../tests/staging_service/physical.rs         | 116 ++++
 .../tests/staging_service/publication.rs      |  39 +-
 .../tests/staging_service/restore.rs          |   6 +-
 .../tests/staging_service/retirement.rs       |   4 +-
 .../publication/tests/terminal_retention.rs   |   2 +-
 .../src/packs/verification/mod.rs             |  10 +-
 .../src/packs/verification/physical.rs        | 102 ++-
 .../src/packs/verification/spool.rs           |   9 +
 docs/design/bound-preparation-lifecycle.md    |   4 +-
 docs/design/final-publication-lifecycle.md    |   4 +-
 docs/design/staging-service-lifecycle.md      |   8 +-
 .../staging-physical-workers-20261004.json    | 649 ++++++++++++++++++
 .../large-repository-implementation-status.md |  64 +-
 28 files changed, 1110 insertions(+), 100 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/tests/staging_service/physical.rs
 create mode 100644 docs/evidence/staging-physical-workers-20261004.json

diff --git a/crates/canopy-server/src/git_cache/artifacts.rs b/crates/canopy-server/src/git_cache/artifacts.rs
index 4fd97a14..c077aa4a 100644
--- a/crates/canopy-server/src/git_cache/artifacts.rs
+++ b/crates/canopy-server/src/git_cache/artifacts.rs
@@ -12,6 +12,7 @@ impl GitCache {
     /// The isolated verifier calls this exactly once on its fresh private cache.
     /// Reserve the complete pair before creating files or reading the provider.
     /// No second pack copy or blob-as-artifact wrapper is involved.
+    #[cfg(test)]
     pub(crate) async fn download_native(
         self: &Arc<Self>,
         store: &ArtifactStore,
diff --git a/crates/canopy-server/src/git_cache/mod.rs b/crates/canopy-server/src/git_cache/mod.rs
index eecbd95a..77009cf5 100644
--- a/crates/canopy-server/src/git_cache/mod.rs
+++ b/crates/canopy-server/src/git_cache/mod.rs
@@ -459,8 +459,16 @@ impl GitCache {
 
     /// Measures native Git's completed writes before the gateway can publish refs.
     pub(crate) async fn reconcile(self: &Arc<Self>) -> Result<(), CacheError> {
+        self.reconcile_owned(Arc::new(())).await
+    }
+
+    pub(crate) async fn reconcile_owned(
+        self: &Arc<Self>,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Result<(), CacheError> {
         let cache = Arc::clone(self);
         tokio::task::spawn_blocking(move || {
+            let _owner = owner;
             cache.reservation()?.resize(tree_bytes(cache.root())?)?;
             Ok(())
         })
diff --git a/crates/canopy-server/src/git_http/capture.rs b/crates/canopy-server/src/git_http/capture.rs
index 28423062..1bc10afb 100644
--- a/crates/canopy-server/src/git_http/capture.rs
+++ b/crates/canopy-server/src/git_http/capture.rs
@@ -41,6 +41,7 @@ struct CapturePin {
     // captured file immutable while hash/upload background jobs retain it.
     _fence: File,
     cache: Arc<GitCache>,
+    _owner: crate::git_objects::ReadOwner,
 }
 impl Drop for CapturePin {
     fn drop(&mut self) {
@@ -90,9 +91,10 @@ impl GitHttpBackend {
             return Err(NativeCaptureError::Limit);
         }
         let _selection = self.cache.selection.lock().await;
-        self.cache.reconcile().await?;
+        self.cache.reconcile_owned(context.physical_owner()).await?;
         let cache = Arc::clone(&self.cache);
         let format = context.format();
+        let owner = context.physical_owner();
         let claim = cache
             .native
             .try_admit(crate::native_resources::NativeWork::Read)?;
@@ -105,6 +107,7 @@ impl GitHttpBackend {
             let pin = Arc::new(CapturePin {
                 cache,
                 _fence: fence,
+                _owner: owner,
             });
             for entry in std::fs::read_dir(pin.cache.git_dir().join("objects"))? {
                 let entry = entry?;
@@ -234,6 +237,7 @@ mod tests {
             _pin: Arc::new(CapturePin {
                 _fence: fence,
                 cache: backend.cache.clone(),
+                _owner: Arc::new(()),
             }),
         });
         let retained = captured.clone();
@@ -312,6 +316,7 @@ mod tests {
             _pin: Arc::new(CapturePin {
                 _fence: fence,
                 cache: Arc::clone(&backend.cache),
+                _owner: Arc::new(()),
             }),
         });
         let (ready_tx, ready_rx) = std::sync::mpsc::channel();
diff --git a/crates/canopy-server/src/git_http/mod.rs b/crates/canopy-server/src/git_http/mod.rs
index 43f2ddcf..6e79505f 100644
--- a/crates/canopy-server/src/git_http/mod.rs
+++ b/crates/canopy-server/src/git_http/mod.rs
@@ -38,6 +38,8 @@ pub(crate) const WORKER_DEADLINE: Duration = Duration::from_secs(3600);
 
 #[derive(Debug, thiserror::Error)]
 pub enum GitHttpError {
+    #[error("native receive has no live staging custody")]
+    Staging(#[from] crate::packs::publication::StagingError),
     #[error("Git cache failed")]
     Cache(#[from] CacheError),
     #[error("Git process I/O failed")]
@@ -133,8 +135,13 @@ impl GitHttpBackend {
     /// this API, then capture and verify inputs before durable publication.
     pub async fn run_native_receive(
         &self,
+        context: &crate::packs::publication::StagingContext,
         request: GitHttpRequest,
     ) -> Result<GitHttpResponse, GitHttpError> {
+        context.ensure_live()?;
+        if context.format() != self.cache.object_format || !request.authenticated {
+            return Err(GitHttpError::Interrupted);
+        }
         if request.method != "POST"
             || request.path_info != "/repo.git/git-receive-pack"
             || !request.query.is_empty()
@@ -143,13 +150,27 @@ impl GitHttpBackend {
         }
         let mut command = self.transport_command()?;
         command.args(["-c", "receive.unpackLimit=0"]);
-        let response = self.stream_command(request, (), command).await?;
-        self.collect(response).await
+        let response = self
+            .stream_command(request, context.physical_owner(), command)
+            .await?;
+        let response = self
+            .collect_owned(response, context.physical_owner())
+            .await?;
+        context.ensure_live()?;
+        Ok(response)
     }
 
     async fn collect(
         &self,
         response: GitHttpResponse<GitBody>,
+    ) -> Result<GitHttpResponse, GitHttpError> {
+        self.collect_owned(response, Arc::new(())).await
+    }
+
+    async fn collect_owned(
+        &self,
+        response: GitHttpResponse<GitBody>,
+        owner: crate::git_objects::ReadOwner,
     ) -> Result<GitHttpResponse, GitHttpError> {
         let GitHttpResponse {
             status,
@@ -164,7 +185,7 @@ impl GitHttpBackend {
             }
             bytes.extend_from_slice(&chunk);
         }
-        self.cache.reconcile().await?;
+        self.cache.reconcile_owned(owner).await?;
         Ok(GitHttpResponse {
             status,
             headers,
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 4835645b..5eadc5fc 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -218,6 +218,10 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("git_gateway/push.rs"));
                 source.update(include_bytes!("git_input/mod.rs"));
                 source.update(include_bytes!("git_http/capture.rs"));
+                source.update(include_bytes!("git_http/mod.rs"));
+                source.update(include_bytes!("packs/verification/mod.rs"));
+                source.update(include_bytes!("packs/verification/physical.rs"));
+                source.update(include_bytes!("packs/verification/spool.rs"));
                 source.update(include_bytes!("packs/wire_request.rs"));
                 source.update(include_bytes!("packs/input_artifact.rs"));
                 source.update(include_bytes!("packs/directory/index/mod.rs"));
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index 52377348..011d135a 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -1074,12 +1074,12 @@ impl StagingTicket {
     /// slots, cancellation/drain and typed result ownership as staging inputs.
     pub fn spawn_bound<F, Fut, T>(&self, producer: F) -> Result<StagingTask<T>, StagingError>
     where
-        F: FnOnce(Arc<PreparationSession>) -> Fut + Send + 'static,
+        F: FnOnce(Arc<PreparationSession>, StagingContext) -> Fut + Send + 'static,
         Fut: Future<Output = Result<T, StagingError>> + Send + 'static,
         T: Send + 'static,
     {
         let session = self.bound_session()?;
-        self.spawn_in_phase(true, move |_| producer(session))
+        self.spawn_in_phase(true, move |context| producer(session, context))
     }
     fn spawn_in_phase<F, Fut, T>(
         &self,
@@ -1097,7 +1097,7 @@ impl StagingTicket {
         let actor_permit = Arc::clone(&self.job.actor_workers)
             .try_acquire_owned()
             .map_err(|_| StagingError::Capacity)?;
-        let context = {
+        let (token, format) = {
             let mut l = self.job.local.lock().expect("staging local");
             if (l.seal && !bound)
                 || l.finishing
@@ -1124,18 +1124,20 @@ impl StagingTicket {
                 (lease.token, lease.format)
             };
             l.workers += 1;
-            StagingContext {
-                job: Arc::clone(&self.job),
-                token,
-                format,
-                bound,
-            }
+            (token, format)
         };
-        let guard = Activity {
+        let guard = Arc::new(Activity {
             inner: Arc::clone(&self.inner),
             job: Arc::clone(&self.job),
             permit: Some(permit),
             actor_permit: Some(actor_permit),
+        });
+        let context = StagingContext {
+            job: Arc::clone(&self.job),
+            token,
+            format,
+            bound,
+            activity: Arc::clone(&guard),
         };
         let mut work = self.job.work.lock().expect("staging work");
         let id = work.next.checked_add(1).ok_or(StagingError::Capacity)?;
@@ -1250,6 +1252,24 @@ impl StagingTicket {
     /// Inject a short custody ceiling only after a test reaches its intended
     /// recovery phase. The real clock and normal fence/drain path still run.
     #[cfg(test)]
+    pub(super) fn limit_bound_ceiling_for_test(
+        &self,
+        remaining: Duration,
+    ) -> Result<Instant, StagingError> {
+        let mut local = self.job.local.lock().expect("staging local");
+        if local.workers != 0 || local.finishing || remaining.is_zero() {
+            return Err(StagingError::Context);
+        }
+        let mut session = (**local.bound.as_ref().ok_or(StagingError::NotReady)?).clone();
+        session.live_lease()?;
+        let ceiling = (Instant::now() + remaining).min(local.lifetime);
+        session.ceiling = Some(ceiling);
+        local.bound = Some(Arc::new(session));
+        local.lifetime = ceiling;
+        self.job.changed.notify_one();
+        Ok(ceiling)
+    }
+    #[cfg(test)]
     pub(super) fn expire_bound_for_test(&self) -> Result<Instant, StagingError> {
         let mut local = self.job.local.lock().expect("staging local");
         let session = local.bound.as_ref().ok_or(StagingError::NotReady)?;
@@ -1287,8 +1307,16 @@ pub struct StagingContext {
     token: PreparationToken,
     format: ObjectFormat,
     bound: bool,
+    // Clones share the original worker admission. Detached blocking jobs,
+    // native descendants and provider readers must retain it until they drain.
+    activity: Arc<Activity>,
 }
 impl StagingContext {
+    /// Lifetime ownership only; it grants no custody or publication authority.
+    /// Keep this in every physical worker that can outlive its async observer.
+    pub(crate) fn physical_owner(&self) -> crate::git_objects::ReadOwner {
+        self.activity.clone()
+    }
     pub(super) fn capability(&self) -> (&CellClient, &CellTarget, LeaseCheck) {
         (
             &self.job.client,
@@ -1357,7 +1385,7 @@ impl StagingContext {
 struct WorkSlot<T> {
     result: Mutex<Option<Result<T, Arc<StagingError>>>>,
     ready: watch::Sender<bool>,
-    guard: Mutex<Option<Activity>>,
+    guard: Mutex<Option<Arc<Activity>>>,
 }
 impl<T: Send + 'static> RetainedWork for WorkSlot<T> {
     fn erased(self: Arc<Self>) -> Arc<dyn Any + Send + Sync> {
diff --git a/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs b/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
index 06b82524..49eec3fd 100644
--- a/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs
@@ -53,7 +53,7 @@ async fn maintenance_final_publication_uses_shared_bound_lifecycle_and_reserved_
         let owned_root = root.clone();
         let owned_budget = budget.clone();
         let mutation = identity()?;
-        let work = ticket.spawn_bound(move |_| async move {
+        let work = ticket.spawn_bound(move |_, _context| async move {
             let prepared = Arc::new(
                 PreparedCompaction::prepare(
                     owned_root.path(),
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
index b6c0cb8e..467200c7 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
@@ -169,7 +169,7 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
             let directory = root.to_path_buf();
             let disk = budget.clone();
             let ready = ticket
-                .spawn_bound(move |_| async move {
+                .spawn_bound(move |_, _context| async move {
                     owner
                         .ready_root_push(root_identity, &guard, &directory, disk, limits(), None)
                         .await
@@ -405,7 +405,7 @@ async fn late_write_case(
     // The lifecycle owns expensive preparation. Awaiting its typed result
     // keeps the original factory/custody checks without nesting the complete
     // native receive fixture on the producer's poll stack.
-    let worker = context.ticket.spawn_bound(move |_| async move {
+    let worker = context.ticket.spawn_bound(move |_, _context| async move {
         let publishing = owner
             .ready_root_push(
                 positive_identity,
diff --git a/crates/canopy-server/src/packs/publication/tests/native_capture.rs b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
index 1d1fa5b8..c0fff050 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_capture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
@@ -628,7 +628,7 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
             .await
             .map_err(|error| StagingError::Input(Box::new(error)))?;
         let response = producer
-            .run_native_receive(preflight.into_native_request())
+            .run_native_receive(&context, preflight.into_native_request())
             .await
             .map_err(|error| StagingError::Input(Box::new(error)))?;
         let inputs = producer
@@ -837,17 +837,30 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
     }
     let physical_root = Arc::new(tempfile::TempDir::new()?);
     let physical_disk = DiskBudget::new(256 << 20);
-    let mut verifier = PhysicalVerifier::download(
-        physical_root.path(),
-        physical_disk.clone(),
-        &store,
-        inputs[0],
-        physical_limits(),
-        native.scope(NativeClass::Foreground),
-    )
-    .await?;
-    let segment = verifier.inspect_next_shard(inputs[0].object_count).await?;
-    let witness = verifier.finish().await?;
+    let verify_root = physical_root.clone();
+    let verify_disk = physical_disk.clone();
+    let verify_store = store.clone();
+    let verify_native = native.clone();
+    let work = ticket.spawn(move |context| async move {
+        let result = async {
+            let mut verifier = PhysicalVerifier::download_staged(
+                &context,
+                verify_root.path(),
+                verify_disk,
+                &verify_store,
+                inputs[0],
+                physical_limits(),
+                verify_native.scope(NativeClass::Foreground),
+            )
+            .await?;
+            let segment = verifier.inspect_next_shard(inputs[0].object_count).await?;
+            let witness = verifier.finish().await?;
+            Ok::<_, crate::packs::verification::PhysicalError>((witness, segment))
+        }
+        .await;
+        result.map_err(|error| StagingError::Input(Box::new(error)))
+    })?;
+    let (witness, segment) = work.wait().await.map_err(|error| error.to_string())?;
     ticket.seal()?;
     assert!(matches!(
         timeout(Duration::from_secs(10), ticket.wait_terminal()).await?,
@@ -935,7 +948,7 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
     let producer_root = Arc::clone(&physical_root);
     let producer_disk = physical_disk.clone();
     let publication_identity = identity()?;
-    let work = ticket.spawn_bound(move |_| async move {
+    let work = ticket.spawn_bound(move |_, _context| async move {
         let result = async {
             let mut builder = CatalogPreparation::new(
                 producer_root.path(),
diff --git a/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs b/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
index 49254fb6..5c33075b 100644
--- a/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs
@@ -101,7 +101,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
         let (release, wait) = tokio::sync::oneshot::channel();
         let (entered, running) = tokio::sync::oneshot::channel();
         let worker = if offset == 0 {
-            Some(ticket.spawn_bound(move |_| async move {
+            Some(ticket.spawn_bound(move |_, _context| async move {
                 let _ = entered.send(());
                 wait.await.map_err(|_| StagingError::Worker)?;
                 Ok(42u64)
diff --git a/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs b/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
index 24f7933e..0952b083 100644
--- a/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
+++ b/crates/canopy-server/src/packs/publication/tests/policy_refusal.rs
@@ -502,7 +502,7 @@ async fn owned_positive(
     let directory = root.to_path_buf();
     let mutation = identity()?;
     Ok(ticket
-        .spawn_bound(move |_| async move {
+        .spawn_bound(move |_, _context| async move {
             owner
                 .ready_root_push(mutation, &guard, &directory, budget, limits(), None)
                 .await
diff --git a/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs b/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
index 9be8299d..ceeec621 100644
--- a/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
+++ b/crates/canopy-server/src/packs/publication/tests/root_dispatch.rs
@@ -123,7 +123,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
     let weak = Arc::downgrade(&prepared);
     let directory = root.to_owned();
     let producer_store = store.clone();
-    let producer = ticket.spawn_bound(move |session| async move {
+    let producer = ticket.spawn_bound(move |session, _context| async move {
         assert!(Arc::ptr_eq(
             &prepared.base.session.deadline,
             &session.deadline
@@ -184,7 +184,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
     p.fault_for_test(fault);
     let (release, wait) = tokio::sync::oneshot::channel();
     let (entered, running) = tokio::sync::oneshot::channel();
-    let worker = ticket.spawn_bound(move |_| async move {
+    let worker = ticket.spawn_bound(move |_, _context| async move {
         let _ = entered.send(());
         wait.await.map_err(|_| StagingError::Worker)?;
         Ok(42u64)
@@ -211,7 +211,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, loss: Loss) -> Resu
     let renewal = ticket.bound_renewal().ok_or("ordered root renewal")?;
     assert!(!close.as_ref().unwrap().is_finished());
     assert_eq!(p.close_and_drain().await.len(), 1);
-    assert!(ticket.spawn_bound(|_| async { Ok(()) }).is_err());
+    assert!(ticket.spawn_bound(|_, _context| async { Ok(()) }).is_err());
     release.send(()).map_err(|_| "drained worker disappeared")?;
     assert_eq!(
         ticket
diff --git a/crates/canopy-server/src/packs/publication/tests/staged_durable.rs b/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
index 78201223..00bb6956 100644
--- a/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staged_durable.rs
@@ -147,7 +147,7 @@ pub(super) async fn qualify(
         let (release, wait) = tokio::sync::oneshot::channel();
         let (entered, running) = tokio::sync::oneshot::channel();
         let worker = if offset == 0 {
-            Some(ticket.spawn_bound(move |_| async move {
+            Some(ticket.spawn_bound(move |_, _context| async move {
                 let _ = entered.send(());
                 wait.await.map_err(|_| StagingError::Worker)?;
                 Ok(42u64)
@@ -270,7 +270,7 @@ pub(super) async fn qualify(
             let disk = budget.clone();
             let mutation = identity()?;
             ticket
-                .spawn_bound(move |_| async move {
+                .spawn_bound(move |_, _context| async move {
                     let guard = policy
                         .ready(&owner)
                         .await
@@ -489,7 +489,7 @@ pub(super) async fn qualify_revoked(context: Context<'_>, root_case: bool) -> Re
         let disk = budget;
         let mutation = identity()?;
         let ready = ticket
-            .spawn_bound(move |_| async move {
+            .spawn_bound(move |_, _context| async move {
                 let guard = intent
                     .ready(&owner)
                     .await
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index e9ca6399..94f00cf3 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -1,4 +1,5 @@
 mod bound;
+mod physical;
 mod publication;
 pub(super) mod restore;
 mod retirement;
@@ -616,7 +617,7 @@ async fn staged_service_owned_native_verification_hands_off_to_the_existing_priv
         let bound_work = {
             let root = root.clone();
             let budget = budget.clone();
-            ticket.spawn_bound(move |_| async move {
+            ticket.spawn_bound(move |_, _context| async move {
                 async {
                     let mut assembler =
                         CatalogPreparation::new(root.path(), budget.clone(), base, limits())
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
index 6ccfe200..2e3b38f9 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs
@@ -70,7 +70,7 @@ async fn bound_service_automatic_renewal_keeps_canceled_worker_and_result_owned_
     let weak = Arc::downgrade(&session);
     let (release, wait) = oneshot::channel();
     let (entered, running) = oneshot::channel();
-    let worker = ticket.spawn_bound(move |session| async move {
+    let worker = ticket.spawn_bound(move |session, _context| async move {
         session.live_lease()?;
         let _ = entered.send(());
         wait.await.map_err(|_| StagingError::Worker)?;
@@ -109,7 +109,11 @@ async fn bound_service_automatic_renewal_keeps_canceled_worker_and_result_owned_
     })
     .await?;
     assert!(!close.is_finished());
-    assert!(retained.spawn_bound(|_| async { Ok(()) }).is_err());
+    assert!(
+        retained
+            .spawn_bound(|_, _context| async { Ok(()) })
+            .is_err()
+    );
     release.send(()).map_err(|_| "worker lost")?;
     let result = retained
         .pending_task::<Arc<PreparationSession>>(id)
@@ -352,9 +356,19 @@ async fn bound_service_phase_handoff_and_residence_cap_fence_existing_bases_and_
     active(&ticket).await?;
     let work = ticket.spawn(|ctx| async { Ok(ctx) })?;
     let old = work.wait().await.map_err(|e| e.to_string())?;
+    let old_token = old.token()?;
+    // A context now owns its physical worker admission. Retain only the
+    // historical token before handoff; a live context must keep Bind blocked.
+    drop(old);
     ticket.seal()?;
     assert!(matches!(terminal(&ticket).await?, StagingState::Bound(_)));
-    assert!(old.ensure_live().is_err());
+    assert!(
+        f.client()
+            .query::<CheckStaging>(&f.target, None, check(old_token))
+            .await?
+            .output
+            .is_none()
+    );
     assert!(ticket.spawn(|_| async { Ok(()) }).is_err());
     let session = ticket.bound_session()?;
     let store = native.store.clone();
@@ -390,7 +404,7 @@ async fn bound_service_phase_handoff_and_residence_cap_fence_existing_bases_and_
     ));
     assert!(!session.fenced.load(std::sync::atomic::Ordering::Acquire));
     let (entered, running) = oneshot::channel();
-    let worker = ticket.spawn_bound(move |_| async move {
+    let worker = ticket.spawn_bound(move |_, _context| async move {
         let _ = entered.send(());
         std::future::pending::<std::result::Result<(), StagingError>>().await
     })?;
@@ -448,13 +462,13 @@ async fn bound_service_worker_caps_results_and_failure_reuse_staging_admission()
         wrong: wrong.clone(),
     };
     let (done, completed) = oneshot::channel();
-    let work = a.spawn_bound(move |_| async move {
+    let work = a.spawn_bound(move |_, _context| async move {
         let _ = done.send(());
         Ok(owned)
     })?;
     timeout(Duration::from_secs(10), completed).await??;
     assert_eq!(c.stats().workers, 1);
-    assert!(b.spawn_bound(|_| async { Ok(()) }).is_err());
+    assert!(b.spawn_bound(|_, _context| async { Ok(()) }).is_err());
     super::super::publishing::edit(
         &f,
         "UPDATE repository_identity SET owner='other' WHERE singleton=1",
@@ -512,7 +526,7 @@ async fn bound_service_checkpoint_shares_renewal_order_exact_recovery_and_origin
             let session = ticket.bound_session()?;
             let parent = prior.clone();
             let provider = store.clone();
-            let worker = ticket.spawn_bound(move |s| async move {
+            let worker = ticket.spawn_bound(move |s, _context| async move {
                 s.adopt_native_inputs(provider, &parent)
                     .await
                     .map_err(|e| StagingError::Input(Box::new(e)))
@@ -664,8 +678,8 @@ async fn bound_service_restored_owner_claim_retains_old_pin_and_owns_new_session
         assert_eq!(bound.receipt, replay.receipt);
         let old_pin = handle.query(0, 32, move |conn| { Ok(conn.query_row("SELECT generation FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2", rusqlite::params![old.owner.incarnation.as_bytes().as_slice(), old.attempt as i64], |row| row.get::<_, i64>(0))?.to_be_bytes().to_vec()) }).await?;
         assert_eq!(old_pin.as_slice(), 0i64.to_be_bytes());
-        let worker =
-            ticket.spawn_bound(|session| async move { Ok(session.live_lease()?.0.token) })?;
+        let worker = ticket
+            .spawn_bound(|session, _context| async move { Ok(session.live_lease()?.0.token) })?;
         assert_eq!(
             worker.wait().await.map_err(|e| e.to_string())?,
             bound.lease.token
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/physical.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/physical.rs
new file mode 100644
index 00000000..971992a0
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/physical.rs
@@ -0,0 +1,116 @@
+//! Physical jobs retain original admission after the async producer is gone.
+use super::*;
+
+// Always release a blocked test job, including after an assertion or timeout.
+struct Release(Option<std::sync::mpsc::Sender<()>>);
+impl Drop for Release {
+    fn drop(&mut self) {
+        if let Some(sender) = self.0.take() {
+            let _ = sender.send(());
+        }
+    }
+}
+fn held_worker(
+    context: StagingContext,
+) -> (Release, oneshot::Receiver<()>, tokio::task::JoinHandle<()>) {
+    let (entered, running) = oneshot::channel();
+    let (release, wait) = std::sync::mpsc::channel();
+    let owner = context.physical_owner();
+    let worker = tokio::task::spawn_blocking(move || {
+        let _owner = owner;
+        let _ = entered.send(());
+        let _ = wait.recv();
+    });
+    (Release(Some(release)), running, worker)
+}
+
+#[tokio::test]
+async fn physical_creating_worker_prevents_bind_and_credit_reuse_after_result_transfer() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let c = StagingCoordinator::new(
+            f.target.clone(),
+            StagingLimits {
+                workers: 1,
+                workers_per_actor: 1,
+                ..StagingLimits::default()
+            },
+            f.authority(),
+        )?;
+        let ticket = submit(&f, &c, [233; 16], "owner").await?;
+        let lease = active(&ticket).await?;
+        let work = ticket.spawn(|context| async move { Ok(held_worker(context)) })?;
+        let (release, running, worker) = work.wait().await.map_err(|e| e.to_string())?;
+        timeout(Duration::from_secs(10), running).await??;
+        // The result was transferred and the producer has exited. Only the
+        // detached physical job owns the original worker admission now.
+        ticket.seal()?;
+        assert_eq!(c.stats().workers, 1);
+        assert!(matches!(
+            ticket.spawn(|_| async { Ok(()) }),
+            Err(StagingError::Capacity)
+        ));
+        assert!(
+            f.client()
+                .query::<CheckPreparation>(&f.target, None, check(lease.token))
+                .await?
+                .output
+                .is_none()
+        );
+        assert!(!worker.is_finished());
+        drop(release);
+        timeout(Duration::from_secs(10), worker).await??;
+        assert!(matches!(terminal(&ticket).await?, StagingState::Bound(_)));
+        assert_eq!(c.stats().workers, 0);
+        assert!(c.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn physical_bound_worker_outlives_custody_fence_async_abort_and_observer_drop() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        let ticket = bound::bind(&f, &c, [234; 16], "owner").await?;
+        let session = ticket.bound_session()?;
+        let (physical, running) = oneshot::channel();
+        let work = ticket.spawn_bound(move |_, context| async move {
+            let held = held_worker(context);
+            physical.send(held).map_err(|_| StagingError::Worker)?;
+            std::future::pending::<std::result::Result<(), StagingError>>().await
+        })?;
+        let (release, entered, worker) = timeout(Duration::from_secs(10), running).await??;
+        timeout(Duration::from_secs(10), entered).await??;
+        drop(work);
+        ticket.expire_bound_for_test()?;
+        timeout(Duration::from_secs(10), async {
+            while !matches!(ticket.state(), StagingState::Fenced(_)) {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        assert!(session.live_lease().is_err());
+        assert!(ticket.bound_session().is_err());
+        assert_eq!(c.stats().workers, 1);
+        assert_eq!(c.stats().admitted, 1);
+        drop(ticket);
+        let closing = c.clone();
+        let close = tokio::spawn(async move { closing.close_and_drain().await });
+        timeout(Duration::from_secs(10), async {
+            while !c.stats().closed {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert!(!close.is_finished());
+        drop(release);
+        timeout(Duration::from_secs(10), worker).await??;
+        assert!(timeout(Duration::from_secs(10), close).await??.is_empty());
+        assert_eq!(c.stats().workers, 0);
+        assert_eq!(c.stats().admitted, 0);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
index 6815e23e..68e1eef6 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
@@ -142,7 +142,7 @@ async fn bound_final_publication_drains_retained_work_and_due_renewal_through_cl
         let input = ready(&session).await?;
         let (release, blocked) = oneshot::channel();
         let (entered, running) = oneshot::channel();
-        let work = ticket.spawn_bound(move |_| async move {
+        let work = ticket.spawn_bound(move |_, _context| async move {
             let _ = entered.send(());
             blocked.await.map_err(|_| StagingError::Worker)?;
             Ok(42u64)
@@ -154,7 +154,7 @@ async fn bound_final_publication_drains_retained_work_and_due_renewal_through_cl
         drop(publication);
         drop(work);
         assert!(matches!(ticket.state(), StagingState::Finishing));
-        assert!(ticket.spawn_bound(|_| async { Ok(()) }).is_err());
+        assert!(ticket.spawn_bound(|_, _context| async { Ok(()) }).is_err());
         assert!(ticket.bound_session().is_err());
         assert_eq!(p.stats().await.held, 1);
         assert_eq!(c.stats().workers, 1);
@@ -229,20 +229,15 @@ fn bound_final_exact_recovery_preserves_commits_and_refuses_absence_after_custod
 }
 async fn exact_case(format: ObjectFormat, fault: u8, expired: bool) -> Result {
     let f = Fixture::new(format).await?;
-    let c = StagingCoordinator::new(
-        f.target.clone(),
-        StagingLimits {
-            bound_lifetime_ms: 1000,
-            ..StagingLimits::default()
-        },
-        f.authority(),
-    )?;
+    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
     let p = PublicationCoordinator::new(
         f.target.clone(),
         PublicationLimits::default(),
         f.publication_budget.clone(),
     )?;
     let ticket = super::bound::bind(&f, &c, [232; 16], "owner").await?;
+    // Start the short ceiling in the publication phase, after Bind setup.
+    ticket.limit_bound_ceiling_for_test(Duration::from_millis(1000))?;
     let session = ticket.bound_session()?;
     p.fault_for_test(fault);
     let observer = ticket.publish(&p, ready(&session).await?)?;
@@ -347,20 +342,15 @@ async fn bound_final_ceiling_discards_held_proof_and_drops_result_before_worker_
         }
     }
     let f = Fixture::new(ObjectFormat::Sha256).await?;
-    let c = StagingCoordinator::new(
-        f.target.clone(),
-        StagingLimits {
-            bound_lifetime_ms: 1000,
-            ..StagingLimits::default()
-        },
-        f.authority(),
-    )?;
+    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
     let p = PublicationCoordinator::new(
         f.target.clone(),
         PublicationLimits::default(),
         f.publication_budget.clone(),
     )?;
     let ticket = super::bound::bind(&f, &c, [233; 16], "owner").await?;
+    // Start the short ceiling in the publication phase, after Bind setup.
+    ticket.limit_bound_ceiling_for_test(Duration::from_millis(1000))?;
     let session = ticket.bound_session()?;
     let input = ready(&session).await?;
     let dropped = Arc::new(AtomicBool::new(false));
@@ -371,7 +361,7 @@ async fn bound_final_ceiling_discards_held_proof_and_drops_result_before_worker_
         wrong: wrong.clone(),
     };
     let (done, completed) = oneshot::channel();
-    let work = ticket.spawn_bound(move |_| async move {
+    let work = ticket.spawn_bound(move |_, _context| async move {
         let _ = done.send(());
         Ok(owned)
     })?;
@@ -478,20 +468,15 @@ async fn bound_final_refusals_keep_exact_ready_and_require_shared_session_and_fi
 #[tokio::test]
 async fn bound_final_queued_transport_rechecks_ceiling_before_initial_execution() -> Result {
     let f = Fixture::new(ObjectFormat::Sha256).await?;
-    let c = StagingCoordinator::new(
-        f.target.clone(),
-        StagingLimits {
-            bound_lifetime_ms: 1000,
-            ..StagingLimits::default()
-        },
-        f.authority(),
-    )?;
+    let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
     let p = PublicationCoordinator::new(
         f.target.clone(),
         PublicationLimits::default(),
         f.publication_budget.clone(),
     )?;
     let ticket = super::bound::bind(&f, &c, [236; 16], "owner").await?;
+    // Start the short ceiling in the publication phase, after Bind setup.
+    ticket.limit_bound_ceiling_for_test(Duration::from_millis(1000))?;
     let session = ticket.bound_session()?;
     let (release, entered) = p.pause_for_test().await;
     let observer = ticket.publish(&p, ready(&session).await?)?;
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
index c6065524..f85628af 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
@@ -398,7 +398,7 @@ async fn cold_bound_owner_loss_cancels_workers_before_releasing_resource_credit(
                 wrong_order: wrong_order.clone(),
             };
             let (entered, running) = oneshot::channel();
-            let worker = ticket.spawn_bound(move |_| async move {
+            let worker = ticket.spawn_bound(move |_, _context| async move {
                 let _resource = resource;
                 let _ = entered.send(());
                 std::future::pending::<std::result::Result<(), StagingError>>().await
@@ -421,7 +421,7 @@ async fn cold_bound_owner_loss_cancels_workers_before_releasing_resource_credit(
             assert!(dropped.load(Ordering::Acquire));
             assert!(!wrong_order.load(Ordering::Acquire));
             assert_eq!(service.stats().workers, 0);
-            assert!(ticket.spawn_bound(|_| async { Ok(()) }).is_err());
+            assert!(ticket.spawn_bound(|_, _context| async { Ok(()) }).is_err());
             assert_eq!(ticket.restored_evidence(), Some(&evidence));
             assert_eq!(
                 *ticket.restored_outcome().ok_or("historical outcome lost")?,
@@ -459,7 +459,7 @@ async fn cold_staging_unsettled_expired_originals_keep_exact_evidence_and_never_
             assert_eq!(ticket.restored_evidence(), Some(&evidence));
             assert!(ticket.restored_outcome().is_none());
             assert!(ticket.spawn(|_| async { Ok(()) }).is_err());
-            assert!(ticket.spawn_bound(|_| async { Ok(()) }).is_err());
+            assert!(ticket.spawn_bound(|_, _context| async { Ok(()) }).is_err());
             assert_eq!(
                 service.stats().command_bytes,
                 super::super::super::custody::RESERVATION
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs
index 6482325f..13022519 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs
@@ -132,14 +132,14 @@ async fn automatic_retirement_joins_live_callbacks_and_drops_retained_results_be
             };
             let finished = owned();
             let completed = if bound {
-                ticket.spawn_bound(move |_| async move { Ok(finished) })?
+                ticket.spawn_bound(move |_, _context| async move { Ok(finished) })?
             } else {
                 ticket.spawn(move |_| async move { Ok(finished) })?
             };
             let running = owned();
             let (entered, start) = oneshot::channel();
             let worker = if bound {
-                ticket.spawn_bound(move |_| async move {
+                ticket.spawn_bound(move |_, _context| async move {
                     let _ = entered.send(());
                     std::future::pending::<()>().await;
                     drop(running);
diff --git a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
index c2ecf41f..3a1690ce 100644
--- a/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
+++ b/crates/canopy-server/src/packs/publication/tests/terminal_retention.rs
@@ -87,7 +87,7 @@ pub(super) async fn qualify(context: Context<'_>, fault: u8, provider: Arc<InMem
     let artifacts = store.clone();
     let directory = root.to_path_buf();
     let ready = ticket
-        .spawn_bound(move |original| async move {
+        .spawn_bound(move |original, _context| async move {
             original
                 .ready_root_outcome(mutation, &artifacts, &directory, budget, None)
                 .await
diff --git a/crates/canopy-server/src/packs/verification/mod.rs b/crates/canopy-server/src/packs/verification/mod.rs
index 781a5544..c75ecb23 100644
--- a/crates/canopy-server/src/packs/verification/mod.rs
+++ b/crates/canopy-server/src/packs/verification/mod.rs
@@ -25,9 +25,17 @@ impl CanonicalVerifier {
         git_dir: &Path,
         format: ObjectFormat,
         native: &crate::native_resources::NativeScope,
+    ) -> Result<Self, ObjectReadError> {
+        Self::new_owned(git_dir, format, native, std::sync::Arc::new(()))
+    }
+    pub(crate) fn new_owned(
+        git_dir: &Path,
+        format: ObjectFormat,
+        native: &crate::native_resources::NativeScope,
+        owner: crate::git_objects::ReadOwner,
     ) -> Result<Self, ObjectReadError> {
         Ok(Self {
-            native: GitObjects::batch(git_dir, native)?,
+            native: GitObjects::batch_owned(git_dir, native, owner)?,
             format,
         })
     }
diff --git a/crates/canopy-server/src/packs/verification/physical.rs b/crates/canopy-server/src/packs/verification/physical.rs
index c05ea7f5..f793b5b1 100644
--- a/crates/canopy-server/src/packs/verification/physical.rs
+++ b/crates/canopy-server/src/packs/verification/physical.rs
@@ -43,6 +43,8 @@ impl Default for PhysicalLimits {
 }
 #[derive(Debug, thiserror::Error)]
 pub enum PhysicalError {
+    #[error("physical verification has no live staging custody")]
+    Staging(#[from] crate::packs::publication::StagingError),
     #[error("isolated native workspace failed")]
     Cache(#[from] CacheError),
     #[error("physical artifact binding failed")]
@@ -113,6 +115,7 @@ impl PhysicalPackWitness {
 /// The service must also retain its native-process admission for this lifetime.
 pub struct PhysicalVerifier {
     store: ArtifactStore,
+    context: Option<crate::packs::publication::StagingContext>,
     // Drop the native actor/index before releasing the fenced workspace.
     native: Option<CanonicalVerifier>,
     binding: Arc<VerifiedPackBinding>,
@@ -127,6 +130,7 @@ pub struct PhysicalVerifier {
     failed: bool,
 }
 impl PhysicalVerifier {
+    #[cfg(test)]
     pub async fn download(
         root: &Path,
         budget: DiskBudget,
@@ -134,6 +138,62 @@ impl PhysicalVerifier {
         descriptor: NativePackDescriptor,
         limits: PhysicalLimits,
         native: crate::native_resources::NativeScope,
+    ) -> Result<Self, PhysicalError> {
+        Self::download_owned(
+            root,
+            budget,
+            store,
+            descriptor,
+            limits,
+            native,
+            Arc::new(()),
+        )
+        .await
+    }
+
+    /// Retain the admitted creating or bound worker through provider reads,
+    /// blocking assembly, native descendants and deferred workspace cleanup.
+    /// A retained owner does not extend custody; check it before each new stage.
+    pub async fn download_staged(
+        context: &crate::packs::publication::StagingContext,
+        root: &Path,
+        budget: DiskBudget,
+        store: &ArtifactStore,
+        descriptor: NativePackDescriptor,
+        limits: PhysicalLimits,
+        native: crate::native_resources::NativeScope,
+    ) -> Result<Self, PhysicalError> {
+        let token = context.token()?;
+        if descriptor.repository != token.repository
+            || store.repository() != token.repository
+            || descriptor.operation != token.artifact_operation
+            || descriptor.format != context.format()
+        {
+            return Err(PhysicalError::Integrity);
+        }
+        let mut verifier = Self::download_owned(
+            root,
+            budget,
+            store,
+            descriptor,
+            limits,
+            native,
+            context.physical_owner(),
+        )
+        .await?;
+        context.ensure_live()?;
+        verifier.context = Some(context.clone());
+        Ok(verifier)
+    }
+
+    async fn download_owned(
+        root: &Path,
+        budget: DiskBudget,
+        store: &ArtifactStore,
+        descriptor: NativePackDescriptor,
+        limits: PhysicalLimits,
+        native: crate::native_resources::NativeScope,
+        owner: crate::git_objects::ReadOwner,
     ) -> Result<Self, PhysicalError> {
         descriptor.validate(store.repository(), descriptor.format)?;
         if limits.max_pack_bytes > MAX_ARTIFACT_BYTES
@@ -145,16 +205,28 @@ impl PhysicalVerifier {
             return Err(PhysicalError::Limit);
         }
         let root = root.to_owned();
-        let root = tokio::task::spawn_blocking(move || std::fs::canonicalize(root)).await??;
-        let cache = GitCache::create(
+        let root_owner = owner.clone();
+        let root = tokio::task::spawn_blocking(move || {
+            let _owner = root_owner;
+            std::fs::canonicalize(root)
+        })
+        .await??;
+        let cache = GitCache::create_owned(
             root.clone(),
             budget.clone(),
             "refs/heads/main",
             descriptor.format,
+            None,
             native,
+            crate::git_cache::CacheOwnership {
+                work: owner.clone(),
+                cleanup: Some(owner.clone()),
+            },
         )
         .await?;
-        cache.download_native(store, descriptor).await?;
+        cache
+            .download_native_owned(store, descriptor, owner)
+            .await?;
         let pinned = Arc::clone(&cache);
         let input_claim = cache
             .native
@@ -166,9 +238,15 @@ impl PhysicalVerifier {
         })
         .await??;
         validate_native(Arc::clone(&cache), descriptor, limits.native_timeout).await?;
-        let native = CanonicalVerifier::new(&cache.git_dir(), descriptor.format, &cache.native)?;
+        let native = CanonicalVerifier::new_owned(
+            &cache.git_dir(),
+            descriptor.format,
+            &cache.native,
+            cache.clone(),
+        )?;
         Ok(Self {
             store: store.clone(),
+            context: None,
             native: Some(native),
             binding: Arc::new(binding),
             cache,
@@ -190,6 +268,7 @@ impl PhysicalVerifier {
         &mut self,
         object_count: u32,
     ) -> Result<Arc<MetadataSegment>, PhysicalError> {
+        self.ensure_live()?;
         if self.failed {
             return Err(PhysicalError::Integrity);
         }
@@ -203,7 +282,9 @@ impl PhysicalVerifier {
         let root = self.root.clone();
         let budget = self.budget.clone();
         let limits = self.limits.metadata;
+        let cache = Arc::clone(&self.cache);
         let mut builder = tokio::task::spawn_blocking(move || {
+            let _pin = cache;
             MetadataBuilder::new(&root, budget, identity, limits)
         })
         .await??;
@@ -225,8 +306,10 @@ impl PhysicalVerifier {
                 return Err(PhysicalError::Integrity);
             }
             let mut witnesses = Vec::with_capacity(ids.len());
-            let edges = spool::EdgeSpool::new(&self.root, self.budget.clone());
+            let edges =
+                spool::EdgeSpool::new_owned(&self.root, self.budget.clone(), self.cache.clone());
             for oid in ids {
+                self.ensure_live()?;
                 let witness = self
                     .native
                     .as_mut()
@@ -257,11 +340,13 @@ impl PhysicalVerifier {
         self.chain = fold_shard(self.chain, self.shards, segment.descriptor());
         self.shards = self.shards.checked_add(1).ok_or(PhysicalError::Integrity)?;
         self.next_ordinal = end;
+        self.ensure_live()?;
         self.failed = false;
         Ok(segment)
     }
 
     pub async fn finish(mut self) -> Result<PhysicalPackWitness, PhysicalError> {
+        self.ensure_live()?;
         if self.failed || self.next_ordinal != self.descriptor.object_count || self.shards == 0 {
             return Err(PhysicalError::Integrity);
         }
@@ -269,6 +354,7 @@ impl PhysicalVerifier {
         tokio::time::timeout(self.limits.native_timeout, native.finish())
             .await
             .map_err(|_| GitHttpError::Timeout)??;
+        self.ensure_live()?;
         Ok(PhysicalPackWitness {
             store: self.store,
             native: self.descriptor,
@@ -276,6 +362,12 @@ impl PhysicalVerifier {
             metadata_digest: self.chain,
         })
     }
+    fn ensure_live(&self) -> Result<(), PhysicalError> {
+        if let Some(context) = &self.context {
+            context.ensure_live()?;
+        }
+        Ok(())
+    }
 }
 
 fn pack_path(cache: &GitCache, descriptor: NativePackDescriptor) -> PathBuf {
diff --git a/crates/canopy-server/src/packs/verification/spool.rs b/crates/canopy-server/src/packs/verification/spool.rs
index 6b2f445a..111a05fb 100644
--- a/crates/canopy-server/src/packs/verification/spool.rs
+++ b/crates/canopy-server/src/packs/verification/spool.rs
@@ -104,6 +104,7 @@ struct Storage {
     file: Option<AdmittedFile>,
     bytes: u64,
     failed: bool,
+    _owner: crate::git_objects::ReadOwner,
 }
 
 /// One append-only dependency file for a bounded native-object batch. Each
@@ -117,6 +118,13 @@ pub(super) struct EdgeSpool {
 }
 impl EdgeSpool {
     pub(super) fn new(root: &Path, budget: DiskBudget) -> Self {
+        Self::new_owned(root, budget, Arc::new(()))
+    }
+    pub(super) fn new_owned(
+        root: &Path,
+        budget: DiskBudget,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Self {
         Self {
             root: root.to_owned(),
             budget,
@@ -124,6 +132,7 @@ impl EdgeSpool {
                 file: None,
                 bytes: 0,
                 failed: false,
+                _owner: owner,
             })),
             writing: Arc::new(AtomicBool::new(false)),
         }
diff --git a/docs/design/bound-preparation-lifecycle.md b/docs/design/bound-preparation-lifecycle.md
index a033bef2..667aac42 100644
--- a/docs/design/bound-preparation-lifecycle.md
+++ b/docs/design/bound-preparation-lifecycle.md
@@ -6,7 +6,7 @@ StagingCoordinator now keeps an operation admitted after BindStaging and can adm
 
 Seal drains staged workers/results before Bind as before. A known Bind or bound Claim stores its original lease and receipt in bound_result before fresh queries. Successful fresh CheckPreparation token/floor/format matching constructs the shared bound PreparationSession. Staging contexts become inactive at that phase transition. Admission remains charged until explicit stop, loss of custody or the residence ceiling; Bound is a recorded handoff result, not release of service ownership.
 
-bound_session returns a locally live shared session only in the usable bound phase. open_base refreshes at the original bound receipt and constructs the existing PreparationBaseResolver with that session's deadline/fence. Base reads, reconciliation and private proof factories observe the same session. spawn_bound admits a callback into the existing global/actor worker slots and typed StagingTask handoff. Dropped callers retain execution/results in service ownership. Retrieved results transfer once; failed/expired results drop before their credits. Use the existing admitted native/disk/reader primitives inside callbacks; these worker counters do not account for arbitrary heap, unjoined descendants or detached I/O.
+bound_session returns a locally live shared session only in the usable bound phase. open_base refreshes at the original bound receipt and constructs the existing PreparationBaseResolver with that session's deadline/fence. Base reads, reconciliation and private proof factories observe the same session. spawn_bound admits a callback receiving both the shared preparation session and a StagingContext into the existing global/actor worker slots and typed StagingTask handoff. Context clones and their internal physical_owner retain that original worker admission until every physical job drains, including after custody fencing or result transfer; lifetime ownership grants no new authority. Dropped callers retain execution/results in service ownership. Retrieved results transfer once; failed/expired results drop before their credits. Use the existing admitted native/disk/reader primitives inside callbacks; these worker counters do not account for arbitrary heap, unjoined descendants or detached I/O.
 
 A public Bound result remains recoverable after graceful stop and failed fresh custody. It is not usable authority. bound_session/open_base reject stopped or fenced jobs. Previously opened bases and session clones observe the shared permanent fence and residence ceiling. The session also retains a terminal fence notification: in-flight bound callbacks wake without waiting for a renewal or a coordinator status change, and late subscribers see the existing fence. Cancellation aborts and joins the callback before resource credit returns.
 
@@ -22,7 +22,7 @@ The local ceiling does not shorten or remove the independent SQL pin. Already ad
 
 A bound Claim may adopt its authenticated retained input root through the shared session. register_inputs now accepts that matching adopted certificate in the bound phase and uses the existing single 4 KiB checkpoint/result slot, adding it to the 28 KiB registered-custody command-wire reservation. Due renewal precedes queued registration. RegisterStagedInputs shares the exact slot with renewal; its original receipt is stored before fresh checkpoint-digest and bound-session queries. Fresh custody failure fences the job while the committed registration remains observable through pending_inputs. The original creating namespace and input root are reused; no nodes or native pairs are copied. A staged checkpoint already consumes that operation's single slot.
 
-stop/close refuse new staged or bound workers, keep renewing while accepted tasks and retained results drain, and retain uncertain exact evidence/credits. Service consumers must retrieve completed results to finish graceful drain. Once drained, the shared bound session is fenced before operation admission is returned. Reached residence, worker error/panic or lost custody aborts and joins outstanding callbacks and discards untransferred results before credit release. SQL pins and remote artifacts remain independently retained.
+stop/close refuse new staged or bound workers, keep renewing while accepted tasks and retained results drain, and retain uncertain exact evidence/credits. Service consumers must retrieve completed results to finish graceful drain. Once drained, the shared bound session is fenced before operation admission is returned. Reached residence, worker error/panic or lost custody aborts and joins outstanding async callbacks and discards untransferred results. Admission remains charged until their retained physical owners also drain. SQL pins and remote artifacts remain independently retained.
 
 ## Remaining integration and release gates
 
diff --git a/docs/design/final-publication-lifecycle.md b/docs/design/final-publication-lifecycle.md
index ddd15c65..01c150a4 100644
--- a/docs/design/final-publication-lifecycle.md
+++ b/docs/design/final-publication-lifecycle.md
@@ -16,8 +16,10 @@ Retrieve the producer's StagingTask result before waiting for publication. Await
 
 ```rust,ignore
 let base = Arc::new(stage.open_base(indexes, files).await?);
-let work = stage.spawn_bound(move |_| async move {
+let work = stage.spawn_bound(move |_, context| async move {
+    context.ensure_live()?;
     // Build/verify with existing admitted native/disk/reader primitives.
+    // Retain context ownership in physical jobs that can outlive this future.
     // Return a private ready_push, ready_root_push or ready_compaction value.
     prepare_ready(base).await
 })?;
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index aac56deb..86867440 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -30,9 +30,13 @@ After Begin or Claim succeeds, query CheckStaging at its receipt. Derive the loc
 
 The service periodically prepares and executes RenewStaging before that deadline. Each renewal has a fresh mutation identity; an ambiguous renewal retains its original command instead of allocating another. After a known success, another authoritative query checks live identity, format, expiry and current access before advancing the shared deadline. Producers receive StagingContext, which supplies the checked namespace token and format, and observes the shared conservative deadline and lifetime.
 
-`ticket.spawn` owns and supervises the producer future. Its returned StagingTask observes the result. A producer error, panic, expired custody or lost access fences the job. Cancellation aborts and joins the producer before releasing its worker credit. Completed retained inputs drop before their credit on fencing, including when an external observer remains alive. Results transfer once through `wait`; resources move to the caller before that slot releases. Retained results count toward both global and actor worker caps, preventing an unbounded completed-result backlog.
+`ticket.spawn` owns and supervises the producer future. Its returned StagingTask observes the result. A producer error, panic, expired custody or lost access fences the job. Cancellation aborts and joins the async producer; its worker credit remains charged until every physical owner also drains. Completed retained inputs drop before their credit on fencing, including when an external observer remains alive. Results transfer once through `wait`; resources move to the caller before the result slot releases its ownership. Transferred physical owners can keep the original worker admission charged afterward. Retained results count toward both global and actor worker caps, preventing an unbounded completed-result backlog.
 
-Use existing admitted native-process, workspace, reader and disk primitives inside producers. The callback counter does not account for arbitrary heap allocation, unjoined descendants or detached physical readers. Their independent admission and retention obligations remain in force; production integration must preserve them through work and handoff.
+Each `StagingContext` clone now retains the same original worker/actor admission. The internal `physical_owner` supplies that lifetime pin without granting custody or publication authority. `spawn_bound` supplies both the live shared preparation session and this context. A detached job must retain the pin through its physical completion; dropping an async observer, returning a result, or expiring custody cannot return that worker's capacity early. No new worker slot or queue is created by cloning ownership.
+
+Native receive requires a live context and retains its owner in the existing Git process group. Response reconciliation and pack enumeration retain it in blocking jobs; capture files retain it through hashing and provider upload. `PhysicalVerifier::download_staged` validates the input's repository, namespace and format against live context, carries the pin through cache creation/download, isolated native verification, canonical extraction and edge-spool writes, and checks custody again before each new inspection and final witness. Deferred workspace cleanup retains the original worker credit. The unowned physical download entry point is qualification-only.
+
+Use the existing independent native-process, workspace, reader and disk admission inside these producers as well. Worker ownership is a drain barrier, not CPU/I/O fairness or a bound on arbitrary heap allocation. The live HTTP/SSH/generated write factories and resident staging service still need conversion; not all lower request, metadata and policy workers have been connected to this pin yet.
 
 ## Durable input checkpoint registration
 
diff --git a/docs/evidence/staging-physical-workers-20261004.json b/docs/evidence/staging-physical-workers-20261004.json
new file mode 100644
index 00000000..8f1e0884
--- /dev/null
+++ b/docs/evidence/staging-physical-workers-20261004.json
@@ -0,0 +1,649 @@
+{
+  "checkpoint": "staging physical worker ownership and publication-phase ceiling qualification",
+  "parent": "6101d5869f71dd836876266ba8d5aec0ac7965b0",
+  "validation": {
+    "source_files": 488,
+    "rust_files": 474,
+    "source_hash_digest": "c76cad71a122baa769df897444e87eb8d7ef4a3b8e46ecaedbb2a9e35ff833fa",
+    "release_qualified": false,
+    "execution_complete": true,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 32.272,
+        "log": "/tmp/canopy-stage-physical-clippy-final.log",
+        "log_sha256": "3df8a565e1aa6a6df71d04cf363c444c0bacaaf546f61fc85236f6da9013b45d",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "physical_creating_worker",
+          "physical_bound_worker",
+          "git_http::capture::tests::",
+          "native_receive_stages_verifies_and_publishes_then_clones_after_cache_loss",
+          "native_receive_prepares_bounded_immutable_root_completion_from_registered_custody",
+          "bound_service_phase_handoff_and_residence_cap_fence_existing_bases_and_inflight_workers",
+          "closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clone_drops",
+          "staging_service::publication::bound_final_ceiling",
+          "staging_service::publication::bound_final_queued_transport",
+          "staging_service::publication::bound_final_exact_recovery",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "seconds": 86.42,
+        "log": "/tmp/canopy-stage-physical-focused-final.log",
+        "log_sha256": "75f1fbb56b460e9397fd77702b61a9bb1741172473478a80e339cc08e12ed239",
+        "summaries": [
+          [
+            11,
+            0,
+            0,
+            0,
+            684
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "libraries",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--lib",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 271.387,
+        "log": "/tmp/canopy-stage-physical-libraries-final.log",
+        "log_sha256": "60b9957c10e2c28124efe01fb0e0c891d7fe7e3a9cad7e6f1daa5c2865da6001",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            14,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            694
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            694
+          ],
+          [
+            695,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "directory",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "directory_cell",
+          "--locked"
+        ],
+        "exit_code": 101,
+        "seconds": 53.858,
+        "log": "/tmp/canopy-stage-physical-directory-final.log",
+        "log_sha256": "d5101da1851c49576bdd6498999584dd657e2d2dfd9c8660320beb854df5ca09",
+        "summaries": [
+          [
+            12,
+            1,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": [
+          "directory_reservations_recover_two_distinct_repository_cells"
+        ]
+      },
+      {
+        "label": "binary",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--bin",
+          "canopy",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 6.919,
+        "log": "/tmp/canopy-stage-physical-binary-final.log",
+        "log_sha256": "8b2e1fa03ccf2587724ee53f19dfed77dc4d216c29d6bc9922b15bec6c25114d",
+        "summaries": [
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 62.313,
+        "log": "/tmp/canopy-stage-physical-build-final.log",
+        "log_sha256": "962e16493d5d1c437445aa2436052d9ac082faf97a33efdfa21519f783b70a06",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.222,
+        "log": "/tmp/canopy-stage-physical-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.066,
+        "log": "/tmp/canopy-stage-physical-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 41.298,
+        "log": "/tmp/canopy-stage-physical-harness-final.log",
+        "log_sha256": "87b82abdb6530000635d38f0cc5f7acb83a174027f6f59c207fa93ab1eb4ce2b",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ]
+  },
+  "unique_rust_executed": 730,
+  "rust_passed": 729,
+  "rust_failed": 1,
+  "library_unique_passed": 715,
+  "server_library_unique_passed": 695,
+  "publication_unique_passed": 400,
+  "focused_passed": 11,
+  "binary_passed": 2,
+  "directory_passed": 12,
+  "directory_failed": 1,
+  "python_passed": 96,
+  "counts_exclude": "focused reruns and nested subprocess summaries; preceding-source isolated reruns are historical evidence only",
+  "release_qualified": false,
+  "remote_preceding_head_ci": [
+    {
+      "head": "6101d5869f71dd836876266ba8d5aec0ac7965b0",
+      "run": 37241921975,
+      "rust_job": 111552187935,
+      "conclusion": "failure",
+      "server_library_passed": 693,
+      "binary_passed": 2,
+      "directory_passed": 12,
+      "directory_failed": 1,
+      "failure": "directory_reservations_recover_two_distinct_repository_cells: retired ingestion command descriptor is unavailable",
+      "log": {
+        "path": "/tmp/canopy-pr34-6101d58-failed.log",
+        "sha256": "a89ae34ea371c2a33e537ccfa7d32febce559acb2fbabea896bc639d10ea5900"
+      }
+    },
+    {
+      "head": "6101d5869f71dd836876266ba8d5aec0ac7965b0",
+      "run": 37241919745,
+      "rust_job": 111552180632,
+      "conclusion": "failure",
+      "server_library_passed": 693,
+      "binary_passed": 2,
+      "directory_passed": 12,
+      "directory_failed": 1,
+      "failure": "directory_reservations_recover_two_distinct_repository_cells: retired ingestion command descriptor is unavailable",
+      "log": {
+        "path": "/tmp/canopy-pr34-6101d58-secondary-failed.log",
+        "sha256": "52cfc5d915246bdee2a28a824278713a3f8377241204a91018284e69b15fc7ed"
+      }
+    }
+  ],
+  "failed_drafts": [
+    {
+      "reason": "new fixture observed Bound as a terminal phase instead of waiting for the actual expiry fence",
+      "validation": {
+        "source_files": 488,
+        "rust_files": 474,
+        "source_hash_digest": "39b90a9b5aafabc8d5273d314105690a9ee943f883e350d797bba348f10270b2",
+        "release_qualified": false,
+        "execution_complete": false,
+        "phases": [
+          {
+            "label": "clippy",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "clippy",
+              "--workspace",
+              "--all-targets",
+              "--locked",
+              "--",
+              "-D",
+              "warnings"
+            ],
+            "exit_code": 0,
+            "seconds": 0.963,
+            "log": "/tmp/canopy-stage-physical-clippy-final.log",
+            "log_sha256": "a7642a0867425c6137f6fda230ee0c5445d5148745ccd7b4f5b0b4f2b4540d91",
+            "summaries": [],
+            "failed_cases": []
+          },
+          {
+            "label": "focused",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "test",
+              "-p",
+              "canopy-server",
+              "--lib",
+              "--locked",
+              "--",
+              "physical_creating_worker",
+              "physical_bound_worker",
+              "git_http::capture::tests::",
+              "native_receive_stages_verifies_and_publishes_then_clones_after_cache_loss",
+              "native_receive_prepares_bounded_immutable_root_completion_from_registered_custody",
+              "--test-threads=4"
+            ],
+            "exit_code": 101,
+            "seconds": 108.937,
+            "log": "/tmp/canopy-stage-physical-focused-final.log",
+            "log_sha256": "eabbdba76d268803f8da2bc5e1dc7cafc4274155d67a4a693c3284e7369876bd",
+            "summaries": [
+              [
+                5,
+                1,
+                0,
+                0,
+                689
+              ]
+            ],
+            "failed_cases": [
+              "packs::publication::tests::staging_service::physical::physical_bound_worker_outlives_custody_fence_async_abort_and_observer_drop"
+            ]
+          }
+        ]
+      },
+      "validation_file": {
+        "path": "/tmp/canopy-stage-physical-before-fence-wait-validation.json",
+        "sha256": "067facbdc2f16ec424fbb918608d7fdf88e704b59ba1527de8ec4e12062061df"
+      }
+    },
+    {
+      "reason": "the old phase fixture retained its newly owned context across Bind; an unrelated serving timeout passed in exact isolation",
+      "validation": {
+        "source_files": 488,
+        "rust_files": 474,
+        "source_hash_digest": "d7b3210e3a0011a39eb1aad7c257ceb6fc7490752e52c59edf21bb8df08a1e9b",
+        "release_qualified": false,
+        "execution_complete": false,
+        "phases": [
+          {
+            "label": "clippy",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "clippy",
+              "--workspace",
+              "--all-targets",
+              "--locked",
+              "--",
+              "-D",
+              "warnings"
+            ],
+            "exit_code": 0,
+            "seconds": 51.379,
+            "log": "/tmp/canopy-stage-physical-clippy-final.log",
+            "log_sha256": "376d4d7ca543747510c2717416f9c17db2c89cfd726d864a4bc5270edba5175a",
+            "summaries": [],
+            "failed_cases": []
+          },
+          {
+            "label": "focused",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "test",
+              "-p",
+              "canopy-server",
+              "--lib",
+              "--locked",
+              "--",
+              "physical_creating_worker",
+              "physical_bound_worker",
+              "git_http::capture::tests::",
+              "native_receive_stages_verifies_and_publishes_then_clones_after_cache_loss",
+              "native_receive_prepares_bounded_immutable_root_completion_from_registered_custody",
+              "--test-threads=4"
+            ],
+            "exit_code": 0,
+            "seconds": 118.525,
+            "log": "/tmp/canopy-stage-physical-focused-final.log",
+            "log_sha256": "8b2d825152bcc50f2364b87e033da72fd0b1e937c3ec5c33cbc9e0bf31d1c7d6",
+            "summaries": [
+              [
+                6,
+                0,
+                0,
+                0,
+                689
+              ]
+            ],
+            "failed_cases": []
+          },
+          {
+            "label": "libraries",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "test",
+              "--workspace",
+              "--lib",
+              "--locked"
+            ],
+            "exit_code": 101,
+            "seconds": 261.895,
+            "log": "/tmp/canopy-stage-physical-libraries-final.log",
+            "log_sha256": "24a23f9ccccd15fdc51cff98a3a8327b4cf6ce14172c6fb33c1e5fffb6a55c44",
+            "summaries": [
+              [
+                6,
+                0,
+                0,
+                0,
+                0
+              ],
+              [
+                14,
+                0,
+                0,
+                0,
+                0
+              ],
+              [
+                1,
+                0,
+                0,
+                0,
+                694
+              ],
+              [
+                1,
+                0,
+                0,
+                0,
+                694
+              ],
+              [
+                693,
+                2,
+                0,
+                0,
+                0
+              ]
+            ],
+            "failed_cases": [
+              "packs::publication::tests::serving::lifecycle::closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clone_drops",
+              "packs::publication::tests::staging_service::bound::bound_service_phase_handoff_and_residence_cap_fence_existing_bases_and_inflight_workers"
+            ]
+          }
+        ]
+      },
+      "validation_file": {
+        "path": "/tmp/canopy-stage-physical-before-context-release-validation.json",
+        "sha256": "6b4d88f8b900addaf95f5163c0115b25d70027c3c5a715984f9d86e8936f3b36"
+      }
+    },
+    {
+      "reason": "the one-second test ceiling sometimes expired during Bind setup; same limit is now applied after Bind before the publication scenario",
+      "validation": {
+        "source_files": 488,
+        "rust_files": 474,
+        "source_hash_digest": "56c289487ff8c16d5b1640e6ede2ce66a5a1b56232eeda0ea10daf4bebf1072c",
+        "release_qualified": false,
+        "execution_complete": false,
+        "phases": [
+          {
+            "label": "clippy",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "clippy",
+              "--workspace",
+              "--all-targets",
+              "--locked",
+              "--",
+              "-D",
+              "warnings"
+            ],
+            "exit_code": 0,
+            "seconds": 43.779,
+            "log": "/tmp/canopy-stage-physical-clippy-final.log",
+            "log_sha256": "8157545edd7feebc907ecf0ac53538f3288bb13543ef8e50ef3ad9cbb1d4aa52",
+            "summaries": [],
+            "failed_cases": []
+          },
+          {
+            "label": "focused",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "test",
+              "-p",
+              "canopy-server",
+              "--lib",
+              "--locked",
+              "--",
+              "physical_creating_worker",
+              "physical_bound_worker",
+              "git_http::capture::tests::",
+              "native_receive_stages_verifies_and_publishes_then_clones_after_cache_loss",
+              "native_receive_prepares_bounded_immutable_root_completion_from_registered_custody",
+              "bound_service_phase_handoff_and_residence_cap_fence_existing_bases_and_inflight_workers",
+              "closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clone_drops",
+              "--test-threads=4"
+            ],
+            "exit_code": 0,
+            "seconds": 86.05,
+            "log": "/tmp/canopy-stage-physical-focused-final.log",
+            "log_sha256": "a3e58e61ad3fa19d2d97b74b3403c93c20fc3a8e294436ac18dc5eaf8b349c52",
+            "summaries": [
+              [
+                8,
+                0,
+                0,
+                0,
+                687
+              ]
+            ],
+            "failed_cases": []
+          },
+          {
+            "label": "libraries",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "test",
+              "--workspace",
+              "--lib",
+              "--locked"
+            ],
+            "exit_code": 101,
+            "seconds": 218.733,
+            "log": "/tmp/canopy-stage-physical-libraries-final.log",
+            "log_sha256": "97848e431c678c2655439767556515e9d41c7da966f738c343a10ebe861e6918",
+            "summaries": [
+              [
+                6,
+                0,
+                0,
+                0,
+                0
+              ],
+              [
+                14,
+                0,
+                0,
+                0,
+                0
+              ],
+              [
+                1,
+                0,
+                0,
+                0,
+                694
+              ],
+              [
+                1,
+                0,
+                0,
+                0,
+                694
+              ],
+              [
+                694,
+                1,
+                0,
+                0,
+                0
+              ]
+            ],
+            "failed_cases": [
+              "packs::publication::tests::staging_service::publication::bound_final_ceiling_discards_held_proof_and_drops_result_before_worker_credit"
+            ]
+          }
+        ]
+      },
+      "validation_file": {
+        "path": "/tmp/canopy-stage-physical-before-ceiling-phase-validation.json",
+        "sha256": "8311028376a090240019592b2cb3e29986b4cf289e849185dcd54ce055242a5e"
+      }
+    }
+  ],
+  "isolated_draft_runs": [
+    {
+      "path": "/tmp/canopy-stage-physical-isolated-failures.log",
+      "sha256": "124d50cd9af13b02685fef4453139f8bdef7f25d52a5e1c9573e5f6c11f33160"
+    },
+    {
+      "path": "/tmp/canopy-stage-physical-ceiling-isolated.log",
+      "sha256": "1d6b30e98ad6bc6efd1acfaf57cb0621dafd22493eb579e892bcdac79c347936"
+    }
+  ],
+  "initial_compile_diagnostic": {
+    "path": "/tmp/canopy-stage-physical-clippy-draft.log",
+    "sha256": "14ac3609200cff14279207a03ac327991f4dc4583cefbd660f80bda05a1b81bf"
+  },
+  "initial_compile_diagnostic_scope": "pre-qualification moved-value and result-alias mistakes; no passing qualification is attributed to this draft",
+  "remaining_ci_failure": "The real write path and directory fixture still use retired loose-object ingestion. Do not restore that command/schema or skip the case; convert the actual native producers before their fixtures.",
+  "unrun": [
+    "complete latest-source workspace command beyond the directory failure",
+    "remaining integration binaries and doctests",
+    "full Linux/RustFS provider workflow",
+    "full histories, OS containment and 10000-engineer mixed-load/recovery capacity",
+    "adopted old-owner inputs through authenticated retained selection"
+  ],
+  "next_priorities": [
+    "resident StagingCoordinator ownership and actual HTTP/SSH/generated producers",
+    "request/metadata/policy physical-owner propagation and bounded persisted metadata replay using existing structures",
+    "mandatory joint-root policy/outcome completion and real consumer fixture conversion",
+    "full Linux/provider CI, owner-aware authoritative consumers and physically fenced adoption",
+    "full remaining hard-cutover, custody history, GC/backup/restore, resource containment, native maintenance/hot-cache, capacity and attribution scope"
+  ],
+  "protected_index_sha256": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+  "protected_archive_sha256": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index baf88924..7a5d14b2 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -3,18 +3,68 @@
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. The cursor/native-base conversion below passes its focused and library
-qualification; the full CI workflow still fails in a legacy integration caller. Both actual `6ab78d6` Rust runs fail on four obsolete SQL cursor tests
-(`objects` is absent); both harness checks pass. The change below replaces their
-production hydration caller before transferring coverage to the immutable source
-index. Passing that coverage will not by itself qualify the whole CI workflow or
-complete owned write publication. The PR is ready for review, but not ready to
-merge or deploy. Older checkpoint notes describe their historical states.
+directly against `main`. The original SQL hydration failures have been resolved by
+converting their real read/cache callers. Full CI remains open: the directory
+integration fixture still invokes the retired loose-object ingestion command.
+The physical worker ownership change below supplies a prerequisite for the native
+write replacement; it does not complete that replacement. The PR remains for
+review and is not ready to merge or deploy. Older checkpoint notes describe
+historical states.
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Staging physical worker ownership
+
+Staging contexts and result slots now share the original worker admission.
+Result transfer, async cancellation and custody expiry cannot release worker or
+actor capacity while detached physical work retains it. Bound callbacks receive
+the live preparation session and its staging context. The existing `ReadOwner`,
+cache ownership and admitted spool structures carry the pin; there is no new
+queue, durable schema or independent physical-worker inventory.
+
+Native receive requires the checked context and carries its owner in the Git
+process group and response reconciliation. Capture enumeration and authenticated
+pack/index upload carry the same owner in blocking jobs and pinned files.
+`PhysicalVerifier::download_staged` validates live repository, current creating
+namespace and format; cache construction/download, native index validation,
+canonical decoding, edge-spool writes and deferred cleanup retain the worker.
+Inspection and witness completion check live custody again. The unowned download
+is confined to qualification builds. The native-receive qualification now runs
+physical verification as an admitted producer rather than outside the lifecycle. A phase-handoff
+fixture now releases its transferred worker context before Bind and checks that
+the retained staging token cannot reopen staging afterward. Holding that context
+across Bind would correctly keep physical admission charged.
+
+This is a lifecycle/API prerequisite. Live HTTP/SSH/generated producer wiring,
+resident staging service ownership, old-owner input adoption, bounded metadata
+replay and final joint-root completion still need conversion. In particular,
+current-namespace verification does not authorize adopted inputs from an older
+attempt; those need the authenticated retained-input selection path. Request,
+metadata and policy workers outside these native stages still need the same
+physical-owner integration. Full CI and capacity qualification remain open.
+
+Final frozen-source qualification passes all 715 unique workspace library cases
+(6 Git-format, 14 object-storage, 695 server), including all 400 publication
+cases, and all 11 focused ownership/native/expiry cases. Two binary cases, the
+server build, all-target workspace Clippy with warnings denied, formatting/diff
+checks and all 96 Python harness cases pass. Directory integration remains 12
+passes and one failure in retired ingestion. Thus 730 unique Rust cases executed,
+729 pass and one fails; focused reruns and two nested subprocess summaries are
+excluded. Later integration binaries/doctests and Linux/provider/capacity gates
+remain unrun for this source. Both actual preceding `6101d58` CI runs pass all
+693 server library cases and fail at the same directory case. Failed draft and
+isolated diagnostics, exact source/commands/log hashes and limits are preserved
+in the [physical-worker evidence](evidence/staging-physical-workers-20261004.json).
+The transferred-context fixture releases admission before Bind and checks the
+old token's staging denial afterward. One-second publication ceilings are now
+applied after actual Bind before private ready-proof construction, exercising
+the same ceiling guard without making startup speed a test prerequisite. The
+ceiling duration, virtual-time advance and publication/result/credit assertions
+remain unchanged. One preceding-source serving timeout passes in exact isolation
+and the final full rerun; no claim of eliminating all timing failures is made.
+
 ## Immutable source cursor and native write-base conversion
 
 The private cache constructor used by HTTP push and generated candidate

From 6357f4149fe7aee6df675fc1c3a50fe5bb45216e Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 17:30:30 -0700
Subject: [PATCH 29/55] Bound native metadata replay and retain artifact hash
 ownership

---
 crates/canopy-object-storage/src/artifact.rs  |  29 +-
 .../src/artifact/tests.rs                     | 112 +++++
 crates/canopy-object-storage/src/external.rs  |  19 +-
 .../canopy-server/src/git_cache/artifacts.rs  |   3 +-
 crates/canopy-server/src/lib.rs               |   5 +
 .../src/packs/closure/verifier.rs             |  24 +-
 .../canopy-server/src/packs/directory/mod.rs  |  19 +-
 .../src/packs/directory/writer.rs             |   3 +
 .../src/packs/metadata/transport.rs           |  86 +++-
 .../src/packs/publication/prepare.rs          | 143 ++++++-
 .../packs/publication/tests/native_capture.rs | 171 ++++++--
 .../src/packs/verification/mod.rs             |   3 +-
 .../src/packs/verification/physical.rs        |   2 +
 .../src/packs/verification/physical/staged.rs | 242 +++++++++++
 .../verification/physical/staged/tests.rs     |  86 ++++
 docs/design/staging-service-lifecycle.md      |  21 +
 .../native-metadata-replay-20261004.json      | 381 ++++++++++++++++++
 .../large-repository-implementation-status.md |  71 +++-
 18 files changed, 1364 insertions(+), 56 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/verification/physical/staged.rs
 create mode 100644 crates/canopy-server/src/packs/verification/physical/staged/tests.rs
 create mode 100644 docs/evidence/native-metadata-replay-20261004.json

diff --git a/crates/canopy-object-storage/src/artifact.rs b/crates/canopy-object-storage/src/artifact.rs
index 893bcff4..6d236ca6 100644
--- a/crates/canopy-object-storage/src/artifact.rs
+++ b/crates/canopy-object-storage/src/artifact.rs
@@ -142,6 +142,18 @@ impl ArtifactStore {
         size: u64,
         digest: [u8; 32],
         input: &mut (impl AsyncRead + Unpin),
+    ) -> Result<ArtifactDescriptor, ArtifactError> {
+        self.put_owned(key, size, digest, input, Arc::new(())).await
+    }
+    /// Queued hashing retains the caller's physical admission after cancellation.
+    /// The pin grants no artifact namespace or publication authority.
+    pub async fn put_owned(
+        &self,
+        key: ArtifactKey,
+        size: u64,
+        digest: [u8; 32],
+        input: &mut (impl AsyncRead + Unpin),
+        owner: Arc<dyn Send + Sync>,
     ) -> Result<ArtifactDescriptor, ArtifactError> {
         if size > MAX_ARTIFACT_BYTES {
             return Err(ArtifactError::TooLarge);
@@ -158,7 +170,8 @@ impl ArtifactStore {
             uuid::Uuid::from_bytes(key.operation),
             uuid::Uuid::new_v4()
         ));
-        let mut upload = external::Upload::new(Arc::clone(&self.store), stage).await?;
+        let mut upload =
+            external::Upload::new_owned(Arc::clone(&self.store), stage, owner.clone()).await?;
         let result = async {
             let mut hash = blake3::Hasher::new();
             let mut remaining = size;
@@ -169,7 +182,9 @@ impl ArtifactStore {
                 tokio::time::timeout(Duration::from_secs(120), input.read_exact(&mut bytes))
                     .await
                     .map_err(|_| ArtifactError::Timeout)??;
+                let activity = owner.clone();
                 let (next, part, bytes) = tokio::task::spawn_blocking(move || {
+                    let _activity = activity;
                     hash.update(&bytes);
                     let part = *blake3::hash(&bytes).as_bytes();
                     (hash, part, Bytes::from(bytes))
@@ -213,6 +228,14 @@ impl ArtifactStore {
         &self,
         key: ArtifactKey,
         descriptor: ArtifactDescriptor,
+    ) -> Result<ArtifactRead, ArtifactError> {
+        self.read_owned(key, descriptor, Arc::new(())).await
+    }
+    pub async fn read_owned(
+        &self,
+        key: ArtifactKey,
+        descriptor: ArtifactDescriptor,
+        owner: Arc<dyn Send + Sync>,
     ) -> Result<ArtifactRead, ArtifactError> {
         if descriptor.size > MAX_ARTIFACT_BYTES {
             return Err(ArtifactError::TooLarge);
@@ -238,6 +261,7 @@ impl ArtifactStore {
             descriptor,
             offset: 0,
             hash: Some(blake3::Hasher::new()),
+            owner,
         })
     }
 }
@@ -251,6 +275,7 @@ pub struct ArtifactRead {
     descriptor: ArtifactDescriptor,
     offset: u64,
     hash: Option<blake3::Hasher>,
+    owner: Arc<dyn Send + Sync>,
 }
 impl ArtifactRead {
     pub fn descriptor(&self) -> ArtifactDescriptor {
@@ -273,7 +298,9 @@ impl ArtifactRead {
             .manifest
             .part_digest(self.offset / PART_BYTES as u64)
             .ok_or(ArtifactError::Corrupt)?;
+        let activity = self.owner.clone();
         let (next, valid, bytes) = tokio::task::spawn_blocking(move || {
+            let _activity = activity;
             let valid = blake3::hash(&bytes).as_bytes() == &expected;
             hash.update(&bytes);
             (hash, valid, bytes)
diff --git a/crates/canopy-object-storage/src/artifact/tests.rs b/crates/canopy-object-storage/src/artifact/tests.rs
index 516c1202..287c5ec5 100644
--- a/crates/canopy-object-storage/src/artifact/tests.rs
+++ b/crates/canopy-object-storage/src/artifact/tests.rs
@@ -367,3 +367,115 @@ async fn empty_manifest_must_certify_the_empty_part() -> Result {
 fn key_for_empty() -> ArtifactKey {
     key(b"")
 }
+
+// Release even on assertion failure: runtime shutdown must not strand a thread.
+struct Release(Option<std::sync::mpsc::Sender<()>>);
+impl Drop for Release {
+    fn drop(&mut self) {
+        if let Some(sender) = self.0.take() {
+            let _ = sender.send(());
+        }
+    }
+}
+
+#[test]
+fn canceled_queued_artifact_hashes_retain_physical_owner_until_actual_drain() -> Result {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .max_blocking_threads(1)
+        .build()?;
+    for phase in 0..3 {
+        let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+        let artifacts = ArtifactStore::new(store.clone(), [1; 16]);
+        let body = b"physically retained input";
+        let key = key(body);
+        let descriptor = runtime.block_on(artifacts.put(
+            key,
+            body.len() as u64,
+            key.binding_digest,
+            &mut body.as_slice(),
+        ))?;
+        let owner: Arc<dyn Send + Sync> = Arc::new(());
+        let weak = Arc::downgrade(&owner);
+        let (entered, running) = std::sync::mpsc::channel();
+        let (release, wait) = std::sync::mpsc::channel();
+        let release = Release(Some(release));
+        let blocker = runtime.spawn_blocking(move || {
+            let _ = entered.send(());
+            let _ = wait.recv();
+        });
+        running.recv_timeout(Duration::from_secs(5))?;
+        runtime.block_on(async {
+            match phase {
+                0 => {
+                    let mut reader = artifacts.read_owned(key, descriptor, owner.clone()).await?;
+                    {
+                        let pending = reader.next();
+                        tokio::pin!(pending);
+                        assert!(
+                            tokio::time::timeout(Duration::from_millis(25), &mut pending)
+                                .await
+                                .is_err()
+                        );
+                    }
+                    assert!(matches!(reader.next().await, Err(ArtifactError::Corrupt)));
+                    drop(reader);
+                }
+                1 => {
+                    let mut input = body.as_slice();
+                    let pending = artifacts.put_owned(
+                        key,
+                        body.len() as u64,
+                        key.binding_digest,
+                        &mut input,
+                        owner.clone(),
+                    );
+                    tokio::pin!(pending);
+                    assert!(
+                        tokio::time::timeout(Duration::from_millis(25), &mut pending)
+                            .await
+                            .is_err()
+                    );
+                }
+                _ => {
+                    let mut upload = external::Upload::new_owned(
+                        store.clone(),
+                        Path::from("stage"),
+                        owner.clone(),
+                    )
+                    .await?;
+                    upload.write(Bytes::from_static(body)).await?;
+                    let digests = [key.binding_digest];
+                    let destination = Path::from("destination");
+                    {
+                        let pending =
+                            upload.publish_hashed(&destination, body.len() as u64, &digests);
+                        tokio::pin!(pending);
+                        assert!(
+                            tokio::time::timeout(Duration::from_millis(25), &mut pending)
+                                .await
+                                .is_err()
+                        );
+                    }
+                    assert!(matches!(
+                        store.head(&Path::from("destination")).await,
+                        Err(object_store::Error::NotFound { .. })
+                    ));
+                    drop(upload);
+                }
+            }
+            Ok::<_, Box<dyn std::error::Error>>(())
+        })?;
+        // All async owners are gone. The confirmed queued hash alone owns it.
+        drop(owner);
+        assert!(weak.upgrade().is_some(), "phase {phase}");
+        drop(release);
+        runtime.block_on(async {
+            blocker.await?;
+            tokio::task::spawn_blocking(|| ()).await?;
+            Ok::<_, tokio::task::JoinError>(())
+        })?;
+        assert!(weak.upgrade().is_none(), "phase {phase}");
+    }
+    Ok(())
+}
diff --git a/crates/canopy-object-storage/src/external.rs b/crates/canopy-object-storage/src/external.rs
index 303c245b..07f06679 100644
--- a/crates/canopy-object-storage/src/external.rs
+++ b/crates/canopy-object-storage/src/external.rs
@@ -69,16 +69,25 @@ pub struct Upload {
     stage: Path,
     parts: u64,
     active: Option<Box<dyn MultipartUpload>>,
+    owner: Arc<dyn Send + Sync>,
 }
 
 impl Upload {
     pub async fn new(store: Arc<dyn ObjectStore>, stage: Path) -> object_store::Result<Self> {
+        Self::new_owned(store, stage, Arc::new(())).await
+    }
+    pub async fn new_owned(
+        store: Arc<dyn ObjectStore>,
+        stage: Path,
+        owner: Arc<dyn Send + Sync>,
+    ) -> object_store::Result<Self> {
         let active = timed(store.put_multipart(&part(&stage, 0))).await?;
         Ok(Self {
             store,
             stage,
             parts: 0,
             active: Some(active),
+            owner,
         })
     }
 
@@ -137,9 +146,13 @@ impl Upload {
                 length,
             )
             .await?;
-            let digest = tokio::task::spawn_blocking(move || blake3::hash(&bytes))
-                .await
-                .map_err(|_| invalid())?;
+            let activity = self.owner.clone();
+            let digest = tokio::task::spawn_blocking(move || {
+                let _activity = activity;
+                blake3::hash(&bytes)
+            })
+            .await
+            .map_err(|_| invalid())?;
             if digest.as_bytes() != expected {
                 return Err(invalid());
             }
diff --git a/crates/canopy-server/src/git_cache/artifacts.rs b/crates/canopy-server/src/git_cache/artifacts.rs
index c077aa4a..dbc5f60a 100644
--- a/crates/canopy-server/src/git_cache/artifacts.rs
+++ b/crates/canopy-server/src/git_cache/artifacts.rs
@@ -67,9 +67,10 @@ impl GitCache {
             })
             .await??;
             let mut input = store
-                .read(
+                .read_owned(
                     descriptor.key(kind).map_err(|_| MetadataError::Integrity)?,
                     artifact,
+                    owner.clone(),
                 )
                 .await?;
             while let Some(bytes) = input.next().await? {
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 5eadc5fc..374727fe 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -221,6 +221,11 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("git_http/mod.rs"));
                 source.update(include_bytes!("packs/verification/mod.rs"));
                 source.update(include_bytes!("packs/verification/physical.rs"));
+                source.update(include_bytes!("packs/verification/physical/staged.rs"));
+                source.update(include_bytes!("packs/closure/verifier.rs"));
+                source.update(include_bytes!("packs/directory/mod.rs"));
+                source.update(include_bytes!("packs/directory/writer.rs"));
+                source.update(include_bytes!("packs/publication/prepare.rs"));
                 source.update(include_bytes!("packs/verification/spool.rs"));
                 source.update(include_bytes!("packs/wire_request.rs"));
                 source.update(include_bytes!("packs/input_artifact.rs"));
diff --git a/crates/canopy-server/src/packs/closure/verifier.rs b/crates/canopy-server/src/packs/closure/verifier.rs
index e062053d..e57222f9 100644
--- a/crates/canopy-server/src/packs/closure/verifier.rs
+++ b/crates/canopy-server/src/packs/closure/verifier.rs
@@ -8,6 +8,7 @@ struct ActivePack {
 }
 pub struct ClosureVerifier {
     spool: Arc<Mutex<Spool>>,
+    activity: crate::git_objects::ReadOwner,
     context: ClosureContext,
     canceled: Arc<AtomicBool>,
     active: Option<ActivePack>,
@@ -25,16 +26,17 @@ impl ClosureVerifier {
         context: ClosureContext,
         limits: MetadataLimits,
     ) -> Result<Self, ClosureError> {
-        Self::new_inner(root, budget, context, limits, None).await
+        Self::new_inner(root, budget, context, limits, None, Arc::new(())).await
     }
-    pub(in crate::packs) async fn new_in_workspace(
+    pub(in crate::packs) async fn new_in_workspace_owned(
         workspace: Arc<tempfile::TempDir>,
         budget: DiskBudget,
         context: ClosureContext,
         limits: MetadataLimits,
+        activity: crate::git_objects::ReadOwner,
     ) -> Result<Self, ClosureError> {
         let root = workspace.path().to_owned();
-        Self::new_inner(&root, budget, context, limits, Some(workspace)).await
+        Self::new_inner(&root, budget, context, limits, Some(workspace), activity).await
     }
     async fn new_inner(
         root: &Path,
@@ -42,12 +44,15 @@ impl ClosureVerifier {
         context: ClosureContext,
         limits: MetadataLimits,
         workspace: Option<Arc<tempfile::TempDir>>,
+        activity: crate::git_objects::ReadOwner,
     ) -> Result<Self, ClosureError> {
         let canceled = Arc::new(AtomicBool::new(false));
         let mut guard = CancelGuard::new(canceled.clone());
         let root = root.to_owned();
         let token = canceled.clone();
+        let worker_activity = activity.clone();
         let spool = tokio::task::spawn_blocking(move || {
+            let _activity = worker_activity;
             let mut spool = Spool::new(&root, budget, context, limits, token)?;
             if let Some(workspace) = workspace {
                 spool._admitted.retain_workspace(workspace);
@@ -58,6 +63,7 @@ impl ClosureVerifier {
         guard.complete();
         Ok(Self {
             spool: Arc::new(Mutex::new(spool)),
+            activity,
             context,
             canceled,
             active: None,
@@ -124,7 +130,9 @@ impl ClosureVerifier {
         active.partition.add(segment.descriptor())?;
         let operation = active.native.operation;
         let spool = self.spool.clone();
+        let activity = self.activity.clone();
         tokio::task::spawn_blocking(move || {
+            let _activity = activity;
             spool
                 .lock()
                 .map_err(|_| ClosureError::Integrity)?
@@ -145,7 +153,9 @@ impl ClosureVerifier {
         }
         active.partition.finish()?;
         let spool = self.spool.clone();
+        let activity = self.activity.clone();
         tokio::task::spawn_blocking(move || {
+            let _activity = activity;
             spool
                 .lock()
                 .map_err(|_| ClosureError::Integrity)?
@@ -176,7 +186,9 @@ impl ClosureVerifier {
         }
         let mut guard = CancelGuard::new(self.canceled.clone());
         let spool = self.spool.clone();
+        let activity = self.activity.clone();
         tokio::task::spawn_blocking(move || {
+            let _activity = activity;
             spool
                 .lock()
                 .map_err(|_| ClosureError::Integrity)?
@@ -186,7 +198,9 @@ impl ClosureVerifier {
         if let (Some(base), Some(resolver)) = (self.context.base, resolver) {
             loop {
                 let spool = self.spool.clone();
+                let activity = self.activity.clone();
                 let ids = tokio::task::spawn_blocking(move || {
+                    let _activity = activity;
                     spool
                         .lock()
                         .map_err(|_| ClosureError::Integrity)?
@@ -198,7 +212,9 @@ impl ClosureVerifier {
                 }
                 let batch = resolver.resolve(base, &ids).await?;
                 let spool = self.spool.clone();
+                let activity = self.activity.clone();
                 tokio::task::spawn_blocking(move || {
+                    let _activity = activity;
                     spool
                         .lock()
                         .map_err(|_| ClosureError::Integrity)?
@@ -208,7 +224,9 @@ impl ClosureVerifier {
             }
         }
         let spool = self.spool.clone();
+        let activity = self.activity.clone();
         let witness = tokio::task::spawn_blocking(move || {
+            let _activity = activity;
             let mut spool = spool.lock().map_err(|_| ClosureError::Integrity)?;
             spool.certify_graph()?;
             spool.witness()
diff --git a/crates/canopy-server/src/packs/directory/mod.rs b/crates/canopy-server/src/packs/directory/mod.rs
index 6a2f9d52..9db7b5b1 100644
--- a/crates/canopy-server/src/packs/directory/mod.rs
+++ b/crates/canopy-server/src/packs/directory/mod.rs
@@ -250,12 +250,29 @@ impl DirectoryRun {
     pub async fn upload(
         self: Arc<Self>,
         store: &ArtifactStore,
+    ) -> Result<StoredRun, MetadataError> {
+        self.upload_owned(store, Arc::new(())).await
+    }
+    pub(in crate::packs) async fn upload_owned(
+        self: Arc<Self>,
+        store: &ArtifactStore,
+        activity: crate::git_objects::ReadOwner,
     ) -> Result<StoredRun, MetadataError> {
         let run = self.descriptor;
         if run.repository != store.repository() {
             return Err(MetadataError::Integrity);
         }
-        let artifact = upload_file(self, store, run.key(), run.size, run.digest).await?;
+        let artifact = upload_file(
+            Arc::new(metadata::transport::OwnedFile {
+                file: self,
+                activity,
+            }),
+            store,
+            run.key(),
+            run.size,
+            run.digest,
+        )
+        .await?;
         Ok(StoredRun {
             run,
             artifact,
diff --git a/crates/canopy-server/src/packs/directory/writer.rs b/crates/canopy-server/src/packs/directory/writer.rs
index 13124b60..fe45d16e 100644
--- a/crates/canopy-server/src/packs/directory/writer.rs
+++ b/crates/canopy-server/src/packs/directory/writer.rs
@@ -12,6 +12,9 @@ pub struct DirectoryBuilder {
     failed: bool,
 }
 impl DirectoryBuilder {
+    pub(in crate::packs) fn workspace(&self) -> Option<Arc<tempfile::TempDir>> {
+        self.admitted.workspace()
+    }
     pub(in crate::packs) fn retain_workspace(&mut self, workspace: Arc<tempfile::TempDir>) {
         self.admitted.retain_workspace(workspace);
     }
diff --git a/crates/canopy-server/src/packs/metadata/transport.rs b/crates/canopy-server/src/packs/metadata/transport.rs
index 763dac0f..f33868e2 100644
--- a/crates/canopy-server/src/packs/metadata/transport.rs
+++ b/crates/canopy-server/src/packs/metadata/transport.rs
@@ -49,13 +49,24 @@ impl MetadataSegment {
     pub async fn upload(
         self: Arc<Self>,
         store: &ArtifactStore,
+    ) -> Result<StoredSegment, MetadataError> {
+        self.upload_owned(store, Arc::new(())).await
+    }
+
+    pub(crate) async fn upload_owned(
+        self: Arc<Self>,
+        store: &ArtifactStore,
+        activity: crate::git_objects::ReadOwner,
     ) -> Result<StoredSegment, MetadataError> {
         let segment = self.descriptor();
         if segment.identity.repository != store.repository() {
             return Err(MetadataError::Integrity);
         }
         let artifact = upload_file(
-            self,
+            Arc::new(OwnedFile {
+                file: self,
+                activity,
+            }),
             store,
             key(segment.identity),
             segment.size,
@@ -85,19 +96,32 @@ impl MetadataSegment {
         stored: StoredSegment,
         limits: MetadataLimits,
         reader: Option<ReaderAdmission>,
+    ) -> Result<Arc<Self>, MetadataError> {
+        Self::download_owned(root, budget, store, stored, limits, reader, Arc::new(())).await
+    }
+
+    pub(in crate::packs) async fn download_owned(
+        root: &Path,
+        budget: DiskBudget,
+        store: &ArtifactStore,
+        stored: StoredSegment,
+        limits: MetadataLimits,
+        reader: Option<ReaderAdmission>,
+        activity: crate::git_objects::ReadOwner,
     ) -> Result<Arc<Self>, MetadataError> {
         stored.validate(store)?;
-        let admitted = download_file_for_reader(
+        let admitted = download_file_owned(
             root,
             budget,
             store,
             stored.key(),
             stored.artifact,
             limits,
-            reader,
+            (reader, activity.clone()),
         )
         .await?;
         tokio::task::spawn_blocking(move || {
+            let _activity = activity;
             Ok(Arc::new(Self::open_admitted(
                 admitted,
                 stored.segment,
@@ -117,6 +141,19 @@ impl PinnedFile for MetadataSegment {
     }
 }
 
+// Hold worker admission only during physical work. Idle metadata files must
+// not keep a creating worker alive across Bind or a bound worker across publish.
+pub(crate) struct OwnedFile<T: PinnedFile> {
+    pub(crate) file: Arc<T>,
+    pub(crate) activity: crate::git_objects::ReadOwner,
+}
+impl<T: PinnedFile> PinnedFile for OwnedFile<T> {
+    fn open(&self) -> io::Result<File> {
+        let _activity = &self.activity;
+        self.file.open()
+    }
+}
+
 pub(crate) async fn upload_file<T: PinnedFile>(
     owner: Arc<T>,
     store: &ArtifactStore,
@@ -136,13 +173,16 @@ pub(crate) async fn upload_file<T: PinnedFile>(
         }))
     })
     .await??;
+    let physical = source.clone();
     let mut input = StreamReader::new(SegmentStream {
         source,
         offset: 0,
         job: None,
         failed: false,
     });
-    Ok(store.put(key, size, digest, &mut input).await?)
+    Ok(store
+        .put_owned(key, size, digest, &mut input, physical)
+        .await?)
 }
 
 pub(in crate::packs) async fn download_file_for_reader(
@@ -154,6 +194,28 @@ pub(in crate::packs) async fn download_file_for_reader(
     limits: MetadataLimits,
     reader: Option<ReaderAdmission>,
 ) -> Result<AdmittedFile, MetadataError> {
+    download_file_owned(
+        root,
+        budget,
+        store,
+        key,
+        artifact,
+        limits,
+        (reader, Arc::new(())),
+    )
+    .await
+}
+
+pub(in crate::packs) async fn download_file_owned(
+    root: &Path,
+    budget: DiskBudget,
+    store: &ArtifactStore,
+    key: ArtifactKey,
+    artifact: ArtifactDescriptor,
+    limits: MetadataLimits,
+    admission: (Option<ReaderAdmission>, crate::git_objects::ReadOwner),
+) -> Result<AdmittedFile, MetadataError> {
+    let (reader, activity) = admission;
     if limits.cache_kib == 0
         || limits.cache_kib > i32::MAX as u32
         || artifact.size > limits.max_file_bytes
@@ -174,10 +236,11 @@ pub(in crate::packs) async fn download_file_for_reader(
                 )
                 .with_reader(reader),
             ),
+            _activity: activity,
         }))
     })
     .await??;
-    let mut reader = store.read(key, artifact).await?;
+    let mut reader = store.read_owned(key, artifact, spool.clone()).await?;
     while let Some(bytes) = reader.next().await? {
         let spool = Arc::clone(&spool);
         tokio::task::spawn_blocking(move || {
@@ -190,6 +253,9 @@ pub(in crate::packs) async fn download_file_for_reader(
         })
         .await??;
     }
+    // The completed reader also owns the spool through its hash jobs. Release
+    // it before transferring the unique file to the final sync/open stage.
+    drop(reader);
     tokio::task::spawn_blocking(move || {
         let spool = Arc::try_unwrap(spool).map_err(|_| MetadataError::Integrity)?;
         let admitted = spool
@@ -205,6 +271,7 @@ pub(in crate::packs) async fn download_file_for_reader(
 // Field order closes/unlinks the private file before releasing admission.
 struct DownloadSpool {
     admitted: Mutex<AdmittedFile>,
+    _activity: crate::git_objects::ReadOwner,
 }
 
 // Unlike a bare tokio::fs::File, each pending blocking task owns its admission
@@ -283,11 +350,16 @@ mod tests {
             release_rx.recv().unwrap();
         });
         ready_rx.recv_timeout(std::time::Duration::from_secs(5))?;
+        let activity: crate::git_objects::ReadOwner = Arc::new(());
+        let weak_activity = Arc::downgrade(&activity);
         let mut stream = SegmentStream {
             source: Arc::new(ReadPin {
                 file: Mutex::new(File::open(&path)?),
                 size: segment.descriptor().size,
-                _owner: segment,
+                _owner: Arc::new(OwnedFile {
+                    file: segment,
+                    activity,
+                }),
             }),
             offset: 0,
             job: None,
@@ -302,6 +374,7 @@ mod tests {
         drop(stream);
         assert_eq!(budget.used(), charged);
         assert!(weak.upgrade().is_some());
+        assert!(weak_activity.upgrade().is_some());
         assert!(path.exists());
         // Always release before assertions that could unwind: a stopped
         // blocking worker must not hang runtime shutdown if this test fails.
@@ -317,6 +390,7 @@ mod tests {
             Ok::<_, Box<dyn std::error::Error>>(())
         })?;
         assert!(weak.upgrade().is_none());
+        assert!(weak_activity.upgrade().is_none());
         assert!(!path.exists());
         Ok(())
     }
diff --git a/crates/canopy-server/src/packs/publication/prepare.rs b/crates/canopy-server/src/packs/publication/prepare.rs
index fc04f7be..52ad8951 100644
--- a/crates/canopy-server/src/packs/publication/prepare.rs
+++ b/crates/canopy-server/src/packs/publication/prepare.rs
@@ -9,9 +9,9 @@ use crate::packs::{
         index::{IndexError, NodeRef},
         snapshot::DirectorySnapshot,
     },
-    metadata::{MetadataError, MetadataLimits, MetadataSegment},
+    metadata::{MetadataError, MetadataLimits, MetadataSegment, StoredSegment},
     sources::{NativePackDescriptor, SourceIndex, SourceRecord, SourceRoot},
-    verification::{PhysicalError, PhysicalPackWitness},
+    verification::{PhysicalError, PhysicalPackWitness, StagedNativeMetadata},
 };
 use canopy_object_storage::artifact::ArtifactStore;
 use cellule_ltx::DiskBudget;
@@ -162,6 +162,7 @@ async fn merge_sources(
 /// subtrees are reused; only exact verified incoming shards insert new leaves.
 /// Failure/cancellation poisons the operation and never yields PreparedCatalog.
 pub struct CatalogPreparation {
+    staging: Option<StagingContext>,
     base: Arc<PreparationBaseResolver>,
     store: Arc<ArtifactStore>,
     sources: Arc<SourceIndex>,
@@ -170,6 +171,7 @@ pub struct CatalogPreparation {
     snapshot: DirectorySnapshot,
     directory: Option<DirectoryBuilder>,
     budget: DiskBudget,
+    input_limits: MetadataLimits,
     output_limits: MetadataLimits,
     closure: Option<ClosureVerifier>,
     active: Option<NativePackDescriptor>,
@@ -203,14 +205,58 @@ impl CatalogPreparation {
         base: Arc<PreparationBaseResolver>,
         limits: MetadataLimits,
         output_limits: MetadataLimits,
+    ) -> Result<Self, CatalogPreparationError> {
+        Self::new_inner(root, budget, base, limits, output_limits, None).await
+    }
+    /// Production construction retains the admitted worker through every
+    /// detached assembler job, while the finished private proof owns no worker.
+    pub async fn new_staged(
+        context: &StagingContext,
+        root: &Path,
+        budget: DiskBudget,
+        base: Arc<PreparationBaseResolver>,
+        limits: MetadataLimits,
+    ) -> Result<Self, CatalogPreparationError> {
+        context.ensure_live().map_err(PhysicalError::from)?;
+        if context.token().map_err(PhysicalError::from)? != base.context_token()
+            || context.format() != base.context().format
+        {
+            return Err(CatalogPreparationError::Integrity);
+        }
+        Self::new_inner(
+            root,
+            budget,
+            base,
+            limits,
+            MetadataLimits {
+                max_file_bytes: limits.max_file_bytes.min(RUN_TARGET_BYTES),
+                ..limits
+            },
+            Some(context.clone()),
+        )
+        .await
+    }
+    async fn new_inner(
+        root: &Path,
+        budget: DiskBudget,
+        base: Arc<PreparationBaseResolver>,
+        limits: MetadataLimits,
+        output_limits: MetadataLimits,
+        staging: Option<StagingContext>,
     ) -> Result<Self, CatalogPreparationError> {
         DirectoryPartitioner::validate_limits(output_limits)?;
         let (lease, deadline) = base.live_lease()?;
         let indexes = base.indexes();
         let (snapshot, source_root) = base.catalog_parts();
         let root = root.to_owned();
+        let activity = staging.as_ref().map_or_else(
+            || Arc::new(()) as crate::git_objects::ReadOwner,
+            StagingContext::physical_owner,
+        );
         let work = async {
+            let workspace_activity = activity.clone();
             let workspace = tokio::task::spawn_blocking(move || {
+                let _activity = workspace_activity;
                 tempfile::Builder::new()
                     .prefix("canopy-catalog-preparation-")
                     .tempdir_in(root)
@@ -219,15 +265,17 @@ impl CatalogPreparation {
             })
             .await??;
             let context = base.context();
-            let closure = ClosureVerifier::new_in_workspace(
+            let closure = ClosureVerifier::new_in_workspace_owned(
                 Arc::clone(&workspace),
                 budget.clone(),
                 context,
                 limits,
+                activity.clone(),
             )
             .await?;
             let directory_budget = budget.clone();
             let directory = tokio::task::spawn_blocking(move || {
+                let _activity = activity;
                 let mut builder = DirectoryBuilder::new(
                     workspace.path(),
                     directory_budget,
@@ -242,6 +290,7 @@ impl CatalogPreparation {
             .await??;
             base.live_lease()?;
             Ok(Self {
+                staging,
                 base,
                 store: indexes.store(),
                 sources: indexes.sources(),
@@ -250,6 +299,7 @@ impl CatalogPreparation {
                 snapshot,
                 directory: Some(directory),
                 budget,
+                input_limits: limits,
                 output_limits,
                 closure: Some(closure),
                 active: None,
@@ -266,8 +316,17 @@ impl CatalogPreparation {
             return Err(CatalogPreparationError::Integrity);
         }
         self.failed = true;
+        if let Some(context) = &self.staging {
+            context.ensure_live().map_err(PhysicalError::from)?;
+        }
         Ok(self.base.live_lease()?.1)
     }
+    fn physical_owner(&self) -> crate::git_objects::ReadOwner {
+        self.staging.as_ref().map_or_else(
+            || Arc::new(()) as crate::git_objects::ReadOwner,
+            StagingContext::physical_owner,
+        )
+    }
     pub fn begin_pack(
         &mut self,
         witness: PhysicalPackWitness,
@@ -326,7 +385,7 @@ impl CatalogPreparation {
         segment: Arc<MetadataSegment>,
     ) -> Result<(), CatalogPreparationError> {
         let deadline = self.start()?;
-        timeout_at(deadline, self.add_inner(segment))
+        timeout_at(deadline, self.add_inner(segment, None))
             .await
             .map_err(|_| PreparationBaseError::Inactive)??;
         self.base.live_lease()?;
@@ -336,6 +395,7 @@ impl CatalogPreparation {
     async fn add_inner(
         &mut self,
         segment: Arc<MetadataSegment>,
+        stored: Option<StoredSegment>,
     ) -> Result<(), CatalogPreparationError> {
         let native = self.active.ok_or(CatalogPreparationError::Integrity)?;
         self.closure
@@ -348,15 +408,25 @@ impl CatalogPreparation {
             .take()
             .ok_or(CatalogPreparationError::Integrity)?;
         let pinned = Arc::clone(&segment);
+        let activity = self.physical_owner();
         self.directory = Some(
             tokio::task::spawn_blocking(move || {
+                let _activity = activity;
                 let mut directory = directory;
                 directory.add_segment(&pinned)?;
                 Ok::<_, MetadataError>(directory)
             })
             .await??,
         );
-        let metadata = segment.upload(&self.store).await?;
+        let metadata = match stored {
+            Some(stored) if stored.segment == segment.descriptor() => stored,
+            Some(_) => return Err(CatalogPreparationError::Integrity),
+            None => {
+                segment
+                    .upload_owned(&self.store, self.physical_owner())
+                    .await?
+            }
+        };
         let record = SourceRecord {
             metadata,
             pack: native.pack,
@@ -378,6 +448,61 @@ impl CatalogPreparation {
         );
         Ok(())
     }
+    /// Consume the complete physical witness and its admitted ordinal replay.
+    /// Download/authenticate/copy one shard at a time; reuse each uploaded
+    /// SourceRecord instead of uploading metadata again during bound assembly.
+    pub async fn add_staged_pack(
+        &mut self,
+        input: StagedNativeMetadata,
+    ) -> Result<(), CatalogPreparationError> {
+        let deadline = self.start()?;
+        let context = self
+            .staging
+            .clone()
+            .ok_or(CatalogPreparationError::Integrity)?;
+        // The complete operation is poisoned on cancellation, including a
+        // failed/absent provider artifact or an incomplete descriptor replay.
+        let result = timeout_at(deadline, async {
+            let native = input.witness.native();
+            self.failed = false;
+            self.begin_retained_pack(input.witness).await?;
+            self.failed = true;
+            let workspace = self
+                .directory
+                .as_ref()
+                .ok_or(CatalogPreparationError::Integrity)?
+                .workspace();
+            let root = workspace
+                .as_ref()
+                .ok_or(CatalogPreparationError::Integrity)?
+                .path();
+            let mut offset = 0;
+            while let Some((stored, end)) = input.replay.next(&context, native, offset).await? {
+                context.ensure_live().map_err(PhysicalError::from)?;
+                let segment = MetadataSegment::download_owned(
+                    root,
+                    self.budget.clone(),
+                    &self.store,
+                    stored,
+                    self.input_limits,
+                    None,
+                    context.physical_owner(),
+                )
+                .await?;
+                self.add_inner(segment, Some(stored)).await?;
+                offset = end;
+            }
+            context.ensure_live().map_err(PhysicalError::from)?;
+            self.failed = false;
+            self.finish_pack().await
+        })
+        .await
+        .map_err(|_| PreparationBaseError::Inactive)?;
+        if result.is_err() {
+            self.failed = true;
+        }
+        result
+    }
     pub async fn finish_pack(&mut self) -> Result<(), CatalogPreparationError> {
         let deadline = self.start()?;
         if self.active.is_none() {
@@ -418,9 +543,11 @@ impl CatalogPreparation {
             .directory
             .take()
             .ok_or(CatalogPreparationError::Integrity)?;
-        let budget = self.budget;
+        let budget = self.budget.clone();
         let limits = self.output_limits;
+        let activity = self.physical_owner();
         let (partitioner, witness) = tokio::task::spawn_blocking(move || {
+            let _activity = activity;
             if witness.object_count() == 0 {
                 drop(directory);
                 Ok((None, witness))
@@ -437,7 +564,9 @@ impl CatalogPreparation {
         let mut incoming_root = None;
         if let Some(mut partitioner) = partitioner {
             loop {
+                let activity = self.physical_owner();
                 let (next, retained) = tokio::task::spawn_blocking(move || {
+                    let _activity = activity;
                     let next = partitioner.next_run()?;
                     Ok::<_, MetadataError>((next, partitioner))
                 })
@@ -446,7 +575,7 @@ impl CatalogPreparation {
                 let Some(run) = next else {
                     break;
                 };
-                let stored = run.upload(&self.store).await?;
+                let stored = run.upload_owned(&self.store, self.physical_owner()).await?;
                 incoming_root = Some(
                     index
                         .insert(incoming_root, context.operation, stored)
diff --git a/crates/canopy-server/src/packs/publication/tests/native_capture.rs b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
index c0fff050..39b41a83 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_capture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_capture.rs
@@ -13,7 +13,7 @@ use crate::{
         catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes, CatalogReader},
         metadata::tests::{fixture as input_fixture, limits},
         verification::{
-            PhysicalVerifier,
+            NativeMetadataLimits, PhysicalVerifier,
             physical::tests::{independence::git_input, physical_limits},
         },
     },
@@ -437,7 +437,50 @@ async fn native_receive(rooted: bool, mode: CompletionMode) -> Result {
     }
     Ok(())
 }
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum MetadataFault {
+    DescriptorLimit,
+    TruncatedReplay,
+    MissingArtifact,
+}
+
+#[tokio::test]
+async fn native_receive_metadata_refuses_capacity_corrupt_replay_and_missing_shards_without_publication()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in [
+            MetadataFault::DescriptorLimit,
+            MetadataFault::TruncatedReplay,
+            MetadataFault::MissingArtifact,
+        ] {
+            Box::pin(native_receive_metadata_case(
+                format,
+                true,
+                CompletionMode::Success,
+                Some(fault),
+            ))
+            .await?;
+        }
+    }
+    Ok(())
+}
+async fn publication_state(fixture: &Fixture) -> Result<Vec<u8>> {
+    Ok(fixture.handle.query(0, 24, |db| {
+        let state = db.query_row("SELECT (SELECT generation FROM catalog_state WHERE singleton=1),(SELECT generation FROM ref_generation WHERE singleton=1),(SELECT count(*) FROM pushes WHERE response_id IS NOT NULL)", [], |row| {
+            Ok((row.get::<_, u64>(0)?, row.get::<_, u64>(1)?, row.get::<_, u64>(2)?))
+        })?;
+        Ok([state.0.to_be_bytes(), state.1.to_be_bytes(), state.2.to_be_bytes()].concat())
+    }).await?)
+}
 async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: CompletionMode) -> Result {
+    Box::pin(native_receive_metadata_case(format, rooted, mode, None)).await
+}
+async fn native_receive_metadata_case(
+    format: ObjectFormat,
+    rooted: bool,
+    mode: CompletionMode,
+    metadata_fault: Option<MetadataFault>,
+) -> Result {
     let ref_free = match mode {
         CompletionMode::RefFree { kind, .. } => Some(kind),
         CompletionMode::Durable { .. }
@@ -835,32 +878,70 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
         fixture.runtime.shutdown().await?;
         return Ok(());
     }
+    let before_publication = publication_state(&fixture).await?;
     let physical_root = Arc::new(tempfile::TempDir::new()?);
     let physical_disk = DiskBudget::new(256 << 20);
     let verify_root = physical_root.clone();
     let verify_disk = physical_disk.clone();
     let verify_store = store.clone();
     let verify_native = native.clone();
+    let input = inputs[0];
     let work = ticket.spawn(move |context| async move {
         let result = async {
-            let mut verifier = PhysicalVerifier::download_staged(
+            let verifier = PhysicalVerifier::download_staged(
                 &context,
                 verify_root.path(),
                 verify_disk,
                 &verify_store,
-                inputs[0],
+                input,
                 physical_limits(),
                 verify_native.scope(NativeClass::Foreground),
             )
             .await?;
-            let segment = verifier.inspect_next_shard(inputs[0].object_count).await?;
-            let witness = verifier.finish().await?;
-            Ok::<_, crate::packs::verification::PhysicalError>((witness, segment))
+            verifier
+                .stage_metadata(NativeMetadataLimits {
+                    max_shard_objects: 1,
+                    max_descriptor_bytes: if metadata_fault == Some(MetadataFault::DescriptorLimit)
+                    {
+                        1
+                    } else {
+                        NativeMetadataLimits::default().max_descriptor_bytes
+                    },
+                })
+                .await
         }
         .await;
         result.map_err(|error| StagingError::Input(Box::new(error)))
     })?;
-    let (witness, segment) = work.wait().await.map_err(|error| error.to_string())?;
+    let staged = work.wait().await;
+    if metadata_fault == Some(MetadataFault::DescriptorLimit) {
+        let error = match staged {
+            Err(error) => error,
+            Ok(_) => return Err("descriptor admission unexpectedly succeeded".into()),
+        };
+        let StagingError::Input(source) = &*error else {
+            return Err("wrong descriptor refusal".into());
+        };
+        assert!(matches!(
+            source.downcast_ref::<crate::packs::verification::PhysicalError>(),
+            Some(crate::packs::verification::PhysicalError::Limit)
+        ));
+        assert!(coordinator.close_and_drain().await.is_empty());
+        assert_eq!(coordinator.stats().workers, 0);
+        assert_eq!(publication_state(&fixture).await?, before_publication);
+        cleaned(physical_root.path(), &physical_disk).await?;
+        fixture.runtime.shutdown().await?;
+        return Ok(());
+    }
+    let staged = staged.map_err(|error| error.to_string())?;
+    assert_eq!(staged.shard_count(), input.object_count);
+    assert!(staged.descriptor_bytes() <= u64::from(staged.shard_count()) * 516);
+    timeout(Duration::from_secs(10), async {
+        while physical_disk.used() != staged.descriptor_bytes() {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
     ticket.seal()?;
     assert!(matches!(
         timeout(Duration::from_secs(10), ticket.wait_terminal()).await?,
@@ -875,14 +956,64 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
         CatalogFileLimits::default(),
     )?);
     let base = Arc::new(ticket.open_base(indexes, files).await?);
-    if rooted {
-        let mut builder =
-            CatalogPreparation::new(physical_root.path(), physical_disk.clone(), base, limits())
+    match metadata_fault {
+        Some(MetadataFault::TruncatedReplay) => staged.truncate_replay_for_test()?,
+        Some(MetadataFault::MissingArtifact) => {
+            use object_store::ObjectStoreExt;
+            let stored = staged.first_metadata_for_test()?;
+            let path = store.path(
+                canopy_object_storage::artifact::ArtifactKey {
+                    operation: input.operation,
+                    binding_digest: input.pack.digest,
+                    kind: canopy_object_storage::artifact::ArtifactKind::Metadata,
+                },
+                stored.artifact.digest,
+            )?;
+            provider
+                .delete(&canopy_object_storage::external::part(&path, 0))
                 .await?;
-        builder.begin_retained_pack(witness).await?;
-        builder.add_segment(segment).await?;
-        builder.finish_pack().await?;
-        let prepared = builder.finish().await?;
+        }
+        _ => {}
+    }
+    let producer_root = Arc::clone(&physical_root);
+    let producer_disk = physical_disk.clone();
+    let work = ticket.spawn_bound(move |_, context| async move {
+        let result = async {
+            let mut builder = CatalogPreparation::new_staged(
+                &context,
+                producer_root.path(),
+                producer_disk,
+                base,
+                limits(),
+            )
+            .await?;
+            let added = builder.add_staged_pack(staged).await;
+            if metadata_fault.is_some() {
+                let error = added.expect_err("invalid staged metadata accepted");
+                assert!(
+                    builder.finish().await.is_err(),
+                    "failed builder escaped poison"
+                );
+                return Err(error);
+            }
+            added?;
+            builder.finish().await
+        }
+        .await;
+        result.map_err(|error| StagingError::Input(Box::new(error)))
+    })?;
+    let prepared = work.wait().await;
+    if metadata_fault.is_some() {
+        assert!(prepared.is_err());
+        assert!(coordinator.close_and_drain().await.is_empty());
+        assert_eq!(coordinator.stats().workers, 0);
+        assert_eq!(publication_state(&fixture).await?, before_publication);
+        cleaned(physical_root.path(), &physical_disk).await?;
+        fixture.runtime.shutdown().await?;
+        return Ok(());
+    }
+    let prepared = prepared.map_err(|error| error.to_string())?;
+    if rooted {
         if matches!(
             mode,
             CompletionMode::MandatoryRegistration
@@ -950,17 +1081,7 @@ async fn native_receive_case(format: ObjectFormat, rooted: bool, mode: Completio
     let publication_identity = identity()?;
     let work = ticket.spawn_bound(move |_, _context| async move {
         let result = async {
-            let mut builder = CatalogPreparation::new(
-                producer_root.path(),
-                producer_disk.clone(),
-                base,
-                limits(),
-            )
-            .await?;
-            builder.begin_pack(witness)?;
-            builder.add_segment(segment).await?;
-            builder.finish_pack().await?;
-            let prepared = Arc::new(builder.finish().await?);
+            let prepared = Arc::new(prepared);
             let ready = Box::pin(prepared.ready_push(
                 publication_identity,
                 recovered,
diff --git a/crates/canopy-server/src/packs/verification/mod.rs b/crates/canopy-server/src/packs/verification/mod.rs
index c75ecb23..14608b55 100644
--- a/crates/canopy-server/src/packs/verification/mod.rs
+++ b/crates/canopy-server/src/packs/verification/mod.rs
@@ -10,7 +10,8 @@ mod spool;
 pub use spool::VerifiedObject;
 pub(super) mod physical;
 pub use physical::{
-    PhysicalError, PhysicalLimits, PhysicalPackWitness, PhysicalPartition, PhysicalVerifier,
+    NativeMetadataLimits, PhysicalError, PhysicalLimits, PhysicalPackWitness, PhysicalPartition,
+    PhysicalVerifier, StagedNativeMetadata,
 };
 
 /// The service retains its admitted private native workspace and process
diff --git a/crates/canopy-server/src/packs/verification/physical.rs b/crates/canopy-server/src/packs/verification/physical.rs
index f793b5b1..dcb07b1f 100644
--- a/crates/canopy-server/src/packs/verification/physical.rs
+++ b/crates/canopy-server/src/packs/verification/physical.rs
@@ -17,6 +17,8 @@ use canopy_object_storage::{artifact::ArtifactStore, external::MAX_ARTIFACT_BYTE
 use cellule_ltx::DiskBudget;
 use std::{path::PathBuf, process::Stdio, sync::Arc, time::Duration};
 
+mod staged;
+pub use staged::{NativeMetadataLimits, StagedNativeMetadata};
 mod partition;
 pub use partition::PhysicalPartition;
 
diff --git a/crates/canopy-server/src/packs/verification/physical/staged.rs b/crates/canopy-server/src/packs/verification/physical/staged.rs
new file mode 100644
index 00000000..aaa40f90
--- /dev/null
+++ b/crates/canopy-server/src/packs/verification/physical/staged.rs
@@ -0,0 +1,242 @@
+//! One resident metadata shard; ordered descriptors live on admitted disk.
+//! This private replay is not an input checkpoint or a publication certificate.
+use super::*;
+use crate::packs::{
+    directory::index::IndexRecord,
+    metadata::{AdmittedFile, StoredSegment},
+    publication::StagingContext,
+    sources::SourceRecord,
+};
+use cellule_runtime::codec::{BoundedDecoder, BoundedEncoder};
+use std::{
+    io::{Read, Seek, SeekFrom, Write},
+    sync::Mutex,
+};
+
+const RECORD_BYTES: u32 = 512;
+
+#[derive(Clone, Copy, Debug)]
+pub struct NativeMetadataLimits {
+    pub max_shard_objects: u32,
+    pub max_descriptor_bytes: u64,
+}
+impl Default for NativeMetadataLimits {
+    fn default() -> Self {
+        Self {
+            max_shard_objects: 8192,
+            max_descriptor_bytes: 64 << 20,
+        }
+    }
+}
+
+/// Available only after every ordinal has passed isolated physical inspection
+/// and all metadata uploads have completed. No local metadata shard or worker
+/// activity remains in the result, allowing Creating to drain before Bind.
+pub struct StagedNativeMetadata {
+    pub(in crate::packs) witness: PhysicalPackWitness,
+    pub(in crate::packs) replay: DescriptorReplay,
+}
+impl StagedNativeMetadata {
+    #[cfg(test)]
+    pub(in crate::packs) fn truncate_replay_for_test(&self) -> Result<(), PhysicalError> {
+        self.replay
+            .spool
+            .lock()
+            .map_err(|_| PhysicalError::Integrity)?
+            .file
+            .file()
+            .as_file()
+            .set_len(self.replay.bytes - 1)?;
+        Ok(())
+    }
+    #[cfg(test)]
+    pub(in crate::packs) fn first_metadata_for_test(&self) -> Result<StoredSegment, PhysicalError> {
+        self.replay
+            .spool
+            .lock()
+            .map_err(|_| PhysicalError::Integrity)?
+            .read(self.native(), 0, self.replay.bytes)?
+            .map(|(stored, _)| stored)
+            .ok_or(PhysicalError::Integrity)
+    }
+    pub fn native(&self) -> NativePackDescriptor {
+        self.witness.native()
+    }
+    pub fn shard_count(&self) -> u32 {
+        self.witness.shard_count()
+    }
+    pub fn descriptor_bytes(&self) -> u64 {
+        self.replay.bytes
+    }
+}
+
+impl PhysicalVerifier {
+    pub async fn stage_metadata(
+        mut self,
+        limits: NativeMetadataLimits,
+    ) -> Result<StagedNativeMetadata, PhysicalError> {
+        if limits.max_shard_objects == 0
+            || limits.max_descriptor_bytes == 0
+            || limits.max_descriptor_bytes > MAX_ARTIFACT_BYTES
+            || self.next_ordinal != 0
+            || self.failed
+        {
+            return Err(PhysicalError::Limit);
+        }
+        let context = self.context.clone().ok_or(PhysicalError::Integrity)?;
+        context.ensure_live()?;
+        let root = self.root.clone();
+        let budget = self.budget.clone();
+        let activity = context.physical_owner();
+        let mut spool = tokio::task::spawn_blocking(move || {
+            let _activity = activity;
+            let workspace = Arc::new(
+                tempfile::Builder::new()
+                    .prefix("canopy-native-metadata-")
+                    .tempdir_in(root)?,
+            );
+            let mut file = AdmittedFile::new(
+                tempfile::NamedTempFile::new_in(workspace.path())?,
+                budget.try_reserve(0).map_err(MetadataError::from)?,
+            );
+            file.retain_workspace(workspace);
+            Ok::<_, PhysicalError>(DescriptorSpool { file, bytes: 0 })
+        })
+        .await??;
+        while self.next_ordinal < self.descriptor.object_count {
+            let count =
+                (self.descriptor.object_count - self.next_ordinal).min(limits.max_shard_objects);
+            let segment = self.inspect_next_shard(count).await?;
+            context.ensure_live()?;
+            let metadata = segment
+                .upload_owned(&self.store, context.physical_owner())
+                .await?;
+            context.ensure_live()?;
+            let record = SourceRecord {
+                metadata,
+                pack: self.descriptor.pack,
+                index: self.descriptor.index,
+                pack_object_count: self.descriptor.object_count,
+            };
+            record.validate(self.descriptor.repository, self.descriptor.format)?;
+            let activity = context.physical_owner();
+            spool = tokio::task::spawn_blocking(move || {
+                let _activity = activity;
+                spool.append(record, limits.max_descriptor_bytes)?;
+                Ok::<_, PhysicalError>(spool)
+            })
+            .await??;
+            // Upload consumes the last shard pin. The next shard never coexists
+            // with earlier metadata files; only fixed-size descriptors survive.
+        }
+        let witness = self.finish().await?;
+        let activity = context.physical_owner();
+        let replay = tokio::task::spawn_blocking(move || {
+            let _activity = activity;
+            spool.file.file().as_file().sync_all()?;
+            if spool.file.file().as_file().metadata()?.len() != spool.bytes {
+                return Err(PhysicalError::Integrity);
+            }
+            Ok::<_, PhysicalError>(DescriptorReplay {
+                bytes: spool.bytes,
+                spool: Arc::new(Mutex::new(spool)),
+            })
+        })
+        .await??;
+        context.ensure_live()?;
+        Ok(StagedNativeMetadata { witness, replay })
+    }
+}
+
+struct DescriptorSpool {
+    file: AdmittedFile,
+    bytes: u64,
+}
+impl DescriptorSpool {
+    fn append(&mut self, record: SourceRecord, maximum: u64) -> Result<(), PhysicalError> {
+        let mut encoder = BoundedEncoder::new(RECORD_BYTES).map_err(IndexError::from)?;
+        record
+            .encode_record(&mut encoder)
+            .map_err(IndexError::from)?;
+        let bytes = encoder.finish();
+        let end = self
+            .bytes
+            .checked_add(4 + bytes.len() as u64)
+            .filter(|end| *end <= maximum)
+            .ok_or(PhysicalError::Limit)?;
+        // Admit before appending. A partial failed append cannot escape the
+        // consuming factory and keeps its file charged through cleanup.
+        self.file
+            .reservation()
+            .resize(end)
+            .map_err(MetadataError::from)?;
+        self.file
+            .file_mut()
+            .write_all(&(bytes.len() as u32).to_be_bytes())?;
+        self.file.file_mut().write_all(&bytes)?;
+        self.bytes = end;
+        Ok(())
+    }
+    fn read(
+        &mut self,
+        native: NativePackDescriptor,
+        offset: u64,
+        size: u64,
+    ) -> Result<Option<(StoredSegment, u64)>, PhysicalError> {
+        if self.file.file().as_file().metadata()?.len() != size || offset > size {
+            return Err(PhysicalError::Integrity);
+        }
+        if offset == size {
+            return Ok(None);
+        }
+        let file = self.file.file_mut();
+        file.seek(SeekFrom::Start(offset))?;
+        let mut length = [0; 4];
+        file.read_exact(&mut length)?;
+        let length = u32::from_be_bytes(length);
+        let end = offset
+            .checked_add(4 + u64::from(length))
+            .filter(|end| *end <= size && length != 0 && length <= RECORD_BYTES)
+            .ok_or(PhysicalError::Integrity)?;
+        let mut bytes = vec![0; length as usize];
+        file.read_exact(&mut bytes)?;
+        let mut decoder = BoundedDecoder::new(&bytes, RECORD_BYTES).map_err(IndexError::from)?;
+        let record = SourceRecord::decode_record(&mut decoder, native.repository, native.format)
+            .map_err(IndexError::from)?;
+        decoder.finish().map_err(IndexError::from)?;
+        record.validate(native.repository, native.format)?;
+        if record.native() != native {
+            return Err(PhysicalError::Integrity);
+        }
+        Ok(Some((record.metadata, end)))
+    }
+}
+
+pub(in crate::packs) struct DescriptorReplay {
+    spool: Arc<Mutex<DescriptorSpool>>,
+    bytes: u64,
+}
+impl DescriptorReplay {
+    pub(in crate::packs) async fn next(
+        &self,
+        context: &StagingContext,
+        native: NativePackDescriptor,
+        offset: u64,
+    ) -> Result<Option<(StoredSegment, u64)>, PhysicalError> {
+        context.ensure_live()?;
+        let spool = self.spool.clone();
+        let activity = context.physical_owner();
+        let size = self.bytes;
+        let record = tokio::task::spawn_blocking(move || {
+            let _activity = activity;
+            let mut spool = spool.lock().map_err(|_| PhysicalError::Integrity)?;
+            spool.read(native, offset, size)
+        })
+        .await??;
+        context.ensure_live()?;
+        Ok(record)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/canopy-server/src/packs/verification/physical/staged/tests.rs b/crates/canopy-server/src/packs/verification/physical/staged/tests.rs
new file mode 100644
index 00000000..50b5e3be
--- /dev/null
+++ b/crates/canopy-server/src/packs/verification/physical/staged/tests.rs
@@ -0,0 +1,86 @@
+use super::*;
+use crate::packs::sources::tests::source;
+type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error>>;
+
+fn spool(budget: &DiskBudget) -> Result<DescriptorSpool> {
+    Ok(DescriptorSpool {
+        file: AdmittedFile::new(tempfile::NamedTempFile::new()?, budget.try_reserve(0)?),
+        bytes: 0,
+    })
+}
+
+#[test]
+fn descriptor_replay_reuses_source_codec_and_reserves_before_each_append() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let budget = DiskBudget::new(8 << 20);
+        let mut spool = spool(&budget)?;
+        let record = source(1, format);
+        // Digest order is deliberately irrelevant to this sequential replay.
+        // Each frame preserves the source codec, including artifact manifests.
+        for ordinal in 0..5000 {
+            let mut next = record;
+            next.metadata.segment.identity.first_ordinal = ordinal;
+            next.pack_object_count = 5001;
+            next.index.size =
+                8 + 256 * 4 + 5001 * (format.bytes() as u64 + 8) + 2 * format.bytes() as u64;
+            spool.append(next, 8 << 20)?;
+            assert_eq!(budget.used(), spool.bytes);
+            assert_eq!(spool.file.file().as_file().metadata()?.len(), spool.bytes);
+        }
+        let size = spool.bytes;
+        let mut native = record.native();
+        native.object_count = 5001;
+        native.index.size =
+            8 + 256 * 4 + 5001 * (format.bytes() as u64 + 8) + 2 * format.bytes() as u64;
+        let mut offset = 0;
+        for ordinal in 0..5000 {
+            let (metadata, end) = spool.read(native, offset, size)?.ok_or("record")?;
+            assert_eq!(metadata.segment.identity.first_ordinal, ordinal);
+            assert_eq!(metadata.artifact, record.metadata.artifact);
+            offset = end;
+        }
+        assert_eq!(offset, size);
+        assert!(spool.read(native, offset, size)?.is_none());
+        let path = spool.file.file().path().to_owned();
+        drop(spool);
+        assert_eq!(budget.used(), 0);
+        assert!(!path.exists());
+    }
+    Ok(())
+}
+
+#[test]
+fn descriptor_replay_rejects_denied_growth_truncation_oversized_frames_and_foreign_binding()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let budget = DiskBudget::new(512);
+        let mut spool = spool(&budget)?;
+        let record = source(1, format);
+        spool.append(record, 1024)?;
+        let charged = budget.used();
+        let size = spool.bytes;
+        assert!(matches!(
+            spool.append(record, 1024),
+            Err(PhysicalError::Metadata(MetadataError::Budget(_)))
+        ));
+        assert_eq!(budget.used(), charged);
+        assert_eq!(spool.bytes, size);
+        assert_eq!(spool.file.file().as_file().metadata()?.len(), size);
+        assert!(matches!(
+            spool.append(record, size),
+            Err(PhysicalError::Limit)
+        ));
+        let mut foreign = record.native();
+        foreign.pack.manifest_digest[0] ^= 1;
+        assert!(spool.read(foreign, 0, size).is_err());
+        assert!(spool.read(record.native(), size + 1, size).is_err());
+        spool.file.file_mut().seek(SeekFrom::Start(0))?;
+        spool.file.file_mut().write_all(&513u32.to_be_bytes())?;
+        assert!(spool.read(record.native(), 0, size).is_err());
+        spool.file.file().as_file().set_len(size - 1)?;
+        assert!(spool.read(record.native(), 0, size).is_err());
+        drop(spool);
+        assert_eq!(budget.used(), 0);
+    }
+    Ok(())
+}
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index 86867440..430caa5c 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -99,3 +99,24 @@ StagingStats exposes completed probe queries, failed observations/fingerprint co
 
 
 Seven additional regression families exercise all seven original custody actions in SHA-1/SHA-256, closed coordinators and dropped observers, stopped staging/bound renewals with live callbacks and retained completed resources, unavailable private queries without absent-command execution or known-phase retries, an old ordinal after an explicit successor, malformed stop rejection, a corrupt head followed by a valid head and later repair, exclusion of input checkpoints despite an older stop, and 130 admitted operations spanning multiple probe pages plus restart at an earlier key after idle. The native/domain codecs reject the all-zero operation ID; the multi-page fixture uses valid nonzero IDs rather than weakening that invariant. The initial warm fixture observed the preceding binding before the renewal; it now waits for the actual uncertain renewal. The checkpoint fixture now registers an explicit successor instead of using the fresh-operation factory against an existing journal. Final frozen-source evidence is recorded in the implementation status.
+
+## Bounded physical metadata handoff
+
+The admitted native verifier now uploads/releases one metadata shard per step
+and retains ordered `SourceRecord` descriptors on admitted disk. The creating
+result contains a complete witness and descriptor replay; it contains no worker
+context or open metadata database, so transferring it cannot block Bind.
+The source tree's digest order is distinct from physical ordinal order.
+
+A bound catalog builder checks its staging context, selects the exact retained
+native input checkpoint, and authenticates/copies one stored shard at a time.
+It reuses the stored metadata artifact instead of uploading it again. Blocking
+closure/directory jobs, file reads/writes and artifact hash jobs retain the same
+activity pin. A failure or cancellation cannot yield a private prepared catalog.
+Completed private proofs do not retain worker activity across final publication.
+
+This API composition is a prerequisite, not live transport conversion or a
+full-history deadline/throughput result. Resident service drain, adopted older
+input verification, remaining request/policy work and actual producer wiring
+remain release work. Current qualification and limits are tracked in the
+[implementation status](../large-repository-implementation-status.md).
diff --git a/docs/evidence/native-metadata-replay-20261004.json b/docs/evidence/native-metadata-replay-20261004.json
new file mode 100644
index 00000000..6e4b43bd
--- /dev/null
+++ b/docs/evidence/native-metadata-replay-20261004.json
@@ -0,0 +1,381 @@
+{
+  "checkpoint": "bounded owned native metadata replay",
+  "previous_head": "d86f3152e450eb97b1b8db6d5968322f49703b0d",
+  "main": "d559e5635e002ee3f885c780a418cf861a5197fc",
+  "main_merge_before_publication": "d0aaaae940651670a6e553e4e8b37ba9379a1135",
+  "pr34_merged_at": "2026-10-04T23:57:49Z",
+  "rust_source_unchanged_across_main_merge": true,
+  "validation": {
+    "source_files": 490,
+    "rust_files": 476,
+    "source_hash_digest": "0c3751fde6bcf8ed1c20a4edde45cf829de54090bcf95caa4abdfebe3ed6c800",
+    "release_qualified": false,
+    "execution_complete": true,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 41.475,
+        "log": "/tmp/canopy-metadata-replay-clippy-final.log",
+        "log_sha256": "8f331ada4aa4c0c4403de8b0232cdae96cf197c294dec01c8d9c6bcd821a829a",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "physical::staged::tests::",
+          "native_receive_stages_verifies_and_publishes_then_clones_after_cache_loss",
+          "native_receive_prepares_bounded_immutable_root_completion_from_registered_custody",
+          "native_receive_metadata_refuses_capacity_corrupt_replay_and_missing_shards_without_publication",
+          "canceled_queued_read_keeps_file_and_admission_until_the_worker_finishes",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "seconds": 89.785,
+        "log": "/tmp/canopy-metadata-replay-focused-final.log",
+        "log_sha256": "1fedfdcf9474fa6248d30e175d313b02a0e399e05fe45e2588e8d8837b326fe7",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            692
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "artifact-owner",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-object-storage",
+          "--lib",
+          "--locked",
+          "canceled_queued_artifact_hashes_retain_physical_owner_until_actual_drain"
+        ],
+        "exit_code": 0,
+        "seconds": 6.884,
+        "log": "/tmp/canopy-metadata-replay-artifact-owner-final.log",
+        "log_sha256": "1acc1a0a9b167682b0d55c0d2c55c519442bf18a3d7c6645b1e265486231782f",
+        "summaries": [
+          [
+            1,
+            0,
+            0,
+            0,
+            14
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked"
+        ],
+        "exit_code": 101,
+        "seconds": 280.965,
+        "log": "/tmp/canopy-metadata-replay-workspace-final.log",
+        "log_sha256": "dd0956ce61eb9dc11c5325611c46e63c935d95058b64600a911b6352976f8173",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            15,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            697
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            697
+          ],
+          [
+            698,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            12,
+            1,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": [
+          "directory_reservations_recover_two_distinct_repository_cells"
+        ]
+      },
+      {
+        "label": "binary",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--bin",
+          "canopy",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 0.734,
+        "log": "/tmp/canopy-metadata-replay-binary-final.log",
+        "log_sha256": "40b603a2b0e2e1134e228a8a2ae0abc6171efa1a9a1ddd0385f5c2bd56083b6a",
+        "summaries": [
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 51.439,
+        "log": "/tmp/canopy-metadata-replay-build-final.log",
+        "log_sha256": "19683af99cd6f5c236c26b491f657169681ec380c18339fdc6a40d62671fe7c5",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.268,
+        "log": "/tmp/canopy-metadata-replay-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.062,
+        "log": "/tmp/canopy-metadata-replay-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 41.884,
+        "log": "/tmp/canopy-metadata-replay-harness-final.log",
+        "log_sha256": "ac71d80010338328a551c19b3481da7555337d0d445822fd34e2c48e098fc4fe",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ]
+  },
+  "rust_unique_executed": 734,
+  "rust_unique_passed": 733,
+  "rust_unique_failed": 1,
+  "library_unique_passed": 719,
+  "server_library_passed": 698,
+  "publication_unique_passed": 401,
+  "focused_server_passed": 6,
+  "focused_artifact_owner_passed": 1,
+  "binary_passed": 2,
+  "directory_passed": 12,
+  "directory_failed": 1,
+  "python_passed": 96,
+  "counts_exclude": "focused and binary reruns, and two nested subprocess summaries; interleaved child stdout is parsed without losing the parent case",
+  "limits": {
+    "default_max_shard_objects": 8192,
+    "default_max_descriptor_bytes": 67108864,
+    "descriptor_record_bytes": 512,
+    "frame_prefix_bytes": 4,
+    "physical_inspection_page_objects": 512,
+    "local_resident_metadata_shards": 1
+  },
+  "qualification_scope": [
+    "SHA-1/SHA-256 actual native receive, retained checkpoint registration, multi-shard physical inspection/upload, Creating drain before Bind, bound replay/closure/catalog preparation, joint-root completion and cold clone composition",
+    "denied descriptor growth, malformed/truncated bounded frames and mismatched native bindings",
+    "descriptor-capacity refusal, truncated replay and missing authenticated metadata parts poison preparation and leave catalog/ref generations and completed responses unchanged in both formats",
+    "canceled confirmed queued metadata reads and all three artifact hash phases retain physical ownership until actual drain"
+  ],
+  "source_hashes_file": {
+    "path": "/tmp/canopy-metadata-replay-source-hashes.json",
+    "sha256": "249b16c28bc2426c3ba2cefeec3e63907bb7e1ab39b13cfd547320e802612844"
+  },
+  "static_audit": {
+    "source_unchanged": true,
+    "source_files": 490,
+    "source_digest": "0c3751fde6bcf8ed1c20a4edde45cf829de54090bcf95caa4abdfebe3ed6c800",
+    "manifest_pins": 5,
+    "lock_pins": 6,
+    "sdk_clean": true,
+    "doc_links": 66,
+    "protected": [
+      {
+        "path": "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index",
+        "sha256": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798"
+      },
+      {
+        "path": "docs/archive/pr20-progress-through-8bb0ee7.md",
+        "sha256": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+      }
+    ],
+    "main": "d559e5635e002ee3f885c780a418cf861a5197fc"
+  },
+  "remote_previous_head_ci": [
+    {
+      "head": "d86f3152e450eb97b1b8db6d5968322f49703b0d",
+      "run": 37244954415,
+      "rust_job": 111560885573,
+      "server_library_passed": 695,
+      "binary_passed": 2,
+      "directory_passed": 12,
+      "directory_failed": 1,
+      "failure": "retired ingestion operation descriptor is unavailable",
+      "log": {
+        "path": "/tmp/canopy-pr34-d86f315-failed.log",
+        "sha256": "7ae471264b95a73ecd98f40162a3afcba00b00125db001583580e106175a82b8"
+      }
+    },
+    {
+      "head": "d86f3152e450eb97b1b8db6d5968322f49703b0d",
+      "run": 37244950312,
+      "rust_job": 111560875098,
+      "server_library_passed": 695,
+      "binary_passed": 2,
+      "directory_passed": 12,
+      "directory_failed": 1,
+      "failure": "retired ingestion operation descriptor is unavailable",
+      "log": {
+        "path": "/tmp/canopy-pr34-d86f315-secondary-failed.log",
+        "sha256": "8bd0ae82dc8399f09145c48bb0699bee33cc87ef82daa1b6974261c5b04f3a7e"
+      }
+    }
+  ],
+  "pre_qualification_diagnostics": [
+    {
+      "path": "/tmp/canopy-metadata-replay-clippy-draft.log",
+      "sha256": "604fb1a07782e4f012951432c96c549b3585d4c25daa3776ac69a06d6a8721ca"
+    },
+    {
+      "path": "/tmp/canopy-metadata-replay-before-artifact-owner-clippy-final.log",
+      "sha256": "53d1fae2ac76ea9f4ab8a7c9a93d4b6e3194bf58d825875e01457747d957e80e"
+    },
+    {
+      "path": "/tmp/canopy-metadata-replay-before-reader-release-clippy-final.log",
+      "sha256": "d748adbb4a98c983f5cb30d16f18d225a19456a83cb4345e9834d2a2b3b9a0e4"
+    }
+  ],
+  "diagnostic_scope": "moved fixture value, missing ObjectStoreExt import and temporary path lifetime; no final-source passing qualification is attributed to drafts",
+  "draft_validation_files": [
+    {
+      "path": "/tmp/canopy-metadata-replay-before-artifact-owner-validation.json",
+      "sha256": "48d082047ec5aa954da613590df52b0244d84120ed58d0fd6abe5180d1a07d44"
+    },
+    {
+      "path": "/tmp/canopy-metadata-replay-before-reader-release-validation.json",
+      "sha256": "39cd2bd368b361df71e8a8c83327b59f69334a406c908d02321225a6a37c92c1"
+    }
+  ],
+  "release_qualified": false,
+  "remaining_failure": "Actual writers and the directory integration caller still invoke retired ingestion. Convert those callers; do not restore the command/schema or skip the case.",
+  "unrun": [
+    "remaining integration binaries/doctests beyond the first failed integration binary",
+    "complete new-source Linux/RustFS workflow",
+    "full native histories, OS containment, fair maintenance/hot-root progress and 10000-engineer mixed-load/recovery capacity",
+    "adopted earlier-owner input physical verification via authenticated retained selection"
+  ],
+  "next_priorities": [
+    "resident staging ownership and real owned HTTP/SSH/generated producers",
+    "remaining request/policy physical ownership and authenticated old-owner physical input selection",
+    "mandatory joint-root completion and real integration caller conversion, then complete Linux/provider CI",
+    "remaining authority consumers, custody history/rollover and final schema removal",
+    "typed GC/backup/restore, OS containment, fair native maintenance/shared hot workspaces, full-history/team capacity and file attribution"
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 7a5d14b2..52892d6e 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -2,19 +2,74 @@
 
 Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
-Current cutover review: [PR #34](https://github.com/crabbuild/canopy/pull/34),
-directly against `main`. The original SQL hydration failures have been resolved by
-converting their real read/cache callers. Full CI remains open: the directory
-integration fixture still invokes the retired loose-object ingestion command.
-The physical worker ownership change below supplies a prerequisite for the native
-write replacement; it does not complete that replacement. The PR remains for
-review and is not ready to merge or deploy. Older checkpoint notes describe
-historical states.
+Packed cutover [PR #34](https://github.com/crabbuild/canopy/pull/34) was merged into
+`main` at `d559e5635e002ee3f885c780a418cf861a5197fc` while its checks still failed.
+The native metadata follow-up is based on that main revision. The original SQL
+hydration failures have been resolved by converting real read/cache callers;
+full CI remains open because a directory integration caller and live writers
+still invoke retired ingestion. The ownership and metadata changes below are
+prerequisites for the write replacement. This cutover is not release qualified.
+Older checkpoint notes describe historical states.
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Bounded native metadata preparation
+
+`PhysicalVerifier::stage_metadata` now consumes a live admitted verifier and
+uploads/releases one metadata shard at a time. Defaults admit at most 8,192
+objects per shard and 64 MiB of descriptor replay; the existing physical metadata
+file and edge ceilings still apply. Native inspection uses pages of at most 512
+objects. A large structural object or exhausted file/disk limit fails preparation
+rather than escaping admission. These limits are configurable runtime inputs,
+not measured large-history throughput or fleet configuration.
+
+The private replay uses the existing `SourceRecord` codec, with a maximum 512-byte
+record and four-byte framing, inside one `AdmittedFile`. Append reserves bytes
+before writes; reading retains one record. Ordinal order is preserved explicitly:
+the source index sorts by incarnation/digest and cannot serve as ordinal replay.
+The result owns admitted descriptor storage and a complete physical witness;
+it retains neither SQLite metadata connections nor creating worker activity.
+Creating can therefore drain before Bind without collecting every shard in a Vec.
+
+`CatalogPreparation::new_staged` checks the bound context and carries worker
+admission through queued closure/directory operations and immutable output
+uploads. `add_staged_pack` authenticates retained native checkpoint membership,
+reopens/hash-checks one uploaded shard at a time and reuses its stored descriptor
+without uploading it twice. Exact witness partition, native artifact bindings,
+typed closure and the final fenced publication gates remain mandatory. A failed
+or canceled replay poisons the builder. The finished private catalog does not
+retain the worker activity that publication must drain.
+
+Artifact uploads/downloads now offer owned entry points. Source hashing,
+download hashing and destination-part validation retain the physical owner in
+each blocking job. Metadata transfers pass their existing pinned file/spool;
+native downloads pass their existing read owner. This closes the lower hash-job
+cancellation gap as well as owning the SQL/file work. Other unconverted request
+and policy paths still need their caller ownership integration.
+
+Final frozen-source qualification passes all 719 unique library cases (6
+Git-format, 15 object-storage, 698 server), including all 401 publication cases.
+All six focused server cases and the artifact hash ownership case pass. The full
+workspace command passes the two binary cases and 12 directory cases, then fails
+the retired-ingestion directory case: 734 unique Rust cases executed, 733 pass,
+one fails. Focused/binary reruns and nested subprocess summaries are excluded.
+All-target workspace Clippy with warnings denied, build, formatting/diff checks
+and 96 Python harness cases pass. Source remains unchanged across the main merge,
+which adds only documentation/gallery files. Exact commands, source/log
+fingerprints, preceding CI results, draft diagnostics, scope and remaining gates
+are recorded in [metadata replay evidence](evidence/native-metadata-replay-20261004.json).
+Both preceding `d86f315` Linux CI runs pass 695 server library cases and then fail
+at the same directory integration case. Live HTTP/SSH/generated
+write wiring, resident staging service ownership, authenticated adopted-input
+physical verification and mandatory joint-root completion remain open. Bound
+assembly still reopens incoming metadata and runs incoming closure checks; no
+claim is made that cold full-history work fits the current bound deadline or that
+this establishes 10,000-engineer capacity. Final Linux/provider qualification,
+cache sharing/hot-root progress and the rest of the hard-cutover goal remain
+required.
+
 ## Staging physical worker ownership
 
 Staging contexts and result slots now share the original worker admission.

From bd8d819315f0e438d9b857a481dfcd294ddd0bd9 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 18:17:31 -0700
Subject: [PATCH 30/55] Own resident staging admission and drain before
 repository release

---
 crates/canopy-server/src/admission.rs         |  29 +-
 crates/canopy-server/src/lib.rs               |  29 ++
 .../src/packs/publication/mod.rs              |   1 +
 .../src/packs/publication/staging_service.rs  | 117 ++++++-
 .../src/packs/publication/tests/custody.rs    |   9 +-
 .../publication/tests/staging_service.rs      |   1 +
 .../tests/staging_service/budget.rs           | 153 +++++++++
 .../tests/staging_service/restore.rs          |  19 +-
 crates/canopy-server/src/server/mod.rs        |   3 +
 .../canopy-server/src/server/residency/mod.rs |   1 +
 .../src/server/residency/recovery.rs          |  44 ++-
 .../src/server/residency/tests.rs             |   1 +
 .../src/server/residency/tests/serving.rs     |   2 +
 .../src/server/residency/tests/staging.rs     | 305 +++++++++++++++++
 docs/evidence/resident-staging-20261004.json  | 310 ++++++++++++++++++
 .../large-repository-implementation-status.md |  46 +++
 16 files changed, 1047 insertions(+), 23 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/tests/staging_service/budget.rs
 create mode 100644 crates/canopy-server/src/server/residency/tests/staging.rs
 create mode 100644 docs/evidence/resident-staging-20261004.json

diff --git a/crates/canopy-server/src/admission.rs b/crates/canopy-server/src/admission.rs
index 6afd514d..b97138d4 100644
--- a/crates/canopy-server/src/admission.rs
+++ b/crates/canopy-server/src/admission.rs
@@ -4,9 +4,9 @@ use crate::ReadIdentity;
 use cellule_runtime::Error;
 use std::{
     collections::HashMap,
-    sync::{Arc, Weak},
+    sync::{Arc, Mutex, Weak},
 };
-use tokio::sync::{Mutex, OwnedSemaphorePermit, Semaphore};
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
 
 /// Node and account admission retained together by work and streamed output.
 pub struct AdmissionPermit {
@@ -47,10 +47,14 @@ impl AccountAdmission {
     }
 
     pub(crate) async fn acquire(&self, actor: ReadIdentity<'_>) -> Result<AdmissionPermit, Error> {
+        self.try_acquire(actor)
+    }
+
+    pub(crate) fn try_acquire(&self, actor: ReadIdentity<'_>) -> Result<AdmissionPermit, Error> {
         let total = Arc::clone(&self.total)
             .try_acquire_owned()
             .map_err(|_| Error::Capacity(self.total_capacity))?;
-        let semaphore = self.account(actor).await;
+        let semaphore = self.account(actor);
         let account = semaphore
             .try_acquire_owned()
             .map_err(|_| Error::Capacity(self.account_capacity))?;
@@ -67,7 +71,6 @@ impl AccountAdmission {
         // cannot fill every pending position while another account has work.
         let _account_waiting = self
             .waiting_account(actor)
-            .await
             .try_acquire_owned()
             .map_err(|_| Error::Capacity(self.account_capacity))?;
         let _waiting = self
@@ -76,7 +79,6 @@ impl AccountAdmission {
             .map_err(|_| Error::Capacity(self.total_capacity))?;
         let account = self
             .account(actor)
-            .await
             .acquire_owned()
             .await
             .map_err(|_| Error::Capacity(self.account_capacity))?;
@@ -90,15 +92,15 @@ impl AccountAdmission {
         })
     }
 
-    async fn account(&self, actor: ReadIdentity<'_>) -> Arc<Semaphore> {
-        Self::semaphore(&self.accounts, actor, self.account_limit).await
+    fn account(&self, actor: ReadIdentity<'_>) -> Arc<Semaphore> {
+        Self::semaphore(&self.accounts, actor, self.account_limit)
     }
 
-    async fn waiting_account(&self, actor: ReadIdentity<'_>) -> Arc<Semaphore> {
-        Self::semaphore(&self.waiting_accounts, actor, self.account_limit).await
+    fn waiting_account(&self, actor: ReadIdentity<'_>) -> Arc<Semaphore> {
+        Self::semaphore(&self.waiting_accounts, actor, self.account_limit)
     }
 
-    async fn semaphore(
+    fn semaphore(
         entries: &Mutex<HashMap<Option<String>, Weak<Semaphore>>>,
         actor: ReadIdentity<'_>,
         limit: usize,
@@ -108,7 +110,7 @@ impl AccountAdmission {
             ReadIdentity::Anonymous => None,
         };
         {
-            let mut accounts = entries.lock().await;
+            let mut accounts = entries.lock().expect("account admission");
             // Permits retain their semaphore through detached ownership work.
             // Active or waiting admission bounds this map; expired accounts need no state.
             accounts.retain(|_, semaphore| semaphore.strong_count() != 0);
@@ -234,6 +236,9 @@ mod tests {
                     .unwrap(),
             );
         }
-        assert_eq!(admission.accounts.lock().await.len(), 1);
+        assert_eq!(
+            admission.accounts.lock().expect("account admission").len(),
+            1
+        );
     }
 }
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 374727fe..6a4daea9 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -455,6 +455,7 @@ pub struct RepositoryCell {
     // reference must not retain its original disk budget after gateway eviction.
     pack_readers: std::sync::Mutex<Vec<std::sync::Weak<pack_store::PackReader>>>,
     serving: std::sync::Mutex<Option<std::sync::Weak<packs::publication::ServingPool>>>,
+    staging: std::sync::Mutex<Option<std::sync::Weak<packs::publication::StagingCoordinator>>>,
 }
 
 impl RepositoryCell {
@@ -483,6 +484,7 @@ impl RepositoryCell {
             target,
             pack_readers: std::sync::Mutex::new(Vec::new()),
             serving: std::sync::Mutex::new(None),
+            staging: std::sync::Mutex::new(None),
         })
     }
 
@@ -490,6 +492,33 @@ impl RepositoryCell {
         *self.serving.lock().expect("repository serving pool") =
             Some(std::sync::Arc::downgrade(pool));
     }
+    pub(crate) fn attach_staging(
+        &self,
+        staging: &std::sync::Arc<packs::publication::StagingCoordinator>,
+    ) {
+        *self.staging.lock().expect("repository staging coordinator") =
+            Some(std::sync::Arc::downgrade(staging));
+    }
+    /// Obtain the resident's owned write lifecycle. Admission still checks live
+    /// custody and actor limits; retaining this handle cannot keep a Cell resident.
+    pub fn staging_coordinator(
+        &self,
+    ) -> Result<
+        std::sync::Arc<packs::publication::StagingCoordinator>,
+        packs::publication::StagingError,
+    > {
+        let staging = self
+            .staging
+            .lock()
+            .expect("repository staging coordinator")
+            .as_ref()
+            .and_then(std::sync::Weak::upgrade)
+            .ok_or(packs::publication::StagingError::Inactive)?;
+        if staging.stats().closed {
+            return Err(packs::publication::StagingError::Closed);
+        }
+        Ok(staging)
+    }
     /// Borrow the resident's certified joint generation; a detached caller
     /// cannot abandon its acquisition or extend a released residency.
     pub async fn serving_snapshot(
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index ff422d05..f6cec117 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -98,6 +98,7 @@ pub use recovery::{
     TerminalReleaseInput, TerminalReleaseReply,
 };
 mod staging_service;
+pub(crate) use staging_service::StagingBudget;
 pub use staging_service::{
     ReadyStaging, StagedInputsTicket, StagedPublicationFailure, StagedPublicationTicket,
     StagingBound, StagingContext, StagingCoordinator, StagingError, StagingLimits, StagingState,
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index 011d135a..c047c57d 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -324,6 +324,7 @@ struct ActorAdmission {
 #[derive(Default)]
 struct Admission {
     closed: bool,
+    paused: bool,
     retirement_probe: bool,
     retirement_probes: u64,
     retirement_failures: u64,
@@ -336,6 +337,7 @@ struct Inner {
     authority: PreparationAuthority,
     target: CellTarget,
     limits: StagingLimits,
+    budget: StagingBudget,
     admission: Mutex<Admission>,
     workers: Arc<Semaphore>,
     drained: Notify,
@@ -378,6 +380,7 @@ struct Job {
     operation: [u8; 16],
     restored_evidence: Option<cellule_runtime::PendingMutation>,
     actor_workers: Arc<Semaphore>,
+    operation_permit: Mutex<Option<crate::admission::AdmissionPermit>>,
     local: Mutex<Local>,
     work: Mutex<WorkSlots>,
     exact: Mutex<Option<Exact>>,
@@ -591,11 +594,76 @@ pub struct StagingStats {
     pub retirement_restarts: u64,
     pub retirement_running: bool,
 }
+/// Node-wide capacity shared by every resident repository. Physical worker
+/// claims are retained by the existing activity owner, including detached work.
+#[derive(Clone)]
+pub(crate) struct StagingBudget {
+    operations: Arc<crate::admission::AccountAdmission>,
+    workers: Arc<crate::admission::AccountAdmission>,
+}
+impl StagingBudget {
+    pub(crate) fn new(operations: usize, workers: usize) -> Result<Self, StagingError> {
+        if operations < 2 || workers < 2 {
+            return Err(StagingError::InvalidLimits);
+        }
+        Ok(Self {
+            operations: Arc::new(crate::admission::AccountAdmission::new(
+                operations,
+                "node staging operations",
+                "account staging operations",
+            )),
+            workers: Arc::new(crate::admission::AccountAdmission::new(
+                workers,
+                "node staging workers",
+                "account staging workers",
+            )),
+        })
+    }
+    #[cfg(test)]
+    pub(crate) fn available(&self) -> (usize, usize) {
+        (self.operations.available(), self.workers.available())
+    }
+}
+/// Pauses an idle resident while its other services attempt eviction. A busy
+/// serving pool or a canceled eviction restores admission through this guard.
+pub(crate) struct StagingQuiescence {
+    inner: Arc<Inner>,
+}
+impl StagingQuiescence {
+    pub(crate) fn commit(self) {
+        self.inner
+            .admission
+            .lock()
+            .expect("staging admission")
+            .closed = true;
+    }
+}
+impl Drop for StagingQuiescence {
+    fn drop(&mut self) {
+        let mut admission = self.inner.admission.lock().expect("staging admission");
+        admission.paused = false;
+    }
+}
 impl StagingCoordinator {
     pub fn new(
         target: CellTarget,
         limits: StagingLimits,
         authority: PreparationAuthority,
+    ) -> Result<Self, StagingError> {
+        limits.validate()?;
+        // Standalone coordinators keep their original per-repository limits.
+        // Production residents share a node budget through new_with_budget.
+        let budget = StagingBudget::new(
+            limits.operations.max(limits.per_actor * 2),
+            limits.workers.max(limits.workers_per_actor * 2),
+        )?;
+        Self::new_with_budget(target, limits, authority, budget)
+    }
+    pub(crate) fn new_with_budget(
+        target: CellTarget,
+        limits: StagingLimits,
+        authority: PreparationAuthority,
+        budget: StagingBudget,
     ) -> Result<Self, StagingError> {
         limits.validate()?;
         if !authority.matches(&target) {
@@ -606,6 +674,7 @@ impl StagingCoordinator {
                 authority,
                 target,
                 limits,
+                budget,
                 admission: Mutex::new(Admission::default()),
                 workers: Arc::new(Semaphore::new(limits.workers)),
                 drained: Notify::new(),
@@ -622,7 +691,7 @@ impl StagingCoordinator {
         let mut admission = self.inner.admission.lock().expect("staging admission");
         let error = if ready.inner.target != self.inner.target {
             Some(StagingError::Foreign)
-        } else if admission.closed {
+        } else if admission.closed || admission.paused {
             Some(StagingError::Closed)
         } else if !matches!(ready.inner.command, Exact::Restored(_))
             && ready.inner.request.lease_ms != self.inner.limits.lease_ms
@@ -645,6 +714,15 @@ impl StagingCoordinator {
         if let Some(error) = error {
             return Err((error, ready));
         }
+        let operation_permit = match self
+            .inner
+            .budget
+            .operations
+            .try_acquire(crate::ReadIdentity::Account(&ready.inner.request.actor))
+        {
+            Ok(permit) => permit,
+            Err(_) => return Err((StagingError::Capacity, ready)),
+        };
         let actor = admission
             .actors
             .entry(ready.inner.request.actor.clone())
@@ -667,6 +745,7 @@ impl StagingCoordinator {
             operation: ready.inner.request.operation,
             restored_evidence,
             actor_workers,
+            operation_permit: Mutex::new(Some(operation_permit)),
             local: Mutex::new(Local {
                 lease: None,
                 bound: None,
@@ -754,6 +833,25 @@ impl StagingCoordinator {
             retirement_running: a.retirement_probe,
         }
     }
+    pub(crate) fn try_quiesce(&self) -> Option<StagingQuiescence> {
+        let mut admission = self.inner.admission.lock().expect("staging admission");
+        if admission.paused || !admission.jobs.is_empty() || admission.retirement_probe {
+            return None;
+        }
+        admission.paused = true;
+        Some(StagingQuiescence {
+            inner: Arc::clone(&self.inner),
+        })
+    }
+    pub(crate) fn close(&self) {
+        let mut admission = self.inner.admission.lock().expect("staging admission");
+        admission.closed = true;
+        for job in admission.jobs.values() {
+            job.local.lock().expect("staging local").stop = true;
+            job.changed.notify_one();
+        }
+        self.inner.drained.notify_waiters();
+    }
     /// Stop admission and renew while accepted workers drain. Uncertain exact
     /// commands remain charged and returned; explicit recovery remains possible.
     pub async fn close_and_drain(&self) -> Vec<StagingTicket> {
@@ -786,7 +884,7 @@ impl StagingCoordinator {
         }
     }
     #[cfg(test)]
-    pub(super) fn fault_for_test(&self, fault: u8) {
+    pub(crate) fn fault_for_test(&self, fault: u8) {
         self.inner
             .fault
             .store(fault, std::sync::atomic::Ordering::Release);
@@ -1097,6 +1195,12 @@ impl StagingTicket {
         let actor_permit = Arc::clone(&self.job.actor_workers)
             .try_acquire_owned()
             .map_err(|_| StagingError::Capacity)?;
+        let node_permit = self
+            .inner
+            .budget
+            .workers
+            .try_acquire(crate::ReadIdentity::Account(&self.job.actor))
+            .map_err(|_| StagingError::Capacity)?;
         let (token, format) = {
             let mut l = self.job.local.lock().expect("staging local");
             if (l.seal && !bound)
@@ -1131,6 +1235,7 @@ impl StagingTicket {
             job: Arc::clone(&self.job),
             permit: Some(permit),
             actor_permit: Some(actor_permit),
+            node_permit: Some(node_permit),
         });
         let context = StagingContext {
             job: Arc::clone(&self.job),
@@ -1291,11 +1396,13 @@ struct Activity {
     job: Arc<Job>,
     permit: Option<OwnedSemaphorePermit>,
     actor_permit: Option<OwnedSemaphorePermit>,
+    node_permit: Option<crate::admission::AdmissionPermit>,
 }
 impl Drop for Activity {
     fn drop(&mut self) {
         drop(self.actor_permit.take());
         drop(self.permit.take());
+        drop(self.node_permit.take());
         self.job.local.lock().expect("staging local").workers -= 1;
         self.job.changed.notify_one();
         self.inner.drained.notify_waiters();
@@ -2116,6 +2223,12 @@ fn bound_state(local: &Local) -> StagingState {
 fn remove(inner: &Inner, job: &Job) {
     let mut a = inner.admission.lock().expect("staging admission");
     a.jobs.remove(&job.operation);
+    drop(
+        job.operation_permit
+            .lock()
+            .expect("staging operation permit")
+            .take(),
+    );
     let count = a.actors.get_mut(&job.actor).expect("staging actor");
     count.operations -= 1;
     if count.operations == 0 {
diff --git a/crates/canopy-server/src/packs/publication/tests/custody.rs b/crates/canopy-server/src/packs/publication/tests/custody.rs
index 193fe140..87f6c0c2 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody.rs
@@ -328,7 +328,7 @@ async fn cold_owner_restoration_recovers_claim_and_renew_receipts_without_revivi
             let started = execute(&f, CustodyAction::BeginPreparation(f.begin(operation))).await?;
             let old = token(&started.output)?;
             let mut mutation = identity()?;
-            mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+            mutation.expires_at_ms = mutation.issued_at_ms + 10_000;
             let action = if claim {
                 CustodyAction::ClaimPreparation(request(old))
             } else {
@@ -337,7 +337,12 @@ async fn cold_owner_restoration_recovers_claim_and_renew_receipts_without_revivi
             let original =
                 PreparedCustody::prepare(&f.client(), &f.target, action, mutation).await?;
             let registered = original.register(&f.client(), identity()?).await?;
-            let accepted = registered.recover(&f.client()).await?;
+            // Allow loaded CI workers to commit before testing actual expiry.
+            // The post-restore Expired assertion below remains mandatory.
+            let accepted = registered
+                .recover(&f.client())
+                .await
+                .map_err(|error| format!("initial acceptance before owner restore: {error:?}"))?;
             let token = token(&accepted.output)?;
             let (runtime, handle, client) =
                 super::durable_recovery::restore_owner(&f, &check(token)).await?;
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index 94f00cf3..7be5be48 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -1,4 +1,5 @@
 mod bound;
+mod budget;
 mod physical;
 mod publication;
 pub(super) mod restore;
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/budget.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/budget.rs
new file mode 100644
index 00000000..dde551a9
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/budget.rs
@@ -0,0 +1,153 @@
+//! A physical owner retains the node share after all async observers leave.
+use super::super::super::staging_service::StagingBudget;
+use super::*;
+
+struct Release(Option<std::sync::mpsc::Sender<()>>);
+impl Drop for Release {
+    fn drop(&mut self) {
+        if let Some(sender) = self.0.take() {
+            let _ = sender.send(());
+        }
+    }
+}
+
+#[tokio::test]
+async fn shared_staging_worker_budget_survives_detached_work_and_terminal_observers() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let one = Fixture::new(format).await?;
+        let two = Fixture::new(format).await?;
+        let budget = StagingBudget::new(4, 2)?;
+        let a = StagingCoordinator::new_with_budget(
+            one.target.clone(),
+            StagingLimits::default(),
+            one.authority(),
+            budget.clone(),
+        )?;
+        let b = StagingCoordinator::new_with_budget(
+            two.target.clone(),
+            StagingLimits::default(),
+            two.authority(),
+            budget.clone(),
+        )?;
+        let first = submit(&one, &a, [211; 16], "owner").await?;
+        let second = submit(&two, &b, [212; 16], "owner").await?;
+        active(&first).await?;
+        active(&second).await?;
+        assert_eq!(budget.available(), (2, 2));
+        let (release, wait) = std::sync::mpsc::channel();
+        let release = Release(Some(release));
+        let (entered, running) = oneshot::channel();
+        let worker = first
+            .spawn(move |context| async move {
+                let owner = context.physical_owner();
+                Ok(tokio::task::spawn_blocking(move || {
+                    let _owner = owner;
+                    let _ = entered.send(());
+                    let _ = wait.recv();
+                }))
+            })?
+            .wait()
+            .await
+            .map_err(|error| error.to_string())?;
+        timeout(Duration::from_secs(5), running).await??;
+        assert_eq!(budget.available(), (2, 1));
+        assert!(matches!(
+            second.spawn(|_| async { Ok(()) }),
+            Err(StagingError::Capacity)
+        ));
+        first.stop();
+        assert!(!worker.is_finished());
+        assert!(a.try_quiesce().is_none());
+        drop(release);
+        timeout(Duration::from_secs(5), worker).await??;
+        timeout(Duration::from_secs(5), async {
+            while a.stats().admitted != 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert_eq!(budget.available(), (3, 2));
+        // The old terminal observer remains alive, but neither node credit is
+        // charged to that observer after the last physical worker exits.
+        assert!(matches!(first.state(), StagingState::Stopped));
+        assert_eq!(
+            second
+                .spawn(|_| async { Ok(7) })?
+                .wait()
+                .await
+                .map_err(|e| e.to_string())?,
+            7
+        );
+        let pause = a.try_quiesce().ok_or("idle staging could not pause")?;
+        let ready = ReadyStaging::new(
+            one.client(),
+            one.target.clone(),
+            one.begin([213; 16]),
+            identity()?,
+        )
+        .await?;
+        let (error, ready) = a.submit(ready).err().ok_or("paused admission opened")?;
+        assert!(matches!(error, StagingError::Closed));
+        drop(pause); // Cancellation/failure restores admission without new state.
+        let retry = a.submit(ready).map_err(|(error, _)| error)?;
+        active(&retry).await?;
+        assert_eq!(budget.available(), (2, 2));
+        assert!(a.close_and_drain().await.is_empty());
+        assert!(b.close_and_drain().await.is_empty());
+        assert_eq!(budget.available(), (4, 2));
+        one.runtime.shutdown().await?;
+        two.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn shared_staging_operation_budget_retains_exact_uncertainty_until_recovery() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in [1, 2, 3] {
+            let fixture = Fixture::new(format).await?;
+            let budget = StagingBudget::new(2, 2)?;
+            let coordinator = StagingCoordinator::new_with_budget(
+                fixture.target.clone(),
+                StagingLimits::default(),
+                fixture.authority(),
+                budget.clone(),
+            )?;
+            coordinator.fault_for_test(fault);
+            let ticket = submit(&fixture, &coordinator, [214; 16], "owner").await?;
+            assert!(matches!(
+                terminal(&ticket).await?,
+                StagingState::Uncertain(_)
+            ));
+            let original = ticket
+                .custody_evidence_for_test()
+                .ok_or("custody absent")?
+                .0;
+            let pending = coordinator.close_and_drain().await;
+            assert_eq!(pending.len(), 1);
+            assert_eq!(budget.available(), (1, 2));
+            assert!(coordinator.try_quiesce().is_none());
+            coordinator.recover(&ticket)?;
+            assert!(
+                timeout(Duration::from_secs(10), coordinator.close_and_drain())
+                    .await?
+                    .is_empty()
+            );
+            assert_eq!(budget.available(), (2, 2));
+            assert!(matches!(
+                fixture.client().resolve(&original).await?,
+                cellule_runtime::Resolution::Committed(_)
+            ));
+            assert_eq!(
+                RegisteredCustody::load_latest(&fixture.client(), &fixture.target, [214; 16])
+                    .await?
+                    .ok_or("exact custody lost")?
+                    .evidence()
+                    .clone(),
+                original
+            );
+            fixture.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
index f85628af..2b495dad 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
@@ -57,16 +57,23 @@ pub(in crate::packs::publication::tests) async fn head_expiring(
     };
     let mut mutation = identity()?;
     if short_expiry {
-        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+        // Accepted-history tests need time to commit on loaded CI workers;
+        // they still wait for real SDK expiry before observing cold recovery.
+        // Intentionally unexecuted expiry cases retain their short window.
+        mutation.expires_at_ms =
+            mutation.issued_at_ms + if execute_original { 10_000 } else { 1_000 };
     }
     let command = PreparedCustody::prepare(&f.client(), &f.target, action, mutation).await?;
     let original = command.evidence().clone();
     let registered = command.register(&f.client(), identity()?).await?;
-    let committed = if execute_original {
-        Some(registered.recover(&f.client()).await?)
-    } else {
-        None
-    };
+    let committed =
+        if execute_original {
+            Some(registered.recover(&f.client()).await.map_err(|error| {
+                format!("initial acceptance for custody kind {kind}: {error:?}")
+            })?)
+        } else {
+            None
+        };
     Ok((original, committed))
 }
 async fn restore(
diff --git a/crates/canopy-server/src/server/mod.rs b/crates/canopy-server/src/server/mod.rs
index 3ab1e1e9..22de0916 100644
--- a/crates/canopy-server/src/server/mod.rs
+++ b/crates/canopy-server/src/server/mod.rs
@@ -203,6 +203,7 @@ pub(crate) struct RepositoryManager {
     residency_admission: AccountAdmission,
     transfers: AccountAdmission,
     tasks: TaskTracker,
+    staging_budget: crate::packs::publication::StagingBudget,
     publication_budget: crate::packs::publication::PublicationBudget,
     recovery_scans: crate::packs::publication::RecoveryScanBudget,
     serving_reads: crate::packs::publication::ServingReadBudget,
@@ -655,6 +656,8 @@ impl RunningServer {
                     "account repository activations",
                 ),
                 tasks: tasks.clone(),
+                staging_budget: crate::packs::publication::StagingBudget::new(32, 64)
+                    .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
                 publication_budget: crate::packs::publication::PublicationBudget::new(
                     crate::packs::publication::PublicationLimits::default(),
                 )
diff --git a/crates/canopy-server/src/server/residency/mod.rs b/crates/canopy-server/src/server/residency/mod.rs
index 224cca71..8b4215f2 100644
--- a/crates/canopy-server/src/server/residency/mod.rs
+++ b/crates/canopy-server/src/server/residency/mod.rs
@@ -382,6 +382,7 @@ impl RepositoryManager {
                 } else if let Some(resident) = loaded.get_mut(&entry.repository_id) {
                     resident.recovery = Some(recovery.clone());
                     repository.attach_serving(&recovery.serving);
+                    repository.attach_staging(&recovery.staging);
                     None
                 } else {
                     Some(ServerError::Repository("loaded repository is absent"))
diff --git a/crates/canopy-server/src/server/residency/recovery.rs b/crates/canopy-server/src/server/residency/recovery.rs
index bfba765a..e01e8bb1 100644
--- a/crates/canopy-server/src/server/residency/recovery.rs
+++ b/crates/canopy-server/src/server/residency/recovery.rs
@@ -4,13 +4,14 @@ use crate::packs::catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes};
 use crate::packs::publication::{
     CustodySupervisor, MaintenanceRequest, PreparationAuthority, PublicationCoordinator,
     PublicationLimits, PublicationState, RecoveryScanLimits, RecoverySupervisor, ServingContext,
-    ServingPool, ServingPoolLimits,
+    ServingPool, ServingPoolLimits, StagingCoordinator, StagingLimits, StagingState,
 };
 use canopy_object_storage::artifact::ArtifactStore;
 
 pub(super) struct RecoveryServices {
     pub(super) coordinator: PublicationCoordinator,
     pub(super) serving: Arc<ServingPool>,
+    pub(super) staging: Arc<StagingCoordinator>,
     workers: Mutex<Option<Workers>>,
 }
 struct Workers {
@@ -40,6 +41,15 @@ impl RecoveryServices {
             manager.publication_budget.clone(),
         )
         .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?;
+        let staging = Arc::new(
+            StagingCoordinator::new_with_budget(
+                target.clone(),
+                StagingLimits::default(),
+                authority.clone(),
+                manager.staging_budget.clone(),
+            )
+            .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
+        );
         let settings = manager
             .recovery_scans
             .settings(RecoveryScanLimits::default(), &entry.owner);
@@ -112,11 +122,15 @@ impl RecoveryServices {
         Ok(Self {
             coordinator,
             serving,
+            staging,
             workers: Mutex::new(Some(Workers { roots, custody })),
         })
     }
 
     pub(super) async fn quiesce(&self) -> bool {
+        let Some(staging) = self.staging.try_quiesce() else {
+            return false;
+        };
         let mut workers = self.workers.lock().await;
         if let Some(active) = workers.as_ref() {
             tokio::join!(active.roots.pause(), active.custody.pause());
@@ -135,12 +149,33 @@ impl RecoveryServices {
             }
             return false;
         }
+        staging.commit();
         self.serving.close_and_drain().await;
         join(workers.take()).await;
         true
     }
 
+    async fn drain_staging(&self) {
+        loop {
+            let pending = self.staging.close_and_drain().await;
+            if pending.is_empty() && !self.staging.stats().retirement_running {
+                return;
+            }
+            // Exact settlement can remove the last job while its read-only
+            // retirement owner is finishing a round. Keep the Cell and node
+            // workspace until that independently owned scanner exits too.
+            for ticket in pending {
+                if matches!(ticket.state(), StagingState::Uncertain(_))
+                    && let Err(error) = self.staging.recover(&ticket)
+                {
+                    tracing::warn!(?error, "exact staging recovery deferred during drain");
+                }
+            }
+            tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+        }
+    }
     pub(super) async fn drain(&self) {
+        self.drain_staging().await;
         self.serving.close_and_drain().await;
         join(self.workers.lock().await.take()).await;
         loop {
@@ -187,6 +222,13 @@ impl RepositoryManager {
                 .filter_map(|repository| repository.recovery.as_ref().map(Arc::clone))
                 .collect()
         };
+        for service in &services {
+            service.staging.close();
+        }
+        // Producer capabilities may retain serving generations and exact held
+        // publication work. Drain them before closing either lower service.
+        futures_util::future::join_all(services.iter().map(|service| service.drain_staging()))
+            .await;
         for service in &services {
             service.serving.close();
         }
diff --git a/crates/canopy-server/src/server/residency/tests.rs b/crates/canopy-server/src/server/residency/tests.rs
index c8125c54..1b1c84cf 100644
--- a/crates/canopy-server/src/server/residency/tests.rs
+++ b/crates/canopy-server/src/server/residency/tests.rs
@@ -3,6 +3,7 @@ use std::{collections::VecDeque, convert::Infallible, future::poll_fn};
 use super::*;
 mod recovery;
 mod serving;
+mod staging;
 
 struct Frames(VecDeque<Frame<Bytes>>);
 
diff --git a/crates/canopy-server/src/server/residency/tests/serving.rs b/crates/canopy-server/src/server/residency/tests/serving.rs
index efa5345c..e2493e5c 100644
--- a/crates/canopy-server/src/server/residency/tests/serving.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving.rs
@@ -149,6 +149,7 @@ async fn shutdown_refuses_unpublished_serving_constructor_and_joins_it_before_wo
             .serving_snapshot(ReadIdentity::Account("canopy"))
             .await;
         let unavailable = premature.is_err();
+        assert!(repository.staging_coordinator().is_err());
         drop(premature);
         let mut shutdown = tokio::spawn(server.shutdown());
         timeout(Duration::from_secs(8), manager.serving_stop.cancelled()).await?;
@@ -169,6 +170,7 @@ async fn shutdown_refuses_unpublished_serving_constructor_and_joins_it_before_wo
             unavailable,
             "unpublished constructor exposed serving before registered ownership"
         );
+        assert!(repository.staging_coordinator().is_err());
         assert!(matches!(
             result,
             Err(crate::server::ServerError::Runtime(
diff --git a/crates/canopy-server/src/server/residency/tests/staging.rs b/crates/canopy-server/src/server/residency/tests/staging.rs
new file mode 100644
index 00000000..2e1ad99f
--- /dev/null
+++ b/crates/canopy-server/src/server/residency/tests/staging.rs
@@ -0,0 +1,305 @@
+//! Production residency owns staging independently of request observers.
+use super::recovery::{create, loaded, server};
+use super::*;
+use crate::packs::publication::{
+    BeginRequest, DEFAULT_LEASE_MS, ReadyStaging, StagingError, StagingState, StagingTicket,
+};
+use crate::{ObjectFormat, server::mutation_identity};
+use tokio::{
+    sync::oneshot,
+    time::{Duration, timeout},
+};
+type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error + Send + Sync>>;
+
+async fn ready(
+    repository: &RepositoryCell,
+    client: CellClient,
+    operation: u8,
+) -> Result<ReadyStaging> {
+    Ok(ReadyStaging::new(
+        client,
+        repository.target.clone(),
+        BeginRequest {
+            repository: repository.id,
+            operation: [operation; 16],
+            request_digest: [operation; 32],
+            actor: "canopy".into(),
+            lease_ms: DEFAULT_LEASE_MS,
+        },
+        mutation_identity()?,
+    )
+    .await?)
+}
+async fn active(ticket: &StagingTicket) -> Result {
+    match timeout(Duration::from_secs(10), ticket.wait()).await? {
+        StagingState::Active(_) => Ok(()),
+        other => Err(format!("production staging refused: {other:?}").into()),
+    }
+}
+
+struct Release(Option<std::sync::mpsc::Sender<()>>);
+impl Drop for Release {
+    fn drop(&mut self) {
+        if let Some(sender) = self.0.take() {
+            let _ = sender.send(());
+        }
+    }
+}
+
+#[tokio::test]
+async fn production_staging_blocks_eviction_and_shutdown_until_detached_physical_worker_drains()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, files) = server().await?;
+        let manager = server.repositories.clone();
+        let entry = create(&manager, "staging-physical", format).await?;
+        let (repository, client, service) = loaded(&manager, entry.repository_id).await?;
+        let coordinator = repository.staging_coordinator()?;
+        assert!(Arc::ptr_eq(&coordinator, &service.staging));
+        let ticket = coordinator
+            .submit(ready(&repository, client.clone(), 91).await?)
+            .map_err(|(error, _)| error)?;
+        active(&ticket).await?;
+        let (release, wait) = std::sync::mpsc::channel();
+        let release = Release(Some(release));
+        let (entered, running) = oneshot::channel();
+        let work = ticket.spawn(move |context| async move {
+            let owner = context.physical_owner();
+            Ok(tokio::task::spawn_blocking(move || {
+                let _owner = owner;
+                let _ = entered.send(());
+                let _ = wait.recv();
+            }))
+        })?;
+        let worker = work.wait().await.map_err(|error| error.to_string())?;
+        timeout(Duration::from_secs(5), running).await??;
+        assert_eq!(manager.staging_budget.available(), (31, 63));
+        assert!(!service.quiesce().await);
+        assert!(!coordinator.stats().closed);
+        assert!(!service.coordinator.stats().await.closed);
+        drop(ticket);
+        let node = server.node.clone();
+        let directory = server.directory.clone();
+        let session = server.advertisement.lock().await.advertisement().session();
+        let mut shutdown = tokio::spawn(server.shutdown());
+        timeout(Duration::from_secs(5), async {
+            while !coordinator.stats().closed {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert!(
+            timeout(Duration::from_millis(50), &mut shutdown)
+                .await
+                .is_err()
+        );
+        assert!(repository.staging_coordinator().is_err());
+        assert!(!node.is_shutting_down());
+        assert!(
+            directory
+                .is_live(session, crate::server::unix_now_ms()?)
+                .await?
+        );
+        assert!(!service.coordinator.stats().await.closed);
+        assert_eq!(manager.staging_budget.available(), (31, 63));
+        assert!(
+            crate::server::workspace::Workspace::open(&files.path().join("node"))
+                .is_err_and(|error| error.kind() == std::io::ErrorKind::WouldBlock)
+        );
+        // A cached handle also refuses new admission after the node barrier.
+        let (error, _) = coordinator
+            .submit(ready(&repository, client, 92).await?)
+            .err()
+            .ok_or("cached coordinator admitted during shutdown")?;
+        assert!(matches!(error, StagingError::Closed));
+        drop(release);
+        timeout(Duration::from_secs(5), worker).await??;
+        timeout(Duration::from_secs(10), shutdown).await???;
+        assert_eq!(manager.staging_budget.available(), (32, 64));
+        assert_eq!(coordinator.stats().admitted, 0);
+        assert!(node.is_shutting_down());
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_staging_account_capacity_is_shared_across_resident_repositories() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let manager = server.repositories.clone();
+        let mut tickets = Vec::new();
+        for (repo, name) in ["stage-one", "stage-two", "stage-three"].iter().enumerate() {
+            let entry = create(&manager, name, format).await?;
+            let (repository, client, service) = loaded(&manager, entry.repository_id).await?;
+            let coordinator = repository.staging_coordinator()?;
+            for index in 0..8 {
+                let input =
+                    ready(&repository, client.clone(), (100 + repo * 8 + index) as u8).await?;
+                match coordinator.submit(input) {
+                    Ok(ticket) => {
+                        active(&ticket).await?;
+                        tickets.push(ticket);
+                    }
+                    Err((error, retained)) => {
+                        assert_eq!(repo, 2);
+                        assert!(matches!(error, StagingError::Capacity));
+                        assert_eq!(service.staging.stats().admitted, 0);
+                        assert_eq!(manager.staging_budget.available(), (16, 64));
+                        // Quota refusal did not consume the prepared request. The
+                        // exact value can be submitted after an owner drains.
+                        if index == 0 {
+                            let stopped = tickets.remove(0);
+                            stopped.stop();
+                            timeout(Duration::from_secs(5), async {
+                                while manager.staging_budget.available().0 != 17 {
+                                    tokio::task::yield_now().await;
+                                }
+                            })
+                            .await?;
+                            let retry = coordinator.submit(retained).map_err(|(error, _)| error)?;
+                            active(&retry).await?;
+                            tickets.push(retry);
+                        }
+                        break;
+                    }
+                }
+            }
+        }
+        assert_eq!(tickets.len(), 16);
+        drop(tickets); // Observers do not return credits; the resident owns them.
+        assert_eq!(manager.staging_budget.available(), (16, 64));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+        assert_eq!(manager.staging_budget.available(), (32, 64));
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_staging_eviction_refusal_restores_admission_and_closed_eviction_is_idempotent()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let manager = server.repositories.clone();
+        let entry = create(&manager, "stage-resume", format).await?;
+        let (repository, client, service) = loaded(&manager, entry.repository_id).await?;
+        let snapshot = repository
+            .serving_snapshot(ReadIdentity::Account("canopy"))
+            .await?;
+        assert!(!service.quiesce().await);
+        let coordinator = repository.staging_coordinator()?;
+        let ticket = coordinator
+            .submit(ready(&repository, client, 93).await?)
+            .map_err(|(error, _)| error)?;
+        active(&ticket).await?;
+        assert!(!service.quiesce().await);
+        ticket.stop();
+        drop(snapshot);
+        timeout(Duration::from_secs(5), async {
+            while coordinator.stats().admitted != 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert!(timeout(Duration::from_secs(5), service.quiesce()).await?);
+        assert!(service.quiesce().await);
+        assert!(matches!(
+            repository.staging_coordinator(),
+            Err(StagingError::Closed)
+        ));
+        assert_eq!(manager.staging_budget.available(), (32, 64));
+        server.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_shutdown_recovers_exact_staging_while_another_repository_holds_physical_work()
+-> Result {
+    use crate::packs::publication::RegisteredCustody;
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in [1, 2, 3] {
+            let (server, _files) = server().await?;
+            let manager = server.repositories.clone();
+            let held = create(&manager, "stage-held", format).await?;
+            let uncertain = create(&manager, "stage-recovery", format).await?;
+            let (held_repo, held_client, held_service) =
+                loaded(&manager, held.repository_id).await?;
+            let (repository, client, service) = loaded(&manager, uncertain.repository_id).await?;
+            let ticket = held_service
+                .staging
+                .submit(ready(&held_repo, held_client, 94).await?)
+                .map_err(|(error, _)| error)?;
+            active(&ticket).await?;
+            let (release, wait) = std::sync::mpsc::channel();
+            let release = Release(Some(release));
+            let (entered, running) = oneshot::channel();
+            let worker = ticket
+                .spawn(move |context| async move {
+                    let owner = context.physical_owner();
+                    Ok(tokio::task::spawn_blocking(move || {
+                        let _owner = owner;
+                        let _ = entered.send(());
+                        let _ = wait.recv();
+                    }))
+                })?
+                .wait()
+                .await
+                .map_err(|error| error.to_string())?;
+            timeout(Duration::from_secs(5), running).await??;
+            service.staging.fault_for_test(fault);
+            let original_ticket = service
+                .staging
+                .submit(ready(&repository, client.clone(), 95).await?)
+                .map_err(|(error, _)| error)?;
+            assert!(matches!(
+                timeout(Duration::from_secs(10), original_ticket.wait_terminal()).await?,
+                StagingState::Uncertain(_)
+            ));
+            let original = RegisteredCustody::load_latest(&client, &repository.target, [95; 16])
+                .await?
+                .ok_or("uncertain staging registration absent")?
+                .evidence()
+                .clone();
+            let prior = match client.resolve(&original).await? {
+                cellule_runtime::Resolution::Absent => None,
+                cellule_runtime::Resolution::Committed(outcome) => Some(outcome.commit_sequence()),
+                other => return Err(format!("unexpected original state: {other:?}").into()),
+            };
+            assert_eq!(prior.is_some(), fault != 1);
+            drop((ticket, original_ticket));
+            let node = server.node.clone();
+            let mut shutdown = tokio::spawn(server.shutdown());
+            timeout(Duration::from_secs(10), async {
+                while service.staging.stats().admitted != 0
+                    || service.staging.stats().retirement_running
+                {
+                    tokio::time::sleep(Duration::from_millis(10)).await;
+                }
+            })
+            .await?;
+            assert!(
+                timeout(Duration::from_millis(30), &mut shutdown)
+                    .await
+                    .is_err()
+            );
+            assert!(!node.is_shutting_down());
+            assert_eq!(manager.staging_budget.available(), (31, 63));
+            assert!(!service.coordinator.stats().await.closed);
+            let saved = RegisteredCustody::load_latest(&client, &repository.target, [95; 16])
+                .await?
+                .ok_or("exact registration lost during shutdown")?;
+            assert_eq!(saved.evidence(), &original);
+            assert!(saved.settled());
+            let replay = saved.recover(&client).await?;
+            if let Some(sequence) = prior {
+                assert_eq!(replay.receipt.commit_sequence, sequence);
+            }
+            drop(release);
+            timeout(Duration::from_secs(5), worker).await??;
+            timeout(Duration::from_secs(10), shutdown).await???;
+            assert!(!service.staging.stats().retirement_running);
+            assert_eq!(manager.staging_budget.available(), (32, 64));
+        }
+    }
+    Ok(())
+}
diff --git a/docs/evidence/resident-staging-20261004.json b/docs/evidence/resident-staging-20261004.json
new file mode 100644
index 00000000..e40eba88
--- /dev/null
+++ b/docs/evidence/resident-staging-20261004.json
@@ -0,0 +1,310 @@
+{
+  "checkpoint": "node-owned resident staging lifecycle and shared admission",
+  "previous_head": "6357f4149fe7aee6df675fc1c3a50fe5bb45216e",
+  "main": "d559e5635e002ee3f885c780a418cf861a5197fc",
+  "validation": {
+    "source_files": 492,
+    "rust_files": 478,
+    "source_hash_digest": "3d83c7cb2432207af2f58a667a562e82624734c8c9c7ad58faf20f2f22ec15bd",
+    "release_qualified": false,
+    "execution_complete": true,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 42.621,
+        "log": "/tmp/canopy-resident-staging-clippy-final.log",
+        "log_sha256": "02cd00b79c2761d7d23109cee9099682bf498300e0665b88da5a0f28495eb4a7",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "server::residency::tests::staging::",
+          "shared_staging_",
+          "cold_owner_restoration_recovers_claim_and_renew_receipts_without_reviving_custody",
+          "cold_staging_keeps_all_original_receipts_after_sdk_expiry_and_actual_owner_restore",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "seconds": 230.974,
+        "log": "/tmp/canopy-resident-staging-focused-final.log",
+        "log_sha256": "f43fe37b3467a8648ecb850ff53e5ad9dc778835bdaeb92a327f36cb29093a8e",
+        "summaries": [
+          [
+            8,
+            0,
+            0,
+            0,
+            696
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked"
+        ],
+        "exit_code": 101,
+        "seconds": 453.441,
+        "log": "/tmp/canopy-resident-staging-workspace-final.log",
+        "log_sha256": "669667303e6c5330ef3c1c468b8b4ea3ca53d8113f173bd280a6ae7cd172dede",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            15,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            703
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            703
+          ],
+          [
+            704,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            12,
+            1,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": [
+          "directory_reservations_recover_two_distinct_repository_cells"
+        ]
+      },
+      {
+        "label": "binary",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--bin",
+          "canopy",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 0.916,
+        "log": "/tmp/canopy-resident-staging-binary-final.log",
+        "log_sha256": "cae37e49f262f366983ce63e0d06965fa91627b732eb813ae6f09909ac3f08f4",
+        "summaries": [
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 52.197,
+        "log": "/tmp/canopy-resident-staging-build-final.log",
+        "log_sha256": "7b7596109c3ec3a52853199a057533dd544995fcdff0f102f4610abcb8df6e57",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.274,
+        "log": "/tmp/canopy-resident-staging-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.064,
+        "log": "/tmp/canopy-resident-staging-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 40.786,
+        "log": "/tmp/canopy-resident-staging-harness-final.log",
+        "log_sha256": "02044d964939bf02c29c246653dcbd0ecbc66410efbb35185fc91735ed8c985a",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ]
+  },
+  "rust_unique_executed": 740,
+  "rust_unique_passed": 739,
+  "rust_unique_failed": 1,
+  "library_unique_passed": 725,
+  "server_library_passed": 704,
+  "publication_unique_passed": 403,
+  "focused_passed": 8,
+  "binary_passed": 2,
+  "directory_passed": 12,
+  "directory_failed": 1,
+  "python_passed": 96,
+  "counts_exclude": "focused and binary reruns, and two nested subprocess summaries; interleaved child stdout is parsed without losing the parent case",
+  "limits": {
+    "node_operations": 32,
+    "node_physical_workers": 64,
+    "node_operations_per_account": 16,
+    "node_physical_workers_per_account": 32,
+    "repository_operations": 32,
+    "repository_operations_per_actor": 8,
+    "repository_workers": 64,
+    "repository_workers_per_actor": 8
+  },
+  "scope": [
+    "Actual resident constructor/registration barrier owns one StagingCoordinator, with a weak RepositoryCell capability.",
+    "Node and account quotas reuse existing AccountAdmission and bounded weak maps. Exact uncertainty retains operation admission; terminal removal releases it despite retained observers.",
+    "Physical activity owns shared node worker capacity through async result transfer, abort and observer cancellation.",
+    "Reversible idle staging pause before serving quiescence. Busy staging blocks eviction. Successful eviction closes admission; retry is idempotent.",
+    "Shutdown closes all staging owners and drains repositories concurrently before serving/publication closure, preserving Cell authority, heartbeat and workspace.",
+    "Drain waits for the independent read-only retirement owner after exact job settlement.",
+    "Production mixed shutdown recovers absent, lost-reply and panicked original staging commands in both formats while another repository holds detached physical work.",
+    "Accepted-history fixture windows permit initial commit under load; tests still wait for actual SDK expiry and preserve original receipts after genuine owner restoration."
+  ],
+  "source_hashes_file": {
+    "path": "/tmp/canopy-resident-staging-source-hashes.json",
+    "sha256": "2293b2f59c8843e46781cea2b1fd5b1c6d10864c07aeefcf974b41e9bbb24518"
+  },
+  "protected": [
+    {
+      "path": "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index",
+      "sha256": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798"
+    },
+    {
+      "path": "/Users/haipingfu/.codex/worktrees/packed-catalog-publication-pr/canopy/docs/archive/pr20-progress-through-8bb0ee7.md",
+      "sha256": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+    }
+  ],
+  "preceding_remote_ci": {
+    "head": "6357f4149fe7aee6df675fc1c3a50fe5bb45216e",
+    "run": 37247847774,
+    "job": 111569198375,
+    "library_passed": 719,
+    "server_library_passed": 698,
+    "failure": "retired ingestion operation descriptor unavailable in directory integration",
+    "log": {
+      "path": "/tmp/canopy-pr36-6357f414-failed.log",
+      "sha256": "b7e0b6fc2673708e4b6180fb95813d1cd79c76a0a53f5c75fed9e6ba6b6eb855"
+    }
+  },
+  "preserved_initial_validation": {
+    "path": "/tmp/canopy-resident-staging-before-final-drain/validation.json",
+    "sha256": "420532880b059928276a6cdd719ff637178d69e29b67c7aeb94a7e873a76b451"
+  },
+  "initial_diagnostics": {
+    "path": "/tmp/canopy-resident-staging-clippy.log",
+    "sha256": "d625f63446be4896b12a577a270f1a42a4763c4202e7e1451d8108bd1a0da504"
+  },
+  "initial_failures": "The first full run passed 701/703 server tests and exposed two one-second accepted-history command windows expiring under parallel load. Its source/log hashes remain attributed to that run. Final source also joins the retirement scanner and adds a production mixed-drain regression.",
+  "release_qualified": false,
+  "remaining_failure": "Actual HTTP/SSH/generated writers and directory integration still invoke retired ingestion. Convert actual writers and callers without restoring the removed table/command or skipping failing cases.",
+  "unrun": [
+    "later integration binaries and doctests beyond failed directory integration",
+    "complete new-source Linux/RustFS workflow",
+    "full native histories and 10000-engineer mixed-load/recovery capacity",
+    "adopted earlier-owner physical input selection and remaining production hard-cutover scope"
+  ],
+  "next_priorities": [
+    "owned HTTP/SSH/generated writer pipeline on resident staging and registered root policy/completion",
+    "actual integration caller conversion, then complete workspace/Linux/provider CI",
+    "remaining read/policy authority, authenticated old-owner input verification, custody history/rollover and final schema cutover",
+    "GC/backup/restore, OS containment, fair maintenance/shared hot workspaces, full-history/team capacity and attribution"
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 52892d6e..276b7b59 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -15,6 +15,52 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Resident staging ownership
+
+The production resident now constructs one `StagingCoordinator` alongside its
+serving pool and publication coordinator. Both capabilities are attached under
+the existing constructor/shutdown barrier; `RepositoryCell` holds weak references.
+A retained or detached caller cannot invent an unregistered resident service.
+Remote repository routes still require owner-aware write forwarding.
+
+All resident coordinators share node admission for 32 operations and 64 physical
+workers, with half-node account shares and the existing repository/account caps.
+These are admission defaults, not measured capacity. The implementation reuses
+`AccountAdmission`, its bounded weak account map, semaphore permits and the
+existing staging activity owner. Operation credit survives exact uncertainty
+and is returned on terminal removal even if a caller retains its old observer.
+Worker credit stays with the last physical activity, including queued jobs after
+an async result is transferred. Rejected admission returns the original prepared
+request. No additional durable queue, SQL schema or operation inventory is added.
+
+Idle eviction pauses staging admission through a reversible guard before
+quiescing serving. Busy staging prevents eviction. A serving refusal or canceled
+pause releases the guard; a committed eviction closes admission. Shutdown closes
+all inventoried staging services first and drains them concurrently while their
+serving/publication resources remain available. Each service resolves its exact
+uncertain originals and waits for the read-only retirement owner to exit before
+releasing the lower services, Cell ownership, heartbeat or node workspace.
+Late constructors are refused by the same registration barrier and drained.
+
+Regression coverage exercises both object formats: production eviction and
+shutdown with detached physical work, shared cross-repository account capacity,
+retry of the same refused request, busy-serving admission restoration, idempotent
+closed eviction, exact staging recovery while another repository remains busy,
+and physical/operation credits after observer cancellation or retained terminal
+observers. Accepted-history expiry fixtures give initial command execution ten
+seconds under loaded CI and still wait for actual SDK expiry before recovery.
+Unexecuted expiry fixtures retain their one-second window.
+
+This increment supplies the resident write lifecycle; live HTTP/SSH/generated
+writers and their integration fixtures still require conversion to it. The full
+CI and release/capacity gates remain open. Final frozen-source qualification passes 725 library cases, including 704
+server cases and 403 publication cases. All eight focused regressions, Clippy
+with warnings denied, build, formatting/diff checks and 96 Python harness cases
+pass. The workspace command executes 740 unique Rust cases: 739 pass and the
+retired-ingestion directory case fails; later integrations/doctests are unrun.
+See [resident staging evidence](evidence/resident-staging-20261004.json) for exact
+commands, source/log fingerprints, preserved earlier failures and remaining gates.
+
 ## Bounded native metadata preparation
 
 `PhysicalVerifier::stage_metadata` now consumes a live admitted verifier and

From 1ab3853d7411876c9f2c8fcc410e3bf409be35a1 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 20:07:07 -0700
Subject: [PATCH 31/55] Add resident workflow ownership and repair recovery
 fixtures

---
 .../src/packs/publication/staging_service.rs  |   73 +-
 .../publication/staging_service/driver.rs     |  155 ++
 .../staging_service/publication.rs            |    3 +
 .../src/packs/publication/tests.rs            |   14 +
 .../src/packs/publication/tests/custody.rs    |   16 +-
 .../packs/publication/tests/custody_stop.rs   |    9 +-
 .../packs/publication/tests/durable_policy.rs |    8 +-
 .../tests/initialization_recovery.rs          |    8 +-
 .../publication/tests/preparation_receipt.rs  |    9 +-
 .../src/packs/publication/tests/serving.rs    |    4 +
 .../publication/tests/serving/custody.rs      |    9 +-
 .../publication/tests/serving/lifecycle.rs    |   21 +-
 .../publication/tests/serving/workspace.rs    |   52 +-
 .../publication/tests/staging_receipt.rs      |    9 +-
 .../publication/tests/staging_service.rs      |    8 +-
 .../tests/staging_service/restore.rs          |   17 +-
 .../tests/staging_service/retirement.rs       |    9 +-
 .../src/server/residency/recovery.rs          |    4 +-
 .../src/server/residency/tests/staging.rs     |  237 ++
 .../tests/directory_cell/main.rs              |   63 +-
 docs/evidence/push-workflow-ci-20261004.json  | 1909 +++++++++++++++++
 .../large-repository-implementation-status.md |  100 +-
 22 files changed, 2593 insertions(+), 144 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/staging_service/driver.rs
 create mode 100644 docs/evidence/push-workflow-ci-20261004.json

diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index c047c57d..23e124ce 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -20,6 +20,7 @@ use tokio::{
 
 mod bound;
 use bound::accept_bound;
+mod driver;
 mod publication;
 mod restore;
 mod retirement;
@@ -338,6 +339,7 @@ struct Inner {
     target: CellTarget,
     limits: StagingLimits,
     budget: StagingBudget,
+    resident: Option<(CellClient, PublicationCoordinator)>,
     admission: Mutex<Admission>,
     workers: Arc<Semaphore>,
     drained: Notify,
@@ -362,6 +364,7 @@ struct Local {
     fenced: bool,
     recovery: bool,
     renew: bool,
+    driver_started: bool,
 }
 trait RetainedWork: Any + Send + Sync {
     fn fence_completed(&self);
@@ -378,6 +381,9 @@ struct Job {
     target: CellTarget,
     actor: String,
     operation: [u8; 16],
+    request_digest: [u8; 32],
+    driver: Mutex<Option<driver::DriverJoin>>,
+    driver_stop: tokio_util::sync::CancellationToken,
     restored_evidence: Option<cellule_runtime::PendingMutation>,
     actor_workers: Arc<Semaphore>,
     operation_permit: Mutex<Option<crate::admission::AdmissionPermit>>,
@@ -675,6 +681,7 @@ impl StagingCoordinator {
                 target,
                 limits,
                 budget,
+                resident: None,
                 admission: Mutex::new(Admission::default()),
                 workers: Arc::new(Semaphore::new(limits.workers)),
                 drained: Notify::new(),
@@ -743,6 +750,9 @@ impl StagingCoordinator {
             target: ready.inner.target,
             actor: ready.inner.request.actor,
             operation: ready.inner.request.operation,
+            request_digest: ready.inner.request.request_digest,
+            driver: Mutex::new(None),
+            driver_stop: tokio_util::sync::CancellationToken::new(),
             restored_evidence,
             actor_workers,
             operation_permit: Mutex::new(Some(operation_permit)),
@@ -766,6 +776,7 @@ impl StagingCoordinator {
                 fenced: false,
                 recovery: false,
                 renew: false,
+                driver_started: false,
             }),
             work: Mutex::new(WorkSlots::default()),
             exact: Mutex::new(Some(ready.inner.command)),
@@ -848,6 +859,7 @@ impl StagingCoordinator {
         admission.closed = true;
         for job in admission.jobs.values() {
             job.local.lock().expect("staging local").stop = true;
+            job.driver_stop.cancel();
             job.changed.notify_one();
         }
         self.inner.drained.notify_waiters();
@@ -859,26 +871,36 @@ impl StagingCoordinator {
             let wake = self.inner.drained.notified();
             tokio::pin!(wake);
             wake.as_mut().enable();
-            {
+            let pending = {
                 let mut a = self.inner.admission.lock().expect("staging admission");
                 a.closed = true;
                 for job in a.jobs.values() {
                     job.local.lock().expect("staging local").stop = true;
+                    job.driver_stop.cancel();
                     job.changed.notify_one();
                 }
                 if a.jobs.values().all(|j| {
                     matches!(*j.status.borrow(), StagingState::Uncertain(_))
                         && j.local.lock().expect("staging local").workers == 0
                 }) {
-                    return a
-                        .jobs
-                        .values()
-                        .map(|job| StagingTicket {
-                            inner: Arc::clone(&self.inner),
-                            job: Arc::clone(job),
-                        })
-                        .collect();
+                    Some(
+                        a.jobs
+                            .values()
+                            .map(|job| StagingTicket {
+                                inner: Arc::clone(&self.inner),
+                                job: Arc::clone(job),
+                            })
+                            .collect::<Vec<_>>(),
+                    )
+                } else {
+                    None
                 }
+            };
+            if let Some(pending) = pending {
+                for ticket in &pending {
+                    driver::drain(&ticket.job).await;
+                }
+                return pending;
             }
             wake.await;
         }
@@ -942,7 +964,7 @@ impl StagedInputsTicket {
 }
 impl StagingTicket {
     #[cfg(test)]
-    pub(super) fn custody_evidence_for_test(
+    pub(crate) fn custody_evidence_for_test(
         &self,
     ) -> Option<(
         cellule_runtime::PendingMutation,
@@ -1098,6 +1120,7 @@ impl StagingTicket {
     }
     pub fn stop(&self) {
         self.job.local.lock().expect("staging local").stop = true;
+        self.job.driver_stop.cancel();
         self.job.changed.notify_one();
     }
     pub async fn open_base(
@@ -2011,20 +2034,22 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
                 }
             }
             Next::Stop => {
-                let mut local = job.local.lock().expect("staging local");
-                local.fenced = true;
-                if let Some(session) = &local.bound {
-                    session.fence();
+                {
+                    let mut local = job.local.lock().expect("staging local");
+                    local.fenced = true;
+                    if let Some(session) = &local.bound {
+                        session.fence();
+                    }
+                    // Keep the original binding receipt observable after graceful stop.
+                    job.status.send_replace(
+                        local
+                            .bound_result
+                            .clone()
+                            .map(StagingState::Bound)
+                            .unwrap_or(StagingState::Stopped),
+                    );
                 }
-                // Keep the original binding receipt observable after graceful stop.
-                job.status.send_replace(
-                    local
-                        .bound_result
-                        .clone()
-                        .map(StagingState::Bound)
-                        .unwrap_or(StagingState::Stopped),
-                );
-                drop(local);
+                driver::drain(&job).await;
                 remove(&inner, &job);
                 return;
             }
@@ -2189,10 +2214,12 @@ async fn finish_fence(inner: &Inner, job: &Job, error: StagingError) {
     let error = Arc::new(error);
     job.status
         .send_replace(StagingState::Fenced(Arc::clone(&error)));
+    job.driver_stop.cancel();
     if let Some(registration) = job.checkpoint.lock().expect("staging checkpoint").as_ref() {
         registration.finish(Err(error));
     }
     drain_work(job).await;
+    driver::drain(job).await;
     remove(inner, job);
 }
 async fn drain_work(job: &Job) {
diff --git a/crates/canopy-server/src/packs/publication/staging_service/driver.rs b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
new file mode 100644
index 00000000..df0466ba
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
@@ -0,0 +1,155 @@
+//! One workflow controller per admitted operation. Physical work still uses
+//! the existing staged/bound worker slots; controllers must not block Bind.
+use super::*;
+use futures_util::FutureExt;
+pub(super) type DriverJoin =
+    futures_util::future::Shared<futures_util::future::BoxFuture<'static, ()>>;
+
+impl StagingCoordinator {
+    pub(crate) fn new_resident(
+        client: CellClient,
+        target: CellTarget,
+        limits: StagingLimits,
+        authority: PreparationAuthority,
+        budget: StagingBudget,
+        publication: PublicationCoordinator,
+    ) -> Result<Self, StagingError> {
+        if !publication.matches_target(&target) {
+            return Err(StagingError::Foreign);
+        }
+        let mut coordinator = Self::new_with_budget(target, limits, authority, budget)?;
+        Arc::get_mut(&mut coordinator.inner)
+            .expect("new staging owner")
+            .resident = Some((client, publication));
+        Ok(coordinator)
+    }
+
+    /// Prepare a request with the resident's actual Cell capability. The
+    /// existing registered custody factory performs the authoritative checks.
+    pub async fn ready_request(
+        &self,
+        request: BeginRequest,
+        identity: MutationIdentity,
+    ) -> Result<ReadyStaging, StagingError> {
+        {
+            let admission = self.inner.admission.lock().expect("staging admission");
+            if admission.closed || admission.paused {
+                return Err(StagingError::Closed);
+            }
+        }
+        let (client, _) = self.inner.resident.as_ref().ok_or(StagingError::Inactive)?;
+        ReadyStaging::new(client.clone(), self.inner.target.clone(), request, identity).await
+    }
+
+    /// Joining an operation ID requires the original authenticated context,
+    /// including while Begin has not yet produced a token.
+    pub fn join_request(
+        &self,
+        request: &BeginRequest,
+    ) -> Result<Option<StagingTicket>, StagingError> {
+        if crate::repository_target(
+            self.inner.target.tenant(),
+            self.inner.target.application(),
+            request.repository,
+        )
+        .map_err(|_| StagingError::Context)?
+            != self.inner.target
+        {
+            return Err(StagingError::Foreign);
+        }
+        let Some(ticket) = self.pending(request.operation) else {
+            return Ok(None);
+        };
+        if ticket.job.actor != request.actor || ticket.job.request_digest != request.request_digest
+        {
+            return Err(StagingError::Context);
+        }
+        Ok(Some(ticket))
+    }
+}
+
+impl StagingTicket {
+    /// Transfer the entire workflow before the request's next await. An HTTP
+    /// observer owns neither this task nor its exact command recovery. Only
+    /// the production resident's publication dispatcher can be supplied here.
+    /// Run physical work through `spawn`/`spawn_bound`; use this task only to
+    /// retrieve their outputs and order checkpoint, Bind and publication steps.
+    pub fn drive<F, Fut>(&self, producer: F) -> Result<(), StagingError>
+    where
+        F: FnOnce(StagingTicket, PublicationCoordinator) -> Fut + Send + 'static,
+        Fut: Future<Output = Result<(), StagingError>> + Send + 'static,
+    {
+        let publication = self
+            .inner
+            .resident
+            .as_ref()
+            .ok_or(StagingError::Inactive)?
+            .1
+            .clone();
+        let admission = self.inner.admission.lock().expect("staging admission");
+        let mut local = self.job.local.lock().expect("staging local");
+        if admission.closed
+            || admission.paused
+            || local.stop
+            || local.fenced
+            || !admission
+                .jobs
+                .get(&self.job.operation)
+                .is_some_and(|job| Arc::ptr_eq(job, &self.job))
+        {
+            return Err(StagingError::Inactive);
+        }
+        if local.driver_started {
+            return Err(StagingError::Duplicate);
+        }
+        local.driver_started = true;
+        let ticket = self.clone();
+        let owner = self.job.clone();
+        let inner = self.inner.clone();
+        let task = tokio::spawn(async move {
+            let mut task = tokio::spawn(async move { producer(ticket, publication).await });
+            let result = tokio::select! {
+                result = &mut task => result.unwrap_or(Err(StagingError::Worker)),
+                _ = owner.driver_stop.cancelled() => {
+                    task.abort();
+                    let _ = task.await;
+                    Err(StagingError::Inactive)
+                }
+            };
+            if let Err(error) = result {
+                tracing::warn!(operation = %hex::encode(owner.operation), ?error, "owned push workflow stopped");
+                // The lifecycle still owns every admitted exact command and
+                // physical worker. Never replace an uncertain result with ng.
+                owner.local.lock().expect("staging local").stop = true;
+                owner.changed.notify_one();
+            } else {
+                let mut local = owner.local.lock().expect("staging local");
+                if !local.finishing && !matches!(*owner.status.borrow(), StagingState::Published(_))
+                {
+                    local.stop = true;
+                }
+            }
+            // Wake drain even when an uncertain command has no more workers.
+            // Its exact owner may be awaiting explicit recovery independently.
+            owner.changed.notify_one();
+            inner.drained.notify_waiters();
+        });
+        *self.job.driver.lock().expect("staging driver") = Some(
+            async move {
+                let _ = task.await;
+            }
+            .boxed()
+            .shared(),
+        );
+        Ok(())
+    }
+}
+
+pub(super) async fn drain(job: &Job) {
+    // Concurrent node/service drains must join the same actual task. Taking a
+    // JoinHandle would let the second caller mistake its absence for completion.
+    let task = job.driver.lock().expect("staging driver").clone();
+    if let Some(task) = task {
+        task.await;
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/staging_service/publication.rs b/crates/canopy-server/src/packs/publication/staging_service/publication.rs
index 3b8d3a4b..b80b9fba 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/publication.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/publication.rs
@@ -166,6 +166,7 @@ pub(super) async fn observe(inner: &Inner, job: &Job, ticket: &PublicationTicket
                 }
                 drain_work(job).await;
                 job.status.send_replace(StagingState::Published(outcome));
+                driver::drain(job).await;
                 remove(inner, job);
                 return true;
             }
@@ -182,6 +183,8 @@ pub(super) async fn observe(inner: &Inner, job: &Job, ticket: &PublicationTicket
                 drain_work(job).await;
                 job.status
                     .send_replace(StagingState::Fenced(Arc::new(StagingError::Inactive)));
+                job.driver_stop.cancel();
+                driver::drain(job).await;
                 remove(inner, job);
                 return true;
             }
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 821c7ff4..61abf81b 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -337,6 +337,20 @@ fn identity() -> std::io::Result<MutationIdentity> {
         expires_at_ms: now + 60_000,
     })
 }
+// SDK expiry uses wall-clock milliseconds; Tokio timers are monotonic.
+// A wake alone cannot establish that the original identity has expired.
+async fn wait_for_sdk_expiry(expires_at_ms: i64) -> Result {
+    loop {
+        let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
+        if now > expires_at_ms {
+            return Ok(());
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(u64::try_from(
+            expires_at_ms - now + 1,
+        )?))
+        .await;
+    }
+}
 async fn registered_preparation(
     f: &Fixture,
     operation: [u8; 16],
diff --git a/crates/canopy-server/src/packs/publication/tests/custody.rs b/crates/canopy-server/src/packs/publication/tests/custody.rs
index 87f6c0c2..d315723d 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody.rs
@@ -1,7 +1,6 @@
 //! Real Cell receipts, pre-admission recovery and the original command's atomic result.
 use super::{publishing::edit, *};
 use cellule_runtime::{Committed, Resolution};
-use tokio::time::Duration;
 
 async fn prepare(f: &Fixture, action: CustodyAction) -> Result<PreparedCustody> {
     Ok(PreparedCustody::prepare(&f.client(), &f.target, action, identity()?).await?)
@@ -22,14 +21,7 @@ fn token(output: &CustodyReply) -> Result<PreparationToken> {
     }
 }
 async fn expire(identity: MutationIdentity) -> Result {
-    let now = sql::now(0)?;
-    if now <= identity.expires_at_ms {
-        tokio::time::sleep(Duration::from_millis(u64::try_from(
-            identity.expires_at_ms - now + 1,
-        )?))
-        .await;
-    }
-    Ok(())
+    wait_for_sdk_expiry(identity.expires_at_ms).await
 }
 
 #[tokio::test]
@@ -283,7 +275,7 @@ async fn denied_begin_is_original_knowledge_after_sdk_expiry_and_authority_chang
         let f = Fixture::new(format).await?;
         let operation = [234; 16];
         let mut mutation = identity()?;
-        mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+        mutation.expires_at_ms = mutation.issued_at_ms + 10_000;
         let original = PreparedCustody::prepare(
             &f.client(),
             &f.target,
@@ -421,7 +413,7 @@ async fn denied_renewal_preserves_knowledge_and_exact_successor_claim_survives_r
             assert_ne!(prior, original);
             edit(&f, "UPDATE catalog_operations SET expires_at_ms=0; UPDATE catalog_leases SET expires_at_ms=0").await?;
             let mut mutation = identity()?;
-            mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+            mutation.expires_at_ms = mutation.issued_at_ms + 10_000;
             let action = if staging {
                 CustodyAction::RenewStaging(request(prior))
             } else {
@@ -732,7 +724,7 @@ async fn denied_claim_keeps_its_original_receipt_after_sdk_expiry_and_cold_resto
             .await?;
             let successor = token(&accepted.output)?;
             let mut mutation = identity()?;
-            mutation.expires_at_ms = mutation.issued_at_ms + 1_000;
+            mutation.expires_at_ms = mutation.issued_at_ms + 10_000;
             let action = if staging {
                 CustodyAction::ClaimStaging(request(old))
             } else {
diff --git a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
index 8ce17155..37a97e35 100644
--- a/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
+++ b/crates/canopy-server/src/packs/publication/tests/custody_stop.rs
@@ -4,14 +4,7 @@ use cellule_runtime::Resolution;
 use tokio::time::{Duration, timeout};
 
 async fn expired(value: &cellule_runtime::PendingMutation) -> Result {
-    let now = sql::now(0)?;
-    if now <= value.identity().expires_at_ms {
-        tokio::time::sleep(Duration::from_millis(
-            (value.identity().expires_at_ms - now + 1) as u64,
-        ))
-        .await;
-    }
-    Ok(())
+    wait_for_sdk_expiry(value.identity().expires_at_ms).await
 }
 async fn registered(f: &Fixture, kind: u8) -> Result<RegisteredCustody> {
     Ok(
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
index 467200c7..962236e1 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_policy.rs
@@ -208,13 +208,7 @@ pub(super) async fn qualify(context: Context<'_>, refusal_case: bool, late_write
     assert!(staging.close_and_drain().await.is_empty());
     let (runtime, handle, client) = super::durable_recovery::restore_owner(f, &check).await?;
     // Wall-clock expiry is real SDK behavior, not a synthetic transport result.
-    let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
-    if now <= first_identity.expires_at_ms {
-        tokio::time::sleep(std::time::Duration::from_millis(u64::try_from(
-            first_identity.expires_at_ms - now + 1,
-        )?))
-        .await;
-    }
+    wait_for_sdk_expiry(first_identity.expires_at_ms).await?;
     assert!(matches!(
         client.resolve(&first_evidence).await?,
         Resolution::Expired
diff --git a/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs b/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
index 21b0c942..03ad1640 100644
--- a/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs
@@ -270,13 +270,7 @@ async fn original_initialization_receipt_survives_lost_ack_expiry_body_loss_and_
     edit(&f, "UPDATE repository_identity SET owner='replacement'").await?;
     drop(registered);
     let (runtime, handle, client) = super::durable_recovery::restore_owner(&f, &check).await?;
-    let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
-    if now <= mutation.expires_at_ms {
-        tokio::time::sleep(Duration::from_millis(u64::try_from(
-            mutation.expires_at_ms - now + 1,
-        )?))
-        .await;
-    }
+    wait_for_sdk_expiry(mutation.expires_at_ms).await?;
     assert!(matches!(
         client.resolve(&original).await?,
         Resolution::Expired
diff --git a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
index 3de5b8d8..7b68ee9a 100644
--- a/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs
@@ -20,14 +20,7 @@ fn denied(
 }
 
 async fn expire(expires_at_ms: i64) -> Result {
-    let now = sql::now(0)?;
-    if now <= expires_at_ms {
-        tokio::time::sleep(Duration::from_millis(u64::try_from(
-            expires_at_ms - now + 1,
-        )?))
-        .await;
-    }
-    Ok(())
+    wait_for_sdk_expiry(expires_at_ms).await
 }
 
 #[tokio::test]
diff --git a/crates/canopy-server/src/packs/publication/tests/serving.rs b/crates/canopy-server/src/packs/publication/tests/serving.rs
index b585ddcf..a85ed574 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving.rs
@@ -16,6 +16,10 @@ mod refs;
 mod selection_drain;
 mod workspace;
 
+// Allow real SQL/provider callbacks under concurrent load. Renewal cases
+// retain borrowers beyond this initial lease; expiry cases use their own clocks.
+const RENEWAL_LEASE_MS: u64 = 5_000;
+
 async fn initialize(f: &Fixture, store: Arc<ArtifactStore>) -> Result<GenerationFact> {
     let (prepared, root, budget) = Box::pin(empty(f, [241; 16], store.clone())).await?;
     let prepared = Arc::new(prepared);
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/custody.rs b/crates/canopy-server/src/packs/publication/tests/serving/custody.rs
index e63ee2bf..c393f53a 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/custody.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/custody.rs
@@ -38,14 +38,7 @@ async fn saved(f: &Fixture, reader: u8) -> Result<RegisteredCustody> {
     .ok_or("serving intent missing")?)
 }
 async fn expired(evidence: &PendingMutation) -> Result {
-    let now = sql::now(0)?;
-    if now <= evidence.identity().expires_at_ms {
-        tokio::time::sleep(Duration::from_millis(u64::try_from(
-            evidence.identity().expires_at_ms - now + 1,
-        )?))
-        .await;
-    }
-    Ok(())
+    wait_for_sdk_expiry(evidence.identity().expires_at_ms).await
 }
 
 #[tokio::test]
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
index 0aaab02d..0ece2bd0 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs
@@ -48,7 +48,8 @@ async fn ready(owner: &ServingOwner) -> Result<ServingOwnerStats> {
             tokio::time::sleep(Duration::from_millis(10)).await;
         }
     })
-    .await?)
+    .await
+    .map_err(|error| format!("serving owner readiness: {error}; {:?}", owner.stats()))?)
 }
 async fn zero_pins(f: &Fixture) -> Result {
     timeout(Duration::from_secs(8), async {
@@ -336,7 +337,7 @@ async fn closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clo
         let owner = ServingOwner::start(
             context(&f, store, &root, tasks.clone())?,
             q.clone(),
-            input(&f, 218, "owner", 1_000),
+            input(&f, 218, "owner", RENEWAL_LEASE_MS),
             identity()?,
         )
         .await?;
@@ -349,7 +350,7 @@ async fn closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clo
             owner.snapshot(Some("owner".into())).await,
             Err(ServingReadError::Inactive)
         ));
-        tokio::time::sleep(Duration::from_millis(1_500)).await;
+        tokio::time::sleep(Duration::from_millis(RENEWAL_LEASE_MS * 3 / 2)).await;
         timeout(Duration::from_secs(8), async {
             while owner.stats().renewals < 2 {
                 assert_eq!(
@@ -361,7 +362,13 @@ async fn closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clo
                 tokio::time::sleep(Duration::from_millis(10)).await;
             }
         })
-        .await?;
+        .await
+        .map_err(|error| {
+            format!(
+                "{format:?}: borrowed-snapshot renewals: {error}; {:?}",
+                owner.stats()
+            )
+        })?;
         assert!(owner.stats().renewals >= 2, "{:?}", owner.stats());
         assert_eq!(owner.stats().token, Some(token));
         assert_eq!(snapshot.fact(), fact);
@@ -371,7 +378,11 @@ async fn closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clo
         drop(clone);
         assert_eq!(
             timeout(Duration::from_secs(8), owner.close_and_drain())
-                .await?
+                .await
+                .map_err(|error| format!(
+                    "{format:?}: last snapshot drain: {error}; {:?}",
+                    owner.stats()
+                ))?
                 .phase,
             ServingOwnerPhase::Released
         );
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
index d0fe9b7d..b12152dc 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
@@ -394,7 +394,13 @@ async fn closed_producer_renews_during_long_construction_and_returned_workspace_
                 tokio::time::sleep(Duration::from_millis(10)).await;
             }
         })
-        .await?;
+        .await
+        .map_err(|error| {
+            format!(
+                "{format:?}: warm owner readiness: {error}; {:?}",
+                warm.stats()
+            )
+        })?;
         let view = warm.snapshot(Some("owner".into())).await?;
         assert!(view.headers(&[oid]).await?[0].is_some());
         drop(view);
@@ -403,14 +409,20 @@ async fn closed_producer_renews_during_long_construction_and_returned_workspace_
             ServingOwnerPhase::Released
         );
         let mut input = f.begin([119; 16]);
-        input.lease_ms = 1000;
+        input.lease_ms = RENEWAL_LEASE_MS;
         let owner = ServingOwner::start(ctx, q.clone(), input, identity()?).await?;
         timeout(Duration::from_secs(8), async {
             while owner.stats().phase != ServingOwnerPhase::Ready {
                 tokio::time::sleep(Duration::from_millis(10)).await;
             }
         })
-        .await?;
+        .await
+        .map_err(|error| {
+            format!(
+                "{format:?}: short-lease readiness: {error}; {:?}",
+                owner.stats()
+            )
+        })?;
         let view = owner.snapshot(Some("owner".into())).await?;
         assert!(
             view.headers(&[oid])
@@ -422,10 +434,16 @@ async fn closed_producer_renews_during_long_construction_and_returned_workspace_
         let observer =
             tokio::spawn(async move { view.workspace(&[oid], WorkspaceLimits::default()).await });
         timeout(Duration::from_secs(8), provider.entered.acquire())
-            .await??
+            .await
+            .map_err(|error| {
+                format!(
+                    "{format:?}: constructor provider entry: {error}; {:?}",
+                    owner.stats()
+                )
+            })??
             .forget();
         owner.close();
-        tokio::time::sleep(Duration::from_millis(1500)).await;
+        tokio::time::sleep(Duration::from_millis(RENEWAL_LEASE_MS * 3 / 2)).await;
         timeout(Duration::from_secs(8), async {
             while owner.stats().renewals < 2 {
                 assert_eq!(
@@ -437,11 +455,23 @@ async fn closed_producer_renews_during_long_construction_and_returned_workspace_
                 tokio::time::sleep(Duration::from_millis(10)).await;
             }
         })
-        .await?;
+        .await
+        .map_err(|error| {
+            format!(
+                "{format:?}: two closed-owner renewals: {error}; {:?}",
+                owner.stats()
+            )
+        })?;
         assert!(owner.stats().renewals >= 2, "{:?}", owner.stats());
         provider.proceed.add_permits(1);
         let workspace = timeout(Duration::from_secs(8), observer)
-            .await??
+            .await
+            .map_err(|error| {
+                format!(
+                    "{format:?}: renewed constructor completion: {error}; {:?}",
+                    owner.stats()
+                )
+            })??
             .map_err(|e| format!("renewed constructor: {e}"))?;
         // Construction's final fresh authority check proves the complete result;
         // short body/membership reads are exercised with their own deadline tests.
@@ -458,7 +488,13 @@ async fn closed_producer_renews_during_long_construction_and_returned_workspace_
         );
         drop(workspace);
         assert_eq!(
-            timeout(Duration::from_secs(8), drain).await??.phase,
+            timeout(Duration::from_secs(8), drain)
+                .await
+                .map_err(|error| format!(
+                    "{format:?}: returned workspace drain: {error}; {:?}",
+                    owner.stats()
+                ))??
+                .phase,
             ServingOwnerPhase::Released
         );
         assert_eq!(pin_count(&f).await?, 0);
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs b/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
index 8649459f..4cbcc45c 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_receipt.rs
@@ -5,14 +5,7 @@ use cellule_runtime::Resolution;
 use tokio::time::{Duration, timeout};
 
 async fn expire(expires_at_ms: i64) -> Result {
-    let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
-    if now <= expires_at_ms {
-        tokio::time::sleep(Duration::from_millis(u64::try_from(
-            expires_at_ms - now + 1,
-        )?))
-        .await;
-    }
-    Ok(())
+    wait_for_sdk_expiry(expires_at_ms).await
 }
 fn denied_stage(
     result: std::result::Result<
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index 7be5be48..8d1b0f14 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -247,13 +247,7 @@ async fn staged_service_recovers_original_begin_after_sdk_expiry_before_allowing
             .output
             .ok_or("artifact custody expired with the SDK identity")?;
         assert!(live.expires_at_ms > mutation.expires_at_ms);
-        let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
-        if now <= mutation.expires_at_ms {
-            tokio::time::sleep(Duration::from_millis(u64::try_from(
-                mutation.expires_at_ms - now + 1,
-            )?))
-            .await;
-        }
+        wait_for_sdk_expiry(mutation.expires_at_ms).await?;
         assert!(matches!(
             fixture.client().resolve(&evidence).await?,
             cellule_runtime::Resolution::Expired
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
index 2b495dad..2a9e9cc5 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs
@@ -91,12 +91,7 @@ async fn settle(ticket: &StagingTicket) -> Result<StagingState> {
     Ok(timeout(Duration::from_secs(10), ticket.wait()).await?)
 }
 async fn expired(evidence: &PendingMutation) -> Result {
-    let until = evidence.identity().expires_at_ms;
-    let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
-    if now <= until {
-        tokio::time::sleep(Duration::from_millis((until - now + 1) as u64)).await;
-    }
-    Ok(())
+    wait_for_sdk_expiry(evidence.identity().expires_at_ms).await
 }
 
 #[tokio::test]
@@ -166,10 +161,12 @@ async fn cold_staging_keeps_all_original_receipts_after_sdk_expiry_and_actual_ow
                 super::super::durable_recovery::restore_owner(&f, &check(old)).await?;
             assert_ne!(handle.owner_fence(), old.owner);
             expired(&evidence).await?;
-            assert!(matches!(
-                client.resolve(&evidence).await?,
-                Resolution::Expired
-            ));
+            let resolution = client.resolve(&evidence).await?;
+            assert!(
+                matches!(resolution, Resolution::Expired),
+                "format {format:?}, custody kind {kind}, expiry {}: {resolution:?}",
+                evidence.identity().expires_at_ms
+            );
             let (service, ticket) =
                 restore(&f, client.clone(), kind, StagingLimits::default()).await?;
             assert!(matches!(settle(&ticket).await?, StagingState::Fenced(_)));
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs
index 13022519..8e519f2b 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs
@@ -5,14 +5,7 @@ use cellule_runtime::{PendingMutation, Resolution};
 use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 
 async fn expired(evidence: &PendingMutation) -> Result {
-    let now = crate::packs::publication::sql::now(0)?;
-    if now <= evidence.identity().expires_at_ms {
-        tokio::time::sleep(Duration::from_millis(
-            (evidence.identity().expires_at_ms - now + 1) as u64,
-        ))
-        .await;
-    }
-    Ok(())
+    wait_for_sdk_expiry(evidence.identity().expires_at_ms).await
 }
 async fn until(c: &StagingCoordinator, predicate: impl Fn(StagingStats) -> bool) -> Result {
     timeout(Duration::from_secs(10), async {
diff --git a/crates/canopy-server/src/server/residency/recovery.rs b/crates/canopy-server/src/server/residency/recovery.rs
index e01e8bb1..d559ac91 100644
--- a/crates/canopy-server/src/server/residency/recovery.rs
+++ b/crates/canopy-server/src/server/residency/recovery.rs
@@ -42,11 +42,13 @@ impl RecoveryServices {
         )
         .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?;
         let staging = Arc::new(
-            StagingCoordinator::new_with_budget(
+            StagingCoordinator::new_resident(
+                client.clone(),
                 target.clone(),
                 StagingLimits::default(),
                 authority.clone(),
                 manager.staging_budget.clone(),
+                coordinator.clone(),
             )
             .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
         );
diff --git a/crates/canopy-server/src/server/residency/tests/staging.rs b/crates/canopy-server/src/server/residency/tests/staging.rs
index 2e1ad99f..e6d110f9 100644
--- a/crates/canopy-server/src/server/residency/tests/staging.rs
+++ b/crates/canopy-server/src/server/residency/tests/staging.rs
@@ -46,6 +46,243 @@ impl Drop for Release {
     }
 }
 
+struct DriverDropped(Arc<std::sync::atomic::AtomicBool>);
+impl Drop for DriverDropped {
+    fn drop(&mut self) {
+        self.0.store(true, std::sync::atomic::Ordering::Release);
+    }
+}
+fn driver_request(repository: &RepositoryCell, operation: u8) -> BeginRequest {
+    BeginRequest {
+        repository: repository.id,
+        operation: [operation; 16],
+        request_digest: [operation; 32],
+        actor: "canopy".into(),
+        lease_ms: DEFAULT_LEASE_MS,
+    }
+}
+
+#[tokio::test]
+async fn production_push_driver_survives_observer_loss_binds_and_joins_before_resident_release()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let manager = server.repositories.clone();
+        let entry = create(&manager, "driver-bind", format).await?;
+        let (repository, _, service) = loaded(&manager, entry.repository_id).await?;
+        let coordinator = repository.staging_coordinator()?;
+        let request = driver_request(&repository, 180);
+        let ready = coordinator
+            .ready_request(request.clone(), mutation_identity()?)
+            .await?;
+        let ticket = coordinator.submit(ready).map_err(|(error, _)| error)?;
+        // Join identity is checked even before Begin has produced a token.
+        assert!(coordinator.join_request(&request)?.is_some());
+        let mut wrong = request.clone();
+        wrong.request_digest[0] ^= 1;
+        assert!(coordinator.join_request(&wrong).is_err());
+        let mut wrong = request.clone();
+        wrong.actor = "another-account".into();
+        assert!(coordinator.join_request(&wrong).is_err());
+        let mut foreign = request.clone();
+        foreign.repository = *uuid::Uuid::new_v4().as_bytes();
+        assert!(coordinator.join_request(&foreign).is_err());
+        let (bound, bound_observer) = oneshot::channel();
+        let dropped = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let owned = DriverDropped(dropped.clone());
+        ticket.drive(move |ticket, publication| async move {
+            let _owned = owned;
+            if !matches!(ticket.wait().await, StagingState::Active(_)) {
+                return Err(StagingError::Context);
+            }
+            if publication.stats().await.closed {
+                return Err(StagingError::Closed);
+            }
+            let work = ticket.spawn(|context| async move { context.token() })?;
+            let _token = work
+                .wait()
+                .await
+                .map_err(|error| StagingError::Input(Box::new(error)))?;
+            ticket.seal()?;
+            if !matches!(ticket.wait_terminal().await, StagingState::Bound(_)) {
+                return Err(StagingError::Context);
+            }
+            let _ = bound.send(());
+            std::future::pending::<std::result::Result<(), StagingError>>().await
+        })?;
+        let called = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let attempt = called.clone();
+        assert!(matches!(
+            ticket.drive(move |_, _| async move {
+                attempt.store(true, std::sync::atomic::Ordering::Release);
+                Ok(())
+            }),
+            Err(StagingError::Duplicate)
+        ));
+        drop(ticket);
+        timeout(Duration::from_secs(10), bound_observer).await??;
+        assert!(!called.load(std::sync::atomic::Ordering::Acquire));
+        assert!(!dropped.load(std::sync::atomic::Ordering::Acquire));
+        assert_eq!(
+            coordinator.stats().workers,
+            0,
+            "controller must not prevent its own Bind"
+        );
+        assert_eq!(coordinator.stats().admitted, 1);
+        assert!(!service.quiesce().await);
+        timeout(Duration::from_secs(10), server.shutdown()).await??;
+        assert!(dropped.load(std::sync::atomic::Ordering::Acquire));
+        assert_eq!(coordinator.stats().admitted, 0);
+        assert_eq!(manager.staging_budget.available(), (32, 64));
+        assert!(matches!(
+            coordinator
+                .ready_request(request.clone(), mutation_identity()?)
+                .await,
+            Err(StagingError::Closed)
+        ));
+        assert!(coordinator.join_request(&request)?.is_none());
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_push_driver_cancellation_keeps_detached_physical_worker_and_node_owned_until_drain()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, files) = server().await?;
+        let manager = server.repositories.clone();
+        let entry = create(&manager, "driver-physical", format).await?;
+        let (repository, _, service) = loaded(&manager, entry.repository_id).await?;
+        let coordinator = repository.staging_coordinator()?;
+        let ready = coordinator
+            .ready_request(driver_request(&repository, 181), mutation_identity()?)
+            .await?;
+        let ticket = coordinator.submit(ready).map_err(|(error, _)| error)?;
+        let (release, wait) = std::sync::mpsc::channel();
+        let release = Release(Some(release));
+        let (entered, running) = oneshot::channel();
+        let (transferred, transfer) = oneshot::channel();
+        let dropped = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let owned = DriverDropped(dropped.clone());
+        ticket.drive(move |ticket, _| async move {
+            let _owned = owned;
+            if !matches!(ticket.wait().await, StagingState::Active(_)) {
+                return Err(StagingError::Context);
+            }
+            let work = ticket.spawn(move |context| async move {
+                let owner = context.physical_owner();
+                Ok(tokio::task::spawn_blocking(move || {
+                    let _owner = owner;
+                    let _ = entered.send(());
+                    let _ = wait.recv();
+                }))
+            })?;
+            let _detached = work
+                .wait()
+                .await
+                .map_err(|error| StagingError::Input(Box::new(error)))?;
+            let _ = transferred.send(());
+            std::future::pending::<std::result::Result<(), StagingError>>().await
+        })?;
+        drop(ticket);
+        timeout(Duration::from_secs(5), running).await??;
+        timeout(Duration::from_secs(5), transfer).await??;
+        let node = server.node.clone();
+        let mut shutdown = tokio::spawn(server.shutdown());
+        timeout(Duration::from_secs(5), async {
+            while !dropped.load(std::sync::atomic::Ordering::Acquire) {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert!(
+            timeout(Duration::from_millis(50), &mut shutdown)
+                .await
+                .is_err()
+        );
+        assert!(!node.is_shutting_down());
+        assert!(!service.coordinator.stats().await.closed);
+        assert_eq!(manager.staging_budget.available(), (31, 63));
+        assert!(
+            crate::server::workspace::Workspace::open(&files.path().join("node"))
+                .is_err_and(|error| error.kind() == std::io::ErrorKind::WouldBlock)
+        );
+        drop(release);
+        timeout(Duration::from_secs(10), shutdown).await???;
+        assert_eq!(manager.staging_budget.available(), (32, 64));
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn production_push_driver_close_preserves_exact_uncertain_begin_and_panic_returns_credit()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for fault in [1, 2, 3] {
+            let (server, _files) = server().await?;
+            let manager = server.repositories.clone();
+            let entry = create(&manager, "driver-exact", format).await?;
+            let (repository, _, service) = loaded(&manager, entry.repository_id).await?;
+            let coordinator = repository.staging_coordinator()?;
+            let ready = coordinator
+                .ready_request(driver_request(&repository, 182), mutation_identity()?)
+                .await?;
+            coordinator.fault_for_test(fault);
+            let ticket = coordinator.submit(ready).map_err(|(error, _)| error)?;
+            let (entered, running) = oneshot::channel();
+            let dropped = Arc::new(std::sync::atomic::AtomicBool::new(false));
+            let owned = DriverDropped(dropped.clone());
+            ticket.drive(move |_, _| async move {
+                let _owned = owned;
+                let _ = entered.send(());
+                std::future::pending::<std::result::Result<(), StagingError>>().await
+            })?;
+            timeout(Duration::from_secs(5), running).await??;
+            assert!(matches!(
+                timeout(Duration::from_secs(10), ticket.wait_terminal()).await?,
+                StagingState::Uncertain(_)
+            ));
+            let original = ticket
+                .custody_evidence_for_test()
+                .ok_or("original missing")?;
+            // Both drains await the same workflow join, without taking its
+            // handle away from another observer or returning its quota early.
+            let (first, second) = timeout(Duration::from_secs(5), async {
+                tokio::join!(coordinator.close_and_drain(), coordinator.close_and_drain())
+            })
+            .await?;
+            assert_eq!((first.len(), second.len()), (1, 1));
+            assert!(dropped.load(std::sync::atomic::Ordering::Acquire));
+            assert_eq!(ticket.custody_evidence_for_test(), Some(original));
+            assert_eq!(manager.staging_budget.available(), (31, 64));
+            assert!(!service.coordinator.stats().await.closed);
+            timeout(Duration::from_secs(10), server.shutdown()).await??;
+            assert_eq!(manager.staging_budget.available(), (32, 64));
+        }
+        let (server, _files) = server().await?;
+        let manager = server.repositories.clone();
+        let entry = create(&manager, "driver-panic", format).await?;
+        let (repository, _, _) = loaded(&manager, entry.repository_id).await?;
+        let coordinator = repository.staging_coordinator()?;
+        let ready = coordinator
+            .ready_request(driver_request(&repository, 183), mutation_identity()?)
+            .await?;
+        let ticket = coordinator.submit(ready).map_err(|(error, _)| error)?;
+        active(&ticket).await?;
+        ticket.drive(|_, _| async { panic!("owned workflow panic") })?;
+        timeout(Duration::from_secs(5), async {
+            while coordinator.stats().admitted != 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert!(matches!(ticket.state(), StagingState::Stopped));
+        assert_eq!(manager.staging_budget.available(), (32, 64));
+        timeout(Duration::from_secs(10), server.shutdown()).await??;
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn production_staging_blocks_eviction_and_shutdown_until_detached_physical_worker_drains()
 -> Result {
diff --git a/crates/canopy-server/tests/directory_cell/main.rs b/crates/canopy-server/tests/directory_cell/main.rs
index 009e7adf..9f029af8 100644
--- a/crates/canopy-server/tests/directory_cell/main.rs
+++ b/crates/canopy-server/tests/directory_cell/main.rs
@@ -2,8 +2,6 @@ mod accounts;
 mod capacity;
 mod compatibility;
 mod expiry;
-#[path = "../support/objects.rs"]
-mod objects;
 #[path = "../support/retained_directory.rs"]
 mod retained_directory;
 mod ssh_keys;
@@ -15,12 +13,12 @@ use std::{
 };
 
 use canopy_server::{
-    CanopyApplication, ObjectKind, RepositoryCell, RepositoryModule, build_descriptor,
+    CanopyApplication, RepositoryCell, RepositoryModule, build_descriptor,
     directory::{
         self, CreateAccountOutcome, DirectoryCell, DirectoryModule, RenameOutcome, RepositoryState,
         TokenScope,
     },
-    object_id, repository_target,
+    repository_target,
 };
 use cellule_app::{ApplicationHandle, CellApplication};
 use cellule_ltx::{CellReplica, DiskBudget, Host, Limits};
@@ -283,20 +281,24 @@ async fn directory_reservations_recover_two_distinct_repository_cells()
             .output,
         renamed
     );
-    let body = b"stored only in alpha";
-    let oid = objects::put(&first_repository, identity(6)?, ObjectKind::Blob, body)
-        .await?
-        .output;
+    // Directory candidates identify Cells but do not share their permissions.
+    // Exercise authoritative repository metadata here; packed object publication
+    // has its own native receive and cold-restore qualification.
+    let grant_identity = identity(6)?;
+    let grant = first_repository
+        .grant_member(grant_identity, "alice", "bob", TokenScope::Write)
+        .await?;
+    assert!(grant.output);
     assert_eq!(
-        oid,
-        object_id(canopy_server::ObjectFormat::Sha1, ObjectKind::Blob, body)
-    );
-    assert!(
-        second_repository
-            .existing_objects(&[oid])
+        first_repository
+            .access_level("bob", Some(grant.receipt))
             .await?
-            .output
-            .is_empty()
+            .output,
+        Some(TokenScope::Write)
+    );
+    assert_eq!(
+        second_repository.access_level("bob", None).await?.output,
+        None
     );
     first_runtime.shutdown().await?;
 
@@ -384,12 +386,33 @@ async fn directory_reservations_recover_two_distinct_repository_cells()
         second_id,
         canopy_server::ObjectFormat::Sha1,
     )?;
+    assert!(alpha.identity_matches("alice", None).await?.output);
+    assert!(beta.identity_matches("alice", None).await?.output);
+    assert_eq!(
+        alpha.access_level("bob", Some(grant.receipt)).await?.output,
+        Some(TokenScope::Write)
+    );
+    assert_eq!(beta.access_level("bob", None).await?.output, None);
+    let replayed = alpha
+        .grant_member(grant_identity, "alice", "bob", TokenScope::Write)
+        .await?;
+    assert_eq!(replayed.receipt, grant.receipt);
+    assert!(replayed.output);
+    // The same logical request ID is scoped to its Cell even after restoration.
+    let beta_grant = beta
+        .grant_member(grant_identity, "alice", "bob", TokenScope::Read)
+        .await?;
+    assert!(beta_grant.output);
+    assert_eq!(
+        beta.access_level("bob", Some(beta_grant.receipt))
+            .await?
+            .output,
+        Some(TokenScope::Read)
+    );
     assert_eq!(
-        alpha.object(oid, None).await?.output,
-        Some((ObjectKind::Blob, body.to_vec()))
+        alpha.access_level("bob", None).await?.output,
+        Some(TokenScope::Write)
     );
-    assert!(beta.existing_objects(&[oid]).await?.output.is_empty());
-    assert_eq!(alpha.access_level("bob", None).await?.output, None);
     second_runtime.shutdown().await?;
     Ok(())
 }
diff --git a/docs/evidence/push-workflow-ci-20261004.json b/docs/evidence/push-workflow-ci-20261004.json
new file mode 100644
index 00000000..6c4b074e
--- /dev/null
+++ b/docs/evidence/push-workflow-ci-20261004.json
@@ -0,0 +1,1909 @@
+{
+  "date": "2026-10-04 America/Vancouver",
+  "base_head": "bd8d819315f0e438d9b857a481dfcd294ddd0bd9",
+  "goal_status": "active",
+  "release_qualified": false,
+  "source": {
+    "files": 493,
+    "rust_files": 479,
+    "digest": "1d3f47aa052dcc8cef1f59aac6d6c8e466165a9f1e013dfffd656daf14b50f37",
+    "algorithm": "SHA256 of JSON sort_keys=true path-to-SHA256 mapping of tracked and nonignored untracked rs/sql/toml/Cargo.lock files",
+    "manifest": "/tmp/canopy-ci-driver-renewal-source-hashes.json"
+  },
+  "validation": {
+    "source_files": 493,
+    "rust_files": 479,
+    "source_hash_digest": "1d3f47aa052dcc8cef1f59aac6d6c8e466165a9f1e013dfffd656daf14b50f37",
+    "release_qualified": false,
+    "execution_complete": true,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 50.962,
+        "log": "/tmp/canopy-ci-driver-renewal-clippy-final.log",
+        "log_sha256": "cf55fabaa3448490b93baad25aea0f932e5a604d82c820010d5f690a3c2390fa",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "server::residency::tests::staging::",
+          "shared_staging_",
+          "cold_staging_keeps_all_original_receipts_after_sdk_expiry_and_actual_owner_restore",
+          "closed_producer_renews_during_long_construction_and_returned_workspace_lifetime",
+          "closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clone_drops",
+          "packs::publication::tests::custody::",
+          "packs::sources::tests::changes::",
+          "reachability_stops_at_live_refs_without_scanning_other_history",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "seconds": 307.121,
+        "log": "/tmp/canopy-ci-driver-renewal-focused-final.log",
+        "log_sha256": "8f9331a75b00215c6f1f3a44823e692c1444fb6c590ca88c0617343473fcf6e2",
+        "summaries": [
+          [
+            31,
+            0,
+            0,
+            0,
+            676
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "libraries",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--lib",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 0,
+        "seconds": 334.677,
+        "log": "/tmp/canopy-ci-driver-renewal-libraries-final.log",
+        "log_sha256": "cc999e7f5313acf9b45926963450ee3e77a2d900382ee7f84a5bee11cd081014",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            15,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            706
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            706
+          ],
+          [
+            707,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "read_integration",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "directory_cell",
+          "--test",
+          "git_http",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 0,
+        "seconds": 12.26,
+        "log": "/tmp/canopy-ci-driver-renewal-read_integration-final.log",
+        "log_sha256": "0b4e671c32b93eb2ccf545acc7f73b446afa985830bc28f39670da5fb52194ea",
+        "summaries": [
+          [
+            13,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "binary",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--bin",
+          "canopy",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 0.78,
+        "log": "/tmp/canopy-ci-driver-renewal-binary-final.log",
+        "log_sha256": "edce003cec44c858eb11ba1c9ba5f5d58d5c0f1c4d5afddc909866aa7b25c6ed",
+        "summaries": [
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 0.311,
+        "log": "/tmp/canopy-ci-driver-renewal-build-final.log",
+        "log_sha256": "f2066ca264b9a8598ecd436c70919e1efe1acea4098ad2a13b5d82d67bc049ec",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.565,
+        "log": "/tmp/canopy-ci-driver-renewal-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.075,
+        "log": "/tmp/canopy-ci-driver-renewal-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 41.185,
+        "log": "/tmp/canopy-ci-driver-renewal-harness-final.log",
+        "log_sha256": "855582c553c0344e2740f28f2facec35bd81a974c52c5d0006ba9af661e1c5c4",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ]
+  },
+  "final_source_case_inventory": {
+    "case_counts": {
+      "canopy_git_format": {
+        "passed": 6,
+        "failed": 0,
+        "ignored": 0,
+        "publication_passed": 0
+      },
+      "canopy_object_storage": {
+        "passed": 15,
+        "failed": 0,
+        "ignored": 0,
+        "publication_passed": 0
+      },
+      "canopy_server": {
+        "passed": 707,
+        "failed": 0,
+        "ignored": 0,
+        "publication_passed": 403
+      },
+      "directory_cell": {
+        "passed": 13,
+        "failed": 0,
+        "ignored": 0,
+        "publication_passed": 0
+      },
+      "git_http": {
+        "passed": 2,
+        "failed": 0,
+        "ignored": 0,
+        "publication_passed": 0
+      },
+      "canopy": {
+        "passed": 2,
+        "failed": 0,
+        "ignored": 0,
+        "publication_passed": 0
+      }
+    },
+    "unique_executed": 745,
+    "unique_passed": 745,
+    "unique_failed": 0,
+    "failed_cases": []
+  },
+  "full_workspace_before_renewal_diagnostics": {
+    "validation": {
+      "source_files": 493,
+      "rust_files": 479,
+      "source_hash_digest": "d34dcdd214989f6407a75c1e2a3761c59e4357d370c77cb9ee6ba05a1e46e980",
+      "release_qualified": false,
+      "execution_complete": true,
+      "phases": [
+        {
+          "label": "clippy",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "clippy",
+            "--workspace",
+            "--all-targets",
+            "--locked",
+            "--",
+            "-D",
+            "warnings"
+          ],
+          "exit_code": 0,
+          "seconds": 45.222,
+          "log": "/tmp/canopy-ci-driver-expiry-clippy-final.log",
+          "log_sha256": "3d43e631c2091fb07b3f611450617052dd92cfdbb6ad56b490e8358ca84030b9",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "label": "focused",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "test",
+            "-p",
+            "canopy-server",
+            "--lib",
+            "--locked",
+            "--",
+            "server::residency::tests::staging::",
+            "shared_staging_",
+            "cold_staging_keeps_all_original_receipts_after_sdk_expiry_and_actual_owner_restore",
+            "--test-threads=4"
+          ],
+          "exit_code": 0,
+          "seconds": 250.971,
+          "log": "/tmp/canopy-ci-driver-expiry-focused-final.log",
+          "log_sha256": "8c876b206a051000482fe406940480eaffa0f5f1cdb0e3ca8a1e6b58df9fc2c8",
+          "summaries": [
+            [
+              10,
+              0,
+              0,
+              0,
+              697
+            ]
+          ],
+          "failed_cases": []
+        },
+        {
+          "label": "workspace",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "test",
+            "--workspace",
+            "--locked",
+            "--no-fail-fast"
+          ],
+          "exit_code": 101,
+          "seconds": 701.724,
+          "log": "/tmp/canopy-ci-driver-expiry-workspace-final.log",
+          "log_sha256": "14c9b7efe248564a11539bf94eb8dc95601efe4ab7c9245be3a7b820d2f50f0b",
+          "summaries": [
+            [
+              6,
+              0,
+              0,
+              0,
+              0
+            ],
+            [
+              15,
+              0,
+              0,
+              0,
+              0
+            ],
+            [
+              1,
+              0,
+              0,
+              0,
+              706
+            ],
+            [
+              1,
+              0,
+              0,
+              0,
+              706
+            ],
+            [
+              706,
+              1,
+              0,
+              0,
+              0
+            ],
+            [
+              2,
+              0,
+              0,
+              0,
+              0
+            ],
+            [
+              13,
+              0,
+              0,
+              0,
+              0
+            ],
+            [
+              2,
+              0,
+              0,
+              0,
+              0
+            ],
+            [
+              46,
+              60,
+              9,
+              0,
+              0
+            ],
+            [
+              0,
+              1,
+              0,
+              0,
+              0
+            ],
+            [
+              0,
+              1,
+              0,
+              0,
+              0
+            ],
+            [
+              0,
+              1,
+              0,
+              0,
+              0
+            ],
+            [
+              0,
+              0,
+              0,
+              0,
+              0
+            ],
+            [
+              0,
+              0,
+              0,
+              0,
+              0
+            ],
+            [
+              0,
+              0,
+              0,
+              0,
+              0
+            ]
+          ],
+          "failed_cases": [
+            "packs::publication::tests::serving::workspace::closed_producer_renews_during_long_construction_and_returned_workspace_lifetime",
+            "bulk_refs::bulk_mirror_publication_is_atomic_and_survives_restart",
+            "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+            "accounts::disabled_account_loses_all_credentials_and_stays_disabled_after_restore",
+            "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+            "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+            "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+            "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+            "compatibility::stock_git_history_refs_and_shallow_fetch_survive_fresh_disk_restore",
+            "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+            "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+            "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+            "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+            "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+            "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+            "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+            "deployment::maintenance_drains_two_nodes_and_fences_startup_until_exact_resume",
+            "browse::browser_reads_exact_git_snapshots_with_pages_modes_and_recovery",
+            "lfs_locks::stock_lfs_locks_block_conflicting_pushes_and_unlock_allows_retry",
+            "large_objects::large_tree_commit_and_tag_restore_from_sqlite_after_owner_restart",
+            "leased_server_recovers_two_repositories_with_git_and_lfs",
+            "merge::merge_rechecks_revisions_authority_and_competing_publications",
+            "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+            "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+            "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+            "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+            "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+            "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+            "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+            "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+            "push_options::signed_push_binds_registered_key_and_preserves_audit_after_restore",
+            "residency::faults::admission::cold_admission_stays_bounded_after_clients_disconnect",
+            "residency::faults::admission::one_accounts_cold_requests_leave_capacity_for_another_account",
+            "residency::faults::cancelled_cold_activation_retains_its_reserved_slot",
+            "residency::faults::denied_release_retains_local_state_and_recovers_after_node_restart",
+            "residency::faults::disconnected_admission_finishes_release_and_allows_a_later_restore",
+            "residency::faults::failed_local_cleanup_retries_before_restoring_the_released_repository",
+            "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+            "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+            "residency::faults::lost_release_reply_is_resolved_before_local_cleanup",
+            "residency::faults::paused_cold_activation_keeps_other_warm_repositories_available",
+            "residency::faults::paused_cold_repository_does_not_serialize_other_cold_activations",
+            "residency::faults::paused_release_keeps_other_warm_repositories_available",
+            "sha256::sha256_checks_reviews_and_merge_survive_restore",
+            "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+            "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+            "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+            "sha256::sha256_repository_push_clone_fetch_and_restore",
+            "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+            "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+            "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+            "ssh::publication::cold_ssh_push_preparation_failure_reports_rejection_before_any_refs_change",
+            "ssh::publication::disconnected_ssh_push_finishes_publication_before_shutdown_releases_cells",
+            "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+            "ssh::sha256_ssh_push_and_clone",
+            "ssh::signed_sha256_ssh_push_survives_fresh_disk_restore",
+            "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+            "ssh::lfs::stock_lfs_uses_ssh_identity_for_push_pull_and_locks_after_restore",
+            "tokens::token_rotation_revocation_and_last_admin_survive_owner_restore",
+            "ssh::stock_ssh_clone_push_fetch_filters_and_revocation_survive_disk_loss",
+            "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+            "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+            "repository_cell_publishes_objects_and_refs_atomically",
+            "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+          ]
+        },
+        {
+          "label": "binary",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "test",
+            "-p",
+            "canopy-server",
+            "--bin",
+            "canopy",
+            "--locked"
+          ],
+          "exit_code": 0,
+          "seconds": 0.742,
+          "log": "/tmp/canopy-ci-driver-expiry-binary-final.log",
+          "log_sha256": "600ea71c8e4db447e31be9ba7e603a51bf12dbfd83d024ae3db30f2d3b7ae862",
+          "summaries": [
+            [
+              2,
+              0,
+              0,
+              0,
+              0
+            ]
+          ],
+          "failed_cases": []
+        },
+        {
+          "label": "build",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "build",
+            "--locked",
+            "--bin",
+            "canopy"
+          ],
+          "exit_code": 0,
+          "seconds": 0.343,
+          "log": "/tmp/canopy-ci-driver-expiry-build-final.log",
+          "log_sha256": "f591e097f22f91dd5c31fbbf7e587d80c0a4e0ed594f9c9012a544f38c52d926",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "label": "fmt",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "fmt",
+            "--all",
+            "--",
+            "--check"
+          ],
+          "exit_code": 0,
+          "seconds": 1.462,
+          "log": "/tmp/canopy-ci-driver-expiry-fmt-final.log",
+          "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "label": "diff",
+          "command": [
+            "git",
+            "diff",
+            "--check"
+          ],
+          "exit_code": 0,
+          "seconds": 0.063,
+          "log": "/tmp/canopy-ci-driver-expiry-diff-final.log",
+          "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "label": "harness",
+          "command": [
+            "python3",
+            "-B",
+            "-m",
+            "unittest",
+            "discover",
+            "-s",
+            "scripts",
+            "-p",
+            "test_*.py"
+          ],
+          "exit_code": 0,
+          "seconds": 42.194,
+          "log": "/tmp/canopy-ci-driver-expiry-harness-final.log",
+          "log_sha256": "9528b23766928ed852ecae4239f27fecdf4471656195757c969233ec23aec079",
+          "summaries": [],
+          "failed_cases": []
+        }
+      ]
+    },
+    "inventory": {
+      "case_counts": {
+        "canopy_git_format": {
+          "passed": 6,
+          "failed": 0,
+          "ignored": 0,
+          "publication_passed": 0
+        },
+        "canopy_object_storage": {
+          "passed": 15,
+          "failed": 0,
+          "ignored": 0,
+          "publication_passed": 0
+        },
+        "canopy_server": {
+          "passed": 706,
+          "failed": 1,
+          "ignored": 0,
+          "publication_passed": 402
+        },
+        "canopy": {
+          "passed": 2,
+          "failed": 0,
+          "ignored": 0,
+          "publication_passed": 0
+        },
+        "directory_cell": {
+          "passed": 13,
+          "failed": 0,
+          "ignored": 0,
+          "publication_passed": 0
+        },
+        "git_http": {
+          "passed": 2,
+          "failed": 0,
+          "ignored": 0,
+          "publication_passed": 0
+        },
+        "multi_server": {
+          "passed": 46,
+          "failed": 60,
+          "ignored": 9,
+          "publication_passed": 0
+        },
+        "owner_restart": {
+          "passed": 0,
+          "failed": 1,
+          "ignored": 0,
+          "publication_passed": 0
+        },
+        "repository_cell": {
+          "passed": 0,
+          "failed": 1,
+          "ignored": 0,
+          "publication_passed": 0
+        },
+        "smart_http": {
+          "passed": 0,
+          "failed": 1,
+          "ignored": 0,
+          "publication_passed": 0
+        }
+      },
+      "unique_executed": 854,
+      "unique_passed": 790,
+      "unique_failed": 64,
+      "failed_cases": [
+        {
+          "runner": "canopy_server",
+          "case": "packs::publication::tests::serving::workspace::closed_producer_renews_during_long_construction_and_returned_workspace_lifetime"
+        },
+        {
+          "runner": "multi_server",
+          "case": "bulk_refs::bulk_mirror_publication_is_atomic_and_survives_restart"
+        },
+        {
+          "runner": "multi_server",
+          "case": "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery"
+        },
+        {
+          "runner": "multi_server",
+          "case": "accounts::disabled_account_loses_all_credentials_and_stays_disabled_after_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "candidates::candidate_native_graph_and_paths_preserve_git_semantics"
+        },
+        {
+          "runner": "multi_server",
+          "case": "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge"
+        },
+        {
+          "runner": "multi_server",
+          "case": "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery"
+        },
+        {
+          "runner": "multi_server",
+          "case": "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery"
+        },
+        {
+          "runner": "multi_server",
+          "case": "compatibility::stock_git_history_refs_and_shallow_fetch_survive_fresh_disk_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "comparison::comparison_rejects_oversized_change_sets_without_partial_results"
+        },
+        {
+          "runner": "multi_server",
+          "case": "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access"
+        },
+        {
+          "runner": "multi_server",
+          "case": "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation"
+        },
+        {
+          "runner": "multi_server",
+          "case": "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries"
+        },
+        {
+          "runner": "multi_server",
+          "case": "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge"
+        },
+        {
+          "runner": "multi_server",
+          "case": "backup::backup_restores_git_lfs_and_collaboration_without_original_storage"
+        },
+        {
+          "runner": "multi_server",
+          "case": "deployment::maintenance_drains_two_nodes_and_fences_startup_until_exact_resume"
+        },
+        {
+          "runner": "multi_server",
+          "case": "browse::browser_reads_exact_git_snapshots_with_pages_modes_and_recovery"
+        },
+        {
+          "runner": "multi_server",
+          "case": "lfs_locks::stock_lfs_locks_block_conflicting_pushes_and_unlock_allows_retry"
+        },
+        {
+          "runner": "multi_server",
+          "case": "large_objects::large_tree_commit_and_tag_restore_from_sqlite_after_owner_restart"
+        },
+        {
+          "runner": "multi_server",
+          "case": "leased_server_recovers_two_repositories_with_git_and_lfs"
+        },
+        {
+          "runner": "multi_server",
+          "case": "merge::merge_rechecks_revisions_authority_and_competing_publications"
+        },
+        {
+          "runner": "multi_server",
+          "case": "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery"
+        },
+        {
+          "runner": "multi_server",
+          "case": "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history"
+        },
+        {
+          "runner": "multi_server",
+          "case": "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs"
+        },
+        {
+          "runner": "multi_server",
+          "case": "push_options::mismatched_signed_push_options_return_a_durable_git_rejection"
+        },
+        {
+          "runner": "multi_server",
+          "case": "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes"
+        },
+        {
+          "runner": "multi_server",
+          "case": "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery"
+        },
+        {
+          "runner": "multi_server",
+          "case": "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory"
+        },
+        {
+          "runner": "multi_server",
+          "case": "push_options::stock_git_push_options_are_validated_recorded_and_recovered"
+        },
+        {
+          "runner": "multi_server",
+          "case": "push_options::signed_push_binds_registered_key_and_preserves_audit_after_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::admission::cold_admission_stays_bounded_after_clients_disconnect"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::admission::one_accounts_cold_requests_leave_capacity_for_another_account"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::cancelled_cold_activation_retains_its_reserved_slot"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::denied_release_retains_local_state_and_recovers_after_node_restart"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::disconnected_admission_finishes_release_and_allows_a_later_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::failed_local_cleanup_retries_before_restoring_the_released_repository"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::lost_release_reply_is_resolved_before_local_cleanup"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::paused_cold_activation_keeps_other_warm_repositories_available"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::paused_cold_repository_does_not_serialize_other_cold_activations"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::faults::paused_release_keeps_other_warm_repositories_available"
+        },
+        {
+          "runner": "multi_server",
+          "case": "sha256::sha256_checks_reviews_and_merge_survive_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories"
+        },
+        {
+          "runner": "multi_server",
+          "case": "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node"
+        },
+        {
+          "runner": "multi_server",
+          "case": "sha256::sha256_native_merge_candidates_survive_restore_and_publish"
+        },
+        {
+          "runner": "multi_server",
+          "case": "sha256::sha256_repository_push_clone_fetch_and_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::publication::cold_ssh_push_preparation_failure_reports_rejection_before_any_refs_change"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::publication::disconnected_ssh_push_finishes_publication_before_shutdown_releases_cells"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::sha256_ssh_push_and_clone"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::signed_sha256_ssh_push_survives_fresh_disk_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::ssh_push_options_cover_pack_and_delete_only_requests"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::lfs::stock_lfs_uses_ssh_identity_for_push_pull_and_locks_after_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "tokens::token_rotation_revocation_and_last_admin_survive_owner_restore"
+        },
+        {
+          "runner": "multi_server",
+          "case": "ssh::stock_ssh_clone_push_fetch_filters_and_revocation_survive_disk_loss"
+        },
+        {
+          "runner": "multi_server",
+          "case": "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+        },
+        {
+          "runner": "owner_restart",
+          "case": "a_second_node_clones_from_the_published_root_after_local_disk_loss"
+        },
+        {
+          "runner": "repository_cell",
+          "case": "repository_cell_publishes_objects_and_refs_atomically"
+        },
+        {
+          "runner": "smart_http",
+          "case": "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        }
+      ]
+    },
+    "final_source_qualification": false
+  },
+  "before_expiry_repair": {
+    "source_files": 493,
+    "rust_files": 479,
+    "source_hash_digest": "6dfcc1f677c343d8c0a12eec3d310ee516325ec85c8134303c3f02283dc60ec6",
+    "release_qualified": false,
+    "execution_complete": true,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 49.618,
+        "log": "/tmp/canopy-ci-driver-before-expiry-clock/canopy-ci-driver-clippy-final.log",
+        "log_sha256": "52c732cbda6a7a90a3a9316cd03889363259ce40605a947219f7f6a48cff71f7",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "server::residency::tests::staging::",
+          "shared_staging_",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "seconds": 113.091,
+        "log": "/tmp/canopy-ci-driver-before-expiry-clock/canopy-ci-driver-focused-final.log",
+        "log_sha256": "45761900523b66acc11ba9c200a546d58f3ce53cc8bb488a4d9a362955d9a492",
+        "summaries": [
+          [
+            9,
+            0,
+            0,
+            0,
+            698
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 673.119,
+        "log": "/tmp/canopy-ci-driver-before-expiry-clock/canopy-ci-driver-workspace-final.log",
+        "log_sha256": "bf5e1a13fdcc50c6329ac1969480ef92bd113d77727e753ae659015bb41ccb46",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            15,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            706
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            706
+          ],
+          [
+            706,
+            1,
+            0,
+            0,
+            0
+          ],
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            13,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            46,
+            60,
+            9,
+            0,
+            0
+          ],
+          [
+            0,
+            1,
+            0,
+            0,
+            0
+          ],
+          [
+            0,
+            1,
+            0,
+            0,
+            0
+          ],
+          [
+            0,
+            1,
+            0,
+            0,
+            0
+          ],
+          [
+            0,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            0,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            0,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": [
+          "packs::publication::tests::staging_service::restore::cold_staging_keeps_all_original_receipts_after_sdk_expiry_and_actual_owner_restore",
+          "bulk_refs::bulk_mirror_publication_is_atomic_and_survives_restart",
+          "accounts::disabled_account_loses_all_credentials_and_stays_disabled_after_restore",
+          "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+          "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+          "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+          "compatibility::stock_git_history_refs_and_shallow_fetch_survive_fresh_disk_restore",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "browse::browser_reads_exact_git_snapshots_with_pages_modes_and_recovery",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "deployment::maintenance_drains_two_nodes_and_fences_startup_until_exact_resume",
+          "lfs_locks::stock_lfs_locks_block_conflicting_pushes_and_unlock_allows_retry",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "large_objects::large_tree_commit_and_tag_restore_from_sqlite_after_owner_restart",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+          "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+          "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+          "push_options::signed_push_binds_registered_key_and_preserves_audit_after_restore",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "residency::faults::admission::cold_admission_stays_bounded_after_clients_disconnect",
+          "residency::faults::admission::one_accounts_cold_requests_leave_capacity_for_another_account",
+          "residency::faults::cancelled_cold_activation_retains_its_reserved_slot",
+          "residency::faults::denied_release_retains_local_state_and_recovers_after_node_restart",
+          "residency::faults::disconnected_admission_finishes_release_and_allows_a_later_restore",
+          "residency::faults::failed_local_cleanup_retries_before_restoring_the_released_repository",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "residency::faults::lost_release_reply_is_resolved_before_local_cleanup",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::paused_cold_repository_does_not_serialize_other_cold_activations",
+          "residency::faults::paused_release_keeps_other_warm_repositories_available",
+          "residency::faults::paused_cold_activation_keeps_other_warm_repositories_available",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "sha256::sha256_repository_push_clone_fetch_and_restore",
+          "ssh::publication::cold_ssh_push_preparation_failure_reports_rejection_before_any_refs_change",
+          "ssh::publication::disconnected_ssh_push_finishes_publication_before_shutdown_releases_cells",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "ssh::sha256_ssh_push_and_clone",
+          "ssh::lfs::stock_lfs_uses_ssh_identity_for_push_pull_and_locks_after_restore",
+          "ssh::signed_sha256_ssh_push_survives_fresh_disk_restore",
+          "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+          "tokens::token_rotation_revocation_and_last_admin_survive_owner_restore",
+          "ssh::stock_ssh_clone_push_fetch_filters_and_revocation_survive_disk_loss",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "label": "binary",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--bin",
+          "canopy",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 0.798,
+        "log": "/tmp/canopy-ci-driver-before-expiry-clock/canopy-ci-driver-binary-final.log",
+        "log_sha256": "edce003cec44c858eb11ba1c9ba5f5d58d5c0f1c4d5afddc909866aa7b25c6ed",
+        "summaries": [
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 53.553,
+        "log": "/tmp/canopy-ci-driver-before-expiry-clock/canopy-ci-driver-build-final.log",
+        "log_sha256": "881a218543f81532c3c8a4f6011bc86c2889ad9c48345756f46f7341845f6a7f",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.434,
+        "log": "/tmp/canopy-ci-driver-before-expiry-clock/canopy-ci-driver-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.086,
+        "log": "/tmp/canopy-ci-driver-before-expiry-clock/canopy-ci-driver-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 47.892,
+        "log": "/tmp/canopy-ci-driver-before-expiry-clock/canopy-ci-driver-harness-final.log",
+        "log_sha256": "70e4a93b039360334cbef4c050b3dcd3d882bf08f4f2886d61753733fa0fd3ac",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ]
+  },
+  "before_shared_clock_and_accepted_denial_windows": {
+    "source_files": 493,
+    "rust_files": 479,
+    "source_hash_digest": "d05adfe14c1bafba443cb20669b75b63b581019d133d96c04e2102600ded67b7",
+    "release_qualified": false,
+    "execution_complete": true,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 42.159,
+        "log": "/tmp/canopy-ci-driver-final-clippy-final.log",
+        "log_sha256": "7750d4d8317880d577fd051623bbad968e897468333cadd66fb4b9127c4526fd",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "server::residency::tests::staging::",
+          "shared_staging_",
+          "cold_staging_keeps_all_original_receipts_after_sdk_expiry_and_actual_owner_restore",
+          "closed_producer_renews_during_long_construction_and_returned_workspace_lifetime",
+          "object_reads::tests::",
+          "reachability_stops_at_live_refs_without_scanning_other_history",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "seconds": 268.339,
+        "log": "/tmp/canopy-ci-driver-final-focused-final.log",
+        "log_sha256": "35ee411d8b5ef3e557060e2399b91eb5175649e41aa7b6359b828b74027e6178",
+        "summaries": [
+          [
+            12,
+            0,
+            0,
+            0,
+            695
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "libraries",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--lib",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 383.954,
+        "log": "/tmp/canopy-ci-driver-final-libraries-final.log",
+        "log_sha256": "90a98aed4e0ce433f84b1fae681ab1b6bcfc2c4bc6ac17fe938e4c081089b77e",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            15,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            706
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            706
+          ],
+          [
+            706,
+            1,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": [
+          "packs::publication::tests::custody::denied_begin_is_original_knowledge_after_sdk_expiry_and_authority_changes"
+        ]
+      },
+      {
+        "label": "read_integration",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "directory_cell",
+          "--test",
+          "git_http",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 0,
+        "seconds": 10.454,
+        "log": "/tmp/canopy-ci-driver-final-read_integration-final.log",
+        "log_sha256": "f02f066ca8799c5f385827774ad70aadb2fd265ad83c78b60a01198b2b290f72",
+        "summaries": [
+          [
+            13,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "binary",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--bin",
+          "canopy",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 1.516,
+        "log": "/tmp/canopy-ci-driver-final-binary-final.log",
+        "log_sha256": "f167dd7dcf179604c65e33e0f831317e7d9c46f8b8c685cc2a0725442e0abb38",
+        "summaries": [
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 0.371,
+        "log": "/tmp/canopy-ci-driver-final-build-final.log",
+        "log_sha256": "8a2933ae25e59188be988ea6218274cb341f13d8bc4b533f57b12ececd4be8b3",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.454,
+        "log": "/tmp/canopy-ci-driver-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.077,
+        "log": "/tmp/canopy-ci-driver-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 42.406,
+        "log": "/tmp/canopy-ci-driver-final-harness-final.log",
+        "log_sha256": "b979edbb903488f026dea0d71e1c910237c8d6b36a80c9b79dcf29aed8ba9221",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ]
+  },
+  "before_renewal_profiles": {
+    "source_files": 493,
+    "rust_files": 479,
+    "source_hash_digest": "8962d75ad2899f66b23f62e1ed9607fc932704dc6cf8a7001d738e57e50702e4",
+    "release_qualified": false,
+    "execution_complete": true,
+    "phases": [
+      {
+        "label": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 50.418,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-clippy-final.log",
+        "log_sha256": "12b99542b944cc9fe99cb9fff248cbfb8553a5f05c65f364cf042a5331620a9f",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked",
+          "--",
+          "server::residency::tests::staging::",
+          "shared_staging_",
+          "cold_staging_keeps_all_original_receipts_after_sdk_expiry_and_actual_owner_restore",
+          "closed_producer_renews_during_long_construction_and_returned_workspace_lifetime",
+          "packs::publication::tests::custody::",
+          "packs::sources::tests::changes::",
+          "reachability_stops_at_live_refs_without_scanning_other_history",
+          "--test-threads=4"
+        ],
+        "exit_code": 0,
+        "seconds": 283.371,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-focused-final.log",
+        "log_sha256": "e780c4bf9fc1e9f1655e42693b29e86a46bd6bb9fbc4cf673f3e444cb8488ebb",
+        "summaries": [
+          [
+            30,
+            0,
+            0,
+            0,
+            677
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "libraries",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--lib",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 365.122,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-libraries-final.log",
+        "log_sha256": "7187e3581964a5dddc8a244d3f39c87cda3c4e3a9936d3a2e5956150dbf76c70",
+        "summaries": [
+          [
+            6,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            15,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            706
+          ],
+          [
+            1,
+            0,
+            0,
+            0,
+            706
+          ],
+          [
+            706,
+            1,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": [
+          "packs::publication::tests::serving::lifecycle::closed_owner_keeps_borrowed_generation_renewing_until_last_snapshot_clone_drops"
+        ]
+      },
+      {
+        "label": "read_integration",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "directory_cell",
+          "--test",
+          "git_http",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 0,
+        "seconds": 7.631,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-read_integration-final.log",
+        "log_sha256": "cf9d9fbcbde66a73deb5001f1dc1204bbbd1bca3e7c165d75ffe32b27683d2bd",
+        "summaries": [
+          [
+            13,
+            0,
+            0,
+            0,
+            0
+          ],
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "binary",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--bin",
+          "canopy",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 0.619,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-binary-final.log",
+        "log_sha256": "15cf2b821d663bfd31fa79d2cb8f5c7bb58693aecc85cde6c899ff24322e49d4",
+        "summaries": [
+          [
+            2,
+            0,
+            0,
+            0,
+            0
+          ]
+        ],
+        "failed_cases": []
+      },
+      {
+        "label": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 0.31,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-build-final.log",
+        "log_sha256": "5604fc8f0c276397a55db4bd7008236712075c0ad37d3b3a0f1fe362b1b85a36",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.422,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.061,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "label": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 42.579,
+        "log": "/tmp/canopy-ci-driver-sdk-clock-harness-final.log",
+        "log_sha256": "b817b0984849c80aa01cbc0115b85631aa1acf0d5bfc9ae5268f0fc5491dad72",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ]
+  },
+  "retained_diagnostics": [
+    {
+      "path": "/tmp/canopy-ci-driver-focused.log",
+      "sha256": "26a99c58671d0e3383228d61bf94a7ae972c028e16d61f1d009ec545e424af82",
+      "final_source_qualification": false
+    },
+    {
+      "path": "/tmp/canopy-ci-driver-focused-repair.log",
+      "sha256": "c353a89aac180817dbe96c041cf56d517e0037c7c3f18f53077f98be112cf10e",
+      "final_source_qualification": false
+    },
+    {
+      "path": "/tmp/canopy-ci-driver-clippy-draft.log",
+      "sha256": "0616323379bedae77d7caf2d3182ecca493b6e97b8ee1f94231db99df8501d8f",
+      "final_source_qualification": false
+    },
+    {
+      "path": "/tmp/canopy-ci-integration-inventory.log",
+      "sha256": "43b2be4b00aaac1684670240b94118bc2842c6f8fb3087229c3e084d9106130e",
+      "final_source_qualification": false
+    },
+    {
+      "path": "/tmp/canopy-ci-directory-domain.log",
+      "sha256": "89699e85afc7f9db48ff430860a64352acb27df5d4215c2c4f1747ae005a3338",
+      "final_source_qualification": false
+    },
+    {
+      "path": "/tmp/canopy-ci-bd8d819-linux-failed.log",
+      "sha256": "d1e930d1de92df14c0d9b3106eb7c9ea46cd0c5e3021886ce15b17782ea77b80",
+      "final_source_qualification": false
+    },
+    {
+      "path": "/tmp/canopy-pr34-reported-rust-failed.log",
+      "sha256": "0d45c1f7145930e379d62f4c82ca68f9b7c4d067f122f2221e5507abb90005e9",
+      "final_source_qualification": false
+    }
+  ],
+  "qualification_limits": [
+    "Production native HTTP/SSH/generated writers remain on retired ingestion/completion. Complete integration and Linux/RustFS CI remain release gates.",
+    "The retired SQL hydration regressions were transferred to native SourceIndex change cursor tests and pinned serving reachability. Final complete library validation includes the replacement native cursor cases.",
+    "Final library/read/binary qualification is distinct from the earlier source-frozen full workspace inventory. That inventory contains 63 integration failures and one unlabelled serving-renewal timeout.",
+    "Two serving-renewal fixtures use five-second test leases and retain borrowers for 7.5 seconds, still crossing the original expiry and requiring multiple real renewals, unchanged pin identity and last-borrower release. Expiration-only cases and production profiles remain unchanged; timeout diagnostics report phase and owner state.",
+    "The pre-controller integration diagnostic lacks a full pre-run manifest; nested child summaries and focused reruns are excluded from unique counts.",
+    "Generic workflow callback cases qualify resident ownership, not actual native network writer publication.",
+    "Portable macOS tests do not qualify Linux-only forks or RustFS/provider behavior.",
+    "No full Linux/Kubernetes/Chromium history or 10000-engineer capacity qualification."
+  ],
+  "reported_ci": {
+    "run": 37232379168,
+    "job": 111524630647,
+    "head": "cc4a963c750d03c22483d6a9f12099a525114385",
+    "state": "FAILURE",
+    "server_library_passed": 670,
+    "server_library_failed": 5,
+    "failure": "retired objects SQL reads"
+  },
+  "previous_ci": [
+    {
+      "run": 37250865851,
+      "job": 111578008697,
+      "head": "bd8d819315f0e438d9b857a481dfcd294ddd0bd9",
+      "state": "FAILURE",
+      "server_library_passed": 704,
+      "directory_passed": 12,
+      "directory_failed": 1
+    },
+    {
+      "run": 37250862165,
+      "job": 111577998825,
+      "head": "bd8d819315f0e438d9b857a481dfcd294ddd0bd9",
+      "state": "FAILURE"
+    }
+  ],
+  "preservation": {
+    "protected_index": "/Users/haipingfu/Github/canopy/.git/worktrees/canopy5/index",
+    "archive": "docs/archive/pr20-progress-through-8bb0ee7.md",
+    "cellule_revision": "161067f5a21703b3e257024bcb64e565fd9657b4",
+    "protected_index_sha256": "bef77b0a83f80518f232060828e83797174b1863b8ed9147bffa65850af59798",
+    "archive_sha256": "c7494d679abed5e1e55a5b2d605d80e786cb4de86406d77f0c7a37c71c79437e"
+  },
+  "next_priorities": [
+    "Wire actual native HTTP/SSH/generated producers through the resident controller and mandatory registered root policy/completion with exact original recovery.",
+    "Complete integration conversion and full Linux/RustFS workflow; investigate any recurrent one-second serving-renewal failure using its phase diagnostics.",
+    "Finish request/policy physical ownership, authenticated old-owner selection, remaining authority/readers, custody rollover/final DDL, GC/backup/isolated restore, containment, fair maintenance/coalesced workspaces, full-history mixed-load capacity and attribution."
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 276b7b59..36d0efd4 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -5,9 +5,11 @@ Updated during implementation on 2026-10-04. **The full implementation and capac
 Packed cutover [PR #34](https://github.com/crabbuild/canopy/pull/34) was merged into
 `main` at `d559e5635e002ee3f885c780a418cf861a5197fc` while its checks still failed.
 The native metadata follow-up is based on that main revision. The original SQL
-hydration failures have been resolved by converting real read/cache callers;
-full CI remains open because a directory integration caller and live writers
-still invoke retired ingestion. The ownership and metadata changes below are
+hydration failures have been resolved by converting real read/cache callers.
+The directory recovery fixture now uses repository-local permission metadata
+to verify separate Cells and replay after restoration. Full CI remains open
+because live writers and other integration callers still invoke retired ingestion.
+The ownership and metadata changes below are
 prerequisites for the write replacement. This cutover is not release qualified.
 Older checkpoint notes describe historical states.
 
@@ -15,6 +17,95 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Whole-workflow ownership and CI repair
+
+The production resident supplies its actual Cell client and publication
+dispatcher to staging. A resident can prepare a request through the existing
+registered custody factory and join an admitted request only when repository,
+actor, operation and request digest match, including before Begin yields a token.
+Closed or paused admission refuses new request preparation.
+
+Each existing staging job can own one workflow controller. Its callback orders
+the staged/bound worker slots, retrieves their private outputs, and then orders
+checkpoint registration, Bind, policy pages and final publication. The controller
+does not consume a physical-worker slot, so its own existence cannot block Bind
+or held publication. Actual physical work must use the existing worker APIs.
+No additional durable queue, schema or operation inventory is introduced.
+
+Dropping a request observer leaves that controller owned by the existing job.
+Stop and shutdown cancel and join its actual callback. Concurrent drains clone
+one shared join rather than taking a handle away from another drain. Final
+publication and fencing join the controller before removing operation credit.
+Native/SQL/provider work detached from a worker retains its existing physical
+activity and still blocks lower serving/publication, Cell, heartbeat and workspace
+release. A callback error or panic stops the workflow without replacing any
+uncertain exact command with a native refusal.
+
+Regression families exercise actual production residents in both object formats:
+observer loss through Bind, duplicate controllers and mismatched join contexts,
+busy eviction, callback cleanup before shutdown, detached physical work through
+shutdown, concurrent drains of uncertain Begin after absent/lost/panicked replies,
+the original command identities and admission credits, and controller panic.
+These qualify controller ownership, not completed HTTP/SSH/generated writer wiring.
+
+The directory recovery test previously entered a removed object-ingestion command.
+It now grants Write in one repository and leaves the other ungranted, restores
+both from durable Cell storage, replays the original grant receipt, and uses the
+same request ID to grant Read in the other Cell without changing the first grant.
+This preserves the directory test's distinct-Cell, permissions and recovery
+contract. Packed object publication and cold object restoration remain covered
+by the native publication qualification; their failures are not skipped.
+
+SDK-expiry fixtures share one helper that rechecks wall-clock milliseconds after
+every Tokio timer wake. The SDK uses wall time for expiry, so a single monotonic
+sleep does not establish that boundary. Prepared identities, deadlines and receipt
+assertions remain unchanged. Accepted-denial fixtures give initial execution ten
+seconds, matching the existing cold acceptance fixtures, and still require real
+SDK expiry before historical recovery. Intentionally unexecuted fixtures retain
+their short window. The full run exposed a Begin denial whose one-second SDK
+identity expired before initial acceptance; its Pending evidence is retained.
+The cold expiry assertion reports the actual resolution, object format, custody
+kind and original deadline. Earlier failed source fingerprints and terminal logs
+remain attributed separately from repaired runs.
+
+Preceding library runs exposed unlabelled timeouts in two serving renewal tests
+using one-second leases. They now use a shared five-second test lease and hold
+actual borrowers for 7.5 seconds, still crossing the original expiry and requiring
+multiple renewals, unchanged pin identity and release after the last borrower.
+Production profiles and expiration-only cases remain unchanged. The waits report
+object format, phase and owner state. Earlier timed-out runs remain failed evidence;
+any recurrent failure must be investigated rather than counted as successful.
+
+The broader pre-controller diagnostic inventory reached previously unrun tests:
+Git backend 2 passed; multi-server 46 passed, 60 failed and 9 ignored; owner restart,
+repository Cell and smart HTTP each failed their one aggregate case. This is not
+final-source qualification. Actual HTTP pushes still call `persist_objects` and
+legacy push completion, encountering removed `objects`/`git_packs` tables or
+unregistered ingestion descriptors. Some standalone fixtures also lack a registered
+resident serving capability. The full workflow remains a release gate.
+
+Final qualification of the repaired source passes 745 unique Rust cases: 728
+library cases (6 Git-format, 15 object-storage and 707 server), 13 directory cases,
+2 Git backend cases and 2 binary cases. All 31 focused ownership, custody, cursor,
+reachability and renewal regressions pass. Clippy with warnings denied, build,
+formatting/diff checks and 96 Python harness cases pass. These results exclude
+focused/binary reruns and nested child summaries from unique counts.
+
+The preceding frozen full workspace run executed 854 unique Rust cases: 790
+passed, 64 failed and 9 were ignored. Its 63 integration failures still require
+production writer/fixture conversion; its additional serving-renewal timeout is
+retained as failed evidence preceding the revised test profile. Final library/read
+qualification is separate from that earlier complete inventory. Linux/RustFS and
+full production integrations are still required before release.
+
+Current qualification and exact source/log fingerprints are recorded in
+[workflow/CI evidence](evidence/push-workflow-ci-20261004.json). The immediately
+required next step is to connect the actual native HTTP/SSH writer to this owned
+controller and mandatory registered root policy/completion, then convert remaining
+integration fixtures and run the complete Linux/RustFS workflow. Request/policy
+physical ownership, adopted old-owner inputs and the remaining large-team design
+requirements are still mandatory; this increment does not establish capacity.
+
 ## Resident staging ownership
 
 The production resident now constructs one `StagingCoordinator` alongside its
@@ -53,7 +144,8 @@ Unexecuted expiry fixtures retain their one-second window.
 
 This increment supplies the resident write lifecycle; live HTTP/SSH/generated
 writers and their integration fixtures still require conversion to it. The full
-CI and release/capacity gates remain open. Final frozen-source qualification passes 725 library cases, including 704
+CI and release/capacity gates remain open. The preceding resident-only increment's
+frozen-source qualification passes 725 library cases, including 704
 server cases and 403 publication cases. All eight focused regressions, Clippy
 with warnings denied, build, formatting/diff checks and 96 Python harness cases
 pass. The workspace command executes 740 unique Rust cases: 739 pass and the

From 64481d15b6d1f210006d137ca481b8b95abcb721 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 21:15:03 -0700
Subject: [PATCH 32/55] Route receive-pack through resident native publication

---
 crates/canopy-server/src/branch_rules/mod.rs  |   9 +-
 crates/canopy-server/src/git_gateway/mod.rs   |  57 +-
 crates/canopy-server/src/git_gateway/push.rs  | 119 +---
 .../src/git_gateway/push/native.rs            | 536 ++++++++++++++++++
 crates/canopy-server/src/git_http/capture.rs  |  48 ++
 crates/canopy-server/src/lib.rs               |   2 +-
 .../src/packs/publication/certificate.rs      |   7 +-
 .../packs/publication/coordinator/policy.rs   |   9 +
 .../src/packs/publication/mod.rs              |   1 +
 .../src/packs/publication/native_result.rs    |   2 +-
 .../src/packs/publication/registry.rs         |   7 +-
 .../packs/publication/root_completion/read.rs |  11 +
 .../src/packs/publication/staging_service.rs  |  71 ++-
 .../publication/staging_service/driver.rs     |  68 ++-
 .../canopy-server/src/packs/sources/native.rs |  19 +
 crates/canopy-server/src/push/certificate.rs  |  88 ---
 crates/canopy-server/src/push/mod.rs          | 517 +----------------
 crates/canopy-server/src/push/plan.rs         | 113 ----
 crates/canopy-server/src/push/report.rs       |  27 +-
 .../src/repository_http/default_branch.rs     |  16 +-
 crates/canopy-server/src/server/lifecycle.rs  |   2 +-
 .../src/server/residency/recovery.rs          |  17 +-
 .../tests/multi_server/compatibility.rs       |   3 +
 .../tests/multi_server/ssh/publication.rs     |  95 +++-
 .../tests/support/paused_blobs.rs             |  16 +-
 docs/design/staging-service-lifecycle.md      |  29 +-
 docs/evidence/native-writer-ci-20261005.json  | 172 ++++++
 .../large-repository-implementation-status.md |  63 +-
 28 files changed, 1204 insertions(+), 920 deletions(-)
 create mode 100644 crates/canopy-server/src/git_gateway/push/native.rs
 delete mode 100644 crates/canopy-server/src/push/plan.rs
 create mode 100644 docs/evidence/native-writer-ci-20261005.json

diff --git a/crates/canopy-server/src/branch_rules/mod.rs b/crates/canopy-server/src/branch_rules/mod.rs
index cc640007..f90692e6 100644
--- a/crates/canopy-server/src/branch_rules/mod.rs
+++ b/crates/canopy-server/src/branch_rules/mod.rs
@@ -179,7 +179,14 @@ impl RepositoryCell {
             .query(
                 None,
                 SqlBatch {
-                    statements: updates.iter().map(policy_statement).collect(),
+                    // Native preparation establishes ancestry in its private
+                    // workspace; final publication supplies catalog-certified
+                    // evidence. Metadata reads must not consult the retired
+                    // mutable commit_ancestry cache.
+                    statements: updates
+                        .iter()
+                        .map(|update| policy_statement_with_ancestry(update, false))
+                        .collect(),
                 },
             )
             .await?;
diff --git a/crates/canopy-server/src/git_gateway/mod.rs b/crates/canopy-server/src/git_gateway/mod.rs
index 600bf224..91348cc5 100644
--- a/crates/canopy-server/src/git_gateway/mod.rs
+++ b/crates/canopy-server/src/git_gateway/mod.rs
@@ -27,7 +27,7 @@ use crate::{
     git_input::{GitInput, InputError, MAX_FETCH_REQUEST_BYTES},
     git_objects::GitObjects,
     lfs::LfsService,
-    push::{PushCompletion, PushError},
+    push::PushError,
 };
 
 mod branch_policy;
@@ -82,17 +82,19 @@ struct CachedRepository {
 }
 
 /// Serves Git requests from a warm, disposable cache of durable Cell state.
+#[derive(Clone)]
 pub struct GitGateway {
     repository: Arc<RepositoryCell>,
     signer_directory: Option<Arc<crate::directory::DirectoryCell>>,
-    certificate_seed: OnceCell<[u8; 32]>,
-    large_blobs: LargeBlobStore,
+    certificate_seed: Arc<OnceCell<[u8; 32]>>,
+    large_blobs: Arc<LargeBlobStore>,
     pack_reader: Arc<crate::pack_store::PackReader>,
-    lfs: LfsService,
+    lfs: Arc<LfsService>,
+    artifacts: Arc<canopy_object_storage::artifact::ArtifactStore>,
     scratch_root: PathBuf,
     disk_budget: DiskBudget,
     native: crate::native_resources::NativeScope,
-    push: Mutex<()>,
+    push: Arc<Mutex<()>>,
 }
 
 impl GitGateway {
@@ -104,7 +106,14 @@ impl GitGateway {
         native: crate::native_resources::NativeResources,
     ) -> Self {
         let native = native.scope(crate::native_resources::NativeClass::Foreground);
-        let large_blobs = LargeBlobStore::new(Arc::clone(&blob_store), repository.repository_id());
+        let large_blobs = Arc::new(LargeBlobStore::new(
+            Arc::clone(&blob_store),
+            repository.repository_id(),
+        ));
+        let artifacts = Arc::new(canopy_object_storage::artifact::ArtifactStore::new(
+            Arc::clone(&blob_store),
+            repository.repository_id(),
+        ));
         // A reader belongs to this gateway's workspace and disk admission.
         // Another gateway may use a different root/budget for the same Cell.
         let pack_reader = Arc::new(crate::pack_store::PackReader::new(
@@ -123,18 +132,19 @@ impl GitGateway {
             readers.retain(|reader| reader.strong_count() > 0);
             readers.push(Arc::downgrade(&pack_reader));
         }
-        let lfs = LfsService::new(Arc::clone(&repository), blob_store);
+        let lfs = Arc::new(LfsService::new(Arc::clone(&repository), blob_store));
         Self {
             repository,
             signer_directory: None,
-            certificate_seed: OnceCell::new(),
+            certificate_seed: Arc::new(OnceCell::new()),
             large_blobs,
             pack_reader,
             lfs,
+            artifacts,
             scratch_root,
             disk_budget,
             native,
-            push: Mutex::new(()),
+            push: Arc::new(Mutex::new(())),
         }
     }
 
@@ -205,24 +215,7 @@ impl GitGateway {
                 id,
             )
             .await?;
-            // Upload spooling uses a private, budgeted scratch file. Serialize
-            // the push-ID check, decode, native Git work and publication, but
-            // do not let one slow client block another client's upload.
-            let _push = self.push.lock().await;
-            if self
-                .repository
-                .begin_push(id, actor, encoded.identity().request_digest)
-                .await?
-            {
-                return Ok(http_body(with_push_id(
-                    self.repository.completed_response(id).await?,
-                    id,
-                )));
-            }
-            let preflight = encoded
-                .decode(&self.scratch_root, &self.disk_budget, None)
-                .await?;
-            return self.handle_push(preflight).await.map(http_body);
+            return self.handle_native_push(encoded).await;
         }
         let request = self
             .receive(request, Some(MAX_FETCH_REQUEST_BYTES), admission)
@@ -536,15 +529,7 @@ impl GitGateway {
     }
 }
 
-fn http_body(response: GitHttpResponse) -> GitHttpResponse<Body> {
-    GitHttpResponse {
-        status: response.status,
-        headers: response.headers,
-        body: Body::from(response.body),
-    }
-}
-
-fn with_push_id(mut response: GitHttpResponse, id: [u8; 16]) -> GitHttpResponse {
+fn with_push_id<B>(mut response: GitHttpResponse<B>, id: [u8; 16]) -> GitHttpResponse<B> {
     response.headers.push((
         "X-Canopy-Push-Id".into(),
         uuid::Uuid::from_bytes(id).to_string(),
diff --git a/crates/canopy-server/src/git_gateway/push.rs b/crates/canopy-server/src/git_gateway/push.rs
index 0fca0d64..e341419a 100644
--- a/crates/canopy-server/src/git_gateway/push.rs
+++ b/crates/canopy-server/src/git_gateway/push.rs
@@ -1,124 +1,7 @@
+mod native;
 use super::*;
 
 impl GitGateway {
-    pub(super) async fn handle_push(
-        &self,
-        preflight: preflight::PushPreflight,
-    ) -> Result<GitHttpResponse, GatewayError> {
-        let preflight::PushParts {
-            request,
-            commands,
-            identity,
-        } = preflight.into_parts();
-        let actor = identity.actor.as_str();
-        let id = identity.operation;
-        let digest = identity.request_digest;
-        let option_error = commands.option_error().or_else(|| {
-            (commands.certificate().is_some() && self.signer_directory.is_none())
-                .then_some("Canopy signed pushes are unavailable on this gateway")
-        });
-        let prepared = async {
-            if let Some(reason) = option_error {
-                let response = commands
-                    .rejection(reason)?
-                    .ok_or(GatewayError::MalformedCache)?;
-                return Ok::<_, GatewayError>((response, None, None));
-            }
-            let names = commands.names();
-            let cached = self.build_cache(actor, &names).await?;
-            self.install_branch_policy(&cached, &commands).await?;
-            let signers = self.install_certificate_policy(&cached, &commands, actor).await?;
-            let before = cached.refs.clone();
-            let backend = signers.map_or_else(
-                || cached.backend.clone(),
-                |path| cached.backend.with_signers(path),
-            );
-            let mut response = backend.run(request).await?;
-            let certificate = self.verified_certificate(&cached, &commands, actor, digest).await?;
-            // Git may accept some refs and reject others unless atomic was requested.
-            // Publish its actual changes before returning any successful per-ref report.
-            let plan = if response.status == 200 {
-                let after = git_refs(&cached.backend, &names).await?;
-                let plan = diff_refs(&before, &after, actor);
-                if plan.updates.is_empty() {
-                    None
-                } else {
-                    match self.persist_objects(&cached.backend, &before, &plan).await {
-                        Ok(()) => Some(plan),
-                        Err(error) => {
-                            tracing::warn!(push_id = %hex::encode(id), error = ?error, "Git object ingestion failed");
-                            let reason = match error {
-                                GatewayError::Objects(ObjectReadError::TooLarge) => {
-                                    "Canopy object ingestion failed: object exceeds server size limit"
-                                }
-                                _ => "Canopy object ingestion failed; retry push after server recovery",
-                            };
-                            response = crate::push::report::rejected_report(&response, reason)?;
-                            // Ingestion cannot publish refs. Persist this refusal through
-                            // completion so a concurrent attempt with the same ID can
-                            // win; only the canonical durable response reaches the client.
-                            None
-                        }
-                    }
-                }
-            } else {
-                None
-            };
-            Ok::<_, GatewayError>((response, plan, certificate))
-        }
-        .await;
-        let (response, plan, certificate) = match prepared {
-            Ok(prepared) => prepared,
-            Err(error) => {
-                let reason = match &error {
-                    GatewayError::Cache(error) | GatewayError::Http(GitHttpError::Cache(error))
-                        if error.is_admission() =>
-                    {
-                        "Canopy push failed before publication: cache disk budget exhausted"
-                    }
-                    GatewayError::Certificate(reason) => reason,
-                    _ => "Canopy push failed before publication; retry after server recovery",
-                };
-                let Some(response) = commands.rejection(reason)? else {
-                    return Err(error);
-                };
-                tracing::warn!(push_id = %hex::encode(id), error = ?error, "Git push failed before publication");
-                (response, None, None)
-            }
-        };
-        let options = if option_error.is_some() {
-            Vec::new()
-        } else {
-            commands.options().to_vec()
-        };
-        // Release parsed command names before staging a potentially large report.
-        drop(commands);
-        // Preparation and native Git mutate only disposable refs. Record their
-        // refusal through completion; a concurrent same-ID winner stays canonical.
-        // Publication failures below may be uncertain and must never become ng.
-        let response_id = self.repository.stage_push_response(id, &response).await?;
-        let result = self
-            .repository
-            .complete_push(PushCompletion {
-                id,
-                actor: actor.into(),
-                digest,
-                response_id,
-                options,
-                plan,
-                certificate,
-            })
-            .await
-            .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-        if !result.output {
-            return Err(PushError::InvalidResponse.into());
-        }
-        Ok(with_push_id(
-            self.repository.completed_response(id).await?,
-            id,
-        ))
-    }
-
     async fn verified_certificate(
         &self,
         cached: &CachedRepository,
diff --git a/crates/canopy-server/src/git_gateway/push/native.rs b/crates/canopy-server/src/git_gateway/push/native.rs
new file mode 100644
index 00000000..9b1291e2
--- /dev/null
+++ b/crates/canopy-server/src/git_gateway/push/native.rs
@@ -0,0 +1,536 @@
+//! Production receive-pack is a resident-owned workflow. Request observers
+//! never own native work or acknowledge disposable cache refs.
+use super::*;
+use crate::packs::{
+    catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes},
+    metadata::MetadataLimits,
+    publication::{
+        CatalogPreparation, NativeInputCertificate, PublicationCoordinator, PublicationOutcome,
+        PublicationState, PushCompletionRequest, RegisteredRootRecovery, StagedPublicationTicket,
+        StagingCoordinator, StagingError, StagingState, StagingTicket,
+    },
+    verification::{NativeMetadataLimits, PhysicalLimits, PhysicalVerifier},
+};
+use canopy_object_storage::artifact::ArtifactRead;
+
+fn input(error: impl StdError + Send + Sync + 'static) -> StagingError {
+    StagingError::Input(Box::new(error))
+}
+fn observed(error: Arc<StagingError>) -> StagingError {
+    input(error)
+}
+fn mutation() -> Result<MutationIdentity, StagingError> {
+    new_identity().map_err(input)
+}
+
+impl GitGateway {
+    pub(in crate::git_gateway) async fn handle_native_push(
+        &self,
+        encoded: preflight::EncodedPush,
+    ) -> Result<GitHttpResponse<Body>, GatewayError> {
+        let staging = self
+            .repository
+            .staging_coordinator()
+            .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+        let identity = encoded.identity().clone();
+        let id = identity.operation;
+        if let Some(response) = staging
+            .replay_request(identity.clone(), &self.artifacts)
+            .await
+            .map_err(|e| GatewayError::Cell(Box::new(e)))?
+        {
+            return Ok(with_push_id(artifact_body(response), id));
+        }
+        // Serialize admission only. Independent pushes execute under bounded
+        // worker admission and publish against the authoritative bound floor.
+        let admission = self.push.lock().await;
+        let ticket = if let Some(ticket) = staging
+            .join_request(&identity)
+            .map_err(|e| GatewayError::Cell(Box::new(e)))?
+        {
+            ticket
+        } else {
+            let ready = staging
+                .ready_request(identity.clone(), new_identity()?)
+                .await
+                .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+            let ticket = staging
+                .submit(ready)
+                .map_err(|(error, _)| GatewayError::Cell(Box::new(error)))?;
+            let gateway = self.clone();
+            let owner = staging.clone();
+            // Transfer encoded bytes synchronously before observing any state.
+            ticket
+                .drive_receive(move |ticket, publication| async move {
+                    Box::pin(gateway.drive_push(owner, ticket, publication, encoded)).await
+                })
+                .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+            ticket
+        };
+        drop(admission);
+        match ticket.wait_completion().await {
+            StagingState::Published(Ok(PublicationOutcome::RootPush(_))) => {
+                let response = staging
+                    .replay_request(identity, &self.artifacts)
+                    .await
+                    .map_err(|e| GatewayError::Cell(Box::new(e)))?
+                    .ok_or(GatewayError::MalformedCache)?;
+                Ok(with_push_id(artifact_body(response), id))
+            }
+            StagingState::Published(Err(error)) => Err(GatewayError::Cell(Box::new(error))),
+            StagingState::Uncertain(error) | StagingState::Fenced(error) => {
+                Err(GatewayError::Cell(Box::new(error)))
+            }
+            _ => Err(GatewayError::MalformedCache),
+        }
+    }
+
+    async fn drive_push(
+        &self,
+        staging: Arc<StagingCoordinator>,
+        ticket: StagingTicket,
+        publication: PublicationCoordinator,
+        encoded: preflight::EncodedPush,
+    ) -> Result<(), StagingError> {
+        active(&staging, &ticket).await?;
+        let store = self.artifacts.clone();
+        let (encoded, request) = ticket
+            .spawn(move |context| async move {
+                let (encoded, saved) = encoded.retain(&context, &store).await.map_err(input)?;
+                let checkpoint = context
+                    .seal_push_inputs(store, std::iter::empty(), saved)
+                    .await
+                    .map_err(input)?;
+                Ok((encoded, checkpoint))
+            })?
+            .wait()
+            .await
+            .map_err(observed)?;
+        checkpoint(&staging, &ticket, request.clone()).await?;
+        let gateway = self.clone();
+        let (packs, certificate, plan) = ticket
+            .spawn(move |context| async move {
+                let preflight = encoded
+                    .decode(&gateway.scratch_root, &gateway.disk_budget, None)
+                    .await
+                    .map_err(input)?;
+                let (completion, packs) = gateway
+                    .native_result(&context, preflight)
+                    .await
+                    .map_err(input)?;
+                let plan = completion.plan.clone();
+                let result = context
+                    .retain_native_result(
+                        &gateway.artifacts,
+                        &request,
+                        completion,
+                        &gateway.scratch_root,
+                        &gateway.disk_budget,
+                    )
+                    .await
+                    .map_err(input)?;
+                let certificate = context
+                    .append_native_result(
+                        gateway.artifacts.clone(),
+                        &request,
+                        packs.iter().copied(),
+                        result,
+                    )
+                    .await
+                    .map_err(input)?;
+                Ok((packs, certificate, plan))
+            })?
+            .wait()
+            .await
+            .map_err(observed)?;
+        checkpoint(&staging, &ticket, certificate).await?;
+        // Only bounded descriptor spools survive physical verification. Native
+        // databases and worker activities drain before Bind can start.
+        let mut metadata = Vec::with_capacity(packs.len());
+        if plan.is_some() {
+            for pack in packs {
+                let gateway = self.clone();
+                let staged = ticket
+                    .spawn(move |context| async move {
+                        PhysicalVerifier::download_staged(
+                            &context,
+                            &gateway.scratch_root,
+                            gateway.disk_budget.clone(),
+                            &gateway.artifacts,
+                            pack,
+                            PhysicalLimits::default(),
+                            gateway.native.clone(),
+                        )
+                        .await
+                        .map_err(input)?
+                        .stage_metadata(NativeMetadataLimits::default())
+                        .await
+                        .map_err(input)
+                    })?
+                    .wait()
+                    .await
+                    .map_err(observed)?;
+                metadata.push(staged);
+            }
+        }
+        ticket.seal()?;
+        bound(&staging, &ticket).await?;
+        let session = ticket.bound_session()?;
+        let Some(plan) = plan else {
+            let gateway = self.clone();
+            let ready = ticket
+                .spawn_bound(move |_, _context| async move {
+                    session
+                        .ready_root_outcome(
+                            mutation()?,
+                            &gateway.artifacts,
+                            &gateway.scratch_root,
+                            gateway.disk_budget.clone(),
+                            gateway.signer_directory.as_deref(),
+                        )
+                        .await
+                        .map_err(input)
+                })?
+                .wait()
+                .await
+                .map_err(observed)?;
+            let registered = ready
+                .persist_recovery(&self.artifacts, mutation()?)
+                .await
+                .map_err(input)?;
+            let ready = ready
+                .bind_recovery(registered, &self.artifacts)
+                .map_err(input)?;
+            let observer = ticket.publish(&publication, ready).map_err(input)?;
+            final_publication(&staging, &ticket, &observer).await?;
+            return Ok(());
+        };
+        let format = self.repository.object_format();
+        let indexes = Arc::new(CatalogIndexes::new(self.artifacts.clone(), format));
+        let files = Arc::new(
+            CatalogFiles::new(
+                &self.scratch_root,
+                self.disk_budget.clone(),
+                self.artifacts.clone(),
+                format,
+                CatalogFileLimits::default(),
+            )
+            .map_err(input)?
+            .with_native(self.native.clone()),
+        );
+        let base = Arc::new(ticket.open_base(indexes, files).await?);
+        let gateway = self.clone();
+        let prepared = Arc::new(
+            ticket
+                .spawn_bound(move |_, context| async move {
+                    let mut builder = CatalogPreparation::new_staged(
+                        &context,
+                        &gateway.scratch_root,
+                        gateway.disk_budget.clone(),
+                        base,
+                        MetadataLimits::default(),
+                    )
+                    .await
+                    .map_err(input)?;
+                    for staged in metadata {
+                        builder.add_staged_pack(staged).await.map_err(input)?;
+                    }
+                    builder.finish().await.map_err(input)
+                })?
+                .wait()
+                .await
+                .map_err(observed)?,
+        );
+        let gateway = self.clone();
+        let owner = prepared.clone();
+        let (policy, refusal) = ticket
+            .spawn_bound(move |_, _context| async move {
+                let policy = Arc::new(
+                    owner
+                        .ref_policy_preparation(
+                            plan,
+                            &gateway.scratch_root,
+                            gateway.disk_budget.clone(),
+                            MetadataLimits::default(),
+                        )
+                        .await
+                        .map_err(input)?,
+                );
+                let refusal = Arc::new(
+                    session
+                        .ready_root_refusal(
+                            mutation()?,
+                            &gateway.artifacts,
+                            &gateway.scratch_root,
+                            gateway.disk_budget.clone(),
+                            gateway.signer_directory.as_deref(),
+                        )
+                        .await
+                        .map_err(input)?,
+                );
+                Ok((policy, refusal))
+            })?
+            .wait()
+            .await
+            .map_err(observed)?;
+        let mut offset = 0;
+        let mut previous: Option<RegisteredRootRecovery> = None;
+        while offset < policy.plan().updates.len() {
+            let intent = policy.clone();
+            let owner = prepared.clone();
+            let refusal = refusal.clone();
+            let store = self.artifacts.clone();
+            let head = previous.clone();
+            let (ready, registered, end) = ticket
+                .spawn_bound(move |_, _context| async move {
+                    let ready = intent
+                        .ready_page(&owner, mutation()?, offset)
+                        .await
+                        .map_err(input)?
+                        .with_refusal(refusal)
+                        .map_err(input)?;
+                    let end = ready.end_offset();
+                    let registered = ready
+                        .persist_recovery(&store, mutation()?, head.as_ref())
+                        .await
+                        .map_err(input)?;
+                    let ready = ready
+                        .bind_recovery(registered.clone(), &store)
+                        .map_err(input)?;
+                    Ok((ready, registered, end))
+                })?
+                .wait()
+                .await
+                .map_err(observed)?;
+            let observer = ticket
+                .register_policy_page(&publication, ready)
+                .map_err(input)?;
+            match final_publication(&staging, &ticket, &observer).await? {
+                PublicationOutcome::PolicyPage(_) => bound(&staging, &ticket).await?,
+                PublicationOutcome::RootPush(_) => return Ok(()),
+                _ => return Err(StagingError::Context),
+            }
+            previous = Some(registered);
+            offset = end;
+        }
+        let gateway = self.clone();
+        let ready = ticket
+            .spawn_bound(move |_, _context| async move {
+                let guard = policy.ready(&prepared).await.map_err(input)?;
+                prepared
+                    .ready_root_push(
+                        mutation()?,
+                        &guard,
+                        &gateway.scratch_root,
+                        gateway.disk_budget.clone(),
+                        MetadataLimits::default(),
+                        gateway.signer_directory.as_deref(),
+                    )
+                    .await
+                    .map_err(input)
+            })?
+            .wait()
+            .await
+            .map_err(observed)?;
+        let registered = ready
+            .persist_recovery_after(
+                &self.artifacts,
+                mutation()?,
+                previous.as_ref().ok_or(StagingError::Context)?,
+            )
+            .await
+            .map_err(input)?;
+        let ready = ready
+            .bind_recovery(registered, &self.artifacts)
+            .map_err(input)?;
+        let observer = ticket.publish(&publication, ready).map_err(input)?;
+        final_publication(&staging, &ticket, &observer).await?;
+        Ok(())
+    }
+
+    async fn native_result(
+        &self,
+        context: &crate::packs::publication::StagingContext,
+        preflight: preflight::PushPreflight,
+    ) -> Result<
+        (
+            PushCompletionRequest,
+            Vec<crate::packs::sources::NativePackDescriptor>,
+        ),
+        GatewayError,
+    > {
+        let preflight::PushParts {
+            request,
+            commands,
+            identity,
+        } = preflight.into_parts();
+        let actor = identity.actor.as_str();
+        let option_error = commands.option_error().or_else(|| {
+            (commands.certificate().is_some() && self.signer_directory.is_none())
+                .then_some("Canopy signed pushes are unavailable on this gateway")
+        });
+        let result = async {
+            if let Some(reason) = option_error {
+                return Ok((
+                    commands
+                        .rejection(reason)?
+                        .ok_or(GatewayError::MalformedCache)?,
+                    None,
+                    None,
+                    Vec::new(),
+                ));
+            }
+            let names = commands.names();
+            let cached = self.build_cache(actor, &names).await?;
+            self.install_branch_policy(&cached, &commands).await?;
+            let signers = self
+                .install_certificate_policy(&cached, &commands, actor)
+                .await?;
+            let backend = signers.map_or_else(
+                || cached.backend.clone(),
+                |path| cached.backend.with_signers(path),
+            );
+            let response = backend.run_native_receive(context, request).await?;
+            let certificate = self
+                .verified_certificate(&cached, &commands, actor, identity.request_digest)
+                .await?;
+            if let Some(verified) = &certificate {
+                backend
+                    .remove_disposable_certificate(
+                        context,
+                        crate::object_id(
+                            self.repository.object_format(),
+                            ObjectKind::Blob,
+                            &verified.body,
+                        ),
+                    )
+                    .await
+                    .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+            }
+            let plan = if response.status == 200 {
+                let after = git_refs(&cached.backend, &names).await?;
+                let plan = diff_refs(&cached.refs, &after, actor);
+                (!plan.updates.is_empty()).then_some(plan)
+            } else {
+                None
+            };
+            let packs = if plan.is_some() {
+                backend
+                    .stage_native_packs(context, &self.artifacts, PhysicalLimits::default())
+                    .await
+                    .map_err(|e| GatewayError::Cell(Box::new(e)))?
+            } else {
+                Vec::new()
+            };
+            Ok::<_, GatewayError>((response, plan, certificate, packs))
+        }
+        .await;
+        let (response, plan, certificate, packs) = match result {
+            Ok(result) => result,
+            Err(error) => {
+                let reason = match &error {
+                    GatewayError::Cache(error) | GatewayError::Http(GitHttpError::Cache(error))
+                        if error.is_admission() =>
+                    {
+                        "Canopy push failed before publication: cache disk budget exhausted"
+                    }
+                    GatewayError::Certificate(reason) => reason,
+                    _ => "Canopy push failed before publication; retry after server recovery",
+                };
+                let Some(response) = commands.rejection(reason)? else {
+                    return Err(error);
+                };
+                tracing::warn!(push_id = %hex::encode(identity.operation), ?error, "native push failed before publication");
+                (response, None, None, Vec::new())
+            }
+        };
+        Ok((
+            PushCompletionRequest {
+                response,
+                plan,
+                certificate,
+                options: if option_error.is_some() {
+                    Vec::new()
+                } else {
+                    commands.options().to_vec()
+                },
+            },
+            packs,
+        ))
+    }
+}
+
+async fn active(staging: &StagingCoordinator, ticket: &StagingTicket) -> Result<(), StagingError> {
+    loop {
+        match ticket.wait().await {
+            StagingState::Active(_) => return Ok(()),
+            StagingState::Uncertain(_) => {
+                staging.recover(ticket)?;
+                tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+            }
+            StagingState::Fenced(error) => return Err(observed(error)),
+            _ => return Err(StagingError::Inactive),
+        }
+    }
+}
+async fn bound(staging: &StagingCoordinator, ticket: &StagingTicket) -> Result<(), StagingError> {
+    loop {
+        match ticket.wait_terminal().await {
+            StagingState::Bound(_) => return Ok(()),
+            StagingState::Uncertain(_) => {
+                staging.recover(ticket)?;
+                tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+            }
+            StagingState::Fenced(error) => return Err(observed(error)),
+            _ => return Err(StagingError::Inactive),
+        }
+    }
+}
+async fn checkpoint(
+    staging: &StagingCoordinator,
+    ticket: &StagingTicket,
+    proof: NativeInputCertificate,
+) -> Result<(), StagingError> {
+    let registration = ticket
+        .register_inputs(proof, mutation()?)
+        .map_err(|(error, _)| error)?;
+    loop {
+        match registration.wait().await {
+            Ok(_) => return Ok(()),
+            Err(_) if matches!(ticket.state(), StagingState::Uncertain(_)) => {
+                staging.recover(ticket)?;
+                tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+            }
+            Err(error) => return Err(observed(error)),
+        }
+    }
+}
+async fn final_publication(
+    staging: &StagingCoordinator,
+    ticket: &StagingTicket,
+    observer: &StagedPublicationTicket,
+) -> Result<PublicationOutcome, StagingError> {
+    loop {
+        match observer.wait().await {
+            PublicationState::Finished(Ok(value)) => return Ok(value),
+            PublicationState::Finished(Err(error)) => return Err(StagingError::Publication(error)),
+            PublicationState::Uncertain(_) => {
+                staging.recover(ticket)?;
+                tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+            }
+            _ => return Err(StagingError::Inactive),
+        }
+    }
+}
+fn artifact_body(response: GitHttpResponse<ArtifactRead>) -> GitHttpResponse<Body> {
+    let stream = futures_util::stream::try_unfold(response.body, |mut body| async move {
+        Ok::<_, canopy_object_storage::artifact::ArtifactError>(
+            body.next().await?.map(|bytes| (bytes, body)),
+        )
+    });
+    GitHttpResponse {
+        status: response.status,
+        headers: response.headers,
+        body: Body::from_stream(stream),
+    }
+}
diff --git a/crates/canopy-server/src/git_http/capture.rs b/crates/canopy-server/src/git_http/capture.rs
index 1bc10afb..97e3388a 100644
--- a/crates/canopy-server/src/git_http/capture.rs
+++ b/crates/canopy-server/src/git_http/capture.rs
@@ -72,6 +72,51 @@ struct Pair {
     index: Arc<InputFile>,
 }
 impl GitHttpBackend {
+    /// Git writes its verified push certificate as a request-private loose
+    /// blob. The immutable native result retains these exact audit bytes; this
+    /// disposable blob is not an incoming pack or a reachable Git object.
+    pub(crate) async fn remove_disposable_certificate(
+        &self,
+        context: &StagingContext,
+        oid: crate::ObjectId,
+    ) -> Result<(), NativeCaptureError> {
+        context.ensure_live()?;
+        if oid.format() != context.format() {
+            return Err(NativeCaptureError::Context);
+        }
+        let cache = self.cache.clone();
+        let activity = context.physical_owner();
+        tokio::task::spawn_blocking(move || {
+            let _activity = activity;
+            let fence = crate::native_git::lock_file(
+                &cache.git_dir().join(crate::native_git::WORKER_LOCK),
+            )?;
+            fence.try_lock().map_err(std::io::Error::from)?;
+            let hex = hex::encode(oid);
+            let directory = cache.git_dir().join("objects").join(&hex[..2]);
+            match std::fs::remove_file(directory.join(&hex[2..])) {
+                Ok(()) => {}
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                Err(error) => return Err(error.into()),
+            }
+            match std::fs::remove_dir(directory) {
+                Ok(()) => {}
+                Err(error)
+                    if matches!(
+                        error.kind(),
+                        std::io::ErrorKind::NotFound | std::io::ErrorKind::DirectoryNotEmpty
+                    ) => {}
+                Err(error) => return Err(error.into()),
+            }
+            fence.unlock()?;
+            Ok::<_, NativeCaptureError>(())
+        })
+        .await??;
+        self.cache.reconcile_owned(context.physical_owner()).await?;
+        context.ensure_live()?;
+        Ok(())
+    }
+
     /// Run inside a StagingTicket producer after native receive completes. The
     /// returned inputs establish authenticated bytes, not physical decoding,
     /// closure, ref authorization or a durable completed network response.
@@ -143,6 +188,9 @@ impl GitHttpBackend {
                 {
                     return Err(NativeCaptureError::Limit);
                 }
+                if NativePackDescriptor::is_empty_pair(format, &path, &index_path)? {
+                    continue;
+                }
                 let native = NativePackDescriptor::inspect_files(
                     token.repository,
                     token.artifact_operation,
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 6a4daea9..aa615b0d 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -216,6 +216,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("git_gateway/preflight/retention.rs"));
                 source.update(include_bytes!("git_gateway/branch_policy.rs"));
                 source.update(include_bytes!("git_gateway/push.rs"));
+                source.update(include_bytes!("git_gateway/push/native.rs"));
                 source.update(include_bytes!("git_input/mod.rs"));
                 source.update(include_bytes!("git_http/capture.rs"));
                 source.update(include_bytes!("git_http/mod.rs"));
@@ -368,7 +369,6 @@ impl CellModule for RepositoryModule {
                     "../../canopy-object-storage/src/external.rs"
                 ));
                 source.update(include_bytes!("push/mod.rs"));
-                source.update(include_bytes!("push/plan.rs"));
                 source.update(include_bytes!("push/report.rs"));
                 source.update(include_bytes!("access.rs"));
                 source.update(include_bytes!("visibility.rs"));
diff --git a/crates/canopy-server/src/packs/publication/certificate.rs b/crates/canopy-server/src/packs/publication/certificate.rs
index 9d4648dd..38e2dd08 100644
--- a/crates/canopy-server/src/packs/publication/certificate.rs
+++ b/crates/canopy-server/src/packs/publication/certificate.rs
@@ -79,8 +79,11 @@ impl CertificateData {
                 .any(|value| *value > i64::MAX as u64)
             || (self.input_count == 0) != (self.object_count == 0)
             || (self.object_count == 0 && self.edge_count != 0)
-            || (self.input_checkpoint_digest.is_some()
-                && (self.input_count == 0 || self.compaction))
+            // A delete-only/ref-only push retains authenticated request and
+            // native outcome custody without adding any physical pack. Its
+            // checkpoint is still checked by final publication. Compaction
+            // has no native push checkpoint.
+            || (self.input_checkpoint_digest.is_some() && self.compaction)
             || (self.compaction && (self.refs_digest.is_some() || self.completion_digest.is_some()))
         {
             return Err(CodecError::Invalid("invalid catalog attestation facts"));
diff --git a/crates/canopy-server/src/packs/publication/coordinator/policy.rs b/crates/canopy-server/src/packs/publication/coordinator/policy.rs
index 8ead4277..ed2a9e82 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/policy.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/policy.rs
@@ -20,6 +20,7 @@ pub struct ReadyRefPolicyPage {
     pub(super) prepared: Arc<PreparedCatalog>,
     intent: Arc<RefPolicyPreparation>,
     command: PreparedCommand<RegisterRefPolicyPage>,
+    end_offset: usize,
     refusal: Option<Arc<ReadyRootPush>>,
     #[cfg(test)]
     refusal_fault: u8,
@@ -35,6 +36,7 @@ impl RefPolicyPreparation {
             .page(prepared, start)
             .await
             .map_err(|error| RefPolicyReadyError::Preparation(Box::new(error)))?;
+        let end_offset = input.offset as usize + input.proof.plan.updates.len();
         input.encode(&mut BoundedEncoder::new(REF_POLICY_PAGE_BYTES)?)?;
         prepared.ensure_live()?;
         let (client, target, _) = prepared.base.capability();
@@ -47,6 +49,7 @@ impl RefPolicyPreparation {
             prepared: prepared.clone(),
             intent: self.clone(),
             command,
+            end_offset,
             refusal: None,
             #[cfg(test)]
             refusal_fault: 0,
@@ -71,6 +74,12 @@ impl std::fmt::Display for RefPolicyRefusalFailure {
 }
 impl std::error::Error for RefPolicyRefusalFailure {}
 impl ReadyRefPolicyPage {
+    /// Next offset from this exact byte-bounded page, which may contain fewer
+    /// than the maximum number of updates.
+    pub fn end_offset(&self) -> usize {
+        self.end_offset
+    }
+
     /// Convert only after this exact original page/refusal bundle is registered.
     /// The shared session and intent survive admission failure and uncertainty.
     pub fn bind_recovery(
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index f6cec117..3327e596 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -247,6 +247,7 @@ pub struct MaintenanceRequest {
 /// Bind the packed production contract. Inline publication/completion adapters
 /// are deliberately excluded; qualification binds its historical fixtures itself.
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
+    registry.bind_command::<crate::branch_rules::command::SetBranchRule>()?;
     registry.bind_command::<ReleaseServingPin>()?;
     registry.bind_query::<CheckServingPin>()?;
     registry.bind_query::<SelectServingGeneration>()?;
diff --git a/crates/canopy-server/src/packs/publication/native_result.rs b/crates/canopy-server/src/packs/publication/native_result.rs
index 66f31d8c..81d50965 100644
--- a/crates/canopy-server/src/packs/publication/native_result.rs
+++ b/crates/canopy-server/src/packs/publication/native_result.rs
@@ -91,7 +91,7 @@ pub(super) struct ResultRecord {
     request: WireRequestRoot,
     pub(super) response: GitHttpResponse<ArtifactDescriptor>,
     plan: Option<ArtifactDescriptor>,
-    options: Vec<String>,
+    pub(super) options: Vec<String>,
     signed: Option<SignedPushAnnotation<ArtifactDescriptor>>,
 }
 impl ResultRecord {
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index eaadd40c..52380fc8 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,8 +23,9 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 17] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 18] = [
     crate::operation(1),
+    command::<crate::branch_rules::command::SetBranchRule>(64 << 10, 64),
     command::<AbortPreparation>(4096, 4096),
     command::<ReapPreparation>(4096, 4096),
     command::<RegisterCatalogAttestation>(4096, 4096),
@@ -64,7 +65,7 @@ mod tests {
     use cellule_runtime::CellModule;
 
     #[test]
-    fn production_registers_only_the_packed_command_contract() -> cellule_runtime::Result<()> {
+    fn production_registers_packed_and_policy_metadata_contracts() -> cellule_runtime::Result<()> {
         let application = CanopyApplication::compile(build_descriptor(
             include_bytes!("../../../../../Cargo.lock"),
             env!("CARGO_PKG_VERSION"),
@@ -84,7 +85,7 @@ mod tests {
         assert_eq!(
             ids,
             vec![
-                1, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46
+                1, 8, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46
             ]
         );
         assert_eq!(
diff --git a/crates/canopy-server/src/packs/publication/root_completion/read.rs b/crates/canopy-server/src/packs/publication/root_completion/read.rs
index a8e019b5..39e6505e 100644
--- a/crates/canopy-server/src/packs/publication/root_completion/read.rs
+++ b/crates/canopy-server/src/packs/publication/root_completion/read.rs
@@ -168,3 +168,14 @@ pub async fn replay_root_push_response(
         body,
     }))
 }
+
+/// Read the retained native annotation selected by an already-authorized
+/// repository audit row. Keep the bounded completion command independent of
+/// the potentially large options field; the outcome roots retain it for GC.
+pub(in crate::packs::publication) async fn selected_options(
+    root: NativeOutcomeRoot,
+    store: &ArtifactStore,
+) -> Result<Vec<String>, Box<dyn std::error::Error + Send + Sync>> {
+    let record: OutcomeRecord = root.0.read(store, INPUT_ROOT_BYTES).await?;
+    Ok(record.native.read(store).await?.options)
+}
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index 23e124ce..e6ea58bf 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -339,7 +339,11 @@ struct Inner {
     target: CellTarget,
     limits: StagingLimits,
     budget: StagingBudget,
-    resident: Option<(CellClient, PublicationCoordinator)>,
+    resident: Option<(
+        CellClient,
+        PublicationCoordinator,
+        Arc<canopy_object_storage::artifact::ArtifactStore>,
+    )>,
     admission: Mutex<Admission>,
     workers: Arc<Semaphore>,
     drained: Notify,
@@ -365,6 +369,7 @@ struct Local {
     recovery: bool,
     renew: bool,
     driver_started: bool,
+    driver_graceful: bool,
 }
 trait RetainedWork: Any + Send + Sync {
     fn fence_completed(&self);
@@ -777,6 +782,7 @@ impl StagingCoordinator {
                 recovery: false,
                 renew: false,
                 driver_started: false,
+                driver_graceful: false,
             }),
             work: Mutex::new(WorkSlots::default()),
             exact: Mutex::new(Some(ready.inner.command)),
@@ -854,6 +860,40 @@ impl StagingCoordinator {
             inner: Arc::clone(&self.inner),
         })
     }
+    /// Seal node admission while already-owned receive workflows finish. Other
+    /// callback producers retain their existing cancel-and-physical-drain contract.
+    pub(crate) fn close_admission(&self) {
+        let mut admission = self.inner.admission.lock().expect("staging admission");
+        admission.closed = true;
+        for job in admission.jobs.values() {
+            let mut local = job.local.lock().expect("staging local");
+            if !local.driver_graceful {
+                local.stop = true;
+                job.driver_stop.cancel();
+                job.changed.notify_one();
+            }
+        }
+    }
+
+    pub(crate) async fn finish_receive_workflows(&self) {
+        let jobs: Vec<_> = self
+            .inner
+            .admission
+            .lock()
+            .expect("staging admission")
+            .jobs
+            .values()
+            .cloned()
+            .collect();
+        // Timeout abandons only this join observer. Forced close below retains
+        // and joins every actual controller, worker and uncertain command.
+        let _ = tokio::time::timeout(
+            Duration::from_secs(30),
+            futures_util::future::join_all(jobs.iter().map(|job| driver::drain(job))),
+        )
+        .await;
+    }
+
     pub(crate) fn close(&self) {
         let mut admission = self.inner.admission.lock().expect("staging admission");
         admission.closed = true;
@@ -867,18 +907,13 @@ impl StagingCoordinator {
     /// Stop admission and renew while accepted workers drain. Uncertain exact
     /// commands remain charged and returned; explicit recovery remains possible.
     pub async fn close_and_drain(&self) -> Vec<StagingTicket> {
+        self.close();
         loop {
             let wake = self.inner.drained.notified();
             tokio::pin!(wake);
             wake.as_mut().enable();
             let pending = {
-                let mut a = self.inner.admission.lock().expect("staging admission");
-                a.closed = true;
-                for job in a.jobs.values() {
-                    job.local.lock().expect("staging local").stop = true;
-                    job.driver_stop.cancel();
-                    job.changed.notify_one();
-                }
+                let a = self.inner.admission.lock().expect("staging admission");
                 if a.jobs.values().all(|j| {
                     matches!(*j.status.borrow(), StagingState::Uncertain(_))
                         && j.local.lock().expect("staging local").workers == 0
@@ -1089,6 +1124,26 @@ impl StagingTicket {
             }
         }
     }
+    /// Observe final publication without treating the intermediate Bound phase
+    /// as completion. Cancellation only drops this watch receiver.
+    pub async fn wait_completion(&self) -> StagingState {
+        let mut status = self.job.status.subscribe();
+        loop {
+            let state = status.borrow_and_update().clone();
+            if matches!(
+                state,
+                StagingState::Published(_)
+                    | StagingState::Uncertain(_)
+                    | StagingState::Fenced(_)
+                    | StagingState::Stopped
+            ) {
+                return state;
+            }
+            if status.changed().await.is_err() {
+                return status.borrow().clone();
+            }
+        }
+    }
     pub async fn wait_terminal(&self) -> StagingState {
         let mut status = self.job.status.subscribe();
         loop {
diff --git a/crates/canopy-server/src/packs/publication/staging_service/driver.rs b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
index df0466ba..c5358dd8 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/driver.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
@@ -6,6 +6,43 @@ pub(super) type DriverJoin =
     futures_util::future::Shared<futures_util::future::BoxFuture<'static, ()>>;
 
 impl StagingCoordinator {
+    /// Called only after RepositoryCell selected this root from the completed
+    /// row under current audit authorization. No client-provided root enters.
+    pub(crate) async fn completed_options(
+        &self,
+        bytes: &[u8],
+    ) -> Result<Vec<String>, StagingError> {
+        let (_, _, store) = self.inner.resident.as_ref().ok_or(StagingError::Inactive)?;
+        let mut decoder =
+            BoundedDecoder::new(bytes, 128).map_err(|e| StagingError::Input(Box::new(e)))?;
+        let root = NativeOutcomeRoot::decode(&mut decoder)
+            .map_err(|e| StagingError::Input(Box::new(e)))?;
+        decoder
+            .finish()
+            .map_err(|e| StagingError::Input(Box::new(e)))?;
+        root_completion::read::selected_options(root, store)
+            .await
+            .map_err(StagingError::Input)
+    }
+
+    /// Select a completed response with current authorization before decoding or
+    /// admitting another attempt. The resident holds the actual Cell capability.
+    pub async fn replay_request(
+        &self,
+        request: BeginRequest,
+        store: &canopy_object_storage::artifact::ArtifactStore,
+    ) -> Result<
+        Option<crate::git_http::GitHttpResponse<canopy_object_storage::artifact::ArtifactRead>>,
+        RootPushReplayError,
+    > {
+        let (client, _, _) = self
+            .inner
+            .resident
+            .as_ref()
+            .ok_or(RootPushReplayError::Context)?;
+        replay_root_push_response(client, &self.inner.target, request, None, store).await
+    }
+
     pub(crate) fn new_resident(
         client: CellClient,
         target: CellTarget,
@@ -13,14 +50,19 @@ impl StagingCoordinator {
         authority: PreparationAuthority,
         budget: StagingBudget,
         publication: PublicationCoordinator,
+        store: Arc<canopy_object_storage::artifact::ArtifactStore>,
     ) -> Result<Self, StagingError> {
-        if !publication.matches_target(&target) {
+        if !publication.matches_target(&target)
+            || crate::repository_target(target.tenant(), target.application(), store.repository())
+                .map_err(|_| StagingError::Foreign)?
+                != target
+        {
             return Err(StagingError::Foreign);
         }
         let mut coordinator = Self::new_with_budget(target, limits, authority, budget)?;
         Arc::get_mut(&mut coordinator.inner)
             .expect("new staging owner")
-            .resident = Some((client, publication));
+            .resident = Some((client, publication, store));
         Ok(coordinator)
     }
 
@@ -37,7 +79,7 @@ impl StagingCoordinator {
                 return Err(StagingError::Closed);
             }
         }
-        let (client, _) = self.inner.resident.as_ref().ok_or(StagingError::Inactive)?;
+        let (client, _, _) = self.inner.resident.as_ref().ok_or(StagingError::Inactive)?;
         ReadyStaging::new(client.clone(), self.inner.target.clone(), request, identity).await
     }
 
@@ -75,6 +117,25 @@ impl StagingTicket {
     /// Run physical work through `spawn`/`spawn_bound`; use this task only to
     /// retrieve their outputs and order checkpoint, Bind and publication steps.
     pub fn drive<F, Fut>(&self, producer: F) -> Result<(), StagingError>
+    where
+        F: FnOnce(StagingTicket, PublicationCoordinator) -> Fut + Send + 'static,
+        Fut: Future<Output = Result<(), StagingError>> + Send + 'static,
+    {
+        self.drive_with_drain(producer, false)
+    }
+
+    /// An authenticated receive-pack keeps its controller during the bounded
+    /// node shutdown grace. Forced close still cancels it and joins physical
+    /// workers and exact recovery before releasing the repository.
+    pub(crate) fn drive_receive<F, Fut>(&self, producer: F) -> Result<(), StagingError>
+    where
+        F: FnOnce(StagingTicket, PublicationCoordinator) -> Fut + Send + 'static,
+        Fut: Future<Output = Result<(), StagingError>> + Send + 'static,
+    {
+        self.drive_with_drain(producer, true)
+    }
+
+    fn drive_with_drain<F, Fut>(&self, producer: F, graceful: bool) -> Result<(), StagingError>
     where
         F: FnOnce(StagingTicket, PublicationCoordinator) -> Fut + Send + 'static,
         Fut: Future<Output = Result<(), StagingError>> + Send + 'static,
@@ -103,6 +164,7 @@ impl StagingTicket {
             return Err(StagingError::Duplicate);
         }
         local.driver_started = true;
+        local.driver_graceful = graceful;
         let ticket = self.clone();
         let owner = self.job.clone();
         let inner = self.inner.clone();
diff --git a/crates/canopy-server/src/packs/sources/native.rs b/crates/canopy-server/src/packs/sources/native.rs
index 9698647d..b5a18eee 100644
--- a/crates/canopy-server/src/packs/sources/native.rs
+++ b/crates/canopy-server/src/packs/sources/native.rs
@@ -80,6 +80,25 @@ impl NativePackDescriptor {
     }
     /// Local precursor only: manifest digests are filled by authenticated
     /// upload before this descriptor escapes the capture service.
+    /// A native receive of refs pointing to existing objects can produce an
+    /// empty pack. Verify its index/header/trailer before excluding it from the
+    /// incoming object inventory; zero-object sources remain forbidden.
+    pub(crate) fn is_empty_pair(
+        format: ObjectFormat,
+        pack: &Path,
+        index: &Path,
+    ) -> Result<bool, IndexError> {
+        let index = PackIndex::open(index, format).map_err(MetadataError::from)?;
+        if !index.is_empty() {
+            return Ok(false);
+        }
+        let size = std::fs::metadata(pack).map_err(MetadataError::from)?.len();
+        if size != 12 + format.bytes() as u64 {
+            return Err(IndexError::Integrity);
+        }
+        pack_digest(pack, size, index.pack_checksum(), 0)?;
+        Ok(true)
+    }
     pub(crate) fn inspect_files(
         repository: [u8; 16],
         operation: [u8; 16],
diff --git a/crates/canopy-server/src/push/certificate.rs b/crates/canopy-server/src/push/certificate.rs
index e5ee3327..618cb9b0 100644
--- a/crates/canopy-server/src/push/certificate.rs
+++ b/crates/canopy-server/src/push/certificate.rs
@@ -1,5 +1,4 @@
 use super::*;
-use sha2::{Digest as _, Sha256};
 
 /// Metadata for a verified push certificate retained with its push.
 #[derive(Debug, serde::Serialize)]
@@ -19,13 +18,6 @@ pub struct VerifiedPushCertificate {
     pub(crate) key: String,
 }
 
-pub(super) struct CertificateMeta {
-    pub digest: [u8; 32],
-    pub size: i64,
-    pub signer: String,
-    pub key: String,
-}
-
 impl RepositoryCell {
     pub(crate) async fn push_certificate_seed(&self) -> Result<[u8; 32], PushError> {
         let result = self
@@ -54,84 +46,4 @@ impl RepositoryCell {
             .try_into()
             .map_err(|_| PushError::InvalidResponse)
     }
-
-    pub(super) async fn stage_push_certificate(
-        &self,
-        push_id: [u8; 16],
-        certificate: &VerifiedPushCertificate,
-    ) -> Result<CertificateMeta, InvocationError<bool>> {
-        let size = i64::try_from(certificate.body.len())
-            .ok()
-            .filter(|size| *size > 0)
-            .ok_or(InvocationError::NotStarted(Error::Command(
-                "invalid push certificate",
-            )))?;
-        if certificate.signer.is_empty() || certificate.key.is_empty() {
-            return Err(InvocationError::NotStarted(Error::Command(
-                "invalid push certificate identity",
-            )));
-        }
-        for (part, body) in certificate.body.chunks(CHUNK_BYTES).enumerate() {
-            self.sql.batch(identity().map_err(|_| InvocationError::NotStarted(Error::Command("push mutation clock failed")))?, SqlBatch { statements: vec![SqlStatement {
-                sql: "INSERT INTO push_certificate_chunks (push_id, part, body) VALUES (?1, ?2, ?3) ON CONFLICT(push_id, part) DO UPDATE SET body = excluded.body".into(),
-                parameters: vec![SqlValue::Blob(push_id.to_vec()), SqlValue::Integer(part as i64), SqlValue::Blob(body.to_vec())],
-            }]}).await.map_err(|source| InvocationError::NotStarted(Error::Facility {
-                name: "push certificate staging",
-                source: Box::new(source),
-            }))?;
-        }
-        Ok(CertificateMeta {
-            digest: Sha256::digest(&certificate.body).into(),
-            size,
-            signer: certificate.signer.clone(),
-            key: certificate.key.clone(),
-        })
-    }
-}
-
-pub(super) fn certificate_complete(
-    context: &CommandContext<'_, '_>,
-    push_id: [u8; 16],
-    certificate: &CertificateMeta,
-) -> cellule_runtime::Result<bool> {
-    if certificate.size <= 0 || certificate.signer.is_empty() || certificate.key.is_empty() {
-        return Ok(false);
-    }
-    let parts = (certificate.size - 1) / CHUNK_BYTES as i64 + 1;
-    let totals = context.sql(&SqlBatch { statements: vec![SqlStatement {
-        sql: "SELECT count(*), coalesce(sum(length(body)), 0) FROM push_certificate_chunks WHERE push_id = ?1".into(),
-        parameters: vec![SqlValue::Blob(push_id.to_vec())],
-    }]})?;
-    if !matches!(
-        totals.first().and_then(|set| set.rows.first()).map(Vec::as_slice),
-        Some([SqlValue::Integer(count), SqlValue::Integer(size)]) if *count == parts && *size == certificate.size
-    ) {
-        return Ok(false);
-    }
-    let mut digest = Sha256::new();
-    let mut size = 0_i64;
-    for part in 0..parts {
-        let result = context.sql(&SqlBatch {
-            statements: vec![SqlStatement {
-                sql: "SELECT body FROM push_certificate_chunks WHERE push_id = ?1 AND part = ?2"
-                    .into(),
-                parameters: vec![SqlValue::Blob(push_id.to_vec()), SqlValue::Integer(part)],
-            }],
-        })?;
-        let Some([SqlValue::Blob(body)]) = result
-            .first()
-            .and_then(|set| set.rows.first())
-            .map(Vec::as_slice)
-        else {
-            return Ok(false);
-        };
-        size = size
-            .checked_add(body.len() as i64)
-            .ok_or(Error::Command("push certificate size overflow"))?;
-        if size > certificate.size {
-            return Ok(false);
-        }
-        digest.update(body);
-    }
-    Ok(size == certificate.size && digest.finalize().as_slice() == certificate.digest)
 }
diff --git a/crates/canopy-server/src/push/mod.rs b/crates/canopy-server/src/push/mod.rs
index 0a8e8d8b..812921fa 100644
--- a/crates/canopy-server/src/push/mod.rs
+++ b/crates/canopy-server/src/push/mod.rs
@@ -1,21 +1,9 @@
 //! Durable request identity and replayable Git responses.
 
-use std::{
-    error::Error as StdError,
-    time::{SystemTime, UNIX_EPOCH},
-};
-
-use cellule_runtime::{
-    CellModule, Command, Error, InvocationError, MutationIdentity, codec::BoundedDecoder,
-    codec::BoundedEncoder, codec::CodecError, codec::WireValue, identity::RequestId,
-    primitives::sql::SqlBatch, primitives::sql::SqlStatement, primitives::sql::SqlValue,
-    registry::CommandContext, registry::CommandResult,
-};
-
+use crate::RepositoryCell;
 use crate::access::READ_ACCESS;
-use crate::{
-    PushPlan, RepositoryCell, RepositoryModule, git_http::GitHttpResponse, refs::apply_refs,
-};
+use cellule_runtime::primitives::sql::{SqlBatch, SqlStatement, SqlValue};
+use std::error::Error as StdError;
 
 /// One completed push's authenticated, durable audit annotation.
 #[derive(Debug, serde::Serialize)]
@@ -38,11 +26,8 @@ pub(crate) fn valid_options(options: &[String]) -> bool {
 }
 
 mod certificate;
-mod plan;
-use certificate::{CertificateMeta, certificate_complete};
 pub use certificate::{PushCertificateReceipt, VerifiedPushCertificate};
 pub(crate) mod report;
-use plan::StagedPlan;
 
 pub(crate) const CHUNK_BYTES: usize = 512 * 1024;
 pub(crate) const MAX_RESPONSE_BYTES: usize = 64 * 1024 * 1024;
@@ -76,7 +61,7 @@ impl RepositoryCell {
     ) -> Result<Option<PushReceipt>, PushError> {
         crate::directory::validate_component(actor).map_err(cell)?;
         let result = self.sql.query(None, SqlBatch { statements: vec![SqlStatement {
-            sql: format!("SELECT p.actor, p.options, c.digest, c.signer, c.key, c.recorded_at_ms FROM pushes p LEFT JOIN push_certificates c ON c.push_id = p.id WHERE p.id = ?2 AND p.response_id IS NOT NULL AND (p.actor = ?1 OR EXISTS (SELECT 1 FROM repository_identity WHERE owner = ?1)) AND ({READ_ACCESS})"),
+            sql: format!("SELECT p.actor, p.options, c.digest, c.signer, c.key, c.recorded_at_ms, p.response_root FROM pushes p LEFT JOIN push_certificates c ON c.push_id = p.id WHERE p.id = ?2 AND p.response_id IS NOT NULL AND (p.actor = ?1 OR EXISTS (SELECT 1 FROM repository_identity WHERE owner = ?1)) AND ({READ_ACCESS})"),
             parameters: vec![SqlValue::Text(actor.into()), SqlValue::Blob(id.to_vec())],
         }]}).await.map_err(cell)?;
         let set = result.output.first().ok_or(PushError::InvalidResponse)?;
@@ -90,12 +75,23 @@ impl RepositoryCell {
             signer,
             key,
             recorded_at_ms,
+            root,
         ] = row.as_slice()
         else {
             return Err(PushError::InvalidResponse);
         };
-        let options: Vec<String> =
-            serde_json::from_str(options).map_err(|_| PushError::InvalidResponse)?;
+        let options: Vec<String> = match root {
+            SqlValue::Blob(bytes) => self
+                .staging_coordinator()
+                .map_err(cell)?
+                .completed_options(bytes)
+                .await
+                .map_err(cell)?,
+            SqlValue::Null => {
+                serde_json::from_str(options).map_err(|_| PushError::InvalidResponse)?
+            }
+            _ => return Err(PushError::InvalidResponse),
+        };
         if !valid_options(&options) {
             return Err(PushError::InvalidResponse);
         }
@@ -121,483 +117,4 @@ impl RepositoryCell {
             certificate,
         }))
     }
-
-    pub(crate) async fn completed_response(
-        &self,
-        push_id: [u8; 16],
-    ) -> Result<GitHttpResponse, PushError> {
-        let result = self
-            .sql
-            .query(
-                None,
-                SqlBatch {
-                    statements: vec![SqlStatement {
-                        sql: "SELECT response_id, rejected, rejection_reason FROM pushes WHERE id = ?1".into(),
-                        parameters: vec![SqlValue::Blob(push_id.to_vec())],
-                    }],
-                },
-            )
-            .await
-            .map_err(cell)?;
-        let Some([SqlValue::Blob(id), SqlValue::Integer(rejected), reason]) = result
-            .output
-            .first()
-            .and_then(|set| set.rows.first())
-            .map(Vec::as_slice)
-        else {
-            return Err(PushError::InvalidResponse);
-        };
-        let response = self
-            .push_response(
-                id.as_slice()
-                    .try_into()
-                    .map_err(|_| PushError::InvalidResponse)?,
-            )
-            .await?;
-        match (rejected, reason) {
-            (0, SqlValue::Null) => Ok(response),
-            (1, SqlValue::Null) => report::rejected_report(&response, report::REJECTED),
-            (1, SqlValue::Text(reason)) => report::rejected_report(&response, reason),
-            _ => Err(PushError::InvalidResponse),
-        }
-    }
-
-    pub(crate) async fn begin_push(
-        &self,
-        id: [u8; 16],
-        actor: &str,
-        digest: [u8; 32],
-    ) -> Result<bool, PushError> {
-        let result = self.sql.batch(identity()?, SqlBatch { statements: vec![
-            SqlStatement {
-                sql: "INSERT INTO pushes (id, actor, request_digest) VALUES (?1, ?2, ?3) ON CONFLICT(id) DO NOTHING".into(),
-                parameters: vec![SqlValue::Blob(id.to_vec()), SqlValue::Text(actor.into()), SqlValue::Blob(digest.to_vec())],
-            },
-            SqlStatement {
-                sql: "SELECT actor, request_digest, response_id FROM pushes WHERE id = ?1".into(),
-                parameters: vec![SqlValue::Blob(id.to_vec())],
-            },
-        ]}).await.map_err(cell)?;
-        let row = result
-            .output
-            .get(1)
-            .and_then(|set| set.rows.first())
-            .ok_or(PushError::InvalidResponse)?;
-        let [
-            SqlValue::Text(stored_actor),
-            SqlValue::Blob(stored_digest),
-            response,
-        ] = row.as_slice()
-        else {
-            return Err(PushError::InvalidResponse);
-        };
-        if stored_actor != actor || stored_digest.as_slice() != digest {
-            return Err(PushError::Conflict);
-        }
-        match response {
-            SqlValue::Null => Ok(false),
-            SqlValue::Blob(id) if id.len() == 16 => Ok(true),
-            _ => Err(PushError::InvalidResponse),
-        }
-    }
-
-    pub(crate) async fn stage_push_response(
-        &self,
-        push_id: [u8; 16],
-        response: &GitHttpResponse,
-    ) -> Result<[u8; 16], PushError> {
-        if response.body.len() > MAX_RESPONSE_BYTES {
-            return Err(PushError::InvalidResponse);
-        }
-        let id = uuid::Uuid::new_v4().into_bytes();
-        let headers = serde_json::to_string(&response.headers)?;
-        if headers.len() > 64 * 1024 {
-            return Err(PushError::InvalidResponse);
-        }
-        let mut statements = vec![SqlStatement {
-            sql: "INSERT INTO push_responses (id, push_id, status, headers, size, digest) VALUES (?1, ?2, ?3, ?4, ?5, ?6)".into(),
-            parameters: vec![SqlValue::Blob(id.to_vec()), SqlValue::Blob(push_id.to_vec()), SqlValue::Integer(i64::from(response.status)), SqlValue::Text(headers), SqlValue::Integer(response.body.len() as i64), SqlValue::Blob(blake3::hash(&response.body).as_bytes().to_vec())],
-        }];
-        for (part, body) in response.body.chunks(CHUNK_BYTES).enumerate() {
-            statements.push(SqlStatement {
-                sql:
-                    "INSERT INTO push_response_chunks (response_id, part, body) VALUES (?1, ?2, ?3)"
-                        .into(),
-                parameters: vec![
-                    SqlValue::Blob(id.to_vec()),
-                    SqlValue::Integer(part as i64),
-                    SqlValue::Blob(body.to_vec()),
-                ],
-            });
-            self.sql
-                .batch(
-                    identity()?,
-                    SqlBatch {
-                        statements: std::mem::take(&mut statements),
-                    },
-                )
-                .await
-                .map_err(cell)?;
-        }
-        if !statements.is_empty() {
-            self.sql
-                .batch(identity()?, SqlBatch { statements })
-                .await
-                .map_err(cell)?;
-        }
-        Ok(id)
-    }
-
-    async fn push_response(&self, id: [u8; 16]) -> Result<GitHttpResponse, PushError> {
-        let result =
-            self.sql
-                .query(
-                    None,
-                    SqlBatch {
-                        statements: vec![SqlStatement {
-            sql: "SELECT status, headers, size, digest FROM push_responses WHERE id = ?1".into(),
-            parameters: vec![SqlValue::Blob(id.to_vec())],
-        }],
-                    },
-                )
-                .await
-                .map_err(cell)?;
-        let row = result
-            .output
-            .first()
-            .and_then(|set| set.rows.first())
-            .ok_or(PushError::InvalidResponse)?;
-        let [
-            SqlValue::Integer(status),
-            SqlValue::Text(headers),
-            SqlValue::Integer(size),
-            SqlValue::Blob(digest),
-        ] = row.as_slice()
-        else {
-            return Err(PushError::InvalidResponse);
-        };
-        let size = usize::try_from(*size).map_err(|_| PushError::InvalidResponse)?;
-        if size > MAX_RESPONSE_BYTES {
-            return Err(PushError::InvalidResponse);
-        }
-        let mut body = Vec::with_capacity(size);
-        for part in 0..size.div_ceil(CHUNK_BYTES) {
-            let result = self.sql.query(None, SqlBatch { statements: vec![SqlStatement {
-                sql: "SELECT body FROM push_response_chunks WHERE response_id = ?1 AND part = ?2".into(),
-                parameters: vec![SqlValue::Blob(id.to_vec()), SqlValue::Integer(part as i64)],
-            }]}).await.map_err(cell)?;
-            let row = result
-                .output
-                .first()
-                .and_then(|set| set.rows.first())
-                .ok_or(PushError::InvalidResponse)?;
-            let [SqlValue::Blob(chunk)] = row.as_slice() else {
-                return Err(PushError::InvalidResponse);
-            };
-            if body.len() + chunk.len() > size {
-                return Err(PushError::InvalidResponse);
-            }
-            body.extend_from_slice(chunk);
-        }
-        if body.len() != size || blake3::hash(&body).as_bytes().as_slice() != digest {
-            return Err(PushError::InvalidResponse);
-        }
-        Ok(GitHttpResponse {
-            status: u16::try_from(*status).map_err(|_| PushError::InvalidResponse)?,
-            headers: serde_json::from_str(headers)?,
-            body,
-        })
-    }
-
-    pub(crate) async fn complete_push(
-        &self,
-        input: PushCompletion,
-    ) -> Result<cellule_runtime::Committed<bool>, InvocationError<bool>> {
-        if !valid_options(&input.options) {
-            return Err(InvocationError::NotStarted(Error::Command(
-                "invalid push options",
-            )));
-        }
-        let certificate = if let Some(certificate) = &input.certificate {
-            if certificate.target != self.target || certificate.request_digest != input.digest {
-                return Err(InvocationError::NotStarted(Error::Command(
-                    "signed push witness context differs",
-                )));
-            }
-            Some(self.stage_push_certificate(input.id, certificate).await?)
-        } else {
-            None
-        };
-        if let Some(plan) = &input.plan {
-            self.prepare_graph(plan).await?;
-            self.prepare_branch_proofs(plan).await?;
-        }
-        let plan = match &input.plan {
-            Some(plan) => {
-                if plan.actor != input.actor {
-                    return Err(InvocationError::NotStarted(Error::Command(
-                        "push plan actor mismatch",
-                    )));
-                }
-                Some(
-                    self.stage_push_plan(input.response_id, plan)
-                        .await
-                        .map_err(|source| {
-                            InvocationError::NotStarted(Error::Facility {
-                                name: "push ref staging",
-                                source: Box::new(source),
-                            })
-                        })?,
-                )
-            }
-            None => None,
-        };
-        let input = CompletePushInput {
-            id: input.id,
-            actor: input.actor,
-            digest: input.digest,
-            response_id: input.response_id,
-            options: input.options,
-            plan,
-            certificate,
-        };
-        let identity = identity().map_err(|_| {
-            InvocationError::NotStarted(Error::Command("push mutation clock failed"))
-        })?;
-        self.application
-            .command::<CompletePush>(&self.target, identity, input)
-            .await
-    }
-}
-
-pub(crate) struct PushCompletion {
-    pub id: [u8; 16],
-    pub actor: String,
-    pub digest: [u8; 32],
-    pub response_id: [u8; 16],
-    pub options: Vec<String>,
-    pub plan: Option<PushPlan>,
-    pub certificate: Option<VerifiedPushCertificate>,
-}
-
-pub(crate) struct CompletePushInput {
-    id: [u8; 16],
-    actor: String,
-    digest: [u8; 32],
-    response_id: [u8; 16],
-    options: Vec<String>,
-    plan: Option<StagedPlan>,
-    certificate: Option<CertificateMeta>,
-}
-
-impl WireValue for CompletePushInput {
-    fn encode(&self, encoder: &mut BoundedEncoder) -> Result<(), CodecError> {
-        encoder.write_bytes(&self.id)?;
-        encoder.write_text(&self.actor)?;
-        encoder.write_bytes(&self.digest)?;
-        encoder.write_bytes(&self.response_id)?;
-        encoder.write_bytes(
-            &serde_json::to_vec(&self.options).map_err(|_| CodecError::Invalid("push options"))?,
-        )?;
-        encoder.write_bool(self.plan.is_some())?;
-        if let Some(plan) = &self.plan {
-            plan.encode(encoder)?;
-        }
-        encoder.write_bool(self.certificate.is_some())?;
-        if let Some(certificate) = &self.certificate {
-            encoder.write_bytes(&certificate.digest)?;
-            encoder.write_u64(certificate.size as u64)?;
-            encoder.write_text(&certificate.signer)?;
-            encoder.write_text(&certificate.key)?;
-        }
-        Ok(())
-    }
-    fn decode(decoder: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
-        Ok(Self {
-            id: fixed(decoder)?,
-            actor: decoder.read_text()?.into(),
-            digest: fixed(decoder)?,
-            response_id: fixed(decoder)?,
-            options: serde_json::from_slice(decoder.read_bytes()?)
-                .map_err(|_| CodecError::Invalid("push options"))?,
-            plan: if decoder.read_bool()? {
-                Some(StagedPlan::decode(decoder)?)
-            } else {
-                None
-            },
-            certificate: if decoder.read_bool()? {
-                Some(CertificateMeta {
-                    digest: fixed(decoder)?,
-                    size: i64::try_from(decoder.read_u64()?)
-                        .map_err(|_| CodecError::Invalid("invalid certificate size"))?,
-                    signer: decoder.read_text()?.into(),
-                    key: decoder.read_text()?.into(),
-                })
-            } else {
-                None
-            },
-        })
-    }
-}
-
-fn fixed<const N: usize>(decoder: &mut BoundedDecoder<'_>) -> Result<[u8; N], CodecError> {
-    decoder
-        .read_bytes()?
-        .try_into()
-        .map_err(|_| CodecError::Invalid("invalid push identity length"))
-}
-
-pub(crate) struct CompletePush;
-
-impl Command for CompletePush {
-    const MODULE: &'static str = RepositoryModule::NAME;
-    const ID: u32 = 4;
-    const CODEC_VERSION: u32 = 6;
-    type Input = CompletePushInput;
-    type Output = bool;
-
-    fn execute(
-        context: &mut CommandContext<'_, '_>,
-        input: Self::Input,
-    ) -> cellule_runtime::Result<CommandResult<bool>> {
-        if !valid_options(&input.options) {
-            return Ok(CommandResult::Rejected(false));
-        }
-        let result = context.sql(&SqlBatch { statements: vec![SqlStatement {
-            sql: "SELECT response_id FROM pushes WHERE id = ?1 AND actor = ?2 AND request_digest = ?3".into(),
-            parameters: vec![SqlValue::Blob(input.id.to_vec()), SqlValue::Text(input.actor.clone()), SqlValue::Blob(input.digest.to_vec())],
-        }]})?;
-        match result
-            .first()
-            .and_then(|set| set.rows.first())
-            .map(Vec::as_slice)
-        {
-            Some([SqlValue::Blob(_)]) => return Ok(CommandResult::Success(true)),
-            Some([SqlValue::Null]) => {}
-            _ => return Ok(CommandResult::Rejected(false)),
-        }
-        if !response_complete(context, input.id, input.response_id)? {
-            return Ok(CommandResult::Rejected(false));
-        }
-        // The final Cell decision must bind the signed principal to the push actor.
-        if let Some(certificate) = &input.certificate
-            && (certificate.signer != input.actor
-                || !certificate_complete(context, input.id, certificate)?)
-        {
-            return Ok(CommandResult::Rejected(false));
-        }
-        let replay = if let Some(certificate) = &input.certificate {
-            let rows = context.sql(&SqlBatch {
-                statements: vec![SqlStatement {
-                    sql: "SELECT push_id FROM push_certificates WHERE digest = ?1".into(),
-                    parameters: vec![SqlValue::Blob(certificate.digest.to_vec())],
-                }],
-            })?;
-            !rows
-                .first()
-                .ok_or(Error::Command("missing certificate replay result"))?
-                .rows
-                .is_empty()
-        } else {
-            false
-        };
-        let rejected = if replay {
-            true
-        } else if let Some(plan) = &input.plan {
-            let plan = plan.load(context, input.response_id, &input.actor)?;
-            // apply_refs returns false only before any writes. A policy/CAS/ACL
-            // refusal records rejection without publishing refs; SQL failures
-            // still roll back the whole completion transaction.
-            !apply_refs(context, &plan, None)?
-        } else {
-            // Native errors and no-op pushes mutate no refs. Record their
-            // bound outcome even if write permission was revoked after admission.
-            false
-        };
-        if let Some(certificate) = &input.certificate
-            && !replay
-        {
-            // Keep the exact signed bytes with the decision. A second push ID
-            // cannot publish the same certificate, even after ref ABA or takeover.
-            context.sql(&SqlBatch { statements: vec![SqlStatement {
-                sql: "INSERT INTO push_certificates (digest, push_id, actor, signer, key, size, recorded_at_ms) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)".into(),
-                parameters: vec![SqlValue::Blob(certificate.digest.to_vec()), SqlValue::Blob(input.id.to_vec()), SqlValue::Text(input.actor.clone()), SqlValue::Text(certificate.signer.clone()), SqlValue::Text(certificate.key.clone()), SqlValue::Integer(certificate.size), SqlValue::Integer(context.now_ms())],
-            }]})?;
-        }
-        // Publishing the response in the ref transaction makes a lost HTTP reply replayable.
-        // Staged chunks from interrupted attempts are never returned as completed outcomes.
-        context.sql(&SqlBatch {
-            statements: vec![SqlStatement {
-                sql: "UPDATE pushes SET response_id = ?1, rejected = ?3, options = ?4, rejection_reason = ?5 WHERE id = ?2 AND response_id IS NULL"
-                    .into(),
-                parameters: vec![
-                    SqlValue::Blob(input.response_id.to_vec()),
-                    SqlValue::Blob(input.id.to_vec()),
-                    SqlValue::Integer(i64::from(rejected)),
-                    SqlValue::Text(serde_json::to_string(&input.options).map_err(|_| Error::Command("invalid push options"))?),
-                    if replay { SqlValue::Text("Canopy signed push certificate was already used".into()) } else { SqlValue::Null },
-                ],
-            }],
-        })?;
-        // Replays need only the saved response. Reclaim the plan atomically
-        // with publication so rollback keeps every staged chunk available.
-        context.sql(&SqlBatch {
-            statements: vec![SqlStatement {
-                sql: "DELETE FROM push_plan_chunks WHERE response_id = ?1".into(),
-                parameters: vec![SqlValue::Blob(input.response_id.to_vec())],
-            }],
-        })?;
-        if replay {
-            context.sql(&SqlBatch {
-                statements: vec![SqlStatement {
-                    sql: "DELETE FROM push_certificate_chunks WHERE push_id = ?1".into(),
-                    parameters: vec![SqlValue::Blob(input.id.to_vec())],
-                }],
-            })?;
-        }
-        Ok(CommandResult::Success(true))
-    }
-}
-
-fn response_complete(
-    context: &CommandContext<'_, '_>,
-    push_id: [u8; 16],
-    response_id: [u8; 16],
-) -> cellule_runtime::Result<bool> {
-    let result = context.sql(&SqlBatch { statements: vec![SqlStatement {
-        sql: "SELECT r.size, count(c.part), coalesce(sum(length(c.body)), 0), coalesce(min(c.part), 0), coalesce(max(c.part), -1) FROM push_responses r LEFT JOIN push_response_chunks c ON c.response_id = r.id WHERE r.id = ?1 AND r.push_id = ?2 GROUP BY r.id".into(),
-        parameters: vec![SqlValue::Blob(response_id.to_vec()), SqlValue::Blob(push_id.to_vec())],
-    }]})?;
-    let Some(
-        [
-            SqlValue::Integer(size),
-            SqlValue::Integer(count),
-            SqlValue::Integer(total),
-            SqlValue::Integer(first),
-            SqlValue::Integer(last),
-        ],
-    ) = result
-        .first()
-        .and_then(|set| set.rows.first())
-        .map(Vec::as_slice)
-    else {
-        return Ok(false);
-    };
-    let expected = (*size + CHUNK_BYTES as i64 - 1) / CHUNK_BYTES as i64;
-    Ok(*count == expected && size == total && *first == 0 && *last == expected - 1)
-}
-
-fn identity() -> Result<MutationIdentity, PushError> {
-    let now = i64::try_from(
-        SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .map_err(|_| PushError::Clock)?
-            .as_millis(),
-    )
-    .map_err(|_| PushError::Clock)?;
-    Ok(MutationIdentity {
-        request_id: RequestId::from_bytes(uuid::Uuid::new_v4().into_bytes()),
-        issued_at_ms: now,
-        expires_at_ms: now.checked_add(60_000).ok_or(PushError::Clock)?,
-    })
 }
diff --git a/crates/canopy-server/src/push/plan.rs b/crates/canopy-server/src/push/plan.rs
deleted file mode 100644
index 301175d4..00000000
--- a/crates/canopy-server/src/push/plan.rs
+++ /dev/null
@@ -1,113 +0,0 @@
-use super::*;
-use crate::refs::MAX_UPDATES;
-
-const UPDATES_PER_CHUNK: usize = 128;
-const CHUNK_LIMIT: u32 = 64 * 1024;
-
-// Completion carries a small immutable binding, not the potentially large ref
-// list. Count, actor and digest checks prevent incomplete or mixed attempts
-// from reaching the single authoritative ref transaction.
-pub(super) struct StagedPlan {
-    updates: usize,
-    digest: [u8; 32],
-}
-
-impl WireValue for StagedPlan {
-    fn encode(&self, encoder: &mut BoundedEncoder) -> Result<(), CodecError> {
-        encoder.write_count(self.updates)?;
-        encoder.write_bytes(&self.digest)
-    }
-
-    fn decode(decoder: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
-        let updates = decoder.read_count()?;
-        if !(1..=MAX_UPDATES).contains(&updates) {
-            return Err(CodecError::Invalid("push update count is outside bounds"));
-        }
-        Ok(Self {
-            updates,
-            digest: fixed(decoder)?,
-        })
-    }
-}
-
-impl RepositoryCell {
-    pub(super) async fn stage_push_plan(
-        &self,
-        response: [u8; 16],
-        plan: &PushPlan,
-    ) -> Result<StagedPlan, PushError> {
-        if !(1..=MAX_UPDATES).contains(&plan.updates.len()) {
-            return Err(PushError::InvalidPlan);
-        }
-        let mut digest = blake3::Hasher::new();
-        for (part, updates) in plan.updates.chunks(UPDATES_PER_CHUNK).enumerate() {
-            let mut encoder = BoundedEncoder::new(CHUNK_LIMIT).map_err(cell)?;
-            PushPlan {
-                actor: plan.actor.clone(),
-                updates: updates.to_vec(),
-            }
-            .encode(&mut encoder)
-            .map_err(cell)?;
-            let body = encoder.finish();
-            digest.update(&body);
-            self.sql.batch(identity()?, SqlBatch { statements: vec![SqlStatement {
-                sql: "INSERT INTO push_plan_chunks (response_id, part, body) VALUES (?1, ?2, ?3)".into(),
-                parameters: vec![SqlValue::Blob(response.to_vec()), SqlValue::Integer(part as i64), SqlValue::Blob(body)],
-            }] }).await.map_err(cell)?;
-        }
-        Ok(StagedPlan {
-            updates: plan.updates.len(),
-            digest: *digest.finalize().as_bytes(),
-        })
-    }
-}
-
-impl StagedPlan {
-    pub(super) fn load(
-        &self,
-        context: &CommandContext<'_, '_>,
-        response: [u8; 16],
-        actor: &str,
-    ) -> cellule_runtime::Result<PushPlan> {
-        let mut digest = blake3::Hasher::new();
-        let mut updates = Vec::new();
-        let parts = self.updates.div_ceil(UPDATES_PER_CHUNK);
-        for part in 0..parts {
-            let result = context.sql(&SqlBatch {
-                statements: vec![SqlStatement {
-                    sql: "SELECT body FROM push_plan_chunks WHERE response_id = ?1 AND part = ?2"
-                        .into(),
-                    parameters: vec![
-                        SqlValue::Blob(response.to_vec()),
-                        SqlValue::Integer(part as i64),
-                    ],
-                }],
-            })?;
-            let Some([SqlValue::Blob(body)]) = result
-                .first()
-                .and_then(|set| set.rows.first())
-                .map(Vec::as_slice)
-            else {
-                return Err(Error::Command("push ref plan is incomplete"));
-            };
-            digest.update(body);
-            let mut decoder = BoundedDecoder::new(body, CHUNK_LIMIT)?;
-            let chunk = PushPlan::decode(&mut decoder)?;
-            decoder.finish()?;
-            let expected = (self.updates - updates.len()).min(UPDATES_PER_CHUNK);
-            if chunk.actor != actor || chunk.updates.len() != expected {
-                return Err(Error::Command(
-                    "push ref plan does not match its publication",
-                ));
-            }
-            updates.extend(chunk.updates);
-        }
-        if digest.finalize().as_bytes() != &self.digest {
-            return Err(Error::Command("push ref plan digest mismatch"));
-        }
-        Ok(PushPlan {
-            actor: actor.into(),
-            updates,
-        })
-    }
-}
diff --git a/crates/canopy-server/src/push/report.rs b/crates/canopy-server/src/push/report.rs
index f1e94542..4bc431f5 100644
--- a/crates/canopy-server/src/push/report.rs
+++ b/crates/canopy-server/src/push/report.rs
@@ -1,4 +1,5 @@
 use super::*;
+use crate::{PushPlan, git_http::GitHttpResponse};
 
 pub(crate) const REJECTED: &str =
     "Canopy publication rejected: refs, permissions or policy changed; fetch and retry";
@@ -82,8 +83,10 @@ pub(crate) fn publication_matches(
         };
         let name = std::str::from_utf8(name).map_err(|_| PushError::InvalidResponse)?;
         if !crate::refs::valid_ref_name(name)
-            || !seen.insert(name)
-            || seen.len() > crate::refs::MAX_UPDATES
+            // A limit hook can reject more commands than we admit for a
+            // publication. All-refusal reports need no per-name inventory:
+            // every successful name still fails against the empty plan below.
+            || (plan.is_some() && (!seen.insert(name) || seen.len() > crate::refs::MAX_UPDATES))
             || (success && (unpack != b"unpack ok\n" || !expected.remove(name)))
             || (!success && expected.contains(name))
         {
@@ -308,6 +311,26 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn oversized_all_refusal_report_is_valid_but_cannot_acknowledge_one_ref()
+    -> Result<(), PushError> {
+        let mut report = Vec::new();
+        write_packet(&mut report, b"unpack ok\n")?;
+        for n in 0..=crate::refs::MAX_UPDATES {
+            write_packet(
+                &mut report,
+                format!("ng refs/tags/{n} pre-receive hook declined\n").as_bytes(),
+            )?;
+        }
+        report.extend_from_slice(b"0000");
+        assert!(publication_matches(&response(report.clone()), None).is_ok());
+        report.truncate(report.len() - 4);
+        write_packet(&mut report, b"ok refs/heads/unvalidated\n")?;
+        report.extend_from_slice(b"0000");
+        assert!(publication_matches(&response(report), None).is_err());
+        Ok(())
+    }
+
     #[test]
     fn malformed_reports_cannot_be_rewritten_as_success() {
         for body in [
diff --git a/crates/canopy-server/src/repository_http/default_branch.rs b/crates/canopy-server/src/repository_http/default_branch.rs
index dc8f45b1..f1402aad 100644
--- a/crates/canopy-server/src/repository_http/default_branch.rs
+++ b/crates/canopy-server/src/repository_http/default_branch.rs
@@ -14,15 +14,23 @@ pub(super) async fn read(
     Path(name): Path<String>,
     headers: axum::http::HeaderMap,
 ) -> Response<Body> {
-    let (route, _) = match readable_route(&state, &name, &headers).await {
+    let (route, actor) = match readable_route(&state, &name, &headers).await {
         Ok(authorized) => authorized,
         Err(response) => return response,
     };
-    match route.repository.default_branch(None).await {
+    let head = async {
+        let snapshot = route.repository.serving_snapshot(actor.identity()).await?;
+        snapshot
+            .resolve_ref(None)
+            .await
+            .map_err(crate::packs::publication::ServingOwnerError::from)
+    }
+    .await;
+    match head {
         Ok(head) if (state.manager.ready)() => response(
             route.repository.repository_id(),
-            &head.output.reference,
-            head.output.generation,
+            &head.reference,
+            head.generation,
         ),
         Ok(_) => plain(StatusCode::SERVICE_UNAVAILABLE, "Canopy node is not ready"),
         Err(error) => {
diff --git a/crates/canopy-server/src/server/lifecycle.rs b/crates/canopy-server/src/server/lifecycle.rs
index 2476c597..24275ca3 100644
--- a/crates/canopy-server/src/server/lifecycle.rs
+++ b/crates/canopy-server/src/server/lifecycle.rs
@@ -112,7 +112,6 @@ impl CanopyServer {
 
 impl RunningServer {
     pub(super) async fn shutdown(mut self) -> Result<(), ServerError> {
-        self.native.close();
         self.maintenance_stop.cancel();
         self.repositories.recovery_scans.close();
         self.ingress_stop.cancel();
@@ -124,6 +123,7 @@ impl RunningServer {
         };
         self.listeners.stop_ingress();
         self.repositories.drain_serving().await;
+        self.native.close();
         self.tasks.close();
         self.tasks.wait().await;
         self.repositories.drain_recovery().await;
diff --git a/crates/canopy-server/src/server/residency/recovery.rs b/crates/canopy-server/src/server/residency/recovery.rs
index d559ac91..6ba2c5f8 100644
--- a/crates/canopy-server/src/server/residency/recovery.rs
+++ b/crates/canopy-server/src/server/residency/recovery.rs
@@ -41,6 +41,10 @@ impl RecoveryServices {
             manager.publication_budget.clone(),
         )
         .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?;
+        let store = Arc::new(ArtifactStore::new(
+            Arc::clone(&manager.external_store),
+            entry.repository_id,
+        ));
         let staging = Arc::new(
             StagingCoordinator::new_resident(
                 client.clone(),
@@ -49,16 +53,13 @@ impl RecoveryServices {
                 authority.clone(),
                 manager.staging_budget.clone(),
                 coordinator.clone(),
+                store.clone(),
             )
             .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
         );
         let settings = manager
             .recovery_scans
             .settings(RecoveryScanLimits::default(), &entry.owner);
-        let store = Arc::new(ArtifactStore::new(
-            Arc::clone(&manager.external_store),
-            entry.repository_id,
-        ));
         let serving = Arc::new(
             ServingPool::new(
                 ServingContext::new(
@@ -225,8 +226,14 @@ impl RepositoryManager {
                 .collect()
         };
         for service in &services {
-            service.staging.close();
+            service.staging.close_admission();
         }
+        futures_util::future::join_all(
+            services
+                .iter()
+                .map(|service| service.staging.finish_receive_workflows()),
+        )
+        .await;
         // Producer capabilities may retain serving generations and exact held
         // publication work. Drain them before closing either lower service.
         futures_util::future::join_all(services.iter().map(|service| service.drain_staging()))
diff --git a/crates/canopy-server/tests/multi_server/compatibility.rs b/crates/canopy-server/tests/multi_server/compatibility.rs
index b2fa926b..fd4faec3 100644
--- a/crates/canopy-server/tests/multi_server/compatibility.rs
+++ b/crates/canopy-server/tests/multi_server/compatibility.rs
@@ -9,6 +9,9 @@ async fn refs(path: &Path) -> Result<Vec<u8>> {
 
 #[tokio::test(flavor = "multi_thread")]
 async fn stock_git_history_refs_and_shallow_fetch_survive_fresh_disk_restore() -> Result {
+    let _ = tracing_subscriber::fmt()
+        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+        .try_init();
     let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
     let workspace = tempfile::TempDir::new()?;
     let address = available_address().await?;
diff --git a/crates/canopy-server/tests/multi_server/ssh/publication.rs b/crates/canopy-server/tests/multi_server/ssh/publication.rs
index aa9c8697..f815223e 100644
--- a/crates/canopy-server/tests/multi_server/ssh/publication.rs
+++ b/crates/canopy-server/tests/multi_server/ssh/publication.rs
@@ -179,7 +179,7 @@ async fn late_ssh_push_refusals_report_both_refs_and_survive_restore() -> Result
         let error = String::from_utf8(output.stderr)?;
         assert!(!output.status.success(), "{change}: {error}");
         let reason = if change == "storage" {
-            "Canopy object ingestion failed"
+            "Canopy push failed before publication"
         } else {
             "Canopy publication rejected"
         };
@@ -344,10 +344,10 @@ async fn cold_ssh_push_preparation_failure_reports_rejection_before_any_refs_cha
         store,
         server,
         host,
+        key,
         source,
         ssh,
         url,
-        ..
     } = fixture().await?;
     git(Some(&source), &ssh, &["push", &url, "main"]).await?;
     server.shutdown().await?;
@@ -365,35 +365,84 @@ async fn cold_ssh_push_preparation_failure_reports_rejection_before_any_refs_cha
     let client = reqwest::Client::new();
     let before = generation(&client, address).await?;
     let original = git(None, &ssh, &["ls-remote", "--refs", &url]).await?;
+    // Finish discovery before arming the provider fault. It must reject the
+    // owned push preparation, rather than fail before any command was sent.
+    let session = connect(ssh_address, &host, &key, "git", true).await?;
+    let mut channel = session.channel_open_session().await?;
+    channel
+        .exec(true, "git-receive-pack 'canopy/publication.git'")
+        .await?;
+    tokio::time::timeout(Duration::from_secs(5), async {
+        let mut advertised = Vec::new();
+        loop {
+            match channel.wait().await.ok_or("SSH advertisement missing")? {
+                russh::ChannelMsg::Data { data } => {
+                    advertised.extend_from_slice(&data);
+                    if advertised.ends_with(b"0000") {
+                        return Ok::<_, Box<dyn std::error::Error>>(());
+                    }
+                }
+                russh::ChannelMsg::Close | russh::ChannelMsg::Failure => {
+                    return Err("SSH discovery rejected".into());
+                }
+                _ => {}
+            }
+        }
+    })
+    .await??;
+    let tip = String::from_utf8(git(Some(&source), &ssh, &["rev-parse", "HEAD"]).await?)?;
+    let mut body = Vec::new();
+    for (n, name) in ["preparation", "準備"].iter().enumerate() {
+        let capabilities = if n == 0 { "\0report-status atomic" } else { "" };
+        let command = format!(
+            "{} {} refs/heads/{name}{capabilities}\n",
+            "0".repeat(40),
+            tip.trim()
+        );
+        body.extend_from_slice(format!("{:04x}{command}", command.len() + 4).as_bytes());
+    }
+    body.extend_from_slice(b"0000");
+    body.extend(git(Some(&source), &ssh, &["pack-objects", "--all", "--stdout"]).await?);
     store.read_armed.store(true, Ordering::SeqCst);
-    let child = git_command(
-        Some(&source),
-        &ssh,
-        &[
-            "push",
-            "--atomic",
-            &url,
-            "HEAD:refs/heads/preparation",
-            "HEAD:refs/heads/準備",
-        ],
-    )
-    .stdout(Stdio::piped())
-    .stderr(Stdio::piped())
-    .spawn()?;
+    channel.data(body.as_slice()).await?;
+    channel.eof().await?;
     tokio::time::timeout(Duration::from_secs(15), store.entered.notified()).await?;
     store.fail.store(true, Ordering::SeqCst);
     store.proceed.notify_one();
-    let output = child.wait_with_output().await?;
-    let error = String::from_utf8_lossy(&output.stderr);
-    assert!(!output.status.success(), "{error}");
+    let report = tokio::time::timeout(Duration::from_secs(15), async {
+        let mut report = Vec::new();
+        loop {
+            match channel.wait().await {
+                Some(russh::ChannelMsg::Data { data }) => report.extend_from_slice(&data),
+                Some(russh::ChannelMsg::Close) | None => break,
+                Some(russh::ChannelMsg::Failure) => return Err("SSH report unavailable".into()),
+                _ => {}
+            }
+        }
+        Ok::<_, Box<dyn std::error::Error>>(report)
+    })
+    .await??;
+    let report = String::from_utf8(report)?;
+    assert!(
+        report.contains("unpack Canopy push failed before publication"),
+        "{report}"
+    );
     for name in ["preparation", "準備"] {
         assert!(
-            error.lines().any(|line| line.contains("[remote rejected]")
-                && line.contains(&format!(" -> {name} "))
-                && line.contains("Canopy push failed before publication")),
-            "{error}"
+            report.contains(&format!(
+                "ng refs/heads/{name} Canopy push failed before publication"
+            )),
+            "{report}"
+        );
+        assert!(
+            !report.contains(&format!("ok refs/heads/{name}\n")),
+            "{report}"
         );
     }
+    drop(channel);
+    let _ = session
+        .disconnect(russh::Disconnect::ByApplication, "test finished", "")
+        .await;
     assert_eq!(
         git(None, &ssh, &["ls-remote", "--refs", &url]).await?,
         original
diff --git a/crates/canopy-server/tests/support/paused_blobs.rs b/crates/canopy-server/tests/support/paused_blobs.rs
index 57329463..0a8fd61f 100644
--- a/crates/canopy-server/tests/support/paused_blobs.rs
+++ b/crates/canopy-server/tests/support/paused_blobs.rs
@@ -44,15 +44,18 @@ impl ObjectStore for PausedBlobs {
         path: &StorePath,
         options: PutMultipartOptions,
     ) -> object_store::Result<Box<dyn MultipartUpload>> {
-        // Large-blob ingestion starts only after native receive-pack has
-        // accepted the disposable refs, but before Cell ref publication.
-        if self.armed.swap(false, Ordering::SeqCst) {
+        // Native pack capture starts after receive-pack accepted disposable
+        // refs and before the certified joint root can become visible.
+        if path.as_ref().contains("/git-packs/")
+            && path.as_ref().contains("/staging/")
+            && self.armed.swap(false, Ordering::SeqCst)
+        {
             self.entered.notify_one();
             self.proceed.notified().await;
             if self.fail.swap(false, Ordering::SeqCst) {
                 return Err(object_store::Error::Generic {
                     store: "publication-race-store",
-                    source: Box::new(std::io::Error::other("injected blob ingestion failure")),
+                    source: Box::new(std::io::Error::other("injected native pack upload failure")),
                 });
             }
         }
@@ -63,7 +66,10 @@ impl ObjectStore for PausedBlobs {
         path: &StorePath,
         options: GetOptions,
     ) -> object_store::Result<GetResult> {
-        if path.as_ref().contains("/git-blobs/") && self.read_armed.swap(false, Ordering::SeqCst) {
+        if path.as_ref().contains("/git-packs/")
+            && (path.as_ref().contains("/pack/") || path.as_ref().ends_with("/pack"))
+            && self.read_armed.swap(false, Ordering::SeqCst)
+        {
             self.entered.notify_one();
             self.proceed.notified().await;
             if self.fail.swap(false, Ordering::SeqCst) {
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index 430caa5c..fa967df3 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -1,6 +1,6 @@
 # Service owned staging lifecycle
 
-`StagingCoordinator` now owns admitted Begin/Claim/Renew/RegisterStagedInputs/Bind commands, input and bound tasks and completed results through observer cancellation and exact outcome recovery. It composes the [stored staging phases](staged-input-retention.md) with fresh deadline observations and the existing private catalog pipeline. Production HTTP/SSH/mirror/generated producer selection, durable takeover reconstruction, full process admission and large-team qualification remain required.
+`StagingCoordinator` now owns admitted Begin/Claim/Renew/RegisterStagedInputs/Bind commands, input and bound tasks and completed results through observer cancellation and exact outcome recovery. It composes the [stored staging phases](staged-input-retention.md) with fresh deadline observations and the existing private catalog pipeline. Production HTTP/SSH receive-pack now selects this lifecycle. Generated producers, durable takeover reconstruction, complete physical admission and large-team qualification remain required.
 
 ## Admission and ownership
 
@@ -120,3 +120,30 @@ full-history deadline/throughput result. Resident service drain, adopted older
 input verification, remaining request/policy work and actual producer wiring
 remain release work. Current qualification and limits are tracked in the
 [implementation status](../large-repository-implementation-status.md).
+
+
+## Production receive workflow and shutdown grace
+
+HTTP and SSH transfer one authenticated encoded receive request to `drive_receive`
+before awaiting status. Its controller registers wire custody, retrieves staged
+native/result/descriptor outputs, registers checkpoints, drains physical workers,
+binds once, and orders the existing policy/ref/completed-root protocol. Each
+byte-bounded page advances by its actual minted end offset. Returned success is
+selected from the durable completed root under current read authorization.
+
+Node shutdown first closes ingress and staging admission. Already-owned receive
+controllers get a shared 30-second grace while serving, native admission, Cell
+heartbeat and workspace ownership remain available. The grace is a controller
+finish window, not a deadline for draining physical jobs or uncertain mutations.
+After it expires, ordinary forced close cancels/joins controllers and drains the
+existing worker/exact recovery owners before the lower services can close.
+Generic `drive` callback producers continue to cancel immediately. Public stop,
+lease/authority fencing and forced close retain their previous semantics.
+
+Stock SSH qualification disconnects the request after real native pack upload is
+paused, starts shutdown, proves release remains blocked, resumes upload, and
+checks the new commit and blob through cold clone and strict fsck. Late Write-to-Read
+revocation before Bind still requires a separately authorized durable refusal
+path. No current lease, completed receipt or generic callback may bypass that
+missing authority transition. Request/result/policy physical pins and authenticated
+older-owner adoption remain unfinished release gates.
diff --git a/docs/evidence/native-writer-ci-20261005.json b/docs/evidence/native-writer-ci-20261005.json
new file mode 100644
index 00000000..7951c028
--- /dev/null
+++ b/docs/evidence/native-writer-ci-20261005.json
@@ -0,0 +1,172 @@
+{
+  "recorded_at_utc": "2026-10-05T04:13:28.009295+00:00",
+  "base_head": "1ab3853d7411876c9f2c8fcc410e3bf409be35a1",
+  "source_files": 493,
+  "rust_files": 479,
+  "source_hash_digest": "3fde41e1f521f09f087f24a212fb9741ce095089e681c8b742ee7b08fc9db439",
+  "source_digest_algorithm": "SHA256 of sorted path + NUL + file SHA256 + newline for tracked/nonignored Rust, SQL, Cargo manifests/lock/toolchain files",
+  "manifest_log": "/tmp/canopy-native-writer-final-source.json",
+  "toolchain": "Rust 1.98.0",
+  "host": "macOS; isolated RustFS in Docker; Linux PR CI remains required",
+  "unique_cases": {
+    "passed": 821,
+    "failed": 36,
+    "ignored": 7,
+    "total": 864
+  },
+  "runs": {
+    "workspace": {
+      "log": "/tmp/canopy-native-writer-workspace2.log",
+      "sha256": "3791d77e95dc911a5b335519508fe6b1487fe14da9c2ed3c4fdb58f2468abf24",
+      "exit_code": 101,
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.78s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.53s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 707 filtered out; finished in 0.02s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 707 filtered out; finished in 0.09s",
+        "test result: ok. 708 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 319.23s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.02s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s",
+        "test result: FAILED. 74 passed; 32 failed; 9 ignored; 0 measured; 0 filtered out; finished in 345.37s"
+      ],
+      "failed_cases": [
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+        "ssh::stock_ssh_clone_push_fetch_filters_and_revocation_survive_disk_loss"
+      ]
+    },
+    "owner_restart": {
+      "log": "/tmp/canopy-native-writer-owner_restart1.log",
+      "sha256": "34742c00418a92c8b521a56932dfcf50feef59d0db00cc29009db672470fa5ac",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.50s"
+      ],
+      "failed_cases": [
+        "a_second_node_clones_from_the_published_root_after_local_disk_loss"
+      ]
+    },
+    "repository_cell": {
+      "log": "/tmp/canopy-native-writer-repository_cell1.log",
+      "sha256": "a924a8381e434434a3b3b2dc581c9b17fea832df06e3969b43c35738c3467a70",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.20s"
+      ],
+      "failed_cases": [
+        "repository_cell_publishes_objects_and_refs_atomically"
+      ]
+    },
+    "smart_http": {
+      "log": "/tmp/canopy-native-writer-smart_http1.log",
+      "sha256": "1df241873fd064a2951293eb61e424524772c3ba2738bb8ff65757bd7edcadf3",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.40s"
+      ],
+      "failed_cases": [
+        "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+      ]
+    },
+    "rustfs": {
+      "log": "/tmp/canopy-native-writer-rustfs1.log",
+      "sha256": "45be385b5c2f1118d440e508a075bca9d0dbed79a785759647fada3640a7d6dc",
+      "exit_code": 1,
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 114 filtered out; finished in 14.79s",
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 4.99s"
+      ],
+      "failed_cases": [
+        "sha256::sha256_real_provider_native_merge_candidates"
+      ]
+    },
+    "clippy": {
+      "log": "/tmp/canopy-native-writer-clippy3.log",
+      "sha256": "3cf4d8ef44cab40cbf914c13c0fcf671f0df1f6c19dc109981f21c6ad55bf69e",
+      "exit_code": 0,
+      "summaries": [],
+      "failed_cases": []
+    },
+    "build": {
+      "log": "/tmp/canopy-native-writer-build1.log",
+      "sha256": "148bd156b917f79c7a616eae627abb60604dee7f29ff18db30c1abfd6bf6f5c8",
+      "exit_code": 0,
+      "summaries": [],
+      "failed_cases": []
+    },
+    "harness": {
+      "log": "/tmp/canopy-native-writer-harness1.log",
+      "sha256": "3463cc7ddce2f982e04d14f65a1ed36b99232ed29bb398de8f1df8eda44a0e4b",
+      "exit_code": 0,
+      "summaries": [],
+      "failed_cases": []
+    }
+  },
+  "source_changed_during_final_validation": false,
+  "release_qualified": false,
+  "remaining_high_priorities": [
+    "Authenticated durable per-ref refusal when Write is revoked during native pack capture, before Bind; refs currently remain unchanged but transport closes.",
+    "Convert generated candidate/merge/rebase writers and authoritative pull/check/default-branch metadata to certified catalog/ref facts.",
+    "Owner-aware routing to actual resident serving/staging capabilities; complete standalone integration fixture conversion.",
+    "Native-aware backup/restore root enumeration, generation retirement, filtered serving and read-only restore boundaries.",
+    "Complete request/result/policy detached physical pins, older-owner input adoption, full Linux/RustFS workflow and large-team/full-history capacity gates."
+  ],
+  "previous_evidence": "push-workflow-ci-20261004.json",
+  "retained_diagnostic_runs": [
+    {
+      "log": "/tmp/canopy-native-writer-matrix1.log",
+      "source_hash_digest": "e8ceddc67dfdd3b852c3d1c96aff0edc2e3165ed926ec0293255908e4840081b",
+      "result": "68 passed, 38 failed, 9 ignored; preceding source"
+    },
+    {
+      "log": "/tmp/canopy-native-writer-workspace1.log",
+      "source_hash_digest": "5348ba16c16f89086b2458f8da3659e95ea01092bdb75622110f79c5694de9af",
+      "result": "349 server library passes, 359 registry-binding failures; fixed on final source"
+    },
+    {
+      "log": "/tmp/canopy-native-writer-focused4.log",
+      "source_hash_digest": "5348ba16c16f89086b2458f8da3659e95ea01092bdb75622110f79c5694de9af",
+      "result": "3 passes, 1 late-revocation failure; preceding source"
+    }
+  ],
+  "unique_case_identity": "Test binary plus case name, checked against terminal per-binary summaries; nested child repetitions/provider reruns are not additional cases.",
+  "interleaved_output": {
+    "binary": "canopy_server",
+    "cases": [
+      "git_http::stream_tests::failed_spawn_releases_parent_fence_before_cache_cleanup",
+      "git_http::stream_tests::disconnect_kills_the_process_group_and_releases_cache"
+    ],
+    "detail": "Parent and subprocess test announcements interleave on one line. Both actual cases are counted once using the terminal 708-pass server summary and the matching 708-case --list inventory; the combined pseudo-name is excluded.",
+    "inventory_log": "/tmp/canopy-native-writer-lib-list.log"
+  }
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 36d0efd4..730c8cfc 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -7,15 +7,68 @@ Packed cutover [PR #34](https://github.com/crabbuild/canopy/pull/34) was merged
 The native metadata follow-up is based on that main revision. The original SQL
 hydration failures have been resolved by converting real read/cache callers.
 The directory recovery fixture now uses repository-local permission metadata
-to verify separate Cells and replay after restoration. Full CI remains open
-because live writers and other integration callers still invoke retired ingestion.
-The ownership and metadata changes below are
-prerequisites for the write replacement. This cutover is not release qualified.
+to verify separate Cells and replay after restoration. Full CI remains open because generated writers and other product callers still
+invoke retired ingestion/ref metadata. The production HTTP/SSH native writer is
+now wired through the resident lifecycle, with the remaining correctness and
+qualification gates described below. This cutover is not release qualified.
 Older checkpoint notes describe historical states.
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
-All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH/generated producers and authoritative readers, complete startup recovery and the final schema hard cutover remain open.
+All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
+
+## Native HTTP/SSH writer cutover (in progress)
+
+The actual receive-pack path now transfers its authenticated encoded request to
+its resident staging controller before waiting. It registers original request
+custody, runs native Git in a disposable cache, registers the exact native result
+and creating pack descriptors, verifies native metadata, binds a publication
+floor, and constructs the certified catalog/ref replacement. Byte-bounded policy
+pages advance by their exact minted offsets. Every page and final outcome uses
+registered exact recovery; ambiguous dispatch never becomes a new success or
+refusal. Success responses stream only after authorized completed-root selection.
+The legacy whole-push mutex and SQL object/push-response writer are removed from
+this path. Generated candidate writers remain outstanding.
+
+Signed certificate bytes remain in immutable audit artifacts; the verified
+request-private loose certificate blob is removed under the native worker fence
+before capturing incoming packs. Authenticated empty native pack/index pairs are
+excluded from the nonempty catalog source inventory. Ref-only/delete-only pushes
+still carry their registered request/result checkpoint through final publication.
+Audit option reads follow the authorized completed outcome root instead of the
+retired SQL payload. The default-branch GET uses the certified ref snapshot;
+its mutation still requires conversion to joint publication.
+
+Node shutdown seals staging admission and gives already-owned receive workflows
+30 seconds to finish while their Cell, serving generations and native admission
+remain available. Forced close after that grace cancels the controller and joins
+its physical work and exact recovery before releasing the lower services. Generic
+callback producers preserve their cancel-and-drain contract. The provider-fault
+fixtures now pause native staging uploads; cold preparation failure is armed only
+after SSH discovery, so the test reaches an actual admitted push.
+
+Current diagnostic qualification confirms signed pushes/audit restore, SHA-1 and
+SHA-256 history/push/clone/fetch/restore, the 4,096-ref mirror and oversized exact
+rejection replay, cold SSH preparation refusal, and disconnected SSH publication
+through shutdown. A late Write-to-Read revocation still fences staging before a
+completed per-ref refusal exists. Refs remain unchanged, but the transport closes.
+This remains a failing correctness/UX gate; authorization is not weakened to hide
+it. Full-workspace, Linux/RustFS and final-source evidence remain release gates.
+Request/result/policy detached physical pins, authenticated older-owner adoption,
+remaining product metadata writers/readers, backup and capacity qualification are
+still required. No large-team throughput or release claim follows from this slice.
+
+Final frozen-source validation passes all 729 library cases (6 Git-format,
+15 object-storage and 708 server), 13 directory cases, two Git backend cases and
+two binary cases. Multi-server completes with 74 passes, 32 failures and nine
+existing ignores. The three standalone aggregate integrations each fail. Isolated
+RustFS passes SHA-256 push/clone/restore and then fails its merge-candidate gate;
+remaining provider cases are unexecuted. Combined unique inventory is 821 passes,
+36 failures and seven unexecuted ignores, including the two provider executions
+without double-counting their ordinary ignored listings. All-target Clippy,
+server build, formatting/diff checks and 96 Python harness cases pass.
+These results do not qualify the full workflow or Linux. Exact fingerprints and
+remaining priorities are in [native writer evidence](evidence/native-writer-ci-20261005.json).
 
 ## Whole-workflow ownership and CI repair
 

From 79e2a3c7c8f6f094d4056ba1a106511619b2a351 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 21:45:55 -0700
Subject: [PATCH 33/55] Reuse idle serving generations before refusing capacity

---
 .../src/packs/publication/serving/pool.rs     | 176 +++++++----
 .../packs/publication/tests/serving/pool.rs   | 149 +++++++++-
 docs/design/certified-serving-pins.md         |  20 +-
 docs/design/final-publication-lifecycle.md    |  47 +++
 .../serving-rollover-ci-20261005.json         | 278 ++++++++++++++++++
 .../large-repository-implementation-status.md |  36 +++
 6 files changed, 636 insertions(+), 70 deletions(-)
 create mode 100644 docs/evidence/serving-rollover-ci-20261005.json

diff --git a/crates/canopy-server/src/packs/publication/serving/pool.rs b/crates/canopy-server/src/packs/publication/serving/pool.rs
index 770d74e0..be460019 100644
--- a/crates/canopy-server/src/packs/publication/serving/pool.rs
+++ b/crates/canopy-server/src/packs/publication/serving/pool.rs
@@ -5,10 +5,16 @@ use std::sync::{
     Weak,
     atomic::{AtomicBool, Ordering},
 };
-use tokio::sync::Mutex;
+use tokio::{
+    sync::Mutex,
+    time::{Duration, Instant, timeout_at},
+};
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 
 pub const MAX_SERVING_GENERATIONS: u8 = 4;
+// Bound detached request observers as well as latency. The producer retains its
+// slot and exact release after this wait expires; timeout is never reclamation.
+const ROLLOVER_WAIT: Duration = Duration::from_secs(2);
 #[derive(Clone, Copy, Debug)]
 pub struct ServingPoolLimits {
     pub generations: u8,
@@ -25,6 +31,7 @@ impl Default for ServingPoolLimits {
 struct Slot {
     requested_generation: u64,
     touched: u64,
+    retiring: bool,
     owner: ServingOwner,
 }
 struct State {
@@ -178,77 +185,116 @@ impl Inner {
         if self.stop.is_cancelled() || self.paused.load(Ordering::Acquire) {
             return Err(ServingReadError::Inactive.into());
         }
-        let selected = self.context.select(actor.clone()).await?;
-        let owner = {
-            let mut state = self.state.lock().await;
-            if state.closed || self.stop.is_cancelled() || self.paused.load(Ordering::Acquire) {
-                return Err(ServingReadError::Inactive.into());
+        let deadline = Instant::now() + ROLLOVER_WAIT;
+        // Concurrent viewers may consume a released slot first. Bound retries
+        // even under continuous publication; admission already bounds waiters.
+        for _ in 0..=self.limits.generations {
+            // Permission and current generation can change while release waits.
+            let selected = self.context.select(actor.clone()).await?;
+            enum Selection {
+                Borrow(ServingOwner),
+                Retire(ServingOwner),
             }
-            state.slots.retain(|slot| !slot.owner.is_drained());
-            state.clock = state.clock.saturating_add(1);
-            let touched = state.clock;
-            if let Some(slot) = state.slots.iter_mut().find(|slot| {
-                let stats = slot.owner.stats();
-                match stats.token {
-                    Some(token) => {
-                        stats.phase == ServingOwnerPhase::Ready
-                            && token.generation == selected.generation
+            let selection = {
+                let mut state = self.state.lock().await;
+                if state.closed || self.stop.is_cancelled() || self.paused.load(Ordering::Acquire) {
+                    return Err(ServingReadError::Inactive.into());
+                }
+                state.slots.retain(|slot| !slot.owner.is_drained());
+                state.clock = state.clock.saturating_add(1);
+                let touched = state.clock;
+                if let Some(slot) = state.slots.iter_mut().find(|slot| {
+                    if slot.retiring {
+                        return false;
                     }
-                    None => {
-                        stats.phase == ServingOwnerPhase::Acquiring
-                            && slot.requested_generation == selected.generation
+                    let stats = slot.owner.stats();
+                    match stats.token {
+                        Some(token) => {
+                            stats.phase == ServingOwnerPhase::Ready
+                                && token.generation == selected.generation
+                        }
+                        None => {
+                            stats.phase == ServingOwnerPhase::Acquiring
+                                && slot.requested_generation == selected.generation
+                        }
                     }
-                }
-            }) {
-                slot.touched = touched;
-                slot.owner.clone()
-            } else {
-                if state.slots.len() >= usize::from(self.limits.generations) {
-                    // Keep the closing slot until its real producer finishes.
-                    // Retry is explicit; there is no unbounded retired inventory
-                    // or wait behind old provider I/O inside the pool lock.
+                }) {
+                    slot.touched = touched;
+                    Selection::Borrow(slot.owner.clone())
+                } else if state.slots.len() >= usize::from(self.limits.generations) {
+                    // No slot leaves the inventory before its real producer
+                    // exits. Closing is shared; no waiter owns a replacement
+                    // release or a second retired-owner inventory.
                     let mut order: Vec<_> = (0..state.slots.len()).collect();
                     order.sort_by_key(|i| state.slots[*i].touched);
-                    for i in order {
-                        if state.slots[i].owner.retire_if_idle() {
-                            break;
+                    let retiring = order
+                        .iter()
+                        .copied()
+                        .find(|i| {
+                            let slot = &mut state.slots[*i];
+                            if !slot.retiring && slot.owner.retire_if_idle() {
+                                slot.retiring = true;
+                                true
+                            } else {
+                                false
+                            }
+                        })
+                        .or_else(|| order.into_iter().find(|i| state.slots[*i].retiring));
+                    match retiring {
+                        Some(i) => Selection::Retire(state.slots[i].owner.clone()),
+                        None => return Err(generation_capacity()),
+                    }
+                } else {
+                    let operation = *uuid::Uuid::new_v4().as_bytes();
+                    let mut digest = blake3::Hasher::new();
+                    digest.update(b"canopy.serving-pool.v1");
+                    digest.update(&self.context.repository());
+                    digest.update(&operation);
+                    let owner = ServingOwner::start(
+                        self.context.clone(),
+                        self.coordinator.clone(),
+                        BeginRequest {
+                            repository: self.context.repository(),
+                            operation,
+                            request_digest: *digest.finalize().as_bytes(),
+                            actor: self.context.administrator().to_owned(),
+                            lease_ms: self.limits.lease_ms,
+                        },
+                        crate::server::mutation_identity()
+                            .map_err(|error| ServingOwnerError::Clock(Box::new(error)))?,
+                    )
+                    .await?;
+                    state.slots.push(Slot {
+                        requested_generation: selected.generation,
+                        touched,
+                        retiring: false,
+                        owner: owner.clone(),
+                    });
+                    Selection::Borrow(owner)
+                }
+            };
+            match selection {
+                Selection::Borrow(owner) => {
+                    // Acquisition may accept a newer fact than selection.
+                    return Ok(owner.snapshot_admitted(actor, permit).await?);
+                }
+                Selection::Retire(owner) => {
+                    // Never wait for provider I/O or exact release under the
+                    // pool lock. Shutdown can cancel this bounded observation
+                    // without canceling the independently owned producer.
+                    let drain = owner.drain_observer();
+                    tokio::select! {
+                        _ = self.stop.cancelled() => return Err(ServingReadError::Inactive.into()),
+                        result = timeout_at(deadline, drain.wait()) => {
+                            if result.is_err() {
+                                return Err(generation_capacity());
+                            }
                         }
                     }
-                    return Err(ServingReadError::Capability(Error::Capacity(
-                        "repository serving generations",
-                    ))
-                    .into());
                 }
-                let operation = *uuid::Uuid::new_v4().as_bytes();
-                let mut digest = blake3::Hasher::new();
-                digest.update(b"canopy.serving-pool.v1");
-                digest.update(&self.context.repository());
-                digest.update(&operation);
-                let owner = ServingOwner::start(
-                    self.context.clone(),
-                    self.coordinator.clone(),
-                    BeginRequest {
-                        repository: self.context.repository(),
-                        operation,
-                        request_digest: *digest.finalize().as_bytes(),
-                        actor: self.context.administrator().to_owned(),
-                        lease_ms: self.limits.lease_ms,
-                    },
-                    crate::server::mutation_identity()
-                        .map_err(|error| ServingOwnerError::Clock(Box::new(error)))?,
-                )
-                .await?;
-                state.slots.push(Slot {
-                    requested_generation: selected.generation,
-                    touched,
-                    owner: owner.clone(),
-                });
-                owner
             }
-        };
-        // The accepted acquisition may select a newer fact than the observation.
-        // Return its fact; never label that capability with the requested hint.
-        Ok(owner.snapshot_admitted(actor, permit).await?)
+        }
+        Err(generation_capacity())
     }
     async fn quiesce(self: Arc<Self>) -> Result<bool, ServingOwnerError> {
         let state = self.state.lock().await;
@@ -295,3 +341,7 @@ impl Inner {
         Ok(true)
     }
 }
+
+fn generation_capacity() -> ServingOwnerError {
+    ServingReadError::Capability(Error::Capacity("repository serving generations")).into()
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/pool.rs b/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
index bc473428..77b398f9 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
@@ -132,6 +132,152 @@ async fn canceled_cold_observer_and_lost_ack_keep_one_owned_acquisition() -> Res
     Ok(())
 }
 
+#[tokio::test]
+async fn sequential_generations_roll_over_idle_slots_without_client_retries() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        for generation in 1..=12 {
+            if generation > 1 {
+                advance(&f, generation).await?;
+            }
+            let snapshot =
+                timeout(Duration::from_secs(8), pool.snapshot(Some("owner".into()))).await??;
+            assert_eq!(snapshot.fact().generation, generation);
+            assert_eq!(snapshot.headers(&[missing(&f)?]).await?, vec![None]);
+            assert!(pool.owners_for_test().await.len() <= 4);
+            assert!(pin_count(&f).await? <= 4);
+            drop(snapshot);
+        }
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn rollover_waiters_share_release_after_observer_cancellation_and_lost_ack() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let mut old_views = Vec::new();
+        for generation in 1..=4 {
+            if generation > 1 {
+                advance(&f, generation).await?;
+            }
+            old_views.push(pool.snapshot(Some("owner".into())).await?);
+        }
+        let old = pool.owners_for_test().await.remove(0);
+        drop(old_views.remove(0));
+        advance(&f, 5).await?;
+        let (dispatch, entered) = q.pause_for_test().await;
+        q.fault_for_test(2);
+        let work = pool.clone();
+        let observer = tokio::spawn(async move { work.snapshot(Some("owner".into())).await });
+        timeout(Duration::from_secs(8), entered).await??;
+        observer.abort();
+        assert!(
+            observer
+                .await
+                .err()
+                .ok_or("rollover finished early")?
+                .is_cancelled()
+        );
+        assert!(
+            timeout(Duration::from_millis(20), old.drain_observer().wait())
+                .await
+                .is_err()
+        );
+        assert_eq!(pool.owners_for_test().await.len(), 4);
+        assert_eq!(pin_count(&f).await?, 4);
+        let work = pool.clone();
+        let viewers = tokio::spawn(async move {
+            futures_util::future::join_all((0..12).map(|_| work.snapshot(Some("owner".into()))))
+                .await
+                .into_iter()
+                .collect::<std::result::Result<Vec<_>, _>>()
+        });
+        dispatch.send(()).map_err(|_| "release dispatch gone")?;
+        let snapshots = timeout(Duration::from_secs(8), viewers).await???;
+        assert!(
+            snapshots
+                .iter()
+                .all(|snapshot| snapshot.fact().generation == 5)
+        );
+        assert_eq!(old.stats().phase, ServingOwnerPhase::Released);
+        assert_eq!(pool.owners_for_test().await.len(), 4);
+        assert_eq!(pin_count(&f).await?, 4);
+        for view in &old_views {
+            assert_eq!(view.headers(&[missing(&f)?]).await?, vec![None]);
+        }
+        drop((old_views, snapshots));
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn rollover_timeout_retains_the_slot_and_exact_release_for_retry() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        let mut old_views = Vec::new();
+        for generation in 1..=4 {
+            if generation > 1 {
+                advance(&f, generation).await?;
+            }
+            old_views.push(pool.snapshot(Some("owner".into())).await?);
+        }
+        let old = pool.owners_for_test().await.remove(0);
+        drop(old_views.remove(0));
+        advance(&f, 5).await?;
+        let (dispatch, entered) = q.pause_for_test().await;
+        let work = pool.clone();
+        let observer = tokio::spawn(async move { work.snapshot(Some("owner".into())).await });
+        timeout(Duration::from_secs(8), entered).await??;
+        assert!(matches!(
+            timeout(Duration::from_secs(8), observer).await??,
+            Err(ServingOwnerError::Read(ServingReadError::Capability(
+                Error::Capacity("repository serving generations")
+            )))
+        ));
+        assert!(
+            timeout(Duration::from_millis(20), old.drain_observer().wait())
+                .await
+                .is_err()
+        );
+        assert_eq!(pool.owners_for_test().await.len(), 4);
+        assert_eq!(pin_count(&f).await?, 4);
+        dispatch.send(()).map_err(|_| "release dispatch gone")?;
+        let fifth = timeout(Duration::from_secs(8), pool.snapshot(Some("owner".into()))).await??;
+        assert_eq!(fifth.fact().generation, 5);
+        assert_eq!(pin_count(&f).await?, 4);
+        for view in &old_views {
+            assert_eq!(view.headers(&[missing(&f)?]).await?, vec![None]);
+        }
+        drop((old_views, fifth));
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn four_generation_bound_retains_borrows_and_reuses_only_actually_drained_slots() -> Result {
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
@@ -161,14 +307,13 @@ async fn four_generation_bound_retains_borrows_and_reuses_only_actually_drained_
         assert_eq!(pin_count(&f).await?, 4);
         let old = pool.owners_for_test().await.remove(0);
         drop(snapshots.remove(0));
-        assert!(pool.snapshot(Some("owner".into())).await.is_err());
+        let fifth = timeout(Duration::from_secs(8), pool.snapshot(Some("owner".into()))).await??;
         assert_eq!(
             timeout(Duration::from_secs(8), old.drain_observer().wait())
                 .await?
                 .phase,
             ServingOwnerPhase::Released
         );
-        let fifth = pool.snapshot(Some("owner".into())).await?;
         assert_eq!(fifth.fact().generation, 5);
         assert_eq!(pin_count(&f).await?, 4);
         for snapshot in &snapshots {
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index 1e2ff3c3..ba0be628 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -217,11 +217,21 @@ must resolve their revision/ref through that accepted snapshot.
 The pool admits each viewer before spawning private request work. Its permit
 covers selection, acquisition waiting and the returned snapshot borrow. Observer
 cancellation detaches accepted work, and the owner's original stays retained.
-At capacity, the pool initiates closure of one least-recently-used unborrowed
-owner and returns an explicit capacity error. Its slot remains charged until the
-real producer has exited; there is no unbounded retired-owner list or waiting
-behind old provider work under the pool lock. Borrowed old generations remain
-immutable. Their independent owners keep renewing while other generations work.
+At capacity, the pool initiates closure of a least-recently-used unborrowed
+owner and observes its independently owned release outside the pool lock. A
+request shares a two-second rollover budget and performs at most one retry per
+configured generation slot. Concurrent waiters can join an already closing
+owner. Each retry selects the current generation under current viewer access;
+closing owners cannot accept new borrows. Sequential readers can therefore move
+through more than four publications without retrying at the client.
+
+The retiring slot remains charged until the real producer has exited. Timeout,
+observer cancellation and a lost release acknowledgement cannot remove its slot
+or pin, cancel its exact release, or allocate a fifth owner. All borrowed slots
+still produce an immediate capacity error. A slow or uncertain release returns
+capacity when the bounded observation expires and remains recoverable. There is
+no separate retired-owner inventory. Borrowed old generations remain immutable;
+their independent owners keep renewing while other generations work.
 
 Eviction pauses acquisition/borrowing and uses a nonwaiting owner handshake.
 The producer driver must be idle, with no pending original, outstanding borrow
diff --git a/docs/design/final-publication-lifecycle.md b/docs/design/final-publication-lifecycle.md
index 01c150a4..e8c5025f 100644
--- a/docs/design/final-publication-lifecycle.md
+++ b/docs/design/final-publication-lifecycle.md
@@ -41,6 +41,53 @@ Final uncertainty appears as StagingState::Uncertain with the original typed Pub
 
 The inline response observer is service-internal access to an already admitted result. Root observers use root_response(store), which selects the durable actor/operation/request result under current read authorization and the original receipt before streaming authenticated bytes. Externally requested replay must use the corresponding authenticated replay_push_response or replay_root_push_response preflight. A receipt or caller-selected root grants no artifact access. Compaction results cannot become push responses. A known catalog conflict terminates this local lifecycle; a subsequent Claim and freshly reconciled proof must enter a new admitted lifecycle rather than replacing an ambiguous command.
 
+## Open gate: refusal after pre-bind Write revocation
+
+The production SSH regression `late_ssh_push_refusals_report_both_refs_and_survive_restore`
+still fails when the writer becomes a reader during native pack upload. The
+admitted operation preserves both refs and their generation, but Write-dependent
+checkpoint registration and fresh staging probes stop before a terminal response
+is committed. Post-bound policy-refusal qualification does not cover this case.
+
+The next implementation must introduce a private **refusal-only capability for
+an already admitted staging attempt**. Do not lower Begin, Claim, Bind, catalog
+proof issuance or ref publication to Read. Reuse the existing attempt token,
+actor/request digest, lease/pin, immutable request/native-result roots, bounded
+root command and exact recovery journal. The terminal capability must not open
+a catalog base, acquire a generation floor, renew preparation, or produce a
+positive completion. Its response must pass current completed-request Read
+selection, including after restore.
+
+Implement and qualify these boundaries in order:
+
+1. Authenticate the original admission and current owner, remaining expiry and
+   exact request checkpoint. A reader cannot allocate a fresh write attempt;
+   terminal preparation cannot replace an uncertain checkpoint command.
+2. Add purpose-specific custody for sealing the admitted native result after
+   revocation. Authenticate the predecessor, original wire request and creating
+   namespace. Keep generic checkpoint/proof authority unchanged. Drain the
+   actual upload/native workers before final handoff.
+3. Freeze an explicit refusal-only root completion with no publication floor.
+   Bind that constraint and the selected input checkpoint into the MAC. Reuse
+   the same immutable outcome layout and exact-command artifacts; an unbound
+   refusal cannot select the native successful report or publish any pack/ref.
+4. Permit first-writer recovery registration only for that authenticated terminal
+   purpose after Write loss. The Repository Cell must independently verify the
+   purpose, original actor/token/checkpoint, actual owner, live pin and expiry.
+   Preserve the same command through ambiguous registration and execution.
+5. Integrate terminal handoff with the existing staging worker/result drain and
+   fair dispatch, without manufacturing a bound lease or retaining a worker
+   activity in its final ready value. Success or an unrecorded synthetic `ng`
+   cannot be returned before durable completed-root selection.
+
+Required negatives include a reader starting a push, a forged purpose/body,
+wrong actor/request/checkpoint, expired or replaced attempt, stale owner, ref
+publication through terminal custody, and uncertainty followed by cancellation
+and restart. Exercise Write-to-Read revocation during upload in SHA-1 and SHA-256,
+verify both exact per-ref refusals, unchanged refs/generation, restored replay and
+unrelated writers' progress. Full access removal must not grant response replay.
+This is a pending implementation contract, not a completed authority change.
+
 ## Terminal recovery retirement
 
 After an immutable root outcome and its recovery phase are durably known, the service can start `RecoverySupervisor::start_retiring` with current repository administration and actual owner custody. It prepares a private terminal release through the existing maintenance queue, transferring the same recovery headers/journal to the selected immutable push row and freeing that preparation pin atomically. Original uncertain release commands remain charged and recoverable even after the pin disappears. Live staging uncertainty keeps its original owner. Follow the [terminal retention contract](terminal-publication-retention.md) for exact eligibility, retained edges and receipt recovery; this path grants no provider deletion authority. Production startup must wire the service as part of the mandatory hard cutover.
diff --git a/docs/evidence/serving-rollover-ci-20261005.json b/docs/evidence/serving-rollover-ci-20261005.json
new file mode 100644
index 00000000..b8f0f0b1
--- /dev/null
+++ b/docs/evidence/serving-rollover-ci-20261005.json
@@ -0,0 +1,278 @@
+{
+  "recorded_at_utc": "2026-10-05T04:44:48.534404+00:00",
+  "base_head": "64481d15b6d1f210006d137ca481b8b95abcb721",
+  "source_files": 493,
+  "rust_files": 479,
+  "source_hash_digest": "07634d72100e79ba93581796920a5391fdfd33df80d819e99d39a3c7c164e040",
+  "source_digest_algorithm": "SHA256 of sorted path + NUL + file SHA256 + newline for tracked/nonignored Rust, SQL, Cargo manifests/lock/toolchain files",
+  "manifest_log": "/tmp/canopy-serving-rollover-final-source.json",
+  "toolchain": "Rust 1.98.0",
+  "host": "macOS; isolated RustFS in Docker; current-source Linux CI required",
+  "source_changed_during_validation": false,
+  "runs": {
+    "workspace": {
+      "log": "/tmp/canopy-serving-rollover-workspace1.log",
+      "sha256": "c88d4453a8f057a014106928b14e13099dcd8930ad9bd6be61fb99133f1552e7",
+      "exit_code": 101,
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.82s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.60s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 710 filtered out; finished in 0.01s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 710 filtered out; finished in 0.08s",
+        "test result: ok. 711 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 285.64s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.50s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s",
+        "test result: FAILED. 75 passed; 31 failed; 9 ignored; 0 measured; 0 filtered out; finished in 370.96s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    },
+    "focused_pool": {
+      "log": "/tmp/canopy-serving-rollover-focused1.log",
+      "sha256": "d55c6d220fb7bc525415fc67e9aa05c6cff359a8dad3ea2d1249491a07841f02",
+      "exit_code": 0,
+      "summaries": [
+        "test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 702 filtered out; finished in 6.25s"
+      ],
+      "failed_cases": []
+    },
+    "clippy": {
+      "log": "/tmp/canopy-serving-rollover-clippy1.log",
+      "sha256": "abeaf69f56824dc0bde93466f05c7532e950c9d70cb231f4bd39b1d9753dc342",
+      "exit_code": 0,
+      "summaries": [],
+      "failed_cases": []
+    },
+    "harness": {
+      "log": "/tmp/canopy-serving-rollover-harness1.log",
+      "sha256": "00eaa78805d5d40de3c6be44db3b0f2dde8200aaed54fc0934b9b77baff2440e",
+      "exit_code": 0,
+      "summaries": [],
+      "failed_cases": []
+    },
+    "owner_restart": {
+      "log": "/tmp/canopy-serving-rollover-owner_restart1.log",
+      "sha256": "d0112cd478f8a30dfb390e81ae1ebf69b50bbe863778de7272b7e5dec12b73b2",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.42s"
+      ],
+      "failed_cases": [
+        "a_second_node_clones_from_the_published_root_after_local_disk_loss"
+      ]
+    },
+    "repository_cell": {
+      "log": "/tmp/canopy-serving-rollover-repository_cell1.log",
+      "sha256": "63d7e15dc76ad9b6e6965da6a426eb5e24b64fe3618430b12c90ebabe78ceec2",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s"
+      ],
+      "failed_cases": [
+        "repository_cell_publishes_objects_and_refs_atomically"
+      ]
+    },
+    "smart_http": {
+      "log": "/tmp/canopy-serving-rollover-smart_http1.log",
+      "sha256": "3ff9409a7a1a3f1a817e69ab2a5e1648c8abf2ce26dff296997670c812ffb653",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.32s"
+      ],
+      "failed_cases": [
+        "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+      ]
+    },
+    "build": {
+      "log": "/tmp/canopy-serving-rollover-build1.log",
+      "sha256": "0b83a7a1488f68a48846a2c431afc5219cce3ef451d99c4767370888ef96bf8c",
+      "exit_code": 0,
+      "summaries": [],
+      "failed_cases": []
+    },
+    "rustfs": {
+      "log": "/tmp/canopy-serving-rollover-rustfs1.log",
+      "sha256": "0975d46acf8b6d74d76949763ddfea5d48ecbe0a6736146936c8e034f7202877",
+      "exit_code": 1,
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 114 filtered out; finished in 8.70s",
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 2.41s"
+      ],
+      "failed_cases": [
+        "sha256::sha256_real_provider_native_merge_candidates"
+      ]
+    }
+  },
+  "unique_cases": {
+    "passed": 825,
+    "failed": 35,
+    "ignored": 7,
+    "executed": 860,
+    "total": 867
+  },
+  "unique_case_identity": "Binary plus case name; terminal per-binary summaries are authoritative. Excludes nested child repeats, focused reruns and ordinary ignored listings of the two separately executed provider cases. Parent/subprocess stream-test announcements can interleave; the two actual cases are counted once, not as a combined pseudo-name.",
+  "reproduction": {
+    "log": "/tmp/canopy-serving-rollover-repro1.log",
+    "exit_code": 101,
+    "source_hash_digest": "689bae1c71ce409743750ff35881bdd2f0263ced039849beba708f2519a102c0",
+    "result": "The new sequential-generation regression fails with repository serving generations capacity before the production fix."
+  },
+  "resolved_multi_server_failure": "ssh::stock_ssh_clone_push_fetch_filters_and_revocation_survive_disk_loss",
+  "new_pool_cases": [
+    "sequential_generations_roll_over_idle_slots_without_client_retries",
+    "rollover_waiters_share_release_after_observer_cancellation_and_lost_ack",
+    "rollover_timeout_retains_the_slot_and_exact_release_for_retry"
+  ],
+  "previous_head_linux_ci": [
+    {
+      "head": "64481d15b6d1f210006d137ca481b8b95abcb721",
+      "event": "push",
+      "run_id": 37262723806,
+      "job_id": 111613132781,
+      "state": "FAILURE",
+      "log": "/tmp/canopy-remote-64481d1-push-failed.log",
+      "log_sha256": "6fbf73db98661281801112b72aa359646f0dae0d1f0aad4a56e6040aec79b8db",
+      "server_library_passes": 708,
+      "multi_server": {
+        "passed": 75,
+        "failed": 35,
+        "ignored": 9
+      },
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::stock_ssh_clone_push_fetch_filters_and_revocation_survive_disk_loss",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    },
+    {
+      "head": "64481d15b6d1f210006d137ca481b8b95abcb721",
+      "event": "pull_request",
+      "run_id": 37262727328,
+      "job_id": 111613143050,
+      "state": "FAILURE",
+      "log": "/tmp/canopy-remote-64481d1-pr-failed.log",
+      "log_sha256": "fc5f7860708aef82d696666ca1405850d15f7a07d2ea2616327fdafc62d49705",
+      "server_library_passes": 708,
+      "multi_server": {
+        "passed": 75,
+        "failed": 35,
+        "ignored": 9
+      },
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::stock_ssh_clone_push_fetch_filters_and_revocation_survive_disk_loss",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    }
+  ],
+  "current_source_linux_ci": "Unexecuted locally; a new PR/push run is required after publication. Previous-head failures do not constitute current-source qualification.",
+  "isolated_provider_cleanup": "No canopy-size- container or volume remains; unrelated containers were preserved.",
+  "provider_not_executed": [
+    "remaining six provider cases after native merge-candidate failure"
+  ],
+  "release_qualified": false,
+  "remaining_high_priorities": [
+    "Durable rejection for invalid/mismatched push options: previous-head Linux has three additional transport/reason failures.",
+    "Purpose-specific durable refusal for Write-to-Read revocation during native upload before Bind; preserve write publication authorization.",
+    "Convert generated candidate/merge/rebase and remaining pull/check/default-branch metadata to certified roots.",
+    "Complete peer resident routing, native backup/isolated restore, filtered serving and standalone resident fixtures.",
+    "Complete detached physical ownership, older-owner adoption, Linux/RustFS full gates and full-history/10,000-engineer capacity qualification."
+  ],
+  "previous_evidence": "native-writer-ci-20261005.json"
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 730c8cfc..aa63a649 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -70,6 +70,42 @@ server build, formatting/diff checks and 96 Python harness cases pass.
 These results do not qualify the full workflow or Linux. Exact fingerprints and
 remaining priorities are in [native writer evidence](evidence/native-writer-ci-20261005.json).
 
+## Serving generation rollover and CI repair (2026-10-05)
+
+A sequential reader could exhaust the four-generation serving pool even after
+all old snapshots were dropped. The pool started one idle owner's release and
+immediately returned capacity. It now observes independently owned retirement
+outside the pool lock and retries current authorized selection within a shared
+two-second rollover budget and a slot-count retry limit. Closing owners remain
+charged and cannot accept new borrows. Four borrowed generations still refuse
+capacity immediately; timeout, observer cancellation and lost acknowledgement
+preserve the exact release and its retained slot/pin. Limits are unchanged.
+
+Three new pool families cover twelve sequential generations, concurrent waiters
+with cancellation/lost acknowledgement, and timed-out release followed by retry,
+in both object formats. All nine pool families pass. The complete frozen-source
+workspace passes 732 library cases (6 Git-format, 15 object-storage and 711 server),
+13 directory cases, two Git backend cases and two binary cases. Multi-server
+finishes with 75 passes, 31 failures and nine existing ignores. The stock SSH
+clone/push/fetch/revocation family now passes; its previous serving-generation
+capacity failure is resolved. The three standalone aggregates still fail.
+Isolated RustFS passes SHA-256 push/clone/restore and fails native merge candidates;
+its later six cases remain unexecuted. Combined unique inventory is 825 passes,
+35 failures and seven unexecuted ignores. Clippy with warnings denied, server
+build, formatting/diff checks and 96 harness cases pass.
+
+Both Linux Verify runs at previous head `64481d15b6d1f210006d137ca481b8b95abcb721`
+pass 708 server library cases but fail multi-server with 75 passes, 35 failures
+and nine ignores. In addition to the macOS failures, three push-option rejection
+families fail with a transport error or missing exact reason. Those logs are
+captured; they are not current-source Linux qualification. New PR/push CI must
+run after this increment. The [rollover evidence](evidence/serving-rollover-ci-20261005.json)
+separates source digests, preserved reproduction, local results and previous-head
+Linux failures. The [final publication contract](design/final-publication-lifecycle.md#open-gate-refusal-after-pre-bind-write-revocation)
+defines the pending refusal-only authority boundary without weakening Write for
+admission or publication. Full CI, generated metadata/writers, backup/routing,
+physical ownership/recovery and large-team capacity remain open.
+
 ## Whole-workflow ownership and CI repair
 
 The production resident supplies its actual Cell client and publication

From 3e40f19ef40694d5f34709b963c7c4f924b01314 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Sun, 4 Oct 2026 23:30:35 -0700
Subject: [PATCH 34/55] fix: preserve push failures and wait for publication
 admission

A busy publication mutex was reported as exhausted capacity and aborted
resident receive-pack workflows. Wait under the original custody ceiling,
then capture the held command synchronously with fresh custody checks.
Keep genuine quota refusals immediate and retain the original prepared
command, registered recovery and completion receipt.

Surface bounded controller diagnostics before and after Bind without
retaining errors that own physical worker pins. Record stop before those
payloads are dropped so credits cannot be reused before cleanup.

Add real bound-handoff contention, quota and expiry regressions plus
resident error-ownership coverage for both Git object formats. Report CI
tool versions and preserve failed reproductions and qualification limits.
The full workspace still has 34 integration failures; no tests are hidden.
---
 .github/workflows/verify.yml                  |   6 +
 .../src/git_gateway/push/native.rs            |  27 +-
 .../src/packs/publication/coordinator.rs      |  34 +-
 .../src/packs/publication/staging_service.rs  |  17 +-
 .../publication/staging_service/driver.rs     |  45 +-
 .../staging_service/publication.rs            |  50 +-
 .../publication/tests/coordinator/held.rs     |   2 +-
 .../tests/staging_service/publication.rs      | 130 ++++
 .../src/server/residency/tests/staging.rs     | 119 +++-
 docs/evidence/push-admission-ci-20261005.json | 632 ++++++++++++++++++
 .../large-repository-implementation-status.md |  67 ++
 11 files changed, 1109 insertions(+), 20 deletions(-)
 create mode 100644 docs/evidence/push-admission-ci-20261005.json

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index db00addb..9396a66b 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -21,6 +21,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y git-lfs openssh-client
           git lfs install
+      - name: Report tool versions
+        run: |
+          rustc --version --verbose
+          cargo --version
+          rustup show active-toolchain
+          git --version
       - name: Check formatting
         run: cargo fmt --all -- --check
       - name: Check lints
diff --git a/crates/canopy-server/src/git_gateway/push/native.rs b/crates/canopy-server/src/git_gateway/push/native.rs
index 9b1291e2..0e5ea542 100644
--- a/crates/canopy-server/src/git_gateway/push/native.rs
+++ b/crates/canopy-server/src/git_gateway/push/native.rs
@@ -70,18 +70,22 @@ impl GitGateway {
         drop(admission);
         match ticket.wait_completion().await {
             StagingState::Published(Ok(PublicationOutcome::RootPush(_))) => {
-                let response = staging
-                    .replay_request(identity, &self.artifacts)
+                // Use the known completion's original read capability and
+                // receipt. Recheck current authorization before streaming.
+                let publication = ticket
+                    .pending_publication()
+                    .ok_or_else(|| GatewayError::Cell(Box::new(StagingError::Context)))?;
+                let response = publication
+                    .root_response(&self.artifacts)
                     .await
-                    .map_err(|e| GatewayError::Cell(Box::new(e)))?
-                    .ok_or(GatewayError::MalformedCache)?;
+                    .map_err(|e| GatewayError::Cell(Box::new(e)))?;
                 Ok(with_push_id(artifact_body(response), id))
             }
             StagingState::Published(Err(error)) => Err(GatewayError::Cell(Box::new(error))),
             StagingState::Uncertain(error) | StagingState::Fenced(error) => {
                 Err(GatewayError::Cell(Box::new(error)))
             }
-            _ => Err(GatewayError::MalformedCache),
+            _ => Err(GatewayError::Cell(Box::new(StagingError::NotReady))),
         }
     }
 
@@ -201,7 +205,10 @@ impl GitGateway {
             let ready = ready
                 .bind_recovery(registered, &self.artifacts)
                 .map_err(input)?;
-            let observer = ticket.publish(&publication, ready).map_err(input)?;
+            let observer = ticket
+                .publish_wait(&publication, ready)
+                .await
+                .map_err(input)?;
             final_publication(&staging, &ticket, &observer).await?;
             return Ok(());
         };
@@ -303,7 +310,8 @@ impl GitGateway {
                 .await
                 .map_err(observed)?;
             let observer = ticket
-                .register_policy_page(&publication, ready)
+                .register_policy_page_wait(&publication, ready)
+                .await
                 .map_err(input)?;
             match final_publication(&staging, &ticket, &observer).await? {
                 PublicationOutcome::PolicyPage(_) => bound(&staging, &ticket).await?,
@@ -343,7 +351,10 @@ impl GitGateway {
         let ready = ready
             .bind_recovery(registered, &self.artifacts)
             .map_err(input)?;
-        let observer = ticket.publish(&publication, ready).map_err(input)?;
+        let observer = ticket
+            .publish_wait(&publication, ready)
+            .await
+            .map_err(input)?;
         final_publication(&staging, &ticket, &observer).await?;
         Ok(())
     }
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index 2bf52518..1dcecdc8 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -192,6 +192,8 @@ pub enum PublicationScheduleError {
     InvalidLimits,
     #[error("publication coordinator is closed")]
     Closed,
+    #[error("publication admission mutex is busy")]
+    Busy,
     #[error("publication admission capacity exceeded")]
     Capacity,
     #[error("publication belongs to another repository coordinator")]
@@ -455,12 +457,20 @@ impl PublicationCoordinator {
         let ready = ready.into();
         let Ok(mut state) = self.inner.state.try_lock() else {
             return Err(Box::new(PublicationAdmissionFailure {
-                reason: PublicationScheduleError::Capacity,
+                reason: PublicationScheduleError::Busy,
                 ready,
             }));
         };
         self.admit(&mut state, ready, true)
     }
+    /// Waiting here reserves no quota and dispatches no command. The caller
+    /// must capture the held ticket synchronously before yielding again.
+    pub(in crate::packs::publication) async fn held_admission(&self) -> HeldAdmission<'_> {
+        HeldAdmission {
+            coordinator: self,
+            state: self.inner.state.lock().await,
+        }
+    }
     fn admit(
         &self,
         state: &mut State,
@@ -797,11 +807,33 @@ impl PublicationCoordinator {
         )
     }
     #[cfg(test)]
+    pub(super) async fn with_admission_async_for_test<T>(
+        &self,
+        inspect: impl std::future::Future<Output = T>,
+    ) -> T {
+        let _state = self.inner.state.lock().await;
+        inspect.await
+    }
+    #[cfg(test)]
     pub(super) async fn with_admission_for_test<T>(&self, inspect: impl FnOnce() -> T) -> T {
         let _state = self.inner.state.lock().await;
         inspect()
     }
 }
+/// A short synchronous handoff while the fair admission mutex is held.
+/// No guard or prepared command may be retained across another await.
+pub(in crate::packs::publication) struct HeldAdmission<'a> {
+    coordinator: &'a PublicationCoordinator,
+    state: tokio::sync::MutexGuard<'a, State>,
+}
+impl HeldAdmission<'_> {
+    pub(in crate::packs::publication) fn reserve(
+        &mut self,
+        ready: ReadyPublication,
+    ) -> Result<PublicationTicket, Box<PublicationAdmissionFailure>> {
+        self.coordinator.admit(&mut self.state, ready, true)
+    }
+}
 impl PublicationTicket {
     pub(in crate::packs::publication) fn is_policy_page(&self) -> bool {
         self.job.policy_page
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index e6ea58bf..f0663a5c 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -98,6 +98,8 @@ pub enum StagingError {
     Clock,
     #[error("staging worker panicked")]
     Worker,
+    #[error("owned push workflow failed: {0}")]
+    DriverFailure(Box<str>),
     #[error("input preparation failed")]
     Input(#[source] Box<dyn std::error::Error + Send + Sync>),
     #[error("staging begin failed")]
@@ -370,6 +372,8 @@ struct Local {
     renew: bool,
     driver_started: bool,
     driver_graceful: bool,
+    // Diagnostic only: rejected producer values can own physical worker pins.
+    driver_failure: Option<Arc<StagingError>>,
 }
 trait RetainedWork: Any + Send + Sync {
     fn fence_completed(&self);
@@ -783,6 +787,7 @@ impl StagingCoordinator {
                 renew: false,
                 driver_started: false,
                 driver_graceful: false,
+                driver_failure: None,
             }),
             work: Mutex::new(WorkSlots::default()),
             exact: Mutex::new(Some(ready.inner.command)),
@@ -2095,14 +2100,18 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
                     if let Some(session) = &local.bound {
                         session.fence();
                     }
-                    // Keep the original binding receipt observable after graceful stop.
-                    job.status.send_replace(
-                        local
+                    // A failed controller must remain a failure before or after
+                    // Bind. Preserve the original receipt as historical evidence;
+                    // reporting Bound here would strand completion observers.
+                    let state = match &local.driver_failure {
+                        Some(error) => StagingState::Fenced(error.clone()),
+                        None => local
                             .bound_result
                             .clone()
                             .map(StagingState::Bound)
                             .unwrap_or(StagingState::Stopped),
-                    );
+                    };
+                    job.status.send_replace(state);
                 }
                 driver::drain(&job).await;
                 remove(&inner, &job);
diff --git a/crates/canopy-server/src/packs/publication/staging_service/driver.rs b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
index c5358dd8..8ae4eb90 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/driver.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
@@ -2,9 +2,44 @@
 //! the existing staged/bound worker slots; controllers must not block Bind.
 use super::*;
 use futures_util::FutureExt;
+use std::fmt::Write;
 pub(super) type DriverJoin =
     futures_util::future::Shared<futures_util::future::BoxFuture<'static, ()>>;
 
+/// Retain diagnostics without retaining rejected preparation values or their
+/// physical credits. Both message bytes and source traversal are bounded.
+fn failure(error: &StagingError) -> StagingError {
+    struct Message(String);
+    impl Write for Message {
+        fn write_str(&mut self, value: &str) -> std::fmt::Result {
+            let remaining = 4096 - self.0.len();
+            if value.len() <= remaining {
+                self.0.push_str(value);
+                return Ok(());
+            }
+            let mut end = remaining;
+            while !value.is_char_boundary(end) {
+                end -= 1;
+            }
+            self.0.push_str(&value[..end]);
+            Err(std::fmt::Error)
+        }
+    }
+    let mut message = Message(String::new());
+    let mut source: Option<&(dyn std::error::Error + 'static)> = Some(error);
+    for _ in 0..8 {
+        let Some(error) = source else { break };
+        if !message.0.is_empty() && message.write_str(": ").is_err() {
+            break;
+        }
+        if write!(&mut message, "{error}").is_err() {
+            break;
+        }
+        source = error.source();
+    }
+    StagingError::DriverFailure(message.0.into_boxed_str())
+}
+
 impl StagingCoordinator {
     /// Called only after RepositoryCell selected this root from the completed
     /// row under current audit authorization. No client-provided root enters.
@@ -182,7 +217,15 @@ impl StagingTicket {
                 tracing::warn!(operation = %hex::encode(owner.operation), ?error, "owned push workflow stopped");
                 // The lifecycle still owns every admitted exact command and
                 // physical worker. Never replace an uncertain result with ng.
-                owner.local.lock().expect("staging local").stop = true;
+                let diagnostic = Arc::new(failure(&error));
+                {
+                    let mut local = owner.local.lock().expect("staging local");
+                    local.driver_failure = Some(diagnostic);
+                    local.stop = true;
+                }
+                // Stop is visible before returning any physical credit. Drop
+                // outside the lock: an Activity destructor acquires it too.
+                drop(error);
                 owner.changed.notify_one();
             } else {
                 let mut local = owner.local.lock().expect("staging local");
diff --git a/crates/canopy-server/src/packs/publication/staging_service/publication.rs b/crates/canopy-server/src/packs/publication/staging_service/publication.rs
index b80b9fba..3eb8ab04 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/publication.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/publication.rs
@@ -59,7 +59,7 @@ impl StagingTicket {
         coordinator: &PublicationCoordinator,
         ready: impl Into<ReadyPublication>,
     ) -> Result<StagedPublicationTicket, Box<StagedPublicationFailure>> {
-        self.handoff(coordinator, ready.into(), false)
+        self.handoff(ready.into(), false, |ready| coordinator.try_reserve(ready))
     }
     /// Order one intermediate policy page through the same held slot. A known
     /// successful page resumes Bound; it never terminates or acknowledges a
@@ -69,13 +69,55 @@ impl StagingTicket {
         coordinator: &PublicationCoordinator,
         ready: impl Into<ReadyPublication>,
     ) -> Result<StagedPublicationTicket, Box<StagedPublicationFailure>> {
-        self.handoff(coordinator, ready.into(), true)
+        self.handoff(ready.into(), true, |ready| coordinator.try_reserve(ready))
     }
-    fn handoff(
+    /// Wait only for mutex contention, bounded by the existing custody ceiling.
+    /// Quota refusal is immediate. Admission and lifecycle capture still happen
+    /// synchronously; cancellation before this point cannot dispatch a command.
+    pub async fn publish_wait(
+        &self,
+        coordinator: &PublicationCoordinator,
+        ready: impl Into<ReadyPublication>,
+    ) -> Result<StagedPublicationTicket, Box<StagedPublicationFailure>> {
+        self.handoff_wait(coordinator, ready.into(), false).await
+    }
+    /// Intermediate pages use the same bounded handoff as final publication.
+    pub async fn register_policy_page_wait(
         &self,
         coordinator: &PublicationCoordinator,
+        ready: impl Into<ReadyPublication>,
+    ) -> Result<StagedPublicationTicket, Box<StagedPublicationFailure>> {
+        self.handoff_wait(coordinator, ready.into(), true).await
+    }
+    async fn handoff_wait(
+        &self,
+        coordinator: &PublicationCoordinator,
+        ready: ReadyPublication,
+        policy_page: bool,
+    ) -> Result<StagedPublicationTicket, Box<StagedPublicationFailure>> {
+        let deadline = {
+            let local = self.job.local.lock().expect("staging local");
+            local.deadline.min(local.lifetime)
+        };
+        let Ok(mut admission) =
+            tokio::time::timeout_at(deadline, coordinator.held_admission()).await
+        else {
+            return Err(Box::new(StagedPublicationFailure {
+                reason: StagingError::Inactive,
+                ready,
+            }));
+        };
+        // Recheck live custody after waiting, then retain the exact held ticket
+        // under the lifecycle lock before either lock is released or we yield.
+        self.handoff(ready, policy_page, |ready| admission.reserve(ready))
+    }
+    fn handoff(
+        &self,
         ready: ReadyPublication,
         policy_page: bool,
+        reserve: impl FnOnce(
+            ReadyPublication,
+        ) -> Result<PublicationTicket, Box<PublicationAdmissionFailure>>,
     ) -> Result<StagedPublicationTicket, Box<StagedPublicationFailure>> {
         let mut local = self.job.local.lock().expect("staging local");
         let reason = if ready.is_policy_page() != policy_page {
@@ -100,7 +142,7 @@ impl StagingTicket {
         if let Some(reason) = reason {
             return Err(Box::new(StagedPublicationFailure { reason, ready }));
         }
-        let ticket = coordinator.try_reserve(ready).map_err(|failure| {
+        let ticket = reserve(ready).map_err(|failure| {
             Box::new(StagedPublicationFailure {
                 reason: StagingError::PublicationAdmission(failure.reason),
                 ready: failure.ready,
diff --git a/crates/canopy-server/src/packs/publication/tests/coordinator/held.rs b/crates/canopy-server/src/packs/publication/tests/coordinator/held.rs
index 922f9576..3496b397 100644
--- a/crates/canopy-server/src/packs/publication/tests/coordinator/held.rs
+++ b/crates/canopy-server/src/packs/publication/tests/coordinator/held.rs
@@ -204,7 +204,7 @@ async fn held_admission_uses_existing_account_bytes_and_returns_refused_ready()
         .await
         .err()
         .ok_or("contended synchronous admission unexpectedly accepted")?;
-    assert_eq!(failure.reason, PublicationScheduleError::Capacity);
+    assert_eq!(failure.reason, PublicationScheduleError::Busy);
     attempts[1].3 = Some(failure.ready);
     // The same logical operation cannot have a second held/executing slot.
     let duplicate = Box::pin(attempts[0].0.ready_push(
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
index 68e1eef6..cd775b70 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
@@ -544,3 +544,133 @@ async fn bound_final_observes_shared_coordinator_recovery_without_losing_lifecyc
     f.runtime.shutdown().await?;
     Ok(())
 }
+
+#[tokio::test]
+async fn bound_publication_waits_for_contended_admission_without_losing_original_command() -> Result
+{
+    use std::{
+        future::Future,
+        task::{Context, Poll, Waker},
+    };
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        let p = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
+        let ticket = super::bound::bind(&f, &c, [236; 16], "owner").await?;
+        let session = ticket.bound_session()?;
+        let input = ready(&session).await?;
+        let future = ticket.publish_wait(&p, input);
+        tokio::pin!(future);
+        p.with_admission_for_test(|| {
+            let mut context = Context::from_waker(Waker::noop());
+            assert!(
+                matches!(future.as_mut().poll(&mut context), Poll::Pending),
+                "mutex contention must wait without consuming the prepared command"
+            );
+            assert!(ticket.pending_publication().is_none());
+            assert!(matches!(ticket.state(), StagingState::Bound(_)));
+        })
+        .await;
+        let observer = timeout(Duration::from_secs(10), future).await??;
+        finished(timeout(Duration::from_secs(10), observer.wait()).await?)?;
+        assert_eq!(observer.response().await?, refused());
+        assert!(matches!(
+            terminal(&ticket).await?,
+            StagingState::Published(Ok(_))
+        ));
+        assert!(c.close_and_drain().await.is_empty());
+        assert!(p.close_and_drain().await.is_empty());
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn bound_publication_wait_ceiling_never_admits_or_executes_the_retained_command() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        let p = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
+        let ticket = super::bound::bind(&f, &c, [237; 16], "owner").await?;
+        let session = ticket.bound_session()?;
+        let input = ready(&session).await?;
+        ticket.expire_bound_for_test()?;
+        let failure = timeout(
+            Duration::from_secs(10),
+            p.with_admission_async_for_test(ticket.publish_wait(&p, input)),
+        )
+        .await?
+        .err()
+        .ok_or("publication admitted under a locked mutex")?;
+        assert!(matches!(failure.reason, StagingError::Inactive));
+        assert!(ticket.pending_publication().is_none());
+        assert_eq!(p.stats().await.admitted, 0);
+        assert_eq!(
+            super::super::completion::completed_pushes(&f.handle).await?,
+            0
+        );
+        drop(failure);
+        assert!(matches!(terminal(&ticket).await?, StagingState::Fenced(_)));
+        assert!(c.close_and_drain().await.is_empty());
+        assert!(p.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn bound_publication_wait_keeps_real_quota_refusal_immediate_and_unexecuted() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        let p = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits {
+                per_actor: 1,
+                ..PublicationLimits::default()
+            },
+            f.publication_budget.clone(),
+        )?;
+        let first = super::bound::bind(&f, &c, [238; 16], "owner").await?;
+        let second = super::bound::bind(&f, &c, [239; 16], "owner").await?;
+        let first_input = ready(&first.bound_session()?).await?;
+        let second_input = ready(&second.bound_session()?).await?;
+        let (release, entered) = p.pause_for_test().await;
+        let observer = first.publish_wait(&p, first_input).await?;
+        timeout(Duration::from_secs(10), entered).await??;
+        let failure = timeout(
+            Duration::from_secs(1),
+            second.publish_wait(&p, second_input),
+        )
+        .await?
+        .err()
+        .ok_or("actor quota exceeded")?;
+        assert!(matches!(
+            failure.reason,
+            StagingError::PublicationAdmission(PublicationScheduleError::Capacity)
+        ));
+        assert!(second.pending_publication().is_none());
+        assert!(matches!(second.state(), StagingState::Bound(_)));
+        assert_eq!(p.stats().await.admitted, 1);
+        drop(failure);
+        release
+            .send(())
+            .map_err(|_| "held publication disappeared")?;
+        finished(timeout(Duration::from_secs(10), observer.wait()).await?)?;
+        assert_eq!(
+            super::super::completion::completed_pushes(&f.handle).await?,
+            1
+        );
+        assert!(c.close_and_drain().await.is_empty());
+        assert!(p.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/server/residency/tests/staging.rs b/crates/canopy-server/src/server/residency/tests/staging.rs
index e6d110f9..7b785590 100644
--- a/crates/canopy-server/src/server/residency/tests/staging.rs
+++ b/crates/canopy-server/src/server/residency/tests/staging.rs
@@ -62,6 +62,22 @@ fn driver_request(repository: &RepositoryCell, operation: u8) -> BeginRequest {
     }
 }
 
+struct DriverOwnedFailure {
+    _pin: crate::git_objects::ReadOwner,
+    message: String,
+}
+impl std::fmt::Debug for DriverOwnedFailure {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DriverOwnedFailure").finish_non_exhaustive()
+    }
+}
+impl std::fmt::Display for DriverOwnedFailure {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+impl std::error::Error for DriverOwnedFailure {}
+
 #[tokio::test]
 async fn production_push_driver_survives_observer_loss_binds_and_joins_before_resident_release()
 -> Result {
@@ -276,13 +292,114 @@ async fn production_push_driver_close_preserves_exact_uncertain_begin_and_panic_
             }
         })
         .await?;
-        assert!(matches!(ticket.state(), StagingState::Stopped));
+        assert!(
+            matches!(ticket.state(), StagingState::Fenced(error) if matches!(&*error, StagingError::DriverFailure(message) if message.contains("staging worker panicked")))
+        );
         assert_eq!(manager.staging_budget.available(), (32, 64));
         timeout(Duration::from_secs(10), server.shutdown()).await??;
     }
     Ok(())
 }
 
+#[tokio::test]
+async fn production_push_driver_failure_remains_observable_before_and_after_bind() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for bind in [false, true] {
+            for owned in [false, true] {
+                let (server, _files) = server().await?;
+                let manager = server.repositories.clone();
+                let entry = create(&manager, "driver-failure", format).await?;
+                let (repository, _, service) = loaded(&manager, entry.repository_id).await?;
+                let coordinator = repository.staging_coordinator()?;
+                let request = driver_request(&repository, 184);
+                let ready = coordinator
+                    .ready_request(request.clone(), mutation_identity()?)
+                    .await?;
+                let ticket = coordinator.submit(ready).map_err(|(error, _)| error)?;
+                let (entered, running) = oneshot::channel();
+                let (release, proceed) = oneshot::channel();
+                ticket.drive(move |ticket, _| async move {
+                    if !matches!(ticket.wait().await, StagingState::Active(_)) {
+                        return Err(StagingError::Context);
+                    }
+                    if bind {
+                        ticket.seal()?;
+                        if !matches!(ticket.wait_terminal().await, StagingState::Bound(_)) {
+                            return Err(StagingError::Context);
+                        }
+                    }
+                    let pin = if owned {
+                        let task = if bind {
+                            ticket.spawn_bound(|_, context| async move {
+                                Ok(context.physical_owner())
+                            })?
+                        } else {
+                            ticket.spawn(|context| async move { Ok(context.physical_owner()) })?
+                        };
+                        Some(
+                            task.wait()
+                                .await
+                                .map_err(|error| StagingError::Input(Box::new(error)))?,
+                        )
+                    } else {
+                        None
+                    };
+                    let _ = entered.send(());
+                    let _ = proceed.await;
+                    Err(match pin {
+                        Some(pin) => StagingError::Input(Box::new(DriverOwnedFailure {
+                            _pin: pin,
+                            message: format!("worker-owned failure {}", "λ".repeat(4096)),
+                        })),
+                        None => StagingError::Clock,
+                    })
+                })?;
+                timeout(Duration::from_secs(5), running).await??;
+                let original_bound = ticket.bound_result();
+                assert_eq!(original_bound.is_some(), bind);
+                assert_eq!(
+                    manager.staging_budget.available(),
+                    (31, if owned { 63 } else { 64 })
+                );
+                drop(ticket);
+                let observer = coordinator.join_request(&request)?.expect("owned driver");
+                let _ = release.send(());
+                let outcome = timeout(Duration::from_secs(5), observer.wait_completion()).await?;
+                let StagingState::Fenced(error) = outcome else {
+                    return Err(format!("controller failure was lost: {outcome:?}").into());
+                };
+                let StagingError::DriverFailure(message) = &*error else {
+                    return Err(format!("unexpected controller failure: {error:?}").into());
+                };
+                assert!(message.len() <= 4096);
+                assert!(message.contains(if owned {
+                    "worker-owned failure"
+                } else {
+                    "staging clock failed"
+                }));
+                assert_eq!(observer.bound_result().is_some(), bind);
+                if let Some(original) = original_bound {
+                    assert!(Arc::ptr_eq(
+                        &original,
+                        &observer.bound_result().expect("historical Bind")
+                    ));
+                }
+                assert!(observer.pending_publication().is_none());
+                timeout(Duration::from_secs(5), async {
+                    while coordinator.stats().admitted != 0 {
+                        tokio::task::yield_now().await;
+                    }
+                })
+                .await?;
+                assert_eq!(manager.staging_budget.available(), (32, 64));
+                assert!(!service.coordinator.stats().await.closed);
+                timeout(Duration::from_secs(10), server.shutdown()).await??;
+            }
+        }
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn production_staging_blocks_eviction_and_shutdown_until_detached_physical_worker_drains()
 -> Result {
diff --git a/docs/evidence/push-admission-ci-20261005.json b/docs/evidence/push-admission-ci-20261005.json
new file mode 100644
index 00000000..5a05b7df
--- /dev/null
+++ b/docs/evidence/push-admission-ci-20261005.json
@@ -0,0 +1,632 @@
+{
+  "recorded_at_utc": "2026-10-05T06:29:55.815708+00:00",
+  "base_head": "79e2a3c7c8f6f094d4056ba1a106511619b2a351",
+  "source_files": 493,
+  "rust_files": 479,
+  "source_hash_digest": "e27224d4325fe884709cddc6d45a2809de1914a9b4c0a5b79f88520cc4e6d024",
+  "source_digest_algorithm": "SHA256 of sorted path + NUL + file SHA256 + newline for Rust, SQL, Cargo manifests/lock/toolchain files",
+  "source_manifest": "/tmp/canopy-admission-final-source.json",
+  "workflow_sha256": "8a891045792649c21d7728bc29341fcf7827050510a898b4d4365df48a1a8649",
+  "toolchain": "Rust 1.98.0, macOS ARM64, isolated Cargo target, RUSTC_WRAPPER empty",
+  "release_qualified": false,
+  "ci_pass_claim": false,
+  "regressions": {
+    "controller_failure_before_bind": {
+      "log": "/tmp/canopy-driver-failure-repro1.log",
+      "sha256": "15a48e82470800f891722fb16a7fe2d71fe1bc5df3b64afaa87de84208470b50",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 711 filtered out; finished in 0.26s"
+      ],
+      "failed_cases": [
+        "server::residency::tests::staging::production_push_driver_failure_remains_observable_before_and_after_bind"
+      ],
+      "source_manifest": "/tmp/canopy-driver-failure-repro1-source.json",
+      "source_digest": "414e41ed3e799c15a8bc31b187864e68b12f8aab20f35b270ecbc1a77d26e7f9"
+    },
+    "retaining_error_that_owns_physical_worker": {
+      "log": "/tmp/canopy-driver-failure-owner-repro1.log",
+      "sha256": "f91918b056057df5e0bb737a58834ad70b78e17d834004b275b55cd64b9e887a",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 711 filtered out; finished in 5.47s"
+      ],
+      "failed_cases": [
+        "server::residency::tests::staging::production_push_driver_failure_remains_observable_before_and_after_bind"
+      ],
+      "source_manifest": "/tmp/canopy-driver-failure-owner-repro1-source.json",
+      "source_digest": "b43ba82a2a059fbf34a1ad521b5e1d1369f801962ec3030b7edc73cb53bc40a7"
+    },
+    "bounded_driver_diagnostic": {
+      "log": "/tmp/canopy-driver-failure-focused-final.log",
+      "sha256": "f8269d4034cf7e2d8910f411983afad846de35b575b16156915bf7d77709d43d",
+      "exit_code": 0,
+      "summaries": [
+        "test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 708 filtered out; finished in 14.24s"
+      ],
+      "failed_cases": [],
+      "source_manifest": "/tmp/canopy-driver-failure-final-source.json",
+      "source_digest": "f02f74b4665dbc6629b881235ed56395a7ecfa49135bbf54e33ea612582aca51"
+    },
+    "contended_real_bound_handoff_before_fix": {
+      "log": "/tmp/canopy-admission-contention-repro.log",
+      "sha256": "f282d674392acbbc2de1d755d6c8251d47958c826805d73812aad26554419e63",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 712 filtered out; finished in 0.16s"
+      ],
+      "failed_cases": [
+        "packs::publication::tests::staging_service::publication::bound_publication_waits_for_contended_admission_without_losing_original_command"
+      ]
+    },
+    "contention_quota_and_deadline_after_fix": {
+      "log": "/tmp/canopy-admission-contention-focused-final.log",
+      "sha256": "bce62f49db9f49e11fa12d1feb398b3a2842d1fe894fb309a49200c635b0c0de",
+      "exit_code": 0,
+      "summaries": [
+        "test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 712 filtered out; finished in 0.55s"
+      ],
+      "failed_cases": [],
+      "source_manifest": "/tmp/canopy-admission-final-source.json",
+      "source_digest": "e27224d4325fe884709cddc6d45a2809de1914a9b4c0a5b79f88520cc4e6d024"
+    }
+  },
+  "intermediate_driver_source": {
+    "validation": {
+      "source_digest": "f02f74b4665dbc6629b881235ed56395a7ecfa49135bbf54e33ea612582aca51",
+      "phases": [
+        {
+          "name": "focused",
+          "exit_code": 0,
+          "seconds": 134.01,
+          "log": "/tmp/canopy-driver-failure-focused-final.log",
+          "log_sha256": "f8269d4034cf7e2d8910f411983afad846de35b575b16156915bf7d77709d43d",
+          "summaries": [
+            "test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 708 filtered out; finished in 14.24s"
+          ],
+          "failed_cases": []
+        },
+        {
+          "name": "workspace",
+          "exit_code": 101,
+          "seconds": 43.46,
+          "log": "/tmp/canopy-driver-failure-workspace-final.log",
+          "log_sha256": "eaf4c8970d796a1072e7fd5a62811b0a7de63baead83f02081a0ab1db7cd2d42",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "clippy",
+          "exit_code": 0,
+          "seconds": 64.98,
+          "log": "/tmp/canopy-driver-failure-clippy-final.log",
+          "log_sha256": "ac704f42b4ed890ab4654f0415890ca3debf5498f7d6d129539c127d029edd61",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "build",
+          "exit_code": 0,
+          "seconds": 68.41,
+          "log": "/tmp/canopy-driver-failure-build-final.log",
+          "log_sha256": "edd67e4a5978392bcd3db1f83b7eb6420506ed92b103d1692c312e247cc098f1",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "fmt",
+          "exit_code": 0,
+          "seconds": 1.33,
+          "log": "/tmp/canopy-driver-failure-fmt-final.log",
+          "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "diff",
+          "exit_code": 0,
+          "seconds": 0.03,
+          "log": "/tmp/canopy-driver-failure-diff-final.log",
+          "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "summaries": [],
+          "failed_cases": []
+        }
+      ],
+      "complete": true,
+      "release_qualified": false,
+      "source_unchanged": true
+    },
+    "workspace_retry": {
+      "log": "/tmp/canopy-driver-failure-workspace-retry1.log",
+      "sha256": "0981246f9b74acd389d7db58fc9dbcb760f72cc04895d145ccd933d518e51280",
+      "exit_code": 101,
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.80s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.31s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 711 filtered out; finished in 0.01s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 711 filtered out; finished in 0.09s",
+        "test result: FAILED. 708 passed; 4 failed; 0 ignored; 0 measured; 0 filtered out; finished in 353.45s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.77s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s",
+        "test result: FAILED. 73 passed; 33 failed; 9 ignored; 0 measured; 0 filtered out; finished in 370.55s",
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.44s",
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.22s",
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.48s",
+        "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s",
+        "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+      ],
+      "failed_cases": [
+        "packs::publication::tests::serving::lifecycle::restarts::producer_restarts_preserve_factory_identity_held_ticket_capture_renewal_and_release",
+        "server::residency::tests::serving::production_shutdown_keeps_publication_cell_heartbeat_and_workspace_until_last_borrow",
+        "server::residency::tests::serving::production_resident_shares_generation_and_busy_eviction_resumes_before_exact_drain",
+        "server::residency::tests::recovery::production_shutdown_recovers_other_repositories_while_one_producer_holds_its_command",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+        "bulk_refs::bulk_mirror_publication_is_atomic_and_survives_restart",
+        "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+        "repository_cell_publishes_objects_and_refs_atomically",
+        "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+      ],
+      "source_manifest": "/tmp/canopy-driver-failure-final-source.json",
+      "source_digest": "f02f74b4665dbc6629b881235ed56395a7ecfa49135bbf54e33ea612582aca51"
+    },
+    "workspace_retry_note": "Isolated target and disabled sccache compiled after a missing rcgu.o failure in the previous shared target. Full run still failed: 708/4 server libraries, 73/33/9 multi-server, three standalone failures. Four timeouts passed focused only after concurrent build jobs drained; final full-suite results supersede neither historical failure nor its source fingerprint."
+  },
+  "final_validation": {
+    "source_digest": "e27224d4325fe884709cddc6d45a2809de1914a9b4c0a5b79f88520cc4e6d024",
+    "phases": [
+      {
+        "name": "restart",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "producer_restarts_preserve_factory_identity_held_ticket_capture_renewal_and_release",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 6.78,
+        "log": "/tmp/canopy-admission-restart-final.log",
+        "log_sha256": "2dde1a4c3b94532c7925333bd55c23860d3784a63ca865ee119c9edca4777bdc",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 714 filtered out; finished in 5.54s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "shutdown",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "production_shutdown_keeps_publication_cell_heartbeat_and_workspace_until_last_borrow",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 1.64,
+        "log": "/tmp/canopy-admission-shutdown-final.log",
+        "log_sha256": "0fad96827df24c581ad5df0781d355379b554b3a39174735ed3c2d2ae090bfa3",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 714 filtered out; finished in 1.00s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "eviction",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "production_resident_shares_generation_and_busy_eviction_resumes_before_exact_drain",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 1.23,
+        "log": "/tmp/canopy-admission-eviction-final.log",
+        "log_sha256": "27392eb0b377815b6b8b8ac32e139dfd1bdd3cf6c943ca9e98697f41c66c7a1a",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 714 filtered out; finished in 0.82s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "recovery",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "production_shutdown_recovers_other_repositories_while_one_producer_holds_its_command",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 8.65,
+        "log": "/tmp/canopy-admission-recovery-final.log",
+        "log_sha256": "eb25bf09a8cd57f248f6da9e92c1ea4de65c92587437eca20c6cd1ae1a966480",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 714 filtered out; finished in 8.30s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "bulk",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "multi_server",
+          "bulk_mirror_publication_is_atomic_and_survives_restart",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 146.72,
+        "log": "/tmp/canopy-admission-bulk-final.log",
+        "log_sha256": "3a77ea2bfd517cfd5a2c05b0a1f6db6665a6724b2b36af16ec385764007f1ece",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 114 filtered out; finished in 74.99s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "options",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "multi_server",
+          "push_options::",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 7.73,
+        "log": "/tmp/canopy-admission-options-final.log",
+        "log_sha256": "0b811e31fc9c583a89703f4cbabbac9b42363c3decc1411065d4f032ab3febec",
+        "summaries": [
+          "test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 111 filtered out; finished in 5.22s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 722.6,
+        "log": "/tmp/canopy-admission-workspace-final.log",
+        "log_sha256": "e3e6fa071cf518d66b65144702a7399a04f37ebc74d59b5e2b674aa5e0a599dc",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.09s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.70s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 714 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 714 filtered out; finished in 0.20s",
+          "test result: ok. 715 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 327.22s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.94s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s",
+          "test result: FAILED. 75 passed; 31 failed; 9 ignored; 0 measured; 0 filtered out; finished in 358.04s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.42s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.63s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.21s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+          "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+          "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 46.74,
+        "log": "/tmp/canopy-admission-clippy-final.log",
+        "log_sha256": "b33de76a1243507d0a4378b4ba042da68b08296e5f56d7585f4f4417fac77c70",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 59.76,
+        "log": "/tmp/canopy-admission-build-final.log",
+        "log_sha256": "9aeec9c34c760a400ef390e410cc12ab6c4eb1d3de6b883e47e3e28190508573",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.29,
+        "log": "/tmp/canopy-admission-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 42.59,
+        "log": "/tmp/canopy-admission-harness-final.log",
+        "log_sha256": "46d58ee2d7dc831ae0e69d4cd0d8a1d424173487af3937adf80887a5215b74ed",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.04,
+        "log": "/tmp/canopy-admission-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "parent_linux_ci": {
+    "head": "79e2a3c7c8f6f094d4056ba1a106511619b2a351",
+    "pr_run": 37264946662,
+    "rust_job": 111619651832,
+    "conclusion": "FAILURE",
+    "server_library": {
+      "passed": 711,
+      "failed": 0
+    },
+    "multi_server": {
+      "passed": 75,
+      "failed": 35,
+      "ignored": 9
+    },
+    "log": {
+      "log": "/tmp/canopy-remote-79e2a3c-pr-full.log",
+      "sha256": "c4544a19463e7dd4ecd2e1c495b957254c3599df345dff90c97502bccae00b4c",
+      "exit_code": 101,
+      "summaries": [],
+      "failed_cases": []
+    },
+    "toolchain_note": "Git 2.55.0 is printed; exact Rust version was not printed. Workflow now reports rustc/cargo/active-toolchain/Git versions without changing toolchain selection."
+  },
+  "prior_linux_arm_probes": {
+    "pre_admission_source_note": "These are diagnostic probes, not final-source Linux qualification.",
+    "rust197_options": {
+      "log": "/tmp/canopy-options-linux-group1.log",
+      "sha256": "e168702f061766ac4ee50d7acd21364c7719072cda5c850f8fd9270172932852",
+      "exit_code": 0,
+      "summaries": [
+        "test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 114 filtered out; finished in 5.96s"
+      ],
+      "failed_cases": []
+    },
+    "rust197_matrix": {
+      "log": "/tmp/canopy-options-linux-matrix1.log",
+      "sha256": "7d83f869d1db6d82b312cb1421b275892dbf1adae0a9846a3df523e3e4e1cc75",
+      "exit_code": 101,
+      "summaries": [
+        "test result: FAILED. 77 passed; 33 failed; 9 ignored; 0 measured; 0 filtered out; finished in 504.00s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "branch_rules::protected_pushes_preserve_native_reports_and_policy_across_recovery",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "lfs_locks::stock_lfs_locks_block_conflicting_pushes_and_unlock_allows_retry",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::failed_local_cleanup_retries_before_restoring_the_released_repository",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    },
+    "rust198_options": {
+      "log": "/tmp/canopy-options-linux-rust198-group1.log",
+      "sha256": "2f61d9ee6386d15739908a6474f9c6b716980772f65625403d8f4d5539d4785d",
+      "exit_code": 0,
+      "summaries": [
+        "test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 114 filtered out; finished in 14.93s"
+      ],
+      "failed_cases": []
+    },
+    "bounded_driver_source_options": {
+      "log": "/tmp/canopy-driver-failure-linux-options-final.log",
+      "sha256": "ee7b1b8d95110bd4a48a025ab4727ecb0e5a32029510321b228667106a6dbc79",
+      "exit_code": 0,
+      "summaries": [
+        "test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 114 filtered out; finished in 3.92s"
+      ],
+      "failed_cases": [],
+      "source_manifest": "/tmp/canopy-driver-failure-final-source.json",
+      "source_digest": "f02f74b4665dbc6629b881235ed56395a7ecfa49135bbf54e33ea612582aca51"
+    },
+    "bounded_driver_source_controllers": {
+      "log": "/tmp/canopy-driver-failure-linux-controllers-final.log",
+      "sha256": "eecbf2792285151aad36fd76847465d1cf5bfb89a32a8c723f90b081567841ab",
+      "exit_code": 0,
+      "summaries": [
+        "test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 708 filtered out; finished in 14.30s"
+      ],
+      "failed_cases": [],
+      "source_manifest": "/tmp/canopy-driver-failure-final-source.json",
+      "source_digest": "f02f74b4665dbc6629b881235ed56395a7ecfa49135bbf54e33ea612582aca51"
+    }
+  },
+  "scope_and_limits": [
+    "A contended mutex now has a distinct Busy classification. Native push waits fairly for the mutex under the existing custody deadline and keeps the original prepared command. Actual operation/account/byte quota refusal remains Capacity and is never retried.",
+    "Held reservation, custody recheck and lifecycle ticket capture are synchronous under the same admission guard. No admitted command exists while awaiting that guard. Timeout returns the original ready value; requester cancellation does not own the resident controller.",
+    "Controller diagnostics retain at most 4096 valid UTF-8 bytes and eight error sources. Rejected prepared values are dropped outside the local lock after stop is recorded, before physical credits can be reused. Historical Bind evidence remains separate.",
+    "Known completion responses use the existing publication ticket read capability, completion receipt watermark and fresh authorization. Missing request replay alone was not proven causal.",
+    "Local bulk failure exposed PublicationAdmission(Capacity); deterministic contention repro proves the busy-mutex defect. Final-head GitHub option failures require actual CI observation, not extrapolation from ARM64/local passes.",
+    "No tests disabled, no quotas raised, no authorization weakened, no retired object/ref SQL tables restored.",
+    "Remaining native metadata/writer conversion, refusal-only pre-Bind terminal semantics, peer routing, backup/filtered reads, standalone resident fixtures, physical custody completion and large-history/team capacity gates remain open."
+  ],
+  "sdk": {
+    "path": "/Users/haipingfu/.codex/worktrees/durable-command-recovery/cellule",
+    "head": "161067f5a21703b3e257024bcb64e565fd9657b4",
+    "clean_when_checked": true
+  },
+  "unique_workspace_inventory": {
+    "passed": 828,
+    "failed": 34,
+    "ignored_unexecuted": 9,
+    "total": 871
+  }
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index aa63a649..30a0ab3a 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -106,6 +106,73 @@ defines the pending refusal-only authority boundary without weakening Write for
 admission or publication. Full CI, generated metadata/writers, backup/routing,
 physical ownership/recovery and large-team capacity remain open.
 
+## Push failure observation and admission contention (2026-10-05)
+
+A controller failure before Bind previously became `Stopped`, so receive-pack
+reported `MalformedCache` instead of the actual failure. After Bind, the same
+path reported the historical `Bound` state and could strand a completion
+observer. Failed controllers now finish as `Fenced` with a diagnostic bounded to
+4,096 UTF-8 bytes and eight error sources. The original Bind receipt remains
+available as historical evidence. Clean stop behavior is unchanged.
+
+Errors can contain rejected preparation values that retain physical worker
+credits. The controller records stop before dropping those values outside its
+local lock; only the bounded diagnostic survives. Regression coverage uses a
+real resident, observer loss/rejoin, both object formats, both Bind phases,
+ordinary failures and an error carrying an actual worker pin. Retaining the
+whole error reproduced a drain timeout; the bounded representation removes that
+ownership cycle. Existing cancellation, panic and exact uncertain-Begin recovery
+families remain required checks.
+
+Known completed HTTP/SSH responses now use the retained publication ticket's
+existing response API, including its completion receipt as the query watermark
+and a fresh read-authorization check. Initial request replay remains a separate
+authorized lookup. Neither diagnostics nor receipts grant artifact authority.
+
+The diagnostic exposed a bulk-mirror failure during final publication admission.
+Synchronous admission classified a busy mutex as `Capacity`; receive-pack treated
+that refusal as terminal. This can happen when a completed page wakes its
+observer before the coordinator releases its mutex. Contention now has a
+separate `Busy` classification. Native final commands and policy pages wait for
+the fair mutex under their existing custody ceiling, retaining the original
+prepared command and registered recovery. After the wait, the lifecycle checks
+current custody and captures the held ticket synchronously under the admission
+guard. Waiting reserves no quota and dispatches no command. Operation, account
+and byte quota refusals remain immediate; no limit is increased or retried.
+
+A deterministic regression polls a real bound publication while the mutex is
+held, then verifies the original command completes after release. Separate cases
+verify that quota exhaustion refuses without execution and that a custody
+ceiling ends the wait without admission. All three families pass for SHA-1 and
+SHA-256. The stock Git bulk mirror and HTTP push-option group also pass locally.
+
+Linux Verify at head `79e2a3c7c8f6f094d4056ba1a106511619b2a351` passes all 711
+server library cases and the stock SSH workflow, but multi-server still fails
+with 75 passes, 35 failures and nine ignores. Three rejected-option families
+continue to fail on GitHub; a bulk-mirror failure also appeared under load.
+Isolated Linux ARM64 option groups pass with Rust 1.97 and 1.98, with and without
+warning-level logging. These observations do not establish the cause of those
+GitHub option failures or qualify the complete CI workflow. Verify now prints
+Rust, Cargo, active-toolchain and Git versions without changing toolchain choice.
+
+The final frozen-source macOS run passes all 736 library cases (715 server),
+13 directory cases, two Git backend cases and two binary cases. Multi-server
+finishes with 75 passes, 31 failures and nine existing ignores; bulk mirror,
+HTTP/SSH options and stock SSH pass under concurrent load. The three standalone
+integration aggregates still fail. All-target Clippy with warnings denied,
+formatting and the server build pass. The unique workspace inventory is 828
+passes, 34 failures and nine unexecuted ignores; focused reruns and nested child
+summaries are not counted again. No final-source RustFS claim is made.
+
+Exact source/log fingerprints, both controller-failure reproductions, the
+contended-admission reproduction, intermediate failed validation and final
+validation are retained in
+[`push-admission-ci-20261005.json`](evidence/push-admission-ci-20261005.json).
+Current-head Linux CI remains required. Native collaboration metadata and
+candidate writers, pre-Bind refusal semantics, peer routing, backup/filtered
+reads and actual standalone resident fixtures remain the highest release gates.
+The complete storage/team-capacity goal remains open.
+
 ## Whole-workflow ownership and CI repair
 
 The production resident supplies its actual Cell client and publication

From c86057c441ca86e856bc5be0fdeef01a6782b142 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 00:25:41 -0700
Subject: [PATCH 35/55] fix: read commit checks from pinned native metadata

---
 crates/canopy-server/src/checks/mod.rs        |  39 +-
 crates/canopy-server/src/checks/mutations.rs  |  53 +-
 crates/canopy-server/src/checks/native.rs     | 188 +++++++
 .../canopy-server/src/checks/native/codec.rs  |  98 ++++
 .../packs/publication/commit_membership.rs    | 164 +++++++
 .../src/packs/publication/mod.rs              |   4 +
 .../src/packs/publication/registry.rs         |  16 +-
 .../packs/publication/serving/lifecycle.rs    |   7 +
 .../src/packs/publication/serving/session.rs  |   1 +
 .../publication/serving/session/membership.rs |  69 +++
 .../src/repository_http/checks.rs             |   8 +-
 .../server/residency/tests/serving/browser.rs |   1 +
 .../residency/tests/serving/browser/checks.rs | 300 ++++++++++++
 docs/contracts.md                             |  23 +-
 docs/evidence/native-checks-ci-20261005.json  | 460 ++++++++++++++++++
 .../large-repository-implementation-status.md |  52 +-
 16 files changed, 1435 insertions(+), 48 deletions(-)
 create mode 100644 crates/canopy-server/src/checks/native.rs
 create mode 100644 crates/canopy-server/src/checks/native/codec.rs
 create mode 100644 crates/canopy-server/src/packs/publication/commit_membership.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/membership.rs
 create mode 100644 crates/canopy-server/src/server/residency/tests/serving/browser/checks.rs
 create mode 100644 docs/evidence/native-checks-ci-20261005.json

diff --git a/crates/canopy-server/src/checks/mod.rs b/crates/canopy-server/src/checks/mod.rs
index c1bb5d7d..e8453a36 100644
--- a/crates/canopy-server/src/checks/mod.rs
+++ b/crates/canopy-server/src/checks/mod.rs
@@ -3,6 +3,8 @@
 use crate::ReadIdentity;
 
 mod mutations;
+pub(crate) mod native;
+pub use native::NativeCheckError;
 
 use crate::{RepositoryCell, directory::validate_component, validate_repository_id};
 use cellule_runtime::{
@@ -179,20 +181,33 @@ impl RepositoryCell {
         actor: impl Into<ReadIdentity<'a>>,
         oid: crate::ObjectId,
         after: Option<&str>,
-    ) -> Result<Observed<Option<Vec<CommitCheck>>>, Invocation> {
+    ) -> Result<Observed<Option<Vec<CommitCheck>>>, NativeCheckError> {
         let actor = actor.into();
-        let mut parameters = cursor_parameters(actor, after)?;
-        parameters.push(SqlValue::Blob(oid.to_vec()));
-        let result = self.check_rows(
-            SqlStatement { sql: format!("SELECT ({ACCESS}) AND EXISTS (SELECT 1 FROM objects WHERE oid = ?2 AND kind = 'commit')"), parameters: vec![parameters[0].clone(), parameters[2].clone()] },
-            SqlStatement {
-                sql: format!("SELECT c.name, c.reporter, c.enabled, c.version, {RUN_COLUMNS} FROM check_contexts c LEFT JOIN check_runs r ON r.number = (SELECT number FROM check_runs WHERE oid = ?3 AND context = c.name AND context_version = c.version ORDER BY number DESC LIMIT 1) WHERE c.enabled = 1 AND c.name > ?2 AND ({ACCESS}) ORDER BY c.name LIMIT {CHECK_PAGE_SIZE}"), parameters,
-            },
-        ).await?;
+        if let Some(cursor) = after {
+            validate_component(cursor)?;
+        }
+        // Keep the actual borrow until the receiver verifies the retained pin.
+        let (_snapshot, selection) = self.check_selection(actor, oid).await?;
+        let result = self
+            .application
+            .query::<native::ReadCommitChecks>(
+                &self.target,
+                None,
+                native::CommitPage {
+                    selection,
+                    after: after.map(str::to_owned),
+                },
+            )
+            .await
+            .map_err(|e| NativeCheckError::Read(Box::new(e)))?;
         let output = result
             .output
-            .map(|rows| {
-                rows.iter()
+            .map(|sets| {
+                let rows = sets
+                    .first()
+                    .ok_or(Error::Command("missing native checks page"))?;
+                rows.rows
+                    .iter()
                     .map(|row| {
                         if row.len() != 14 {
                             return Err(Error::Command("invalid commit checks row"));
@@ -209,7 +224,7 @@ impl RepositoryCell {
                     .collect()
             })
             .transpose()
-            .map_err(Invocation::NotStarted)?;
+            .map_err(NativeCheckError::Invalid)?;
         Ok(Observed {
             output,
             receipt: result.receipt,
diff --git a/crates/canopy-server/src/checks/mutations.rs b/crates/canopy-server/src/checks/mutations.rs
index 74d32c4f..76cbf1df 100644
--- a/crates/canopy-server/src/checks/mutations.rs
+++ b/crates/canopy-server/src/checks/mutations.rs
@@ -45,34 +45,37 @@ impl RepositoryCell {
         identity: MutationIdentity,
         actor: &str,
         input: NewCheck<'_>,
-    ) -> Result<Committed<CheckChange>, Invocation> {
-        for name in [actor, input.context] {
-            validate_component(name).map_err(Invocation::NotStarted)?;
+    ) -> Result<Committed<CheckChange>, NativeCheckError> {
+        for value in [actor, input.context] {
+            validate_component(value)?;
         }
-        validate_repository_id(input.id).map_err(Invocation::NotStarted)?;
+        validate_repository_id(input.id)?;
         if input.context_version < 1 {
-            return Err(Invocation::NotStarted(Error::Command(
-                "invalid check context version",
-            )));
+            return Err(Error::Command("invalid check context version").into());
+        }
+        let (_snapshot, selection) = self
+            .check_selection(ReadIdentity::Account(actor), input.oid)
+            .await?;
+        let result = self
+            .application
+            .command::<native::StartCommitCheck>(
+                &self.target,
+                identity,
+                native::CheckStart {
+                    selection,
+                    id: input.id,
+                    context: input.context.into(),
+                    context_version: input.context_version,
+                },
+            )
+            .await;
+        // A recorded policy rejection is a domain outcome with its original
+        // receipt. Pending/transport failures must never be converted to one.
+        match result {
+            Ok(value) => Ok(value),
+            Err(InvocationError::Rejected(value)) => Ok(*value),
+            Err(error) => Err(NativeCheckError::Start(Box::new(error))),
         }
-        let mut parameters = vec![
-            SqlValue::Text(actor.into()),
-            SqlValue::Blob(input.id.to_vec()),
-            SqlValue::Blob(input.oid.to_vec()),
-            SqlValue::Text(input.context.into()),
-            SqlValue::Integer(input.context_version),
-        ];
-        let decision = format!(
-            "CASE WHEN NOT ({ACCESS}) OR NOT EXISTS (SELECT 1 FROM objects WHERE oid = ?3 AND kind = 'commit') OR NOT EXISTS (SELECT 1 FROM check_contexts WHERE name = ?4) THEN 'missing' WHEN NOT EXISTS (SELECT 1 FROM check_contexts WHERE name = ?4 AND reporter = ?1) THEN 'forbidden' WHEN NOT EXISTS (SELECT 1 FROM check_contexts WHERE name = ?4 AND version = ?5 AND enabled = 1) OR EXISTS (SELECT 1 FROM check_runs WHERE id = ?2 AND (oid != ?3 OR context != ?4 OR context_version != ?5 OR reporter != ?1)) THEN 'conflict' ELSE 'applied' END"
-        );
-        let check = SqlStatement {
-            sql: format!("SELECT {decision}"),
-            parameters: parameters.clone(),
-        };
-        parameters.push(SqlValue::Integer(identity.issued_at_ms));
-        self.check_change(identity, vec![check,
-            SqlStatement { sql: format!("INSERT INTO check_runs (id, oid, context, context_version, reporter, state, version, summary, created_ms, updated_ms) SELECT ?2, ?3, ?4, ?5, ?1, 'queued', 1, '', ?6, ?6 WHERE ({decision}) = 'applied' AND NOT EXISTS (SELECT 1 FROM check_runs WHERE id = ?2)"), parameters },
-        ]).await
     }
 
     /// Advances an active attempt for its still-configured reporter and policy version.
diff --git a/crates/canopy-server/src/checks/native.rs b/crates/canopy-server/src/checks/native.rs
new file mode 100644
index 00000000..8ea0847b
--- /dev/null
+++ b/crates/canopy-server/src/checks/native.rs
@@ -0,0 +1,188 @@
+//! Check metadata receivers consume privately issued, bounded commit membership.
+use super::*;
+use crate::{
+    ObjectId, RepositoryModule,
+    packs::publication::{
+        CommitMembership, MembershipRequest, ServingOwnerError, ServingReadError,
+    },
+};
+use cellule_runtime::codec::{BoundedDecoder, BoundedEncoder, CodecError, WireValue};
+use cellule_runtime::{
+    CellId, CellModule, Command, Query,
+    registry::{CommandContext, CommandResult, OwnerFence, QueryContext},
+};
+mod codec;
+
+#[derive(Debug, thiserror::Error)]
+pub enum NativeCheckError {
+    #[error("invalid native check request")]
+    Invalid(#[from] Error),
+    #[error("native check membership unavailable")]
+    Owner(#[from] ServingOwnerError),
+    #[error("native check membership failed")]
+    Membership(#[from] ServingReadError),
+    #[error("native check page failed")]
+    Read(#[source] Box<InvocationError<Option<Vec<SqlResultSet>>>>),
+    #[error("native check start failed")]
+    Start(#[source] Box<InvocationError<CheckChange>>),
+}
+#[derive(Clone, Debug)]
+pub(crate) struct CommitSelection {
+    pub(crate) repository: [u8; 16],
+    pub(crate) actor: Option<String>,
+    pub(crate) oid: ObjectId,
+    pub(crate) membership: Option<CommitMembership>,
+}
+impl CommitSelection {
+    fn authorized(
+        &self,
+        cell: CellId,
+        owner: Option<OwnerFence>,
+        now: i64,
+        query: impl FnMut(&SqlBatch) -> cellule_runtime::Result<Vec<SqlResultSet>>,
+    ) -> cellule_runtime::Result<bool> {
+        let Some(proof) = &self.membership else {
+            return Ok(false);
+        };
+        proof.authorize(
+            MembershipRequest {
+                cell,
+                owner,
+                repository: self.repository,
+                actor: &self.actor,
+                oid: self.oid,
+                admitted_ms: now,
+            },
+            query,
+        )
+    }
+}
+#[derive(Clone, Debug)]
+pub(crate) struct CommitPage {
+    pub(crate) selection: CommitSelection,
+    pub(crate) after: Option<String>,
+}
+#[derive(Clone, Debug)]
+pub(crate) struct CheckStart {
+    pub(crate) selection: CommitSelection,
+    pub(crate) id: [u8; 16],
+    pub(crate) context: String,
+    pub(crate) context_version: i64,
+}
+
+pub(crate) struct ReadCommitChecks;
+impl Query for ReadCommitChecks {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 50;
+    const CODEC_VERSION: u32 = 1;
+    type Input = CommitPage;
+    type Output = Option<Vec<SqlResultSet>>;
+    fn execute(
+        context: &mut QueryContext<'_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<Self::Output> {
+        input.encode(&mut BoundedEncoder::new(4096)?)?;
+        if !input
+            .selection
+            .authorized(context.cell_id(), None, context.now_ms(), |q| {
+                context.sql(q)
+            })?
+        {
+            return Ok(None);
+        }
+        let actor = input
+            .selection
+            .actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        Ok(Some(context.sql(&SqlBatch { statements: vec![SqlStatement {
+            sql: format!("SELECT c.name, c.reporter, c.enabled, c.version, {RUN_COLUMNS} FROM check_contexts c LEFT JOIN check_runs r ON r.number = (SELECT number FROM check_runs WHERE oid = ?3 AND context = c.name AND context_version = c.version ORDER BY number DESC LIMIT 1) WHERE c.enabled = 1 AND c.name > ?2 AND ({ACCESS}) ORDER BY c.name LIMIT {CHECK_PAGE_SIZE}"),
+            parameters: vec![actor.parameter(), SqlValue::Text(input.after.unwrap_or_default()), SqlValue::Blob(input.selection.oid.to_vec())],
+        }]})?))
+    }
+}
+pub(crate) struct StartCommitCheck;
+impl Command for StartCommitCheck {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 49;
+    const CODEC_VERSION: u32 = 1;
+    type Input = CheckStart;
+    type Output = CheckChange;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        input.encode(&mut BoundedEncoder::new(4096)?)?;
+        if !input.selection.authorized(
+            context.target().cell_id(),
+            Some(context.owner_fence()),
+            context.now_ms(),
+            |q| context.sql(q),
+        )? {
+            return Ok(CommandResult::Rejected(CheckChange::NotFound));
+        }
+        let actor = input
+            .selection
+            .actor
+            .ok_or(Error::Command("check reporter missing"))?;
+        let mut parameters = vec![
+            SqlValue::Text(actor),
+            SqlValue::Blob(input.id.to_vec()),
+            SqlValue::Blob(input.selection.oid.to_vec()),
+            SqlValue::Text(input.context),
+            SqlValue::Integer(input.context_version),
+        ];
+        let decision = format!(
+            "CASE WHEN NOT ({ACCESS}) OR NOT EXISTS (SELECT 1 FROM check_contexts WHERE name = ?4) THEN 'missing' WHEN NOT EXISTS (SELECT 1 FROM check_contexts WHERE name = ?4 AND reporter = ?1) THEN 'forbidden' WHEN NOT EXISTS (SELECT 1 FROM check_contexts WHERE name = ?4 AND version = ?5 AND enabled = 1) OR EXISTS (SELECT 1 FROM check_runs WHERE id = ?2 AND (oid != ?3 OR context != ?4 OR context_version != ?5 OR reporter != ?1)) THEN 'conflict' ELSE 'applied' END"
+        );
+        let check = SqlStatement {
+            sql: format!("SELECT {decision}"),
+            parameters: parameters.clone(),
+        };
+        parameters.push(SqlValue::Integer(context.now_ms()));
+        let result = context.sql(&SqlBatch { statements:vec![check, SqlStatement {
+            sql:format!("INSERT INTO check_runs (id, oid, context, context_version, reporter, state, version, summary, created_ms, updated_ms) SELECT ?2, ?3, ?4, ?5, ?1, 'queued', 1, '', ?6, ?6 WHERE ({decision}) = 'applied' AND NOT EXISTS (SELECT 1 FROM check_runs WHERE id = ?2)"), parameters,
+        }]})?;
+        let value = result
+            .first()
+            .and_then(|s| s.rows.first())
+            .map(Vec::as_slice);
+        match value {
+            Some([SqlValue::Text(v)]) if v == "applied" => {
+                Ok(CommandResult::Success(CheckChange::Applied))
+            }
+            Some([SqlValue::Text(v)]) if v == "missing" => {
+                Ok(CommandResult::Rejected(CheckChange::NotFound))
+            }
+            Some([SqlValue::Text(v)]) if v == "forbidden" => {
+                Ok(CommandResult::Rejected(CheckChange::Forbidden))
+            }
+            Some([SqlValue::Text(v)]) if v == "conflict" => {
+                Ok(CommandResult::Rejected(CheckChange::Conflict))
+            }
+            _ => Err(Error::Command("invalid native check outcome")),
+        }
+    }
+}
+impl RepositoryCell {
+    pub(super) async fn check_selection(
+        &self,
+        actor: ReadIdentity<'_>,
+        oid: ObjectId,
+    ) -> Result<(crate::packs::publication::ServingSnapshot, CommitSelection), NativeCheckError>
+    {
+        actor.validate()?;
+        let snapshot = self.serving_snapshot(actor).await?;
+        let membership = snapshot.commit_membership(oid).await?;
+        let selection = CommitSelection {
+            repository: self.id,
+            actor: match actor {
+                ReadIdentity::Anonymous => None,
+                ReadIdentity::Account(v) => Some(v.into()),
+            },
+            oid,
+            membership,
+        };
+        Ok((snapshot, selection))
+    }
+}
diff --git a/crates/canopy-server/src/checks/native/codec.rs b/crates/canopy-server/src/checks/native/codec.rs
new file mode 100644
index 00000000..ffee2e4f
--- /dev/null
+++ b/crates/canopy-server/src/checks/native/codec.rs
@@ -0,0 +1,98 @@
+use super::*;
+fn fixed<const N: usize>(d: &mut BoundedDecoder<'_>) -> Result<[u8; N], CodecError> {
+    d.read_bytes()?.try_into().map_err(|_| invalid())
+}
+fn invalid() -> CodecError {
+    CodecError::Invalid("invalid native check input")
+}
+impl WireValue for CommitSelection {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        validate_repository_id(self.repository).map_err(|_| invalid())?;
+        if self
+            .actor
+            .as_deref()
+            .is_some_and(|a| validate_component(a).is_err())
+        {
+            return Err(invalid());
+        }
+        e.write_bytes(&self.repository)?;
+        self.actor.encode(e)?;
+        e.write_bytes(self.oid.as_ref())?;
+        self.membership.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            repository: fixed(d)?,
+            actor: Option::<String>::decode(d)?,
+            oid: ObjectId::try_from(d.read_bytes()?).map_err(|_| invalid())?,
+            membership: Option::<CommitMembership>::decode(d)?,
+        };
+        value.encode(&mut BoundedEncoder::new(4096)?)?;
+        Ok(value)
+    }
+}
+impl WireValue for CommitPage {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self
+            .after
+            .as_deref()
+            .is_some_and(|a| validate_component(a).is_err())
+        {
+            return Err(invalid());
+        }
+        self.selection.encode(e)?;
+        self.after.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            selection: CommitSelection::decode(d)?,
+            after: Option::<String>::decode(d)?,
+        };
+        value.encode(&mut BoundedEncoder::new(4096)?)?;
+        Ok(value)
+    }
+}
+impl WireValue for CheckStart {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.selection.actor.is_none()
+            || validate_repository_id(self.id).is_err()
+            || validate_component(&self.context).is_err()
+            || self.context_version < 1
+        {
+            return Err(invalid());
+        }
+        self.selection.encode(e)?;
+        e.write_bytes(&self.id)?;
+        e.write_text(&self.context)?;
+        e.write_i64(self.context_version)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            selection: CommitSelection::decode(d)?,
+            id: fixed(d)?,
+            context: d.read_text()?.into(),
+            context_version: d.read_i64()?,
+        };
+        value.encode(&mut BoundedEncoder::new(4096)?)?;
+        Ok(value)
+    }
+}
+impl WireValue for CheckChange {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        e.write_u8(match self {
+            Self::Applied => 0,
+            Self::NotFound => 1,
+            Self::Forbidden => 2,
+            Self::Conflict => 3,
+        })
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        match d.read_u8()? {
+            0 => Ok(Self::Applied),
+            1 => Ok(Self::NotFound),
+            2 => Ok(Self::Forbidden),
+            3 => Ok(Self::Conflict),
+            _ => Err(invalid()),
+        }
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/commit_membership.rs b/crates/canopy-server/src/packs/publication/commit_membership.rs
new file mode 100644
index 00000000..0c37c52a
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/commit_membership.rs
@@ -0,0 +1,164 @@
+//! Bounded historical commit membership under an existing retained serving pin.
+//! This proves kind/existence only; callers must recheck their own current policy.
+use super::*;
+use crate::packs::directory::index::codec::fixed;
+use crate::{ObjectId, ReadIdentity};
+use cellule_runtime::{ApplicationId, CellId, TenantId};
+use certificate::CertificateEnvelope;
+
+const DOMAIN: &[u8] = b"canopy.commit-membership.v1\0";
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct CommitMembership(CertificateEnvelope);
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct MembershipData {
+    pub(super) tenant: [u8; 16],
+    pub(super) application: [u8; 16],
+    pub(super) token: ServingToken,
+    pub(super) fact: GenerationFact,
+    pub(super) actor: Option<String>,
+    pub(super) oid: ObjectId,
+}
+impl MembershipData {
+    fn validate(&self) -> Result<(), CodecError> {
+        self.token.validate()?;
+        self.fact.validate()?;
+        if self.token.generation != self.fact.generation
+            || self.fact.catalog.is_none_or(|c| {
+                c.repository != self.token.repository || c.format != self.oid.format()
+            })
+            || self.fact.refs.is_none()
+            || self.oid.is_zero()
+            || self
+                .actor
+                .as_deref()
+                .is_some_and(|a| validate_component(a).is_err())
+        {
+            return Err(CodecError::Invalid("invalid commit membership"));
+        }
+        Ok(())
+    }
+}
+impl WireValue for MembershipData {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.validate()?;
+        e.write_bytes(DOMAIN)?;
+        e.write_bytes(&self.tenant)?;
+        e.write_bytes(&self.application)?;
+        self.token.encode(e)?;
+        self.fact.encode(e)?;
+        self.actor.encode(e)?;
+        e.write_bytes(self.oid.as_ref())
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != DOMAIN {
+            return Err(CodecError::Invalid("invalid membership purpose"));
+        }
+        let value = Self {
+            tenant: fixed(d)?,
+            application: fixed(d)?,
+            token: ServingToken::decode(d)?,
+            fact: GenerationFact::decode(d)?,
+            actor: Option::<String>::decode(d)?,
+            oid: ObjectId::try_from(d.read_bytes()?)
+                .map_err(|_| CodecError::Invalid("invalid membership OID"))?,
+        };
+        value.validate()?;
+        Ok(value)
+    }
+}
+pub(crate) struct MembershipRequest<'a> {
+    pub(crate) cell: CellId,
+    pub(crate) owner: Option<OwnerFence>,
+    pub(crate) repository: [u8; 16],
+    pub(crate) actor: &'a Option<String>,
+    pub(crate) oid: ObjectId,
+    pub(crate) admitted_ms: i64,
+}
+impl CommitMembership {
+    pub(super) fn seal(data: MembershipData, seed: &[u8; 32]) -> Result<Self, CodecError> {
+        Ok(Self(CertificateEnvelope::seal(&data, seed)?))
+    }
+    /// The receiver checks the original pin and immutable joint fact rather than
+    /// the moving current head: unrelated pushes cannot invalidate membership.
+    pub(crate) fn authorize(
+        &self,
+        request: MembershipRequest<'_>,
+        mut query: impl FnMut(&SqlBatch) -> cellule_runtime::Result<Vec<SqlResultSet>>,
+    ) -> cellule_runtime::Result<bool> {
+        use sql::*;
+        let MembershipRequest {
+            cell,
+            owner,
+            repository,
+            actor,
+            oid,
+            admitted_ms,
+        } = request;
+        let data: MembershipData = self.0.data()?;
+        let target = crate::repository_target(
+            TenantId::from_bytes(data.tenant),
+            ApplicationId::from_bytes(data.application),
+            repository,
+        )?;
+        if target.cell_id() != cell
+            || data.token.repository != repository
+            || data.actor != *actor
+            || data.oid != oid
+            || owner.is_some_and(|f| data.token.owner != f)
+        {
+            return Ok(false);
+        }
+        let scope = actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        scope.validate()?;
+        let access = query(&statement(
+            &format!("SELECT 1 WHERE {}", crate::access::READ_ACCESS),
+            vec![scope.parameter()],
+        ))?;
+        if rows(&access)?.is_empty() {
+            return Ok(false);
+        }
+        let secret = query(&statement(
+            "SELECT push_cert_seed FROM repository_identity WHERE singleton=1 AND repository_id=?1 AND object_format=?2",
+            vec![
+                blob(repository),
+                SqlValue::Text(oid.format().as_str().into()),
+            ],
+        ))?;
+        if rows(&secret)?.is_empty() || !self.0.authenticated(&attestation::seed(&secret)?) {
+            return Ok(false);
+        }
+        let token = data.token;
+        let pin = query(&statement(
+            "SELECT 1 FROM catalog_serving_pins WHERE reader=?1 AND incarnation=?2 AND admission_sequence=?3 AND owner_epoch=?4 AND generation=?5 AND expires_at_ms>?6",
+            vec![
+                blob(token.reader),
+                blob(token.owner.incarnation.as_bytes()),
+                number(token.admission_sequence)?,
+                blob(token.owner.epoch.to_be_bytes()),
+                number(token.generation)?,
+                SqlValue::Integer(now(admitted_ms)?),
+            ],
+        ))?;
+        if rows(&pin)?.is_empty() {
+            return Ok(false);
+        }
+        Ok(generation(
+            &query(&statement(GENERATION, vec![number(token.generation)?]))?,
+            repository,
+            oid.format(),
+        )? == data.fact)
+    }
+}
+impl WireValue for CommitMembership {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.0.data::<MembershipData>()?;
+        self.0.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self(CertificateEnvelope::decode(d)?);
+        value.0.data::<MembershipData>()?;
+        Ok(value)
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 3327e596..e2c69d83 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -33,6 +33,8 @@ pub use session::PreparationSession;
 mod base;
 pub use base::{PreparationBaseError, PreparationBaseResolver};
 mod certificate;
+mod commit_membership;
+pub(crate) use commit_membership::{CommitMembership, MembershipRequest};
 pub(in crate::packs) mod codec;
 pub use certificate::{
     AttestationOutcome, CERTIFICATE_BYTES, CatalogCertificate, RegisteredCatalog,
@@ -248,6 +250,8 @@ pub struct MaintenanceRequest {
 /// are deliberately excluded; qualification binds its historical fixtures itself.
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_command::<crate::branch_rules::command::SetBranchRule>()?;
+    registry.bind_command::<crate::checks::native::StartCommitCheck>()?;
+    registry.bind_query::<crate::checks::native::ReadCommitChecks>()?;
     registry.bind_command::<ReleaseServingPin>()?;
     registry.bind_query::<CheckServingPin>()?;
     registry.bind_query::<SelectServingGeneration>()?;
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 52380fc8..2fb41184 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,7 +23,7 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 18] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 19] = [
     crate::operation(1),
     command::<crate::branch_rules::command::SetBranchRule>(64 << 10, 64),
     command::<AbortPreparation>(4096, 4096),
@@ -42,8 +42,9 @@ pub(crate) const COMMANDS: [OperationDescriptor; 18] = [
     command::<ExecuteCustody>(1024, 512),
     command::<StopCustodyIntent>(1024, 128),
     command::<ReleaseServingPin>(1024, 128),
+    command::<crate::checks::native::StartCommitCheck>(4096, 16),
 ];
-pub(crate) const QUERIES: [OperationDescriptor; 11] = [
+pub(crate) const QUERIES: [OperationDescriptor; 12] = [
     crate::operation(2),
     query::<CheckPreparation>(4096, 4096),
     query::<CheckPreparationFrontier>(4096, 4096),
@@ -55,6 +56,7 @@ pub(crate) const QUERIES: [OperationDescriptor; 11] = [
     query::<CheckCompletedRootPush>(4096, 512),
     query::<CheckServingPin>(1024, 1024),
     query::<SelectServingGeneration>(1024, 512),
+    query::<crate::checks::native::ReadCommitChecks>(4096, 256 << 10),
 ];
 
 #[cfg(test)]
@@ -85,7 +87,7 @@ mod tests {
         assert_eq!(
             ids,
             vec![
-                1, 8, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46
+                1, 8, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49
             ]
         );
         assert_eq!(
@@ -94,7 +96,7 @@ mod tests {
                 .iter()
                 .map(|operation| operation.id)
                 .collect::<Vec<_>>(),
-            vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48]
+            vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48, 50]
         );
         for (id, codec, input, output) in [
             (
@@ -121,6 +123,12 @@ mod tests {
             (42, ExecuteCustody::CODEC_VERSION, 1024, 512),
             (43, StopCustodyIntent::CODEC_VERSION, 1024, 128),
             (46, ReleaseServingPin::CODEC_VERSION, 1024, 128),
+            (
+                49,
+                crate::checks::native::StartCommitCheck::CODEC_VERSION,
+                4096,
+                16,
+            ),
         ] {
             let operation = descriptor
                 .commands
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
index 4cdbe315..b56d7393 100644
--- a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -116,6 +116,13 @@ pub struct ServingSnapshot {
     _borrow: Arc<Borrow>,
 }
 impl ServingSnapshot {
+    pub(crate) async fn commit_membership(
+        &self,
+        oid: crate::ObjectId,
+    ) -> Result<Option<super::super::CommitMembership>, ServingReadError> {
+        self.pin.commit_membership(self.actor.clone(), oid).await
+    }
+
     pub(crate) async fn resolve_refs(
         &self,
         names: &[String],
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index 2e1a51d6..4f10971e 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -13,6 +13,7 @@ use tokio::{sync::Notify, time::Instant};
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 mod body;
 mod edges;
+mod membership;
 mod native_base;
 mod workspace;
 pub use edges::{MAX_EDGE_PARENTS, ServingEdgePage};
diff --git a/crates/canopy-server/src/packs/publication/serving/session/membership.rs b/crates/canopy-server/src/packs/publication/serving/session/membership.rs
new file mode 100644
index 00000000..0a7ce137
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/membership.rs
@@ -0,0 +1,69 @@
+//! Private issuance follows certified header lookup under tracked physical ownership.
+use super::super::super::commit_membership::{CommitMembership, MembershipData};
+use super::super::super::{attestation, sql};
+use super::*;
+
+impl ServingPin {
+    pub(in crate::packs::publication::serving) async fn commit_membership(
+        &self,
+        actor: Option<String>,
+        oid: crate::ObjectId,
+    ) -> Result<Option<CommitMembership>, ServingReadError> {
+        if oid.is_zero() || oid.format() != self.inner.lease.format {
+            return Ok(None);
+        }
+        self.read_owned(actor.clone(), move |inner, deadline, _permit| async move {
+            let reader = inner.catalog().await?;
+            let header = reader
+                .headers(&[oid], &*inner.context.files, &*inner.context.files)
+                .await?
+                .pop()
+                .flatten();
+            if header.is_none_or(|h| h.object.kind != crate::ObjectKind::Commit) {
+                return Ok(None);
+            }
+            if Instant::now() >= deadline {
+                return Err(ServingReadError::Inactive);
+            }
+            let capability = SqlCell::<RepositoryModule>::new(
+                inner.context.client.clone(),
+                inner.context.target.clone(),
+            )?;
+            let result = capability
+                .query(None, SqlBatch {
+                    statements: vec![
+                        SqlStatement {
+                            sql: "SELECT push_cert_seed FROM repository_identity WHERE singleton=1 AND repository_id=?1 AND object_format=?2".into(),
+                            parameters: vec![
+                                sql::blob(inner.lease.token.repository),
+                                SqlValue::Text(oid.format().as_str().into()),
+                            ],
+                        },
+                        SqlStatement {
+                            sql: sql::GENERATION.into(),
+                            parameters: vec![sql::number(inner.lease.token.generation)?],
+                        },
+                    ],
+                })
+                .await
+                .map_err(|e| ServingReadError::Proof(Box::new(e)))?;
+            let generation = sql::generation(
+                result.output.get(1..).ok_or(ServingReadError::Context)?,
+                inner.lease.token.repository,
+                oid.format(),
+            )?;
+            if generation != inner.lease.fact {
+                return Err(ServingReadError::Context);
+            }
+            let seed = attestation::seed(&result.output)?;
+            Ok(Some(CommitMembership::seal(MembershipData {
+                tenant: *inner.context.target.tenant().as_bytes(),
+                application: *inner.context.target.application().as_bytes(),
+                token: inner.lease.token,
+                fact: inner.lease.fact,
+                actor,
+                oid,
+            }, &seed)?))
+        }).await
+    }
+}
diff --git a/crates/canopy-server/src/repository_http/checks.rs b/crates/canopy-server/src/repository_http/checks.rs
index 845cfd11..dd886c44 100644
--- a/crates/canopy-server/src/repository_http/checks.rs
+++ b/crates/canopy-server/src/repository_http/checks.rs
@@ -6,9 +6,7 @@ use crate::{
     },
     server::{RepositoryRoute, mutation_identity},
 };
-use cellule_runtime::{
-    Committed, InvocationError, MutationIdentity, primitives::sql::SqlResultSet,
-};
+use cellule_runtime::{Committed, MutationIdentity};
 use serde::de::DeserializeOwned;
 use std::time::Duration;
 
@@ -354,9 +352,9 @@ pub(super) async fn update(
     )
 }
 
-fn changed(
+fn changed<E: std::fmt::Display>(
     state: &RepositoryHttp,
-    result: Result<Committed<CheckChange>, InvocationError<Vec<SqlResultSet>>>,
+    result: Result<Committed<CheckChange>, E>,
     id: Option<[u8; 16]>,
 ) -> Response<Body> {
     match result {
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser.rs b/crates/canopy-server/src/server/residency/tests/serving/browser.rs
index 5cd449d0..641e7d6b 100644
--- a/crates/canopy-server/src/server/residency/tests/serving/browser.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser.rs
@@ -2,6 +2,7 @@
 //! catalog fact and editorial pull records are installed by trusted test SQL;
 //! this does not qualify the still-unconverted live pull/ref producers.
 use super::*;
+mod checks;
 use crate::packs::{
     catalog::{
         CatalogSnapshot, StoredCatalog,
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser/checks.rs b/crates/canopy-server/src/server/residency/tests/serving/browser/checks.rs
new file mode 100644
index 00000000..d7ff2ba8
--- /dev/null
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser/checks.rs
@@ -0,0 +1,300 @@
+//! Receiver qualification uses real resident ownership and physical pack metadata.
+//! Trusted generation installation isolates membership, not the writer pipeline.
+use super::*;
+use crate::checks::{
+    CheckChange, CheckContextEdit,
+    native::{CheckStart, CommitPage, CommitSelection, ReadCommitChecks, StartCommitCheck},
+};
+use crate::packs::publication::CommitMembership;
+use cellule_runtime::codec::BoundedDecoder;
+
+async fn select(
+    repository: &RepositoryCell,
+    actor: ReadIdentity<'_>,
+    oid: ObjectId,
+) -> Result<(crate::packs::publication::ServingSnapshot, CommitSelection)> {
+    let snapshot = repository.serving_snapshot(actor).await?;
+    let membership = snapshot.commit_membership(oid).await?;
+    let selection = CommitSelection {
+        repository: repository.repository_id(),
+        actor: match actor {
+            ReadIdentity::Anonymous => None,
+            ReadIdentity::Account(v) => Some(v.into()),
+        },
+        oid,
+        membership,
+    };
+    Ok((snapshot, selection))
+}
+async fn page(repository: &RepositoryCell, selection: CommitSelection) -> Result<bool> {
+    Ok(repository
+        .application
+        .query::<ReadCommitChecks>(
+            &repository.target,
+            None,
+            CommitPage {
+                selection,
+                after: None,
+            },
+        )
+        .await?
+        .output
+        .is_some())
+}
+async fn start(
+    repository: &RepositoryCell,
+    selection: CommitSelection,
+    version: i64,
+) -> Result<CheckChange> {
+    let result = repository
+        .application
+        .command::<StartCommitCheck>(
+            &repository.target,
+            crate::server::mutation_identity()?,
+            CheckStart {
+                selection,
+                id: uuid::Uuid::new_v4().into_bytes(),
+                context: "unit-tests".into(),
+                context_version: version,
+            },
+        )
+        .await;
+    match result {
+        Ok(value) => Ok(value.output),
+        Err(cellule_runtime::InvocationError::Rejected(value)) => Ok(value.output),
+        Err(error) => Err(error.into()),
+    }
+}
+fn damaged(proof: &CommitMembership) -> Result<CommitMembership> {
+    let mut e = BoundedEncoder::new(1024)?;
+    proof.encode(&mut e)?;
+    let mut bytes = e.finish();
+    *bytes.last_mut().ok_or("empty membership")? ^= 1;
+    let mut d = BoundedDecoder::new(&bytes, 1024)?;
+    let proof = CommitMembership::decode(&mut d)?;
+    d.finish()?;
+    Ok(proof)
+}
+
+#[tokio::test]
+async fn native_check_receivers_bind_commit_actor_repository_and_live_retained_pin() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        assert_eq!(
+            repository
+                .set_check_context(
+                    crate::server::mutation_identity()?,
+                    "canopy",
+                    "unit-tests",
+                    CheckContextEdit {
+                        expected_version: 0,
+                        reporter: "canopy",
+                        enabled: true,
+                    }
+                )
+                .await?
+                .output,
+            CheckChange::Applied
+        );
+        let (snapshot, selection) =
+            select(&repository, ReadIdentity::Account("canopy"), native.main).await?;
+        let proof = selection.membership.as_ref().ok_or("commit proof absent")?;
+        assert!(page(&repository, selection.clone()).await?);
+        assert_eq!(
+            start(&repository, selection.clone(), 1).await?,
+            CheckChange::Applied
+        );
+        let mut invalid = Vec::new();
+        let mut forged = selection.clone();
+        forged.membership = Some(damaged(proof)?);
+        invalid.push(forged);
+        let mut wrong_actor = selection.clone();
+        wrong_actor.actor = Some("outsider".into());
+        invalid.push(wrong_actor);
+        let mut wrong_repository = selection.clone();
+        wrong_repository.repository = uuid::Uuid::new_v4().into_bytes();
+        invalid.push(wrong_repository);
+        let mut other_commit = selection.clone();
+        other_commit.oid = native.previous;
+        invalid.push(other_commit);
+        let mut no_proof = selection.clone();
+        no_proof.membership = None;
+        invalid.push(no_proof);
+        for oid in [native.tree, native.tag, missing(format)] {
+            assert!(snapshot.commit_membership(oid).await?.is_none());
+            let mut substitution = selection.clone();
+            substitution.oid = oid;
+            invalid.push(substitution);
+        }
+        for selection in invalid {
+            assert!(!page(&repository, selection.clone()).await?);
+            assert_eq!(
+                start(&repository, selection, 1).await?,
+                CheckChange::NotFound
+            );
+        }
+        let other = create(&server.repositories, "other-checks", format).await?;
+        let (other, _, _) = loaded(&server.repositories, other.repository_id).await?;
+        assert!(!page(&other, selection.clone()).await?);
+        assert_eq!(
+            start(&other, selection.clone(), 1).await?,
+            CheckChange::NotFound
+        );
+        drop(other);
+        // The exact retained fact remains valid while its original physical pin
+        // is live, even though current head no longer contains that commit.
+        let store = ArtifactStore::new(
+            server.repositories.external_store.clone(),
+            repository.repository_id(),
+        );
+        let directory = DirectorySnapshot::empty(repository.repository_id(), format)
+            .upload(&store, operation(200))
+            .await?;
+        let empty = CatalogSnapshot {
+            directory,
+            sources: None,
+        }
+        .upload(&store, operation(201))
+        .await?;
+        install(&repository, 3, empty, native.refs).await?;
+        assert!(page(&repository, selection.clone()).await?);
+        assert_eq!(
+            start(&repository, selection.clone(), 1).await?,
+            CheckChange::Applied
+        );
+        assert!(
+            repository
+                .commit_checks(ReadIdentity::Account("canopy"), native.main, None)
+                .await?
+                .output
+                .is_none()
+        );
+        // A valid kind proof must not authorize an obsolete context version.
+        assert_eq!(
+            repository
+                .set_check_context(
+                    crate::server::mutation_identity()?,
+                    "canopy",
+                    "unit-tests",
+                    CheckContextEdit {
+                        expected_version: 1,
+                        reporter: "canopy",
+                        enabled: true,
+                    }
+                )
+                .await?
+                .output,
+            CheckChange::Applied
+        );
+        assert_eq!(
+            start(&repository, selection.clone(), 1).await?,
+            CheckChange::Conflict
+        );
+        assert_eq!(
+            start(&repository, selection.clone(), 2).await?,
+            CheckChange::Applied
+        );
+        // Real producer drain removes the lease; deleting SQL rows would not
+        // qualify the physical lifecycle which protects the proof's metadata.
+        drop(snapshot);
+        let (_, _, service) = loaded(&server.repositories, repository.repository_id()).await?;
+        timeout(Duration::from_secs(8), service.serving.close_and_drain()).await?;
+        assert_eq!(retained(&repository).await?, 0);
+        assert!(!page(&repository, selection.clone()).await?);
+        assert_eq!(
+            start(&repository, selection, 2).await?,
+            CheckChange::NotFound
+        );
+        let rows = repository
+            .sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "SELECT count(*) FROM check_runs".into(),
+                        parameters: vec![],
+                    }],
+                },
+            )
+            .await?;
+        assert_eq!(rows.output[0].rows, vec![vec![SqlValue::Integer(3)]]);
+        drop((service, repository));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_check_receivers_recheck_revoked_membership_and_public_visibility() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        repository
+            .grant_member(
+                crate::server::mutation_identity()?,
+                "canopy",
+                "ci",
+                crate::server::TokenScope::Read,
+            )
+            .await?;
+        repository
+            .set_check_context(
+                crate::server::mutation_identity()?,
+                "canopy",
+                "unit-tests",
+                CheckContextEdit {
+                    expected_version: 0,
+                    reporter: "ci",
+                    enabled: true,
+                },
+            )
+            .await?;
+        let (snapshot, selection) =
+            select(&repository, ReadIdentity::Account("ci"), native.main).await?;
+        assert_eq!(
+            start(&repository, selection.clone(), 1).await?,
+            CheckChange::Applied
+        );
+        repository
+            .revoke_member(crate::server::mutation_identity()?, "canopy", "ci")
+            .await?;
+        assert!(!page(&repository, selection.clone()).await?);
+        assert_eq!(
+            start(&repository, selection, 1).await?,
+            CheckChange::NotFound
+        );
+        repository
+            .sql
+            .batch(
+                crate::server::mutation_identity()?,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "UPDATE ref_generation SET visibility='public' WHERE singleton=1"
+                            .into(),
+                        parameters: vec![],
+                    }],
+                },
+            )
+            .await?;
+        let (public, selection) = select(&repository, ReadIdentity::Anonymous, native.main).await?;
+        assert!(page(&repository, selection.clone()).await?);
+        repository
+            .sql
+            .batch(
+                crate::server::mutation_identity()?,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "UPDATE ref_generation SET visibility='private' WHERE singleton=1"
+                            .into(),
+                        parameters: vec![],
+                    }],
+                },
+            )
+            .await?;
+        assert!(!page(&repository, selection).await?);
+        drop((snapshot, public, repository));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
diff --git a/docs/contracts.md b/docs/contracts.md
index 6f0ca384..f9dfbe57 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -1618,6 +1618,26 @@ increasing creation number. The OID must identify a stored Git commit; absent
 objects, trees, tags and blobs are not check targets. A context does not imply
 branch protection; an enabled branch rule must explicitly require it.
 
+Native commit reads and starts use the resident serving snapshot's authenticated
+catalog headers to prove kind and existence. The private `CommitMembership`
+factory issues a bounded purpose-specific MAC binding tenant, application,
+repository, actor, commit OID, serving token and exact retained catalog/ref fact.
+Header lookup runs under the existing tracked physical read owner and admission;
+it reads bounded metadata and does not hydrate native pack bodies. The caller
+keeps its serving snapshot through the final receiver.
+
+Repository command 49 starts a check; query 50 reads the bounded latest-check
+page. Both verify the MAC, actual Cell identity, current read access, exact live
+pin and retained fact. Command 49 also checks the actual admitted owner fence.
+Pin expiry uses a refreshed wall clock clamped to runtime logical time. An
+unrelated publication may advance current head while the original retained pin
+remains authoritative. Producer release, expiry, access loss, or a substituted
+actor/OID/repository invalidates that authority. Command policy decisions and
+conditional insertion occur in the same transaction. Recorded rejections retain
+their receipts and map to domain HTTP outcomes; pending invocation errors remain
+ambiguous. Inputs are bounded at 4 KiB and commit pages at 256 KiB / 32 contexts.
+The existing check metadata tables, creation order and policy triggers are reused.
+
 Only the configured reporter can start runs. The owner has no implicit reporting
 bypass and must explicitly configure itself as reporter if desired. Starting
 requires the enabled context's current version and current repository read access.
@@ -1666,7 +1686,8 @@ HTTP routes:
 Each context contains name, reporter, enabled and version. Each run contains id,
 OID, context, context_version, reporter, state, version, summary, created_at_ms
 and updated_at_ms. Mutation UUIDs are canonical lowercase with the supported
-RFC variant/version; OIDs use 40 lowercase hexadecimal characters. All writes
+RFC variant/version; OIDs use 40 or 64 lowercase hexadecimal characters for
+the repository's SHA-1 or SHA-256 format. All writes
 carry the repository UUID to prevent stale names from targeting another Cell.
 Missing membership/resources/non-commit targets return 404, authority or scope
 failure returns 403, identity/version/terminal-state conflicts return 409, and
diff --git a/docs/evidence/native-checks-ci-20261005.json b/docs/evidence/native-checks-ci-20261005.json
new file mode 100644
index 00000000..dd0ac1c8
--- /dev/null
+++ b/docs/evidence/native-checks-ci-20261005.json
@@ -0,0 +1,460 @@
+{
+  "recorded_at_utc": "2026-10-05T07:25:13.004826+00:00",
+  "base_head": "3e40f19ef40694d5f34709b963c7c4f924b01314",
+  "source_files": 502,
+  "rust_files": 484,
+  "source_hash_digest": "d13027792e8b7354fb58c7a152f7d38534083d5389ddffebc35be54bf133eda3",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON path-to-file-SHA256 map, including Rust/SQL/TOML/lock/YAML sources",
+  "source_manifest": "/tmp/canopy-native-checks-final-source.json",
+  "toolchain": "Rust 1.98.0, macOS ARM64, isolated target, RUSTC_WRAPPER empty",
+  "release_qualified": false,
+  "ci_pass_claim": false,
+  "reproductions": {
+    "removed_object_table_http": {
+      "log": "/tmp/canopy-native-checks-repro1.log",
+      "sha256": "950353be002daf6f176827cfb10846e71c36e74ef9dc30668fd1b9dadcc759fc",
+      "exit_code": 101,
+      "source_note": "Base commit 3e40f19; original HTTP and stock-Git production integration test before native checks conversion.",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 3.47s"
+      ],
+      "failed_cases": [
+        "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery"
+      ]
+    },
+    "initial_adapter_compile": {
+      "log": "/tmp/canopy-native-checks-check1.log",
+      "sha256": "ac4296ba570e3cad197f69a30edc89eb9af04e1d8cdc63bdd7bab72b912a790b",
+      "exit_code": 101,
+      "source_note": "Intermediate source; private codec helper and missing SQL client accessor. Not final-source validation.",
+      "summaries": [],
+      "failed_cases": []
+    },
+    "test_fixture_compile": {
+      "log": "/tmp/canopy-native-checks-negative1.log",
+      "sha256": "7c5eccef3dde7599010dc85e1d9a5073095730f86452c06de3e90c055e6e1f43",
+      "exit_code": 101,
+      "source_note": "Intermediate source; private adapter and incorrect TokenScope namespace corrected in the test without widening the production API.",
+      "summaries": [],
+      "failed_cases": []
+    },
+    "durable_rejection_incorrectly_treated_as_service_failure": {
+      "log": "/tmp/canopy-native-checks-e2e1.log",
+      "sha256": "a56370d557b3a2c4ca7be810a454d0f8e6c5b23fc5524e9dde2ef9335443d2ff",
+      "exit_code": 101,
+      "source_note": "Intermediate source: 503 instead of expected 403. Final adapter preserves recorded domain rejection receipt.",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 3.00s"
+      ],
+      "failed_cases": [
+        "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery"
+      ]
+    },
+    "receiver_rejection_contract": {
+      "log": "/tmp/canopy-native-checks-negative2.log",
+      "sha256": "a474e3a9b5df2dccb3391397339c57716fdb0939defba249b8b4ad187d705313",
+      "exit_code": 101,
+      "source_note": "Intermediate tests treated InvocationError::Rejected as transport failure; receiver kept the correct durable rejection. Final tests explicitly inspect its recorded outcome.",
+      "summaries": [
+        "test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 715 filtered out; finished in 0.98s"
+      ],
+      "failed_cases": [
+        "server::residency::tests::serving::browser::checks::native_check_receivers_recheck_revoked_membership_and_public_visibility",
+        "server::residency::tests::serving::browser::checks::native_check_receivers_bind_commit_actor_repository_and_live_retained_pin"
+      ]
+    }
+  },
+  "isolated_timing_probes": {
+    "source_digest": "d13027792e8b7354fb58c7a152f7d38534083d5389ddffebc35be54bf133eda3",
+    "binary": "/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9",
+    "rollover": {
+      "log": "/tmp/canopy-native-checks-rollover-focused.log",
+      "sha256": "78390c538af17cc2fbdf448226ea418eb631c9741066ef68bfc3502f359306b2",
+      "exit_code": 0,
+      "source_note": null,
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 716 filtered out; finished in 9.47s"
+      ],
+      "failed_cases": []
+    },
+    "ceiling": {
+      "log": "/tmp/canopy-native-checks-ceiling-focused.log",
+      "sha256": "7676d4ed53c4d44226d66f8c3ec00a0a255225594d3fff4c82ed04394540cfac",
+      "exit_code": 0,
+      "source_note": null,
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 716 filtered out; finished in 4.87s"
+      ],
+      "failed_cases": []
+    },
+    "interpretation": "Both pass in isolation. This does not establish root cause or supersede the two failed library cases in the full workload."
+  },
+  "final_validation": {
+    "source_digest": "d13027792e8b7354fb58c7a152f7d38534083d5389ddffebc35be54bf133eda3",
+    "phases": [
+      {
+        "name": "negative",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "native_check_receivers",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 110.13,
+        "log": "/tmp/canopy-native-checks-negative-final.log",
+        "log_sha256": "9e262997db3be0a33dec01cd157dd05e7dfcf3e07c418ce82c3b1c3cf8756785",
+        "summaries": [
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 715 filtered out; finished in 3.05s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "e2e",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "multi_server",
+          "checks::commit_checks_bind_reporters_versions_and_reruns_across_recovery",
+          "--locked",
+          "--",
+          "--exact",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 62.37,
+        "log": "/tmp/canopy-native-checks-e2e-final.log",
+        "log_sha256": "658ed7ebcc41e00e3a4a1cf70553f565ca8f3c0a8ae4ddb51b38be03b924201b",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 114 filtered out; finished in 3.62s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "branch-rules",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "multi_server",
+          "branch_rules::",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 18.38,
+        "log": "/tmp/canopy-native-checks-branch-rules-final.log",
+        "log_sha256": "d5b19071e749da1c1cf60eeccd77e2f2be13a6b081fc1920ae543905e9973af2",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 114 filtered out; finished in 17.28s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 796.8,
+        "log": "/tmp/canopy-native-checks-workspace-final.log",
+        "log_sha256": "0ba7361ecb050ff5c785abd5d6cfa073113803e307d708206c8f380187b009e7",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.51s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.71s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 716 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 716 filtered out; finished in 0.10s",
+          "test result: FAILED. 715 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 414.61s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.72s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+          "test result: FAILED. 77 passed; 29 failed; 9 ignored; 0 measured; 0 filtered out; finished in 349.32s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.51s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.29s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "packs::publication::tests::serving::pool::sequential_generations_roll_over_idle_slots_without_client_retries",
+          "packs::publication::tests::staging_service::publication::bound_publication_wait_ceiling_never_admits_or_executes_the_retained_command",
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 54.11,
+        "log": "/tmp/canopy-native-checks-clippy-final.log",
+        "log_sha256": "cd809d40250466bc8b0688fd8832cce9186a7e01f758313a640246b24e476e6e",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 101.06,
+        "log": "/tmp/canopy-native-checks-build-final.log",
+        "log_sha256": "4ea2d32201c07d9398ffdb4082cd6931713215605e743b272634faec758da981",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.72,
+        "log": "/tmp/canopy-native-checks-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 42.25,
+        "log": "/tmp/canopy-native-checks-harness-final.log",
+        "log_sha256": "3f424359086bead86badfb20ba3cc66c89e9d9c21cb191190676941f11d85f23",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.05,
+        "log": "/tmp/canopy-native-checks-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "unique_workspace_inventory": {
+    "targets": [
+      {
+        "target": "Running unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+        "passed": 6,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "target": "Running unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+        "passed": 15,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "target": "Running unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+        "passed": 715,
+        "failed": 2,
+        "ignored": 0
+      },
+      {
+        "target": "Running unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+        "passed": 2,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "target": "Running tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+        "passed": 13,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "target": "Running tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+        "passed": 2,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "target": "Running tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+        "passed": 77,
+        "failed": 29,
+        "ignored": 9
+      },
+      {
+        "target": "Running tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+        "passed": 0,
+        "failed": 1,
+        "ignored": 0
+      },
+      {
+        "target": "Running tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+        "passed": 0,
+        "failed": 1,
+        "ignored": 0
+      },
+      {
+        "target": "Running tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+        "passed": 0,
+        "failed": 1,
+        "ignored": 0
+      }
+    ],
+    "totals": {
+      "passed": 830,
+      "failed": 34,
+      "ignored": 9
+    },
+    "counting_note": "Largest aggregate by case count per Cargo Running target; nested child summaries and focused reruns excluded. Existing ignored cases were not executed."
+  },
+  "parent_linux_ci": [
+    {
+      "head": "3e40f19ef40694d5f34709b963c7c4f924b01314",
+      "run": 37272804247,
+      "rust_job": 111643212719,
+      "url": "https://github.com/crabbuild/canopy/actions/runs/37272804247/job/111643212719",
+      "conclusion": "FAILURE",
+      "rustc": "1.98.1 (48a229cea 2026-09-01)",
+      "cargo": "1.98.1 (797e8a9bc 2026-08-05)",
+      "git": "2.55.0",
+      "server_library": {
+        "passed": 715,
+        "failed": 0
+      },
+      "multi_server": {
+        "passed": 75,
+        "failed": 35,
+        "ignored": 9
+      },
+      "log": "/tmp/canopy-native-checks-parent-push-full.log",
+      "log_sha256": "c1457999fa277df1820c299458a73b6c97f5cd473ac726da5ebc7a66dd7ad574"
+    },
+    {
+      "head": "3e40f19ef40694d5f34709b963c7c4f924b01314",
+      "run": 37272808437,
+      "rust_job": 111643224703,
+      "url": "https://github.com/crabbuild/canopy/actions/runs/37272808437/job/111643224703",
+      "conclusion": "FAILURE",
+      "rustc": "1.98.1 (48a229cea 2026-09-01)",
+      "cargo": "1.98.1 (797e8a9bc 2026-08-05)",
+      "git": "2.55.0",
+      "server_library": {
+        "passed": 715,
+        "failed": 0
+      },
+      "multi_server": {
+        "passed": 76,
+        "failed": 34,
+        "ignored": 9
+      },
+      "log": "/tmp/canopy-native-checks-parent-pr-full.log",
+      "log_sha256": "16683781287eda2c9660e719a6e12f4852c50d71f9fcf0472521d590030b61b1"
+    }
+  ],
+  "coverage": [
+    "Actual HTTP and stock-Git push/check integration: reporter permissions, concurrent logical UUID retries, ordering, policy-version changes, terminal updates, pagination, rename, and independent owner recovery.",
+    "Actual resident production registry and physically verified SHA-1/SHA-256 metadata: MAC corruption, actor/repository/OID substitution, another actual Cell receiver, missing proof, noncommit targets, a retained generation after current-head advancement, fresh context version, actual producer drain, and rejected insert count.",
+    "Actual read-only reporter grant/revocation and anonymous public-to-private visibility change before final receiver.",
+    "Proof issuance uses existing tracked read_owned ownership and authenticated metadata headers; final receiver uses current access, exact retained fact, live pin, and actual command owner fence. Existing metadata structure and immutable MAC envelope reused."
+  ],
+  "remaining_high_priority": [
+    "Diagnose workload-dependent serving rollover Capacity and bound expiry terminal-state assertion; both failed in the full library suite but pass isolated.",
+    "Complete native pull creation/list/detail/review/ref authority and default-branch mutation; generated merge/rebase/candidate writers still use legacy metadata.",
+    "Resolve Linux native rejected-push/bulk admission or custody expiry and pre-Bind late Write-revocation terminal refusal without weakening final authorization.",
+    "Complete peer ownership/residency, source-independent backup, reachable-only cold/filtered fetch, and standalone real-resident integrations.",
+    "Complete physical ownership/recovery, final DDL hard cutover, full-history Linux/Kubernetes/Chromium qualification and 10,000-developer capacity gates."
+  ],
+  "sdk": {
+    "path": "/Users/haipingfu/.codex/worktrees/durable-command-recovery/cellule",
+    "head": "161067f5a21703b3e257024bcb64e565fd9657b4",
+    "clean_when_checked": true
+  }
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 30a0ab3a..5dc91683 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -1,6 +1,6 @@
 # Large-repository implementation status
 
-Updated during implementation on 2026-10-04. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
+Updated during implementation on 2026-10-05. **The full implementation and capacity goal remains open.** The [large-team amendment](large-team-scalability.md) is mandatory scope alongside the original storage design. Passing primitive tests is not completion of the hard cutover or proof of capacity.
 
 Packed cutover [PR #34](https://github.com/crabbuild/canopy/pull/34) was merged into
 `main` at `d559e5635e002ee3f885c780a418cf861a5197fc` while its checks still failed.
@@ -17,6 +17,56 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Native commit checks conversion (2026-10-05 checkpoint)
+
+Commit-check reads and starts were still querying the removed `objects` table,
+returning HTTP 503 after a native push. They now use authenticated bounded
+catalog headers under the actual resident serving snapshot. A private,
+purpose-specific membership certificate reuses the existing MAC envelope,
+serving token and retained joint fact. The final typed receivers verify actual
+Cell identity, fresh read access, the exact live pin/fact, and the command's
+admitted owner fence. Check policy/version and guarded insertion share one
+transaction. Unrelated current-head advancement preserves a live historical pin;
+actor, OID or repository substitution, tampering, revocation and real producer
+drain invalidate its authority. Existing check metadata and ordering are reused.
+No native pack-body hydration is needed for membership issuance.
+
+Production command 49 and query 50 have 4 KiB input bounds, a 16-byte command
+outcome bound and a 256 KiB / 32-context query bound. Recorded policy rejections
+retain their original receipts and produce the existing HTTP domain statuses;
+pending/transport failures remain errors. The stock-Git HTTP checks family and
+branch-protection family pass. Two new actual-resident receiver families cover
+both object formats, forged/substituted proofs, noncommit targets, another Cell,
+retained generations, current policy, revocation, visibility and physical drain.
+
+Frozen-source full-workspace validation still fails: server libraries finish
+715 passed / 2 failed; multi-server finishes 77 passed / 29 failed / 9 existing
+ignores; the three standalone integration aggregates each fail. The two library
+failures are sequential serving rollover capacity and bound-expiry terminal-state
+classification. Both pass isolated from the same compiled source, which does not
+establish their cause or supersede the full-workload failure. The unique workspace
+inventory is 830 passed / 34 failed / 9 unexecuted ignores; child summaries and
+focused reruns are excluded. All-target Clippy with warnings denied, server build,
+formatting, diff checks and all 96 Python harness cases pass.
+The complete validation and build/format/harness results are recorded in
+[evidence/native-checks-ci-20261005.json](evidence/native-checks-ci-20261005.json).
+
+The parent `3e40f19` Linux push Verify run
+[37272804247](https://github.com/crabbuild/canopy/actions/runs/37272804247)
+fails multi-server at 75/35/9; its PR run
+[37272808437](https://github.com/crabbuild/canopy/actions/runs/37272808437)
+fails at 76/34/9. Both pass all 715 server library cases. Reported tools are
+Rust/Cargo 1.98.1 and Git 2.55.0. Those results belong to that parent, not this
+increment. New-head Linux qualification is required.
+
+Highest priorities are the two workload-dependent library failures, Linux native
+bulk/rejected-push custody and pre-Bind terminal refusal, then native pull/ref
+creation/list/detail/reviews and default-branch mutation. Generated writers, peer
+residency, source-independent backup, reachable-only cold/filtered fetch,
+standalone resident fixtures, physical custody completion, final DDL and full
+large-history/team capacity gates remain open. The full goal is active and this
+cutover remains unqualified for release.
+
 ## Native HTTP/SSH writer cutover (in progress)
 
 The actual receive-pack path now transfers its authenticated encoded request to

From 4eb4fd0b6594ec71d6e7f7cec36ce63705556c2b Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 09:07:27 -0700
Subject: [PATCH 36/55] fix: preserve serving rollover observation budget

Start the shared release deadline at first retirement so initial Cell selection latency cannot consume it. Reproduce worker contention in both object formats while preserving physical drain and capacity limits. Observe bound expiry through lifecycle completion rather than intermediate staging handoff; record passing library tests and remaining integration failures.
---
 .../src/packs/publication/serving/pool.rs     |  32 +-
 .../packs/publication/tests/serving/pool.rs   |  71 +++
 .../tests/staging_service/publication.rs      |   5 +-
 docs/design/certified-serving-pins.md         |   6 +-
 docs/design/staging-service-lifecycle.md      |   5 +
 .../serving-selection-budget-ci-20261005.json | 403 ++++++++++++++++++
 .../large-repository-implementation-status.md |  36 ++
 7 files changed, 554 insertions(+), 4 deletions(-)
 create mode 100644 docs/evidence/serving-selection-budget-ci-20261005.json

diff --git a/crates/canopy-server/src/packs/publication/serving/pool.rs b/crates/canopy-server/src/packs/publication/serving/pool.rs
index be460019..76e6b6ca 100644
--- a/crates/canopy-server/src/packs/publication/serving/pool.rs
+++ b/crates/canopy-server/src/packs/publication/serving/pool.rs
@@ -48,6 +48,8 @@ struct Inner {
     stop: CancellationToken,
     requests: TaskTracker,
     drain: TaskTracker,
+    #[cfg(test)]
+    selection_started: std::sync::Mutex<Option<tokio::sync::oneshot::Sender<()>>>,
 }
 struct Lifetime(Weak<Inner>);
 impl Drop for Lifetime {
@@ -101,6 +103,8 @@ impl ServingPool {
             stop: CancellationToken::new(),
             requests: TaskTracker::new(),
             drain: TaskTracker::new(),
+            #[cfg(test)]
+            selection_started: std::sync::Mutex::new(None),
         });
         let work = inner.clone();
         inner.drain.spawn(async move {
@@ -165,6 +169,18 @@ impl ServingPool {
             .map_err(ServingReadError::Task)?
     }
     #[cfg(test)]
+    pub(in crate::packs::publication) fn observe_selection_for_test(
+        &self,
+    ) -> tokio::sync::oneshot::Receiver<()> {
+        let (sender, receiver) = tokio::sync::oneshot::channel();
+        *self
+            .inner
+            .selection_started
+            .lock()
+            .expect("selection observer") = Some(sender);
+        receiver
+    }
+    #[cfg(test)]
     pub(in crate::packs::publication) async fn owners_for_test(&self) -> Vec<ServingOwner> {
         self.inner
             .state
@@ -185,11 +201,20 @@ impl Inner {
         if self.stop.is_cancelled() || self.paused.load(Ordering::Acquire) {
             return Err(ServingReadError::Inactive.into());
         }
-        let deadline = Instant::now() + ROLLOVER_WAIT;
+        let mut rollover_deadline = None;
         // Concurrent viewers may consume a released slot first. Bound retries
         // even under continuous publication; admission already bounds waiters.
         for _ in 0..=self.limits.generations {
             // Permission and current generation can change while release waits.
+            #[cfg(test)]
+            if let Some(observer) = self
+                .selection_started
+                .lock()
+                .expect("selection observer")
+                .take()
+            {
+                let _ = observer.send(());
+            }
             let selected = self.context.select(actor.clone()).await?;
             enum Selection {
                 Borrow(ServingOwner),
@@ -282,6 +307,11 @@ impl Inner {
                     // Never wait for provider I/O or exact release under the
                     // pool lock. Shutdown can cancel this bounded observation
                     // without canceling the independently owned producer.
+                    // Initial Cell selection may queue behind unrelated work.
+                    // Charge the observation budget only once retirement starts;
+                    // subsequent retries share it rather than extending it.
+                    let deadline =
+                        *rollover_deadline.get_or_insert_with(|| Instant::now() + ROLLOVER_WAIT);
                     let drain = owner.drain_observer();
                     tokio::select! {
                         _ = self.stop.cancelled() => return Err(ServingReadError::Inactive.into()),
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/pool.rs b/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
index 77b398f9..d6d12421 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/pool.rs
@@ -456,3 +456,74 @@ async fn blocked_old_generation_does_not_block_other_release_or_allow_early_evic
     }
     Ok(())
 }
+
+#[tokio::test]
+async fn slow_cell_selection_preserves_the_idle_rollover_observation_budget() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let store = Arc::new(ArtifactStore::new(Arc::new(InMemory::new()), f.repository));
+        initialize(&f, store.clone()).await?;
+        let q = queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let pool = pooled(&f, store, &root, tasks.clone(), q.clone())?;
+        for generation in 1..=4 {
+            if generation > 1 {
+                advance(&f, generation).await?;
+            }
+            drop(pool.snapshot(Some("owner".into())).await?);
+        }
+        advance(&f, 5).await?;
+        assert_eq!(pool.owners_for_test().await.len(), 4);
+        // Stall the actual Cell worker, not the pool's timers or a mock reader.
+        // Selection queues behind this callback; exact release queues afterward.
+        let handle = f.handle.clone();
+        let mutation = identity()?;
+        let now = sql::now(0)?;
+        let (entered, started) = tokio::sync::oneshot::channel();
+        let (release, waiting) = std::sync::mpsc::channel();
+        let blocked = tokio::spawn(async move {
+            handle
+                .execute(
+                    mutation,
+                    Digest::from_bytes(*blake3::hash(b"selection-gate").as_bytes()),
+                    now,
+                    b"selection-gate".len(),
+                    0,
+                    move |_| {
+                        let _ = entered.send(());
+                        waiting
+                            .recv()
+                            .map_err(|_| Error::Command("selection gate lost"))?;
+                        Ok(cellule_runtime::cell::executor::HandlerOutcome::Success(
+                            Vec::new(),
+                        ))
+                    },
+                )
+                .await
+        });
+        timeout(Duration::from_secs(8), started).await??;
+        let selected = pool.observe_selection_for_test();
+        let work = pool.clone();
+        let viewer = tokio::spawn(async move { work.snapshot(Some("owner".into())).await });
+        timeout(Duration::from_secs(8), selected).await??;
+        tokio::time::sleep(Duration::from_millis(2100)).await;
+        assert!(
+            !viewer.is_finished(),
+            "Cell selection did not wait for the real worker"
+        );
+        release
+            .send(())
+            .map_err(|_| "Cell selection gate disappeared")?;
+        timeout(Duration::from_secs(8), blocked).await???;
+        let result = timeout(Duration::from_secs(8), viewer).await??;
+        // Always join cleanup before asserting, even for the failing baseline.
+        let fact = result.as_ref().ok().map(|s| s.fact().generation);
+        let error = result.as_ref().err().map(|e| format!("{e:?}"));
+        drop(result);
+        finish(&f, &pool, &q, tasks).await?;
+        f.runtime.shutdown().await?;
+        assert_eq!(fact, Some(5), "{error:?}");
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
index cd775b70..81379eba 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs
@@ -617,7 +617,10 @@ async fn bound_publication_wait_ceiling_never_admits_or_executes_the_retained_co
             0
         );
         drop(failure);
-        assert!(matches!(terminal(&ticket).await?, StagingState::Fenced(_)));
+        // Bound is terminal for the staging phase, but expiry completes later.
+        // Wait for the lifecycle outcome rather than racing its status update.
+        let state = timeout(Duration::from_secs(10), ticket.wait_completion()).await?;
+        assert!(matches!(state, StagingState::Fenced(_)), "{state:?}");
         assert!(c.close_and_drain().await.is_empty());
         assert!(p.close_and_drain().await.is_empty());
         f.runtime.shutdown().await?;
diff --git a/docs/design/certified-serving-pins.md b/docs/design/certified-serving-pins.md
index ba0be628..57166dac 100644
--- a/docs/design/certified-serving-pins.md
+++ b/docs/design/certified-serving-pins.md
@@ -219,8 +219,10 @@ covers selection, acquisition waiting and the returned snapshot borrow. Observer
 cancellation detaches accepted work, and the owner's original stays retained.
 At capacity, the pool initiates closure of a least-recently-used unborrowed
 owner and observes its independently owned release outside the pool lock. A
-request shares a two-second rollover budget and performs at most one retry per
-configured generation slot. Concurrent waiters can join an already closing
+request starts its two-second rollover observation budget when it first needs
+to retire an owner; initial authenticated Cell selection does not consume this
+budget. Later release observations and selection retries share that deadline.
+The request performs at most one retry per configured generation slot. Concurrent waiters can join an already closing
 owner. Each retry selects the current generation under current viewer access;
 closing owners cannot accept new borrows. Sequential readers can therefore move
 through more than four publications without retrying at the client.
diff --git a/docs/design/staging-service-lifecycle.md b/docs/design/staging-service-lifecycle.md
index fa967df3..29fd0d41 100644
--- a/docs/design/staging-service-lifecycle.md
+++ b/docs/design/staging-service-lifecycle.md
@@ -50,6 +50,11 @@ A known registration stores its original receipt before a fresh CheckStaging que
 
 Call seal when the input phase should finish. It prevents new producer admission and enters Draining. Existing producers and retained completed results continue under renewed staging custody. Bind does not begin until all input slots have drained through handoff or failure. This prevents a canceled observer from silently losing a physical witness while the service advances to catalog preparation.
 
+`wait_terminal()` observes staging handoff, including the intermediate Bound
+state. Callers waiting for expiry or final publication must use
+`wait_completion()`, which waits for Published, Uncertain, Fenced or Stopped.
+Observing Bound does not establish an expiry result or completed publication.
+
 Bind uses a newly prepared original command 42 and registrar 41 under the shared registered custody protocol. Known binding preserves the token, creating namespace and artifact expiry, and adds only the current catalog floor. Bound records that durable result and its original receipt; its recorded timestamps are not a fresh live-lease observation. Stage contexts become inactive after handoff. The operation remains admitted through bound preparation. `ticket.open_base` refreshes at the binding receipt and uses the existing PreparationBaseResolver with the supervisor's shared session, validating current access and expiry while inheriting automatic renewal, shutdown fencing and the bound residence ceiling.
 
 A producer can physically verify a native pack and return its private PhysicalPackWitness and sealed metadata segments. Take that result, seal, observe Bound, open the base, and feed the witness/segments to CatalogPreparation. The existing assembler rechecks store, namespace, partition completeness, canonical overlap and closure. Its private factories issue the publication proof. Bind and a generic producer result do not grant canonical or publication authority.
diff --git a/docs/evidence/serving-selection-budget-ci-20261005.json b/docs/evidence/serving-selection-budget-ci-20261005.json
new file mode 100644
index 00000000..a99fcfa0
--- /dev/null
+++ b/docs/evidence/serving-selection-budget-ci-20261005.json
@@ -0,0 +1,403 @@
+{
+  "recorded_at_utc": "2026-10-05T16:06:50.539325+00:00",
+  "base_head": "c86057c441ca86e856bc5be0fdeef01a6782b142",
+  "host": "macOS, Rust 1.98.0; Linux qualification required",
+  "source_files": 502,
+  "rust_files": 484,
+  "source_hash_digest": "57004d2198c0001dfed9c02c60d4e979f1905a2e887607b48f3d52d7f28138d0",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256; source manifest /tmp/canopy-lifecycle-source.json",
+  "source_unchanged_during_validation": true,
+  "release_qualified": false,
+  "reproduction": {
+    "exit_code": 101,
+    "path": "/tmp/canopy-rollover-selection-repro3.log",
+    "sha256": "08d8305ce91adbee8540f55ed994a866a5f04aecd7f514df18b91a94d7fae176",
+    "summaries": [
+      "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 717 filtered out; finished in 2.87s"
+    ],
+    "baseline_source_hash_digest": "e77e101432456257c5228137ed7b872032a8e9635e35ec5e643bd07e1417e626",
+    "baseline_manifest_reconstructed": true,
+    "result": "After queuing initial selection on the actual Cell worker for 2.1 seconds, the unmodified timer returns repository serving generations Capacity before idle release can use its observation budget. This proves one trigger; it does not attribute every historical Capacity failure."
+  },
+  "discarded_fixture_attempts": [
+    {
+      "log": "/tmp/canopy-rollover-selection-repro1.log",
+      "result": "Compiler borrow error; not a bug reproduction."
+    },
+    {
+      "log": "/tmp/canopy-rollover-selection-repro2.log",
+      "result": "Zero-byte SDK mailbox reservation rejected test setup before its callback; RecvError is not the bug reproduction."
+    }
+  ],
+  "publication_family": {
+    "exit_code": 0,
+    "path": "/tmp/canopy-lifecycle-publication-tests.log",
+    "sha256": "44fb1ac6e0ad872e6f36c4636107a906d7a018e449603d93cfd1ab9109d59dde",
+    "summaries": [
+      "test result: ok. 376 passed; 0 failed; 0 ignored; 0 measured; 342 filtered out; finished in 282.02s"
+    ]
+  },
+  "validation": {
+    "source_digest": "57004d2198c0001dfed9c02c60d4e979f1905a2e887607b48f3d52d7f28138d0",
+    "phases": [
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 689.92,
+        "log": "/tmp/canopy-lifecycle-workspace-final.log",
+        "log_sha256": "09a9b2dce024cb9982885d3239be7c987827e0b2181b8fdac3917b5e06caf607",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.67s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.17s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 717 filtered out; finished in 0.00s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 717 filtered out; finished in 0.06s",
+          "test result: ok. 718 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 293.38s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.03s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+          "test result: FAILED. 77 passed; 29 failed; 9 ignored; 0 measured; 0 filtered out; finished in 337.03s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.23s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+          "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 31.04,
+        "log": "/tmp/canopy-lifecycle-clippy-final.log",
+        "log_sha256": "a32ee79f7dec1470a9cd949d0b11b083e6bc7803bc864b9763c092de04bd8cb1",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 36.43,
+        "log": "/tmp/canopy-lifecycle-build-final.log",
+        "log_sha256": "9ba3258f8b439288f542274aef9a4259625fa1660318406cacac82642d6bdcf1",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.19,
+        "log": "/tmp/canopy-lifecycle-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 41.18,
+        "log": "/tmp/canopy-lifecycle-harness-final.log",
+        "log_sha256": "3e6bc8df29a2990de483f893523bdf539da691ca691465268045a9eb63916449",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.04,
+        "log": "/tmp/canopy-lifecycle-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 718,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 77,
+      "failed": 29,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 833,
+    "failed": 32,
+    "ignored": 9,
+    "executed": 865,
+    "total": 874
+  },
+  "counting": "Uses the last summary for each Cargo Running section; nested subprocess case summaries and focused reruns are excluded. Ordinary ignored cases remain unexecuted.",
+  "parent_linux_ci": [
+    {
+      "head": "c86057c441ca86e856bc5be0fdeef01a6782b142",
+      "run": 37277708867,
+      "job": 111658341938,
+      "conclusion": "failure",
+      "log": "/tmp/canopy-lifecycle-parent-push-full.log",
+      "sha256": "11ca55f6f9794664043b00c911162344609997fa218bd539663d1cb258166c78",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.28s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.46s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 716 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 716 filtered out; finished in 0.01s",
+        "test result: ok. 717 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 410.28s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.01s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s",
+        "test result: FAILED. 78 passed; 32 failed; 9 ignored; 0 measured; 0 filtered out; finished in 512.38s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    },
+    {
+      "head": "c86057c441ca86e856bc5be0fdeef01a6782b142",
+      "run": 37277713775,
+      "job": 111658357649,
+      "conclusion": "failure",
+      "log": "/tmp/canopy-lifecycle-parent-pr-full.log",
+      "sha256": "b266e10b7e6288bac66e64cea43665181374b6b4106b4ce3c2c9effcaaabc3c8",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.44s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.83s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 716 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 716 filtered out; finished in 0.01s",
+        "test result: ok. 717 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 456.85s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.81s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s",
+        "test result: FAILED. 78 passed; 32 failed; 9 ignored; 0 measured; 0 filtered out; finished in 543.29s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    }
+  ],
+  "changes": [
+    "Start the unchanged two-second rollover observation deadline only at the first retirement; share it across later retries and preserve charged slots until actual physical drain.",
+    "Observe bound expiry via wait_completion rather than intermediate staging Bound; retain Fenced, zero-admission and no-execution assertions."
+  ],
+  "remaining": "Linux rejected-push workload failures; native pull/ref product receivers and default-branch mutation; generated merge/rebase/candidate writers; peers/recovery/backup; reachability and cache evidence; standalone real-resident fixtures; full physical custody/owner adoption/final DDL and large-history/team capacity qualification."
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 5dc91683..0355bc3e 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,42 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Serving rollover and expiry observation (2026-10-05 checkpoint)
+
+Initial authenticated Cell selection used to consume the pool's two-second idle
+release observation budget. A regression fills all four slots, queues the actual
+Cell selection behind an admitted worker for 2.1 seconds, and then requests the
+next generation. Before the fix it fails with repository serving-generation
+capacity; after the fix it succeeds in both object formats and drains all pins.
+The budget now begins at the first retirement observation and stays shared across
+later retries. Its duration, generation cap and physical-drain requirements are
+unchanged. This reproduces one cause of the earlier workload-dependent capacity
+failure; it does not prove that every historical capacity failure had that cause.
+
+The bound-expiry test was calling `wait_terminal()`, which accepts intermediate
+Bound as staging handoff. It now calls `wait_completion()` to observe the expiry
+outcome and retains the Fenced, zero-admission and no-execution assertions. No
+production expiry classification or authorization semantics were relaxed.
+All 376 publication cases pass on the new frozen source. Full workspace tests
+pass all 718 server library cases, including both previously failing cases and
+the new Cell-contention regression. Multi-server remains at 77 passed / 29
+failed / 9 ignored; the three standalone aggregate fixtures also fail. The unique
+workspace inventory is 833 passed / 32 failed / 9 unexecuted ignores. All-target
+Clippy with warnings denied, server build, formatting, diff checks and all 96
+Python harness cases pass. Source fingerprints and complete results are in
+[evidence/serving-selection-budget-ci-20261005.json](evidence/serving-selection-budget-ci-20261005.json).
+Current-head Linux qualification remains required.
+
+Both `c86057c` Linux Verify runs pass all 717 server library tests and fail
+multi-server at 78 passed / 32 failed / 9 ignored: the
+[push run](https://github.com/crabbuild/canopy/actions/runs/37277708867) and
+[PR run](https://github.com/crabbuild/canopy/actions/runs/37277713775).
+Native commit checks, branch protection and bulk mirror cases pass there.
+Three rejected-push option cases still fail in the full Linux workload despite
+isolated local and earlier isolated Linux passes. Pull/ref product callers,
+default-branch mutation, generated writers, recovery/backup and filtered/cache
+expectations remain open. This follow-up is not a green-CI or release claim.
+
 ## Native commit checks conversion (2026-10-05 checkpoint)
 
 Commit-check reads and starts were still querying the removed `objects` table,

From ef765d449ab09488af1712d72dc39aa1894dc555 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 10:26:03 -0700
Subject: [PATCH 37/55] fix: authorize pull metadata with native ref snapshots

---
 crates/canopy-server/src/git_read/mod.rs      |   7 +
 crates/canopy-server/src/lib.rs               |  17 +
 .../src/packs/publication/mod.rs              |   5 +
 .../src/packs/publication/ref_observation.rs  | 176 +++++
 .../publication/ref_observation/selection.rs  | 149 +++++
 .../src/packs/publication/registry.rs         |  26 +-
 .../src/packs/publication/schema.sql          |   4 +-
 .../packs/publication/serving/lifecycle.rs    |  10 +
 .../src/packs/publication/serving/session.rs  |   1 +
 .../serving/session/ref_observation.rs        |  55 ++
 crates/canopy-server/src/pulls/mod.rs         |  94 +--
 crates/canopy-server/src/pulls/mutations.rs   | 216 +++---
 .../canopy-server/src/pulls/native/client.rs  | 130 ++++
 .../canopy-server/src/pulls/native/codec.rs   | 294 ++++++++
 crates/canopy-server/src/pulls/native/mod.rs  | 215 ++++++
 .../canopy-server/src/pulls/native/reads.rs   | 279 ++++++++
 .../src/repository_http/pulls.rs              |   6 +-
 .../server/residency/tests/serving/browser.rs |  65 +-
 .../residency/tests/serving/browser/pulls.rs  | 501 ++++++++++++++
 docs/contracts.md                             |  43 +-
 docs/evidence/native-pulls-ci-20261005.json   | 632 ++++++++++++++++++
 .../large-repository-implementation-status.md |  54 ++
 22 files changed, 2811 insertions(+), 168 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/ref_observation.rs
 create mode 100644 crates/canopy-server/src/packs/publication/ref_observation/selection.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/ref_observation.rs
 create mode 100644 crates/canopy-server/src/pulls/native/client.rs
 create mode 100644 crates/canopy-server/src/pulls/native/codec.rs
 create mode 100644 crates/canopy-server/src/pulls/native/mod.rs
 create mode 100644 crates/canopy-server/src/pulls/native/reads.rs
 create mode 100644 crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
 create mode 100644 docs/evidence/native-pulls-ci-20261005.json

diff --git a/crates/canopy-server/src/git_read/mod.rs b/crates/canopy-server/src/git_read/mod.rs
index d952f5c4..85233dfc 100644
--- a/crates/canopy-server/src/git_read/mod.rs
+++ b/crates/canopy-server/src/git_read/mod.rs
@@ -45,6 +45,8 @@ pub(crate) enum ReadError {
     Malformed,
     #[error("Git Cell read failed")]
     Cell(#[from] InvocationError<Vec<SqlResultSet>>),
+    #[error("native pull metadata read failed")]
+    Pull(#[source] Box<crate::pulls::NativePullError>),
     #[error("Git read worker failed")]
     Task(#[from] tokio::task::JoinError),
     #[error("certified Git snapshot is unavailable")]
@@ -52,6 +54,11 @@ pub(crate) enum ReadError {
     #[error("certified Git snapshot owner is unavailable")]
     ServingOwner(#[from] crate::packs::publication::ServingOwnerError),
 }
+impl From<crate::pulls::NativePullError> for ReadError {
+    fn from(error: crate::pulls::NativePullError) -> Self {
+        Self::Pull(Box::new(error))
+    }
+}
 #[derive(Clone, Copy, PartialEq, Eq)]
 struct Node {
     mode: u32,
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index aa615b0d..b88a1f21 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -346,6 +346,17 @@ impl CellModule for RepositoryModule {
                 ));
                 source.update(include_bytes!("packs/publication/serving/ownership.rs"));
                 source.update(include_bytes!("packs/publication/serving/schema.sql"));
+                source.update(include_bytes!("packs/publication/ref_observation.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/ref_observation/selection.rs"
+                ));
+                source.update(include_bytes!(
+                    "packs/publication/serving/session/ref_observation.rs"
+                ));
+                source.update(include_bytes!("pulls/native/mod.rs"));
+                source.update(include_bytes!("pulls/native/codec.rs"));
+                source.update(include_bytes!("pulls/native/client.rs"));
+                source.update(include_bytes!("pulls/native/reads.rs"));
                 source.update(include_bytes!("packs/publication/registry.rs"));
                 source.update(include_bytes!("server/catalog_initialization.rs"));
                 source.update(include_bytes!("server/residency/mod.rs"));
@@ -372,6 +383,12 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("push/report.rs"));
                 source.update(include_bytes!("access.rs"));
                 source.update(include_bytes!("visibility.rs"));
+                source.update(include_bytes!("checks/native.rs"));
+                source.update(include_bytes!("checks/native/codec.rs"));
+                source.update(include_bytes!("packs/publication/commit_membership.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/serving/session/membership.rs"
+                ));
                 source.update(include_bytes!("checks/mod.rs"));
                 source.update(include_bytes!("checks/mutations.rs"));
                 source.update(include_bytes!("pulls/mod.rs"));
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index e2c69d83..b61c9e09 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -34,7 +34,9 @@ mod base;
 pub use base::{PreparationBaseError, PreparationBaseResolver};
 mod certificate;
 mod commit_membership;
+mod ref_observation;
 pub(crate) use commit_membership::{CommitMembership, MembershipRequest};
+pub(crate) use ref_observation::{REF_SELECTION_BYTES, RefSelection};
 pub(in crate::packs) mod codec;
 pub use certificate::{
     AttestationOutcome, CERTIFICATE_BYTES, CatalogCertificate, RegisteredCatalog,
@@ -252,6 +254,9 @@ pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_command::<crate::branch_rules::command::SetBranchRule>()?;
     registry.bind_command::<crate::checks::native::StartCommitCheck>()?;
     registry.bind_query::<crate::checks::native::ReadCommitChecks>()?;
+    registry.bind_command::<crate::pulls::native::CreateNativePull>()?;
+    registry.bind_command::<crate::pulls::native::ReviewNativePull>()?;
+    registry.bind_query::<crate::pulls::native::ReadNativePulls>()?;
     registry.bind_command::<ReleaseServingPin>()?;
     registry.bind_query::<CheckServingPin>()?;
     registry.bind_query::<SelectServingGeneration>()?;
diff --git a/crates/canopy-server/src/packs/publication/ref_observation.rs b/crates/canopy-server/src/packs/publication/ref_observation.rs
new file mode 100644
index 00000000..ceebcaab
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/ref_observation.rs
@@ -0,0 +1,176 @@
+//! Private exact-ref observation under a live serving pin and CURRENT joint fact.
+//! Editorial receivers independently recheck current policy in their transaction.
+use super::*;
+use crate::ReadIdentity;
+use crate::packs::directory::index::codec::fixed;
+use cellule_runtime::{ApplicationId, CellId, TenantId};
+use certificate::CertificateEnvelope;
+
+mod selection;
+pub(crate) use selection::{REF_SELECTION_BYTES, RefFact, RefSelection};
+
+const DOMAIN: &[u8] = b"canopy.ref-observation.v1\0";
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct RefObservation(CertificateEnvelope);
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct ObservationData {
+    pub(super) tenant: [u8; 16],
+    pub(super) application: [u8; 16],
+    pub(super) token: ServingToken,
+    pub(super) fact: GenerationFact,
+    pub(super) actor: Option<String>,
+    pub(super) binding: [u8; 32],
+}
+impl ObservationData {
+    fn validate(&self) -> Result<(), CodecError> {
+        self.token.validate()?;
+        self.fact.validate()?;
+        if self.token.generation != self.fact.generation
+            || self
+                .fact
+                .catalog
+                .is_none_or(|c| c.repository != self.token.repository)
+            || self.fact.refs.is_none()
+            || self.binding == [0; 32]
+            || self
+                .actor
+                .as_deref()
+                .is_some_and(|a| validate_component(a).is_err())
+        {
+            return Err(CodecError::Invalid("invalid ref observation"));
+        }
+        Ok(())
+    }
+}
+impl WireValue for ObservationData {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.validate()?;
+        e.write_bytes(DOMAIN)?;
+        e.write_bytes(&self.tenant)?;
+        e.write_bytes(&self.application)?;
+        self.token.encode(e)?;
+        self.fact.encode(e)?;
+        self.actor.encode(e)?;
+        e.write_bytes(&self.binding)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != DOMAIN {
+            return Err(CodecError::Invalid("invalid ref observation purpose"));
+        }
+        let value = Self {
+            tenant: fixed(d)?,
+            application: fixed(d)?,
+            token: ServingToken::decode(d)?,
+            fact: GenerationFact::decode(d)?,
+            actor: Option::<String>::decode(d)?,
+            binding: fixed(d)?,
+        };
+        value.validate()?;
+        Ok(value)
+    }
+}
+pub(crate) struct ObservationRequest<'a> {
+    pub(crate) cell: CellId,
+    pub(crate) owner: Option<OwnerFence>,
+    pub(crate) repository: [u8; 16],
+    pub(crate) actor: &'a Option<String>,
+    pub(crate) binding: [u8; 32],
+    pub(crate) admitted_ms: i64,
+}
+impl RefObservation {
+    pub(super) fn seal(data: ObservationData, seed: &[u8; 32]) -> Result<Self, CodecError> {
+        Ok(Self(CertificateEnvelope::seal(&data, seed)?))
+    }
+    /// This proof requires the original pin and equality with the current joint fact.
+    pub(crate) fn authorize(
+        &self,
+        request: ObservationRequest<'_>,
+        mut query: impl FnMut(&SqlBatch) -> cellule_runtime::Result<Vec<SqlResultSet>>,
+    ) -> cellule_runtime::Result<bool> {
+        use sql::*;
+        let ObservationRequest {
+            cell,
+            owner,
+            repository,
+            actor,
+            binding,
+            admitted_ms,
+        } = request;
+        let data: ObservationData = self.0.data()?;
+        let target = crate::repository_target(
+            TenantId::from_bytes(data.tenant),
+            ApplicationId::from_bytes(data.application),
+            repository,
+        )?;
+        if target.cell_id() != cell
+            || data.token.repository != repository
+            || data.actor != *actor
+            || data.binding != binding
+            || owner.is_some_and(|f| data.token.owner != f)
+        {
+            return Ok(false);
+        }
+        let scope = actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        scope.validate()?;
+        let access = query(&statement(
+            &format!("SELECT 1 WHERE {}", crate::access::READ_ACCESS),
+            vec![scope.parameter()],
+        ))?;
+        if rows(&access)?.is_empty() {
+            return Ok(false);
+        }
+        let secret = query(&statement(
+            "SELECT push_cert_seed FROM repository_identity WHERE singleton=1 AND repository_id=?1 AND object_format=?2",
+            vec![
+                blob(repository),
+                SqlValue::Text(
+                    data.fact
+                        .catalog
+                        .ok_or(Error::Command("ref observation catalog absent"))?
+                        .format
+                        .as_str()
+                        .into(),
+                ),
+            ],
+        ))?;
+        if rows(&secret)?.is_empty() || !self.0.authenticated(&attestation::seed(&secret)?) {
+            return Ok(false);
+        }
+        let token = data.token;
+        let pin = query(&statement(
+            "SELECT 1 FROM catalog_serving_pins WHERE reader=?1 AND incarnation=?2 AND admission_sequence=?3 AND owner_epoch=?4 AND generation=?5 AND expires_at_ms>?6",
+            vec![
+                blob(token.reader),
+                blob(token.owner.incarnation.as_bytes()),
+                number(token.admission_sequence)?,
+                blob(token.owner.epoch.to_be_bytes()),
+                number(token.generation)?,
+                SqlValue::Integer(now(admitted_ms)?),
+            ],
+        ))?;
+        if rows(&pin)?.is_empty() {
+            return Ok(false);
+        }
+        let format = data
+            .fact
+            .catalog
+            .ok_or(Error::Command("ref observation catalog absent"))?
+            .format;
+        // A retained historical commit proof permits old generations. Ref policy
+        // must match the moving current joint fact, including HEAD-only changes.
+        Ok(generation(&query(&statement(CURRENT, vec![]))?, repository, format)? == data.fact)
+    }
+}
+impl WireValue for RefObservation {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.0.data::<ObservationData>()?;
+        self.0.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self(CertificateEnvelope::decode(d)?);
+        value.0.data::<ObservationData>()?;
+        Ok(value)
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/ref_observation/selection.rs b/crates/canopy-server/src/packs/publication/ref_observation/selection.rs
new file mode 100644
index 00000000..f6bd672d
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/ref_observation/selection.rs
@@ -0,0 +1,149 @@
+//! Byte-bounded exact facts reuse the immutable ref state's OID/version shape.
+use super::*;
+use crate::refs::{RefExpectation, valid_ref_name};
+
+pub(crate) const REF_SELECTION_BYTES: u32 = 560 << 10;
+const NAME_BYTES: usize = 512 << 10;
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct RefFact {
+    pub(crate) name: String,
+    pub(crate) state: Option<RefExpectation>,
+}
+#[derive(Clone, Debug)]
+pub(crate) struct RefSelection {
+    pub(crate) repository: [u8; 16],
+    pub(crate) actor: Option<String>,
+    pub(crate) facts: Vec<RefFact>,
+    pub(crate) proof: Option<RefObservation>,
+}
+impl RefSelection {
+    pub(crate) fn binding(&self, request: [u8; 32]) -> Result<[u8; 32], CodecError> {
+        self.shape()?;
+        let mut h = blake3::Hasher::new();
+        h.update(b"canopy.ref-selection.v1\0");
+        h.update(&request);
+        h.update(&(self.facts.len() as u64).to_le_bytes());
+        for fact in &self.facts {
+            h.update(&(fact.name.len() as u64).to_le_bytes());
+            h.update(fact.name.as_bytes());
+            h.update(&[u8::from(fact.state.is_some())]);
+            if let Some(state) = &fact.state {
+                h.update(&state.version.to_le_bytes());
+                h.update(&[u8::from(state.oid.is_some())]);
+                if let Some(oid) = state.oid {
+                    h.update(&[oid.format().bytes() as u8]);
+                    h.update(oid.as_ref());
+                }
+            }
+        }
+        Ok(*h.finalize().as_bytes())
+    }
+    pub(crate) fn authorized(
+        &self,
+        cell: cellule_runtime::CellId,
+        owner: Option<OwnerFence>,
+        admitted_ms: i64,
+        request: [u8; 32],
+        query: impl FnMut(&SqlBatch) -> cellule_runtime::Result<Vec<SqlResultSet>>,
+    ) -> cellule_runtime::Result<bool> {
+        let Some(proof) = &self.proof else {
+            return Ok(false);
+        };
+        proof.authorize(
+            ObservationRequest {
+                cell,
+                owner,
+                repository: self.repository,
+                actor: &self.actor,
+                binding: self.binding(request)?,
+                admitted_ms,
+            },
+            query,
+        )
+    }
+    fn shape(&self) -> Result<(), CodecError> {
+        if crate::validate_repository_id(self.repository).is_err()
+            || self
+                .actor
+                .as_deref()
+                .is_some_and(|a| validate_component(a).is_err())
+            || self.facts.len() > 128
+            || self.facts.iter().map(|f| f.name.len()).sum::<usize>() > NAME_BYTES
+            || self.facts.windows(2).any(|p| p[0].name >= p[1].name)
+            || self.facts.iter().any(|f| {
+                !valid_ref_name(&f.name)
+                    || f.name.len() > crate::packs::ref_state::MAX_NAME_BYTES
+                    || f.state
+                        .as_ref()
+                        .is_some_and(|s| s.version < 1 || s.oid.is_some_and(|o| o.is_zero()))
+            })
+        {
+            return Err(CodecError::Invalid("invalid exact ref selection"));
+        }
+        Ok(())
+    }
+}
+impl WireValue for RefSelection {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.shape()?;
+        e.write_bytes(&self.repository)?;
+        self.actor.encode(e)?;
+        e.write_count(self.facts.len())?;
+        for fact in &self.facts {
+            e.write_text(&fact.name)?;
+            e.write_bool(fact.state.is_some())?;
+            if let Some(state) = &fact.state {
+                e.write_i64(state.version)?;
+                e.write_bool(state.oid.is_some())?;
+                if let Some(oid) = state.oid {
+                    e.write_bytes(oid.as_ref())?;
+                }
+            }
+        }
+        self.proof.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let repository = fixed(d)?;
+        let actor = Option::<String>::decode(d)?;
+        let count = d.read_count()?;
+        if count > 128 {
+            return Err(CodecError::Invalid("ref selection count"));
+        }
+        let mut facts = Vec::with_capacity(count);
+        let mut bytes = 0;
+        for _ in 0..count {
+            let name = d.read_text()?;
+            bytes += name.len();
+            if bytes > NAME_BYTES {
+                return Err(CodecError::Invalid("ref selection bytes"));
+            }
+            let state = if d.read_bool()? {
+                Some(RefExpectation {
+                    version: d.read_i64()?,
+                    oid: if d.read_bool()? {
+                        Some(
+                            crate::ObjectId::try_from(d.read_bytes()?)
+                                .map_err(|_| CodecError::Invalid("ref selection OID"))?,
+                        )
+                    } else {
+                        None
+                    },
+                })
+            } else {
+                None
+            };
+            facts.push(RefFact {
+                name: name.into(),
+                state,
+            });
+        }
+        let value = Self {
+            repository,
+            actor,
+            facts,
+            proof: Option::<RefObservation>::decode(d)?,
+        };
+        value.shape()?;
+        Ok(value)
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 2fb41184..ddbcc0cd 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,7 +23,7 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 19] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 21] = [
     crate::operation(1),
     command::<crate::branch_rules::command::SetBranchRule>(64 << 10, 64),
     command::<AbortPreparation>(4096, 4096),
@@ -43,8 +43,10 @@ pub(crate) const COMMANDS: [OperationDescriptor; 19] = [
     command::<StopCustodyIntent>(1024, 128),
     command::<ReleaseServingPin>(1024, 128),
     command::<crate::checks::native::StartCommitCheck>(4096, 16),
+    command::<crate::pulls::native::CreateNativePull>(crate::pulls::native::INPUT_BYTES, 16),
+    command::<crate::pulls::native::ReviewNativePull>(crate::pulls::native::INPUT_BYTES, 16),
 ];
-pub(crate) const QUERIES: [OperationDescriptor; 12] = [
+pub(crate) const QUERIES: [OperationDescriptor; 13] = [
     crate::operation(2),
     query::<CheckPreparation>(4096, 4096),
     query::<CheckPreparationFrontier>(4096, 4096),
@@ -57,6 +59,10 @@ pub(crate) const QUERIES: [OperationDescriptor; 12] = [
     query::<CheckServingPin>(1024, 1024),
     query::<SelectServingGeneration>(1024, 512),
     query::<crate::checks::native::ReadCommitChecks>(4096, 256 << 10),
+    query::<crate::pulls::native::ReadNativePulls>(
+        crate::pulls::native::INPUT_BYTES,
+        crate::pulls::native::OUTPUT_BYTES,
+    ),
 ];
 
 #[cfg(test)]
@@ -87,7 +93,7 @@ mod tests {
         assert_eq!(
             ids,
             vec![
-                1, 8, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49
+                1, 8, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49, 51, 53
             ]
         );
         assert_eq!(
@@ -96,7 +102,7 @@ mod tests {
                 .iter()
                 .map(|operation| operation.id)
                 .collect::<Vec<_>>(),
-            vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48, 50]
+            vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48, 50, 52]
         );
         for (id, codec, input, output) in [
             (
@@ -129,6 +135,18 @@ mod tests {
                 4096,
                 16,
             ),
+            (
+                51,
+                crate::pulls::native::CreateNativePull::CODEC_VERSION,
+                crate::pulls::native::INPUT_BYTES,
+                16,
+            ),
+            (
+                53,
+                crate::pulls::native::ReviewNativePull::CODEC_VERSION,
+                crate::pulls::native::INPUT_BYTES,
+                16,
+            ),
         ] {
             let operation = descriptor
                 .commands
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index 6bf84189..a55068a0 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -238,8 +238,8 @@ CREATE TABLE pull_requests (
     state TEXT NOT NULL CHECK(state IN ('open', 'closed', 'merged')),
     draft INTEGER NOT NULL CHECK(draft IN (0, 1)),
     version INTEGER NOT NULL CHECK(typeof(version) = 'integer' AND version > 0),
-    source_ref TEXT NOT NULL REFERENCES refs(name),
-    base_ref TEXT NOT NULL REFERENCES refs(name) CHECK(source_ref != base_ref),
+    source_ref TEXT NOT NULL,
+    base_ref TEXT NOT NULL CHECK(source_ref != base_ref),
     initial_source_oid BLOB NOT NULL CHECK(length(initial_source_oid) IN (20, 32)),
     initial_base_oid BLOB NOT NULL CHECK(length(initial_base_oid) IN (20, 32)),
     created_ms INTEGER NOT NULL CHECK(created_ms >= 0),
diff --git a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
index b56d7393..2321de21 100644
--- a/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
+++ b/crates/canopy-server/src/packs/publication/serving/lifecycle.rs
@@ -116,6 +116,16 @@ pub struct ServingSnapshot {
     _borrow: Arc<Borrow>,
 }
 impl ServingSnapshot {
+    pub(crate) async fn ref_selection(
+        &self,
+        request: [u8; 32],
+        names: &[String],
+    ) -> Result<super::super::RefSelection, ServingReadError> {
+        self.pin
+            .ref_selection(self.actor.clone(), request, names)
+            .await
+    }
+
     pub(crate) async fn commit_membership(
         &self,
         oid: crate::ObjectId,
diff --git a/crates/canopy-server/src/packs/publication/serving/session.rs b/crates/canopy-server/src/packs/publication/serving/session.rs
index 4f10971e..88e43aae 100644
--- a/crates/canopy-server/src/packs/publication/serving/session.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session.rs
@@ -15,6 +15,7 @@ mod body;
 mod edges;
 mod membership;
 mod native_base;
+mod ref_observation;
 mod workspace;
 pub use edges::{MAX_EDGE_PARENTS, ServingEdgePage};
 pub use workspace::{NativeWorkspace, WorkspaceLimits, WorkspaceStats};
diff --git a/crates/canopy-server/src/packs/publication/serving/session/ref_observation.rs b/crates/canopy-server/src/packs/publication/serving/session/ref_observation.rs
new file mode 100644
index 00000000..7d6b4a8f
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/ref_observation.rs
@@ -0,0 +1,55 @@
+//! Issuance reads immutable ref facts under the existing tracked physical owner.
+use super::super::super::ref_observation::{
+    ObservationData, RefFact, RefObservation, RefSelection,
+};
+use super::super::super::{attestation, sql};
+use super::*;
+
+impl ServingPin {
+    pub(in crate::packs::publication::serving) async fn ref_selection(
+        &self,
+        actor: Option<String>,
+        request: [u8; 32],
+        names: &[String],
+    ) -> Result<RefSelection, ServingReadError> {
+        if names.len() > 128
+            || names.iter().map(String::len).sum::<usize>() > 512 << 10
+            || names.windows(2).any(|p| p[0] >= p[1])
+            || names.iter().any(|n| {
+                !crate::refs::valid_ref_name(n) || n.len() > crate::packs::ref_state::MAX_NAME_BYTES
+            })
+        {
+            return Err(ServingReadError::Context);
+        }
+        let names = names.to_vec();
+        self.read_owned(actor.clone(), move |inner, deadline, _permit| async move {
+            let snapshot = inner.ref_snapshot().await?;
+            let mut facts = Vec::with_capacity(names.len());
+            for name in names {
+                if Instant::now() >= deadline { return Err(ServingReadError::Inactive) }
+                let state = inner.context.indexes.refs().read(snapshot.root.clone(), &name).await?;
+                facts.push(RefFact { name, state });
+            }
+            let mut selection = RefSelection { repository: inner.lease.token.repository, actor: actor.clone(), facts, proof: None };
+            let binding = selection.binding(request)?;
+            let capability = SqlCell::<RepositoryModule>::new(inner.context.client.clone(), inner.context.target.clone())?;
+            let result = capability.query(None, SqlBatch { statements: vec![
+                SqlStatement {
+                    sql: "SELECT push_cert_seed FROM repository_identity WHERE singleton=1 AND repository_id=?1 AND object_format=?2".into(),
+                    parameters: vec![sql::blob(inner.lease.token.repository), SqlValue::Text(inner.lease.format.as_str().into())],
+                },
+                SqlStatement { sql: sql::GENERATION.into(), parameters: vec![sql::number(inner.lease.token.generation)?] },
+            ]}).await.map_err(|e| ServingReadError::Proof(Box::new(e)))?;
+            if sql::generation(result.output.get(1..).ok_or(ServingReadError::Context)?, inner.lease.token.repository, inner.lease.format)? != inner.lease.fact {
+                return Err(ServingReadError::Context)
+            }
+            let seed = attestation::seed(&result.output)?;
+            selection.proof = Some(RefObservation::seal(ObservationData {
+                tenant: *inner.context.target.tenant().as_bytes(), application: *inner.context.target.application().as_bytes(),
+                token: inner.lease.token, fact: inner.lease.fact, actor, binding,
+            }, &seed)?);
+            if Instant::now() >= deadline { return Err(ServingReadError::Inactive) }
+            Ok(selection)
+        }).await
+    }
+}
diff --git a/crates/canopy-server/src/pulls/mod.rs b/crates/canopy-server/src/pulls/mod.rs
index e56f7778..0504bfbc 100644
--- a/crates/canopy-server/src/pulls/mod.rs
+++ b/crates/canopy-server/src/pulls/mod.rs
@@ -5,6 +5,8 @@ use crate::ReadIdentity;
 pub mod candidates;
 pub mod merge;
 mod mutations;
+pub(crate) mod native;
+pub use native::NativePullError;
 pub(crate) mod threads;
 
 use crate::{
@@ -184,55 +186,54 @@ pub(crate) fn valid_review(input: &NewReview<'_>) -> bool {
 }
 
 impl RepositoryCell {
-    /// Lists 32 pull summaries with coherent current branches; missing access returns None.
+    /// A bounded coherent page from editorial SQL and privately certified native refs.
     pub async fn pulls<'a>(
         &self,
         actor: impl Into<ReadIdentity<'a>>,
         after: i64,
         state: Option<PullState>,
-    ) -> Result<Observed<Option<Vec<PullSummary>>>, Invocation> {
-        let actor = actor.into();
+    ) -> Result<Observed<Option<Vec<PullSummary>>>, NativePullError> {
         if after < 0 {
-            return Err(invalid("invalid pull cursor"));
+            return Err(Error::Command("invalid pull cursor").into());
         }
-        actor.validate().map_err(Invocation::NotStarted)?;
-        let mut parameters = vec![actor.parameter(), SqlValue::Integer(after)];
-        let filter = if let Some(state) = state {
-            parameters.push(SqlValue::Text(state.as_str().into()));
-            "AND p.state = ?3"
-        } else {
-            ""
-        };
-        let result = self.pull_rows(
-            SqlStatement { sql: format!("SELECT ({ACCESS})"), parameters: vec![actor.parameter()] },
-            SqlStatement { sql: format!("SELECT {COLUMNS} FROM {JOINS} WHERE p.number > ?2 {filter} AND ({ACCESS}) ORDER BY p.number LIMIT {PULL_PAGE_SIZE}"), parameters },
-        ).await?;
+        let result = self
+            .native_pull_rows(actor.into(), native::ReadKind::Page { after, state })
+            .await?;
         let output = result
             .output
-            .map(|rows| rows.iter().map(|row| summary(row)).collect())
-            .transpose()
-            .map_err(Invocation::NotStarted)?;
+            .map(|sets| {
+                sets.first()
+                    .ok_or(Error::Command("missing native pull page"))?
+                    .rows
+                    .iter()
+                    .map(|row| summary(row))
+                    .collect()
+            })
+            .transpose()?;
         Ok(Observed {
             output,
             receipt: result.receipt,
         })
     }
-    /// Reads a pull, original tips and live ref state under current read membership.
+    /// Current branch facts and editorial details share the final typed observation.
     pub async fn pull<'a>(
         &self,
         actor: impl Into<ReadIdentity<'a>>,
         number: i64,
-    ) -> Result<Observed<Option<PullRequest>>, Invocation> {
-        let actor = actor.into();
-        actor.validate().map_err(Invocation::NotStarted)?;
-        let result = self.sql.query(None, SqlBatch { statements: vec![SqlStatement {
-            sql: format!("SELECT {COLUMNS}, p.body, p.initial_source_oid, p.initial_base_oid, merged.id, merged.pull_number, merged.oid, merged.merged_ms, merged.pull_version, merged.source_oid, merged.source_version, merged.base_oid, merged.base_version FROM {JOINS} LEFT JOIN pull_merges merged ON merged.pull_number = p.number WHERE p.number = ?2 AND ({ACCESS})"),
-            parameters: vec![actor.parameter(), SqlValue::Integer(number)],
-        }] }).await?;
-        let rows = result
-            .output
-            .first()
-            .ok_or_else(|| invalid("missing pull result"))?;
+    ) -> Result<Observed<Option<PullRequest>>, NativePullError> {
+        if number < 1 {
+            return Err(Error::Command("invalid pull number").into());
+        }
+        let result = self
+            .native_pull_rows(actor.into(), native::ReadKind::Detail(number))
+            .await?;
+        let Some(sets) = result.output else {
+            return Ok(Observed {
+                output: None,
+                receipt: result.receipt,
+            });
+        };
+        let rows = sets.first().ok_or(Error::Command("missing pull result"))?;
         let output = rows
             .rows
             .first()
@@ -265,33 +266,36 @@ impl RepositoryCell {
                 })
             })
             .transpose()
-            .map_err(Invocation::NotStarted)?;
+            .map_err(NativePullError::Invalid)?;
         Ok(Observed {
             output,
             receipt: result.receipt,
         })
     }
-    /// Reads 16 immutable reviews with current applicability; missing pull/access returns None.
+    /// Immutable reviews with applicability checked against current exact native refs.
     pub async fn pull_reviews<'a>(
         &self,
         actor: impl Into<ReadIdentity<'a>>,
         number: i64,
         after: i64,
-    ) -> Result<Observed<Option<Vec<PullReview>>>, Invocation> {
-        let actor = actor.into();
-        if after < 0 {
-            return Err(invalid("invalid review cursor"));
+    ) -> Result<Observed<Option<Vec<PullReview>>>, NativePullError> {
+        if number < 1 || after < 0 {
+            return Err(Error::Command("invalid review cursor").into());
         }
-        actor.validate().map_err(Invocation::NotStarted)?;
-        let result = self.pull_rows(
-            SqlStatement { sql: format!("SELECT ({ACCESS}) AND EXISTS (SELECT 1 FROM pull_requests WHERE number = ?2)"), parameters: vec![actor.parameter(), SqlValue::Integer(number)] },
-            SqlStatement { sql: format!("SELECT r.number, r.id, r.reviewer, r.kind, r.body, r.pull_version, r.source_oid, r.source_version, r.base_oid, r.base_version, coalesce(({APPLICABLE}), 0), r.created_ms FROM pull_reviews r JOIN pull_requests p ON p.number = r.pull_number JOIN refs s ON s.name = p.source_ref JOIN refs b ON b.name = p.base_ref WHERE r.pull_number = ?2 AND r.number > ?3 AND ({ACCESS}) ORDER BY r.number LIMIT {REVIEW_PAGE_SIZE}"), parameters: vec![actor.parameter(), SqlValue::Integer(number), SqlValue::Integer(after)] },
-        ).await?;
+        let result = self
+            .native_pull_rows(actor.into(), native::ReadKind::Reviews { number, after })
+            .await?;
         let output = result
             .output
-            .map(|rows| rows.iter().map(|row| review(row)).collect())
-            .transpose()
-            .map_err(Invocation::NotStarted)?;
+            .map(|sets| {
+                sets.first()
+                    .ok_or(Error::Command("missing native review page"))?
+                    .rows
+                    .iter()
+                    .map(|row| review(row))
+                    .collect()
+            })
+            .transpose()?;
         Ok(Observed {
             output,
             receipt: result.receipt,
diff --git a/crates/canopy-server/src/pulls/mutations.rs b/crates/canopy-server/src/pulls/mutations.rs
index 8ec4eba6..a3e41ef8 100644
--- a/crates/canopy-server/src/pulls/mutations.rs
+++ b/crates/canopy-server/src/pulls/mutations.rs
@@ -10,49 +10,8 @@ impl RepositoryCell {
         identity: MutationIdentity,
         actor: &str,
         input: NewPull<'_>,
-    ) -> Result<Committed<PullChange>, Invocation> {
-        validate_component(actor).map_err(Invocation::NotStarted)?;
-        validate_repository_id(input.id).map_err(Invocation::NotStarted)?;
-        if !valid_new(&input) {
-            return Err(invalid("invalid pull creation"));
-        }
-        let mut parameters = vec![
-            SqlValue::Text(actor.into()),
-            SqlValue::Blob(input.id.to_vec()),
-            SqlValue::Blob(binding(&[
-                actor,
-                input.title,
-                input.body,
-                if input.draft { "draft" } else { "ready" },
-                input.source_ref,
-                input.source_oid,
-                input.base_ref,
-                input.base_oid,
-            ])),
-            SqlValue::Text(input.source_ref.into()),
-            SqlValue::Blob(
-                parse_oid(input.source_oid).ok_or_else(|| invalid("invalid source OID"))?,
-            ),
-            SqlValue::Text(input.base_ref.into()),
-            SqlValue::Blob(parse_oid(input.base_oid).ok_or_else(|| invalid("invalid base OID"))?),
-        ];
-        let decision = format!(
-            "CASE WHEN NOT ({ACCESS}) THEN 'missing' WHEN EXISTS (SELECT 1 FROM pull_requests WHERE id = ?2 AND creation_digest != ?3) THEN 'conflict' WHEN EXISTS (SELECT 1 FROM pull_requests WHERE id = ?2) THEN 'applied' WHEN NOT EXISTS (SELECT 1 FROM refs WHERE name = ?4 AND oid = ?5) OR NOT EXISTS (SELECT 1 FROM refs WHERE name = ?6 AND oid = ?7) OR ?5 = ?7 THEN 'conflict' ELSE 'applied' END"
-        );
-        let check = SqlStatement {
-            sql: format!("SELECT {decision}"),
-            parameters: parameters.clone(),
-        };
-        parameters.extend([
-            SqlValue::Text(input.title.into()),
-            SqlValue::Text(input.body.into()),
-            SqlValue::Integer(i64::from(input.draft)),
-            SqlValue::Integer(identity.issued_at_ms),
-        ]);
-        self.pull_change(identity, vec![check,
-            SqlStatement { sql: format!("INSERT INTO pull_requests (id, creation_digest, author, title, body, state, draft, version, source_ref, initial_source_oid, base_ref, initial_base_oid, created_ms, updated_ms) SELECT ?2, ?3, ?1, ?8, ?9, 'open', ?10, 1, ?4, ?5, ?6, ?7, ?11, ?11 WHERE ({decision}) = 'applied' AND NOT EXISTS (SELECT 1 FROM pull_requests WHERE id = ?2)"), parameters },
-            SqlStatement { sql: "SELECT number FROM pull_requests WHERE id = ?1".into(), parameters: vec![SqlValue::Blob(input.id.to_vec())] },
-        ]).await
+    ) -> Result<Committed<PullChange>, native::NativePullError> {
+        self.native_create_pull(identity, actor, input).await
     }
     /// Replaces editorial fields for the author or a current repository writer.
     ///
@@ -107,62 +66,9 @@ impl RepositoryCell {
         actor: &str,
         number: i64,
         input: NewReview<'_>,
-    ) -> Result<Committed<PullChange>, Invocation> {
-        validate_component(actor).map_err(Invocation::NotStarted)?;
-        validate_repository_id(input.id).map_err(Invocation::NotStarted)?;
-        if number < 1 || !valid_review(&input) {
-            return Err(invalid("invalid pull review"));
-        }
-        let revision = input.revision;
-        let mut parameters = vec![
-            SqlValue::Text(actor.into()),
-            SqlValue::Integer(number),
-            SqlValue::Blob(input.id.to_vec()),
-            SqlValue::Blob(binding(&[
-                actor,
-                input.kind.as_str(),
-                input.body,
-                &revision.pull_version.to_string(),
-                &revision.source_oid,
-                &revision.source_version.to_string(),
-                &revision.base_oid,
-                &revision.base_version.to_string(),
-            ])),
-            SqlValue::Text(input.kind.as_str().into()),
-            SqlValue::Integer(revision.pull_version),
-            SqlValue::Blob(
-                parse_oid(&revision.source_oid).ok_or_else(|| invalid("invalid source OID"))?,
-            ),
-            SqlValue::Integer(revision.source_version),
-            SqlValue::Blob(
-                parse_oid(&revision.base_oid).ok_or_else(|| invalid("invalid base OID"))?,
-            ),
-            SqlValue::Integer(revision.base_version),
-        ];
-        // Retry identity precedes current revision eligibility, but never access.
-        // A historical retry can return its review without creating a new decision.
-        let decision = format!(
-            "CASE WHEN NOT ({ACCESS}) OR NOT EXISTS (SELECT 1 FROM pull_requests WHERE number = ?2) THEN 'missing' WHEN EXISTS (SELECT 1 FROM pull_reviews WHERE id = ?3 AND (pull_number != ?2 OR creation_digest != ?4)) THEN 'conflict' WHEN EXISTS (SELECT 1 FROM pull_reviews WHERE id = ?3) THEN 'applied' WHEN ?5 != 'comment' AND (NOT ({WRITE}) OR EXISTS (SELECT 1 FROM pull_requests WHERE number = ?2 AND author = ?1)) THEN 'forbidden' WHEN NOT EXISTS (SELECT 1 FROM {JOINS} WHERE p.number = ?2 AND p.version = ?6 AND p.state = 'open' AND (?5 = 'comment' OR p.draft = 0) AND s.oid = ?7 AND s.version = ?8 AND b.oid = ?9 AND b.version = ?10 AND s.oid != b.oid) THEN 'conflict' ELSE 'applied' END"
-        );
-        let check = SqlStatement {
-            sql: format!("SELECT {decision}"),
-            parameters: parameters.clone(),
-        };
-        parameters.extend([
-            SqlValue::Text(input.body.into()),
-            SqlValue::Integer(identity.issued_at_ms),
-        ]);
-        let review_binding = parameters[3].clone();
-        self.pull_change(identity, vec![check,
-            // Public commenters may have no grant history. Version zero cannot
-            // authorize an approval: only the owner or a current writer qualifies.
-            SqlStatement { sql: format!("INSERT INTO pull_reviews (id, creation_digest, pull_number, reviewer, membership_version, kind, body, pull_version, source_oid, source_version, base_oid, base_version, created_ms) SELECT ?3, ?4, ?2, ?1, CASE WHEN EXISTS (SELECT 1 FROM repository_identity WHERE owner = ?1) THEN 0 ELSE coalesce((SELECT version FROM membership_versions WHERE account = ?1), 0) END, ?5, ?11, ?6, ?7, ?8, ?9, ?10, ?12 WHERE ({decision}) = 'applied' AND NOT EXISTS (SELECT 1 FROM pull_reviews WHERE id = ?3)"), parameters },
-            // Only an inserted or exact-bound decision can advance its reviewer's
-            // head. Historical retries cannot replace a newer decision; comments
-            // never enter this table.
-            SqlStatement { sql: "INSERT INTO pull_review_heads (pull_number, reviewer, review_number) SELECT pull_number, reviewer, number FROM pull_reviews WHERE id = ?1 AND creation_digest = ?2 AND pull_number = ?3 AND kind != 'comment' AND (EXISTS (SELECT 1 FROM repository_identity WHERE owner = ?4) OR EXISTS (SELECT 1 FROM repository_members WHERE account = ?4)) ON CONFLICT(pull_number, reviewer) DO UPDATE SET review_number = excluded.review_number WHERE excluded.review_number > pull_review_heads.review_number".into(), parameters: vec![SqlValue::Blob(input.id.to_vec()), review_binding, SqlValue::Integer(number), SqlValue::Text(actor.into())] },
-            SqlStatement { sql: "SELECT number FROM pull_reviews WHERE id = ?1".into(), parameters: vec![SqlValue::Blob(input.id.to_vec())] },
-        ]).await
+    ) -> Result<Committed<PullChange>, native::NativePullError> {
+        self.native_review_pull(identity, actor, number, input)
+            .await
     }
     pub(super) async fn pull_change(
         &self,
@@ -190,7 +96,7 @@ pub(super) fn binding(fields: &[&str]) -> Vec<u8> {
     }
     hash.finalize().as_bytes().to_vec()
 }
-fn change(sets: &[SqlResultSet]) -> cellule_runtime::Result<PullChange> {
+pub(super) fn change(sets: &[SqlResultSet]) -> cellule_runtime::Result<PullChange> {
     match sets
         .first()
         .and_then(|set| set.rows.first())
@@ -210,3 +116,113 @@ fn change(sets: &[SqlResultSet]) -> cellule_runtime::Result<PullChange> {
         _ => Err(Error::Command("invalid pull mutation result")),
     }
 }
+
+pub(super) fn create_statements(
+    actor: &str,
+    input: NewPull<'_>,
+    now: i64,
+) -> cellule_runtime::Result<Vec<SqlStatement>> {
+    let mut parameters = vec![
+        SqlValue::Text(actor.into()),
+        SqlValue::Blob(input.id.to_vec()),
+        SqlValue::Blob(binding(&[
+            actor,
+            input.title,
+            input.body,
+            if input.draft { "draft" } else { "ready" },
+            input.source_ref,
+            input.source_oid,
+            input.base_ref,
+            input.base_oid,
+        ])),
+        SqlValue::Text(input.source_ref.into()),
+        SqlValue::Blob(
+            parse_oid(input.source_oid).ok_or_else(|| Error::Command("invalid source OID"))?,
+        ),
+        SqlValue::Text(input.base_ref.into()),
+        SqlValue::Blob(
+            parse_oid(input.base_oid).ok_or_else(|| Error::Command("invalid base OID"))?,
+        ),
+    ];
+    let decision = format!(
+        "CASE WHEN NOT ({ACCESS}) THEN 'missing' WHEN EXISTS (SELECT 1 FROM pull_requests WHERE id = ?2 AND creation_digest != ?3) THEN 'conflict' WHEN EXISTS (SELECT 1 FROM pull_requests WHERE id = ?2) THEN 'applied' WHEN NOT EXISTS (SELECT 1 FROM refs WHERE name = ?4 AND oid = ?5) OR NOT EXISTS (SELECT 1 FROM refs WHERE name = ?6 AND oid = ?7) OR ?5 = ?7 THEN 'conflict' ELSE 'applied' END"
+    );
+    let check = SqlStatement {
+        sql: format!("SELECT {decision}"),
+        parameters: parameters.clone(),
+    };
+    parameters.extend([
+        SqlValue::Text(input.title.into()),
+        SqlValue::Text(input.body.into()),
+        SqlValue::Integer(i64::from(input.draft)),
+        SqlValue::Integer(now),
+    ]);
+    Ok(vec![
+        check,
+        SqlStatement {
+            sql: format!(
+                "INSERT INTO pull_requests (id, creation_digest, author, title, body, state, draft, version, source_ref, initial_source_oid, base_ref, initial_base_oid, created_ms, updated_ms) SELECT ?2, ?3, ?1, ?8, ?9, 'open', ?10, 1, ?4, ?5, ?6, ?7, ?11, ?11 WHERE ({decision}) = 'applied' AND NOT EXISTS (SELECT 1 FROM pull_requests WHERE id = ?2)"
+            ),
+            parameters,
+        },
+        SqlStatement {
+            sql: "SELECT number FROM pull_requests WHERE id = ?1".into(),
+            parameters: vec![SqlValue::Blob(input.id.to_vec())],
+        },
+    ])
+}
+
+pub(super) fn review_statements(
+    actor: &str,
+    number: i64,
+    input: NewReview<'_>,
+    now: i64,
+) -> cellule_runtime::Result<Vec<SqlStatement>> {
+    let revision = input.revision;
+    let mut parameters = vec![
+        SqlValue::Text(actor.into()),
+        SqlValue::Integer(number),
+        SqlValue::Blob(input.id.to_vec()),
+        SqlValue::Blob(binding(&[
+            actor,
+            input.kind.as_str(),
+            input.body,
+            &revision.pull_version.to_string(),
+            &revision.source_oid,
+            &revision.source_version.to_string(),
+            &revision.base_oid,
+            &revision.base_version.to_string(),
+        ])),
+        SqlValue::Text(input.kind.as_str().into()),
+        SqlValue::Integer(revision.pull_version),
+        SqlValue::Blob(
+            parse_oid(&revision.source_oid).ok_or_else(|| Error::Command("invalid source OID"))?,
+        ),
+        SqlValue::Integer(revision.source_version),
+        SqlValue::Blob(
+            parse_oid(&revision.base_oid).ok_or_else(|| Error::Command("invalid base OID"))?,
+        ),
+        SqlValue::Integer(revision.base_version),
+    ];
+    // Retry identity precedes current revision eligibility, but never access.
+    // A historical retry can return its review without creating a new decision.
+    let decision = format!(
+        "CASE WHEN NOT ({ACCESS}) OR NOT EXISTS (SELECT 1 FROM pull_requests WHERE number = ?2) THEN 'missing' WHEN EXISTS (SELECT 1 FROM pull_reviews WHERE id = ?3 AND (pull_number != ?2 OR creation_digest != ?4)) THEN 'conflict' WHEN EXISTS (SELECT 1 FROM pull_reviews WHERE id = ?3) THEN 'applied' WHEN ?5 != 'comment' AND (NOT ({WRITE}) OR EXISTS (SELECT 1 FROM pull_requests WHERE number = ?2 AND author = ?1)) THEN 'forbidden' WHEN NOT EXISTS (SELECT 1 FROM {JOINS} WHERE p.number = ?2 AND p.version = ?6 AND p.state = 'open' AND (?5 = 'comment' OR p.draft = 0) AND s.oid = ?7 AND s.version = ?8 AND b.oid = ?9 AND b.version = ?10 AND s.oid != b.oid) THEN 'conflict' ELSE 'applied' END"
+    );
+    let check = SqlStatement {
+        sql: format!("SELECT {decision}"),
+        parameters: parameters.clone(),
+    };
+    parameters.extend([SqlValue::Text(input.body.into()), SqlValue::Integer(now)]);
+    let review_binding = parameters[3].clone();
+    Ok(vec![check,
+            // Public commenters may have no grant history. Version zero cannot
+            // authorize an approval: only the owner or a current writer qualifies.
+            SqlStatement { sql: format!("INSERT INTO pull_reviews (id, creation_digest, pull_number, reviewer, membership_version, kind, body, pull_version, source_oid, source_version, base_oid, base_version, created_ms) SELECT ?3, ?4, ?2, ?1, CASE WHEN EXISTS (SELECT 1 FROM repository_identity WHERE owner = ?1) THEN 0 ELSE coalesce((SELECT version FROM membership_versions WHERE account = ?1), 0) END, ?5, ?11, ?6, ?7, ?8, ?9, ?10, ?12 WHERE ({decision}) = 'applied' AND NOT EXISTS (SELECT 1 FROM pull_reviews WHERE id = ?3)"), parameters },
+            // Only an inserted or exact-bound decision can advance its reviewer's
+            // head. Historical retries cannot replace a newer decision; comments
+            // never enter this table.
+            SqlStatement { sql: "INSERT INTO pull_review_heads (pull_number, reviewer, review_number) SELECT pull_number, reviewer, number FROM pull_reviews WHERE id = ?1 AND creation_digest = ?2 AND pull_number = ?3 AND kind != 'comment' AND (EXISTS (SELECT 1 FROM repository_identity WHERE owner = ?4) OR EXISTS (SELECT 1 FROM repository_members WHERE account = ?4)) ON CONFLICT(pull_number, reviewer) DO UPDATE SET review_number = excluded.review_number WHERE excluded.review_number > pull_review_heads.review_number".into(), parameters: vec![SqlValue::Blob(input.id.to_vec()), review_binding, SqlValue::Integer(number), SqlValue::Text(actor.into())] },
+            SqlStatement { sql: "SELECT number FROM pull_reviews WHERE id = ?1".into(), parameters: vec![SqlValue::Blob(input.id.to_vec())] },
+        ])
+}
diff --git a/crates/canopy-server/src/pulls/native/client.rs b/crates/canopy-server/src/pulls/native/client.rs
new file mode 100644
index 00000000..4ce7e1a5
--- /dev/null
+++ b/crates/canopy-server/src/pulls/native/client.rs
@@ -0,0 +1,130 @@
+use super::*;
+impl RepositoryCell {
+    async fn pull_ref_selection(
+        &self,
+        actor: &str,
+        request: [u8; 32],
+        names: &[String],
+    ) -> Result<
+        (
+            Option<crate::packs::publication::ServingSnapshot>,
+            RefSelection,
+        ),
+        NativePullError,
+    > {
+        let access = self
+            .sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![reads::access(ReadIdentity::Account(actor))],
+                },
+            )
+            .await
+            .map_err(|e| NativePullError::Metadata(Box::new(e)))?;
+        // A known denied caller still reaches the final typed command so its
+        // domain refusal has an original durable receipt. No proof is issued.
+        if !reads::allowed(&access.output)? {
+            return Ok((
+                None,
+                RefSelection {
+                    repository: self.id,
+                    actor: Some(actor.into()),
+                    facts: Vec::new(),
+                    proof: None,
+                },
+            ));
+        }
+        let snapshot = self.serving_snapshot(ReadIdentity::Account(actor)).await?;
+        let selection = snapshot.ref_selection(request, names).await?;
+        Ok((Some(snapshot), selection))
+    }
+
+    pub(in crate::pulls) async fn native_create_pull(
+        &self,
+        identity: MutationIdentity,
+        actor: &str,
+        input: NewPull<'_>,
+    ) -> Result<Committed<PullChange>, NativePullError> {
+        validate_component(actor)?;
+        validate_repository_id(input.id)?;
+        if !valid_new(&input) {
+            return Err(Error::Command("invalid pull creation").into());
+        }
+        let data = CreateData {
+            id: input.id,
+            title: input.title.into(),
+            body: input.body.into(),
+            draft: input.draft,
+            source_ref: input.source_ref.into(),
+            source_oid: input.source_oid.into(),
+            base_ref: input.base_ref.into(),
+            base_oid: input.base_oid.into(),
+        };
+        let mut names = vec![data.source_ref.clone(), data.base_ref.clone()];
+        names.sort();
+        let (_snapshot, selection) = self
+            .pull_ref_selection(actor, data.digest()?, &names)
+            .await?;
+        let result = self
+            .application
+            .command::<CreateNativePull>(&self.target, identity, CreateRequest { selection, data })
+            .await;
+        match result {
+            Ok(v) => Ok(v),
+            Err(InvocationError::Rejected(v)) => Ok(*v),
+            Err(e) => Err(NativePullError::Command(Box::new(e))),
+        }
+    }
+    pub(in crate::pulls) async fn native_review_pull(
+        &self,
+        identity: MutationIdentity,
+        actor: &str,
+        number: i64,
+        input: NewReview<'_>,
+    ) -> Result<Committed<PullChange>, NativePullError> {
+        validate_component(actor)?;
+        validate_repository_id(input.id)?;
+        if number < 1 || !valid_review(&input) {
+            return Err(Error::Command("invalid pull review").into());
+        }
+        let data = ReviewData {
+            number,
+            id: input.id,
+            revision: input.revision.clone(),
+            kind: input.kind,
+            body: input.body.into(),
+        };
+        let selected = self
+            .sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![reads::selector(
+                        ReadIdentity::Account(actor),
+                        &ReadKind::Detail(number),
+                    )],
+                },
+            )
+            .await
+            .map_err(|e| NativePullError::Metadata(Box::new(e)))?;
+        let rows = &selected
+            .output
+            .first()
+            .ok_or(Error::Command("review selection missing"))?
+            .rows;
+        let names = reads::selected_names(rows)?;
+        let (_snapshot, selection) = self
+            .pull_ref_selection(actor, data.digest()?, &names)
+            .await?;
+        let result = self
+            .application
+            .command::<ReviewNativePull>(&self.target, identity, ReviewRequest { selection, data })
+            .await;
+        match result {
+            Ok(v) => Ok(v),
+            Err(InvocationError::Rejected(v)) => Ok(*v),
+            Err(e) => Err(NativePullError::Command(Box::new(e))),
+        }
+    }
+}
diff --git a/crates/canopy-server/src/pulls/native/codec.rs b/crates/canopy-server/src/pulls/native/codec.rs
new file mode 100644
index 00000000..ffbcd708
--- /dev/null
+++ b/crates/canopy-server/src/pulls/native/codec.rs
@@ -0,0 +1,294 @@
+use super::*;
+fn invalid() -> CodecError {
+    CodecError::Invalid("invalid native pull input")
+}
+fn fixed<const N: usize>(d: &mut BoundedDecoder<'_>) -> Result<[u8; N], CodecError> {
+    d.read_bytes()?.try_into().map_err(|_| invalid())
+}
+fn digest(value: &impl WireValue) -> Result<[u8; 32], CodecError> {
+    let mut e = BoundedEncoder::new(INPUT_BYTES)?;
+    value.encode(&mut e)?;
+    Ok(*blake3::hash(&e.finish()).as_bytes())
+}
+impl CreateData {
+    pub(crate) fn digest(&self) -> Result<[u8; 32], CodecError> {
+        digest(self)
+    }
+}
+impl ReviewData {
+    pub(crate) fn digest(&self) -> Result<[u8; 32], CodecError> {
+        digest(self)
+    }
+}
+impl ReadData {
+    pub(crate) fn digest(&self) -> Result<[u8; 32], CodecError> {
+        digest(self)
+    }
+}
+impl WireValue for CreateData {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if validate_repository_id(self.id).is_err()
+            || !valid_new(&self.view())
+            || [self.source_ref.len(), self.base_ref.len()]
+                .into_iter()
+                .any(|n| n > crate::packs::ref_state::MAX_NAME_BYTES)
+        {
+            return Err(invalid());
+        }
+        e.write_u8(51)?;
+        e.write_bytes(&self.id)?;
+        e.write_text(&self.title)?;
+        e.write_text(&self.body)?;
+        e.write_bool(self.draft)?;
+        e.write_text(&self.source_ref)?;
+        e.write_text(&self.source_oid)?;
+        e.write_text(&self.base_ref)?;
+        e.write_text(&self.base_oid)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_u8()? != 51 {
+            return Err(invalid());
+        }
+        let v = Self {
+            id: fixed(d)?,
+            title: d.read_text()?.into(),
+            body: d.read_text()?.into(),
+            draft: d.read_bool()?,
+            source_ref: d.read_text()?.into(),
+            source_oid: d.read_text()?.into(),
+            base_ref: d.read_text()?.into(),
+            base_oid: d.read_text()?.into(),
+        };
+        v.digest()?;
+        Ok(v)
+    }
+}
+impl WireValue for PullRevision {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        e.write_i64(self.pull_version)?;
+        e.write_text(&self.source_oid)?;
+        e.write_i64(self.source_version)?;
+        e.write_text(&self.base_oid)?;
+        e.write_i64(self.base_version)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        Ok(Self {
+            pull_version: d.read_i64()?,
+            source_oid: d.read_text()?.into(),
+            source_version: d.read_i64()?,
+            base_oid: d.read_text()?.into(),
+            base_version: d.read_i64()?,
+        })
+    }
+}
+impl WireValue for ReviewData {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.number < 1
+            || validate_repository_id(self.id).is_err()
+            || !valid_review(&self.view())
+        {
+            return Err(invalid());
+        }
+        e.write_u8(53)?;
+        e.write_i64(self.number)?;
+        e.write_bytes(&self.id)?;
+        self.revision.encode(e)?;
+        e.write_u8(match self.kind {
+            ReviewKind::Comment => 0,
+            ReviewKind::Approve => 1,
+            ReviewKind::RequestChanges => 2,
+        })?;
+        e.write_text(&self.body)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_u8()? != 53 {
+            return Err(invalid());
+        }
+        let number = d.read_i64()?;
+        let id = fixed(d)?;
+        let revision = PullRevision::decode(d)?;
+        let kind = match d.read_u8()? {
+            0 => ReviewKind::Comment,
+            1 => ReviewKind::Approve,
+            2 => ReviewKind::RequestChanges,
+            _ => return Err(invalid()),
+        };
+        let v = Self {
+            number,
+            id,
+            revision,
+            kind,
+            body: d.read_text()?.into(),
+        };
+        v.digest()?;
+        Ok(v)
+    }
+}
+impl WireValue for PullState {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        e.write_u8(match self {
+            Self::Open => 0,
+            Self::Closed => 1,
+            Self::Merged => 2,
+        })
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        match d.read_u8()? {
+            0 => Ok(Self::Open),
+            1 => Ok(Self::Closed),
+            2 => Ok(Self::Merged),
+            _ => Err(invalid()),
+        }
+    }
+}
+impl WireValue for ReadData {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        e.write_u8(52)?;
+        match &self.kind {
+            ReadKind::Page { after, state } => {
+                if *after < 0 {
+                    return Err(invalid());
+                }
+                e.write_u8(0)?;
+                e.write_i64(*after)?;
+                state.encode(e)?;
+            }
+            ReadKind::Detail(number) => {
+                if *number < 1 {
+                    return Err(invalid());
+                }
+                e.write_u8(1)?;
+                e.write_i64(*number)?;
+            }
+            ReadKind::Reviews { number, after } => {
+                if *number < 1 || *after < 0 {
+                    return Err(invalid());
+                }
+                e.write_u8(2)?;
+                e.write_i64(*number)?;
+                e.write_i64(*after)?;
+            }
+        }
+        e.write_bytes(&self.metadata)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_u8()? != 52 {
+            return Err(invalid());
+        }
+        let kind = match d.read_u8()? {
+            0 => ReadKind::Page {
+                after: d.read_i64()?,
+                state: Option::<PullState>::decode(d)?,
+            },
+            1 => ReadKind::Detail(d.read_i64()?),
+            2 => ReadKind::Reviews {
+                number: d.read_i64()?,
+                after: d.read_i64()?,
+            },
+            _ => return Err(invalid()),
+        };
+        let v = Self {
+            kind,
+            metadata: fixed(d)?,
+        };
+        v.digest()?;
+        Ok(v)
+    }
+}
+impl WireValue for CreateRequest {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.selection.actor.is_none() {
+            return Err(invalid());
+        }
+        self.selection.encode(e)?;
+        self.data.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let v = Self {
+            selection: RefSelection::decode(d)?,
+            data: CreateData::decode(d)?,
+        };
+        if v.selection.actor.is_none() {
+            return Err(invalid());
+        }
+        Ok(v)
+    }
+}
+impl WireValue for ReviewRequest {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.selection.actor.is_none() {
+            return Err(invalid());
+        }
+        self.selection.encode(e)?;
+        self.data.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let v = Self {
+            selection: RefSelection::decode(d)?,
+            data: ReviewData::decode(d)?,
+        };
+        if v.selection.actor.is_none() {
+            return Err(invalid());
+        }
+        Ok(v)
+    }
+}
+impl WireValue for ReadRequest {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.selection.encode(e)?;
+        self.data.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        Ok(Self {
+            selection: RefSelection::decode(d)?,
+            data: ReadData::decode(d)?,
+        })
+    }
+}
+impl WireValue for ReadReply {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        match self {
+            Self::Changed => e.write_u8(0),
+            Self::Rows(rows) => {
+                e.write_u8(1)?;
+                rows.encode(e)
+            }
+        }
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        match d.read_u8()? {
+            0 => Ok(Self::Changed),
+            1 => Ok(Self::Rows(Option::<Vec<SqlResultSet>>::decode(d)?)),
+            _ => Err(invalid()),
+        }
+    }
+}
+impl WireValue for PullChange {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        match self {
+            Self::Applied(n) if *n > 0 => {
+                e.write_u8(0)?;
+                e.write_i64(*n)
+            }
+            Self::NotFound => e.write_u8(1),
+            Self::Forbidden => e.write_u8(2),
+            Self::Conflict => e.write_u8(3),
+            _ => Err(invalid()),
+        }
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        match d.read_u8()? {
+            0 => {
+                let n = d.read_i64()?;
+                if n < 1 {
+                    return Err(invalid());
+                }
+                Ok(Self::Applied(n))
+            }
+            1 => Ok(Self::NotFound),
+            2 => Ok(Self::Forbidden),
+            3 => Ok(Self::Conflict),
+            _ => Err(invalid()),
+        }
+    }
+}
diff --git a/crates/canopy-server/src/pulls/native/mod.rs b/crates/canopy-server/src/pulls/native/mod.rs
new file mode 100644
index 00000000..ba75db36
--- /dev/null
+++ b/crates/canopy-server/src/pulls/native/mod.rs
@@ -0,0 +1,215 @@
+//! Native ref facts authorize editorial SQL inside one final typed transaction.
+use super::*;
+use crate::{
+    RepositoryModule,
+    packs::publication::{REF_SELECTION_BYTES, RefSelection},
+};
+use cellule_runtime::codec::{BoundedDecoder, BoundedEncoder, CodecError, WireValue};
+use cellule_runtime::{
+    CellModule, Command, Query,
+    registry::{CommandContext, CommandResult, QueryContext},
+};
+mod codec;
+mod reads;
+pub(crate) use reads::{ReadData, ReadKind, ReadNativePulls, ReadReply, ReadRequest};
+mod client;
+
+pub(crate) const INPUT_BYTES: u32 = REF_SELECTION_BYTES + (256 << 10);
+pub(crate) const OUTPUT_BYTES: u32 = 1 << 20;
+#[derive(Debug, thiserror::Error)]
+pub enum NativePullError {
+    #[error("invalid native pull request")]
+    Invalid(#[from] Error),
+    #[error("native pull codec failed")]
+    Codec(#[from] CodecError),
+    #[error("native pull snapshot unavailable")]
+    Owner(#[from] crate::packs::publication::ServingOwnerError),
+    #[error("native pull ref selection failed")]
+    Serving(#[from] crate::packs::publication::ServingReadError),
+    #[error("native pull metadata selection failed")]
+    Metadata(#[source] Box<Invocation>),
+    #[error("native pull read failed")]
+    Read(#[source] Box<dyn std::error::Error + Send + Sync>),
+    #[error("native pull command failed")]
+    Command(#[source] Box<InvocationError<PullChange>>),
+    #[error("native pull refs or editorial selection changed")]
+    Changed,
+}
+#[derive(Clone, Debug)]
+pub(crate) struct CreateData {
+    pub(crate) id: [u8; 16],
+    pub(crate) title: String,
+    pub(crate) body: String,
+    pub(crate) draft: bool,
+    pub(crate) source_ref: String,
+    pub(crate) source_oid: String,
+    pub(crate) base_ref: String,
+    pub(crate) base_oid: String,
+}
+impl CreateData {
+    pub(crate) fn view(&self) -> NewPull<'_> {
+        NewPull {
+            id: self.id,
+            title: &self.title,
+            body: &self.body,
+            draft: self.draft,
+            source_ref: &self.source_ref,
+            source_oid: &self.source_oid,
+            base_ref: &self.base_ref,
+            base_oid: &self.base_oid,
+        }
+    }
+}
+#[derive(Clone, Debug)]
+pub(crate) struct ReviewData {
+    pub(crate) number: i64,
+    pub(crate) id: [u8; 16],
+    pub(crate) revision: PullRevision,
+    pub(crate) kind: ReviewKind,
+    pub(crate) body: String,
+}
+impl ReviewData {
+    pub(crate) fn view(&self) -> NewReview<'_> {
+        NewReview {
+            id: self.id,
+            revision: &self.revision,
+            kind: self.kind,
+            body: &self.body,
+        }
+    }
+}
+#[derive(Clone, Debug)]
+pub(crate) struct CreateRequest {
+    pub(crate) selection: RefSelection,
+    pub(crate) data: CreateData,
+}
+#[derive(Clone, Debug)]
+pub(crate) struct ReviewRequest {
+    pub(crate) selection: RefSelection,
+    pub(crate) data: ReviewData,
+}
+
+/// Shadow the retired table only within this statement with authenticated facts.
+/// Names/OIDs/versions are bound parameters, never interpolated client SQL.
+fn with_refs(mut statement: SqlStatement, selection: &RefSelection) -> SqlStatement {
+    if !statement.sql.contains("FROM refs ") && !statement.sql.contains("JOIN refs ") {
+        return statement;
+    }
+    let mut values = Vec::with_capacity(selection.facts.len());
+    for fact in &selection.facts {
+        let n = statement.parameters.len() + 1;
+        values.push(format!("(?{n},?{},?{})", n + 1, n + 2));
+        statement.parameters.extend([
+            SqlValue::Text(fact.name.clone()),
+            fact.state
+                .as_ref()
+                .and_then(|s| s.oid)
+                .map_or(SqlValue::Null, |o| SqlValue::Blob(o.to_vec())),
+            SqlValue::Integer(fact.state.as_ref().map_or(0, |s| s.version)),
+        ]);
+    }
+    let refs = if values.is_empty() {
+        "SELECT NULL,NULL,0 WHERE 0".into()
+    } else {
+        format!("VALUES {}", values.join(","))
+    };
+    statement.sql = format!("WITH refs(name,oid,version) AS ({refs}) {}", statement.sql);
+    statement
+}
+fn transaction(
+    context: &mut CommandContext<'_, '_>,
+    selection: &RefSelection,
+    statements: Vec<SqlStatement>,
+) -> cellule_runtime::Result<CommandResult<PullChange>> {
+    let statements = statements
+        .into_iter()
+        .map(|s| with_refs(s, selection))
+        .collect();
+    let change = mutations::change(&context.sql(&SqlBatch { statements })?)?;
+    Ok(match change {
+        PullChange::Applied(_) => CommandResult::Success(change),
+        _ => CommandResult::Rejected(change),
+    })
+}
+fn denial(
+    context: &mut CommandContext<'_, '_>,
+    selection: &RefSelection,
+) -> cellule_runtime::Result<CommandResult<PullChange>> {
+    let actor = selection
+        .actor
+        .as_deref()
+        .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+    let permitted = reads::allowed(&context.sql(&SqlBatch {
+        statements: vec![reads::access(actor)],
+    })?)?;
+    Ok(CommandResult::Rejected(if permitted {
+        PullChange::Conflict
+    } else {
+        PullChange::NotFound
+    }))
+}
+pub(crate) struct CreateNativePull;
+impl Command for CreateNativePull {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 51;
+    const CODEC_VERSION: u32 = 1;
+    type Input = CreateRequest;
+    type Output = PullChange;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        input.encode(&mut BoundedEncoder::new(INPUT_BYTES)?)?;
+        if !input.selection.authorized(
+            context.target().cell_id(),
+            Some(context.owner_fence()),
+            context.now_ms(),
+            input.data.digest()?,
+            |q| context.sql(q),
+        )? {
+            return denial(context, &input.selection);
+        }
+        let actor = input
+            .selection
+            .actor
+            .as_deref()
+            .ok_or(Error::Command("pull author missing"))?;
+        let statements = mutations::create_statements(actor, input.data.view(), context.now_ms())?;
+        transaction(context, &input.selection, statements)
+    }
+}
+pub(crate) struct ReviewNativePull;
+impl Command for ReviewNativePull {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 53;
+    const CODEC_VERSION: u32 = 1;
+    type Input = ReviewRequest;
+    type Output = PullChange;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        input.encode(&mut BoundedEncoder::new(INPUT_BYTES)?)?;
+        if !input.selection.authorized(
+            context.target().cell_id(),
+            Some(context.owner_fence()),
+            context.now_ms(),
+            input.data.digest()?,
+            |q| context.sql(q),
+        )? {
+            return denial(context, &input.selection);
+        }
+        let actor = input
+            .selection
+            .actor
+            .as_deref()
+            .ok_or(Error::Command("reviewer missing"))?;
+        let statements = mutations::review_statements(
+            actor,
+            input.data.number,
+            input.data.view(),
+            context.now_ms(),
+        )?;
+        transaction(context, &input.selection, statements)
+    }
+}
diff --git a/crates/canopy-server/src/pulls/native/reads.rs b/crates/canopy-server/src/pulls/native/reads.rs
new file mode 100644
index 00000000..122aca4b
--- /dev/null
+++ b/crates/canopy-server/src/pulls/native/reads.rs
@@ -0,0 +1,279 @@
+use super::*;
+#[derive(Clone, Debug)]
+pub(crate) enum ReadKind {
+    Page {
+        after: i64,
+        state: Option<PullState>,
+    },
+    Detail(i64),
+    Reviews {
+        number: i64,
+        after: i64,
+    },
+}
+#[derive(Clone, Debug)]
+pub(crate) struct ReadData {
+    pub(crate) kind: ReadKind,
+    pub(crate) metadata: [u8; 32],
+}
+impl ReadData {
+    /// Bind the bounded editorial selection before privately observing its refs.
+    pub(crate) fn selected(
+        kind: ReadKind,
+        rows: &[Vec<SqlValue>],
+    ) -> cellule_runtime::Result<(Self, Vec<String>)> {
+        Ok((
+            Self {
+                kind,
+                metadata: row_binding(rows)?,
+            },
+            selected_names(rows)?,
+        ))
+    }
+}
+#[derive(Clone, Debug)]
+pub(crate) struct ReadRequest {
+    pub(crate) selection: RefSelection,
+    pub(crate) data: ReadData,
+}
+#[derive(Debug)]
+pub(crate) enum ReadReply {
+    Changed,
+    Rows(Option<Vec<SqlResultSet>>),
+}
+
+pub(super) fn selector(actor: ReadIdentity<'_>, kind: &ReadKind) -> SqlStatement {
+    let (filter, mut parameters) = match kind {
+        ReadKind::Page { after, state } => {
+            let mut p = vec![actor.parameter(), SqlValue::Integer(*after)];
+            let extra = if let Some(state) = state {
+                p.push(SqlValue::Text(state.as_str().into()));
+                " AND p.state=?3"
+            } else {
+                ""
+            };
+            (format!("p.number>?2{extra}"), p)
+        }
+        ReadKind::Detail(number) | ReadKind::Reviews { number, .. } => (
+            "p.number=?2".into(),
+            vec![actor.parameter(), SqlValue::Integer(*number)],
+        ),
+    };
+    SqlStatement {
+        sql: format!(
+            "SELECT p.number,p.version,p.source_ref,p.base_ref FROM pull_requests p WHERE {filter} AND ({ACCESS}) ORDER BY p.number LIMIT {PULL_PAGE_SIZE}"
+        ),
+        parameters: std::mem::take(&mut parameters),
+    }
+}
+fn row_binding(rows: &[Vec<SqlValue>]) -> cellule_runtime::Result<[u8; 32]> {
+    if rows.len() > PULL_PAGE_SIZE {
+        return Err(Error::Command("pull selection count"));
+    }
+    let mut h = blake3::Hasher::new();
+    h.update(b"canopy.pull-metadata-selection.v1\0");
+    h.update(&(rows.len() as u64).to_le_bytes());
+    for row in rows {
+        let [
+            SqlValue::Integer(number),
+            SqlValue::Integer(version),
+            SqlValue::Text(source),
+            SqlValue::Text(base),
+        ] = row.as_slice()
+        else {
+            return Err(Error::Command("pull selection shape"));
+        };
+        if *number < 1
+            || *version < 1
+            || !valid_default_branch(source)
+            || !valid_default_branch(base)
+        {
+            return Err(Error::Command("pull selection fields"));
+        }
+        h.update(&number.to_le_bytes());
+        h.update(&version.to_le_bytes());
+        for s in [source, base] {
+            h.update(&(s.len() as u64).to_le_bytes());
+            h.update(s.as_bytes());
+        }
+    }
+    Ok(*h.finalize().as_bytes())
+}
+pub(super) fn selected_names(rows: &[Vec<SqlValue>]) -> cellule_runtime::Result<Vec<String>> {
+    row_binding(rows)?;
+    let names: std::collections::BTreeSet<_> = rows
+        .iter()
+        .flat_map(|r| r[2..4].iter())
+        .map(|v| {
+            if let SqlValue::Text(s) = v {
+                Ok(s.clone())
+            } else {
+                Err(Error::Command("pull ref name"))
+            }
+        })
+        .collect::<cellule_runtime::Result<_>>()?;
+    let names: Vec<_> = names.into_iter().collect();
+    if names.iter().map(String::len).sum::<usize>() > 512 << 10 {
+        return Err(Error::Capacity("pull ref selection bytes"));
+    }
+    Ok(names)
+}
+pub(super) fn access(actor: ReadIdentity<'_>) -> SqlStatement {
+    SqlStatement {
+        sql: format!("SELECT ({ACCESS})"),
+        parameters: vec![actor.parameter()],
+    }
+}
+pub(super) fn allowed(sets: &[SqlResultSet]) -> cellule_runtime::Result<bool> {
+    match sets.first().and_then(|s| s.rows.first()).map(Vec::as_slice) {
+        Some([SqlValue::Integer(0)]) => Ok(false),
+        Some([SqlValue::Integer(1)]) => Ok(true),
+        _ => Err(Error::Command("invalid native pull access")),
+    }
+}
+pub(crate) struct ReadNativePulls;
+impl Query for ReadNativePulls {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 52;
+    const CODEC_VERSION: u32 = 1;
+    type Input = ReadRequest;
+    type Output = ReadReply;
+    fn execute(
+        context: &mut QueryContext<'_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<Self::Output> {
+        input.encode(&mut BoundedEncoder::new(INPUT_BYTES)?)?;
+        let actor = input
+            .selection
+            .actor
+            .as_deref()
+            .map_or(ReadIdentity::Anonymous, ReadIdentity::Account);
+        if !allowed(&context.sql(&SqlBatch {
+            statements: vec![access(actor)],
+        })?)? {
+            return Ok(ReadReply::Rows(None));
+        }
+        if !input.selection.authorized(
+            context.cell_id(),
+            None,
+            context.now_ms(),
+            input.data.digest()?,
+            |q| context.sql(q),
+        )? {
+            return Ok(ReadReply::Changed);
+        }
+        let selected = context.sql(&SqlBatch {
+            statements: vec![selector(actor, &input.data.kind)],
+        })?;
+        let rows = &selected
+            .first()
+            .ok_or(Error::Command("pull selection absent"))?
+            .rows;
+        if row_binding(rows)? != input.data.metadata
+            || selected_names(rows)?
+                != input
+                    .selection
+                    .facts
+                    .iter()
+                    .map(|f| f.name.clone())
+                    .collect::<Vec<_>>()
+        {
+            return Ok(ReadReply::Changed);
+        }
+        let query = match input.data.kind {
+            ReadKind::Page { after, state } => {
+                let mut parameters = vec![actor.parameter(), SqlValue::Integer(after)];
+                let filter = if let Some(state) = state {
+                    parameters.push(SqlValue::Text(state.as_str().into()));
+                    "AND p.state=?3"
+                } else {
+                    ""
+                };
+                SqlStatement {
+                    sql: format!(
+                        "SELECT {COLUMNS} FROM {JOINS} WHERE p.number>?2 {filter} AND ({ACCESS}) ORDER BY p.number LIMIT {PULL_PAGE_SIZE}"
+                    ),
+                    parameters,
+                }
+            }
+            ReadKind::Detail(number) => SqlStatement {
+                sql: format!(
+                    "SELECT {COLUMNS},p.body,p.initial_source_oid,p.initial_base_oid,merged.id,merged.pull_number,merged.oid,merged.merged_ms,merged.pull_version,merged.source_oid,merged.source_version,merged.base_oid,merged.base_version FROM {JOINS} LEFT JOIN pull_merges merged ON merged.pull_number=p.number WHERE p.number=?2 AND ({ACCESS})"
+                ),
+                parameters: vec![actor.parameter(), SqlValue::Integer(number)],
+            },
+            ReadKind::Reviews { number, after } => {
+                if rows.is_empty() {
+                    return Ok(ReadReply::Rows(None));
+                }
+                SqlStatement {
+                    sql: format!(
+                        "SELECT r.number,r.id,r.reviewer,r.kind,r.body,r.pull_version,r.source_oid,r.source_version,r.base_oid,r.base_version,coalesce(({APPLICABLE}),0),r.created_ms FROM pull_reviews r JOIN pull_requests p ON p.number=r.pull_number JOIN refs s ON s.name=p.source_ref JOIN refs b ON b.name=p.base_ref WHERE r.pull_number=?2 AND r.number>?3 AND ({ACCESS}) ORDER BY r.number LIMIT {REVIEW_PAGE_SIZE}"
+                    ),
+                    parameters: vec![
+                        actor.parameter(),
+                        SqlValue::Integer(number),
+                        SqlValue::Integer(after),
+                    ],
+                }
+            }
+        };
+        Ok(ReadReply::Rows(Some(context.sql(&SqlBatch {
+            statements: vec![with_refs(query, &input.selection)],
+        })?)))
+    }
+}
+impl RepositoryCell {
+    pub(in crate::pulls) async fn native_pull_rows(
+        &self,
+        actor: ReadIdentity<'_>,
+        kind: ReadKind,
+    ) -> Result<Observed<Option<Vec<SqlResultSet>>>, NativePullError> {
+        actor.validate()?;
+        for _ in 0..3 {
+            let selected = self
+                .sql
+                .query(
+                    None,
+                    SqlBatch {
+                        statements: vec![access(actor), selector(actor, &kind)],
+                    },
+                )
+                .await
+                .map_err(|e| NativePullError::Metadata(Box::new(e)))?;
+            if !allowed(&selected.output)? {
+                return Ok(Observed {
+                    output: None,
+                    receipt: selected.receipt,
+                });
+            }
+            let rows = &selected
+                .output
+                .get(1)
+                .ok_or(Error::Command("native pull selection absent"))?
+                .rows;
+            let (data, names) = ReadData::selected(kind.clone(), rows)?;
+            let snapshot = self.serving_snapshot(actor).await?;
+            let selection = snapshot.ref_selection(data.digest()?, &names).await?;
+            let result = self
+                .application
+                .query::<ReadNativePulls>(
+                    &self.target,
+                    Some(selected.receipt),
+                    ReadRequest { selection, data },
+                )
+                .await
+                .map_err(|e| NativePullError::Read(Box::new(e)))?;
+            match result.output {
+                ReadReply::Changed => continue,
+                ReadReply::Rows(output) => {
+                    return Ok(Observed {
+                        output,
+                        receipt: result.receipt,
+                    });
+                }
+            }
+        }
+        Err(NativePullError::Changed)
+    }
+}
diff --git a/crates/canopy-server/src/repository_http/pulls.rs b/crates/canopy-server/src/repository_http/pulls.rs
index c2d1ee1e..a1c7b504 100644
--- a/crates/canopy-server/src/repository_http/pulls.rs
+++ b/crates/canopy-server/src/repository_http/pulls.rs
@@ -7,9 +7,7 @@ use crate::{
     },
     server::{RepositoryRoute, mutation_identity},
 };
-use cellule_runtime::{
-    Committed, InvocationError, MutationIdentity, primitives::sql::SqlResultSet,
-};
+use cellule_runtime::{Committed, MutationIdentity};
 use serde::de::DeserializeOwned;
 use std::time::Duration;
 
@@ -338,7 +336,7 @@ pub(super) async fn review(
 }
 fn changed(
     state: &RepositoryHttp,
-    result: Result<Committed<PullChange>, InvocationError<Vec<SqlResultSet>>>,
+    result: Result<Committed<PullChange>, impl std::fmt::Display>,
     created: bool,
 ) -> Response<Body> {
     match result {
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser.rs b/crates/canopy-server/src/server/residency/tests/serving/browser.rs
index 641e7d6b..ff6a2385 100644
--- a/crates/canopy-server/src/server/residency/tests/serving/browser.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser.rs
@@ -1,8 +1,10 @@
 //! Actual HTTP reads against native, physically verified packs. Only the joint
 //! catalog fact and editorial pull records are installed by trusted test SQL;
-//! this does not qualify the still-unconverted live pull/ref producers.
+//! this isolates native reader semantics from generated Git producers. Pull
+//! receiver tests use the registered native commands against these real roots.
 use super::*;
 mod checks;
+mod pulls;
 use crate::packs::{
     catalog::{
         CatalogSnapshot, StoredCatalog,
@@ -305,17 +307,63 @@ async fn production_native_browser_refuses_absent_generations_wrong_formats_and_
 }
 
 async fn editorial_pull(
+    server: &crate::server::RunningServer,
     repository: &RepositoryCell,
     number: i64,
     source: ObjectId,
     base: ObjectId,
 ) -> Result<Value> {
-    // Only editorial metadata remains on legacy refs. The compared bodies and
-    // ancestry must come from the certified catalog, never objects/parents SQL.
+    // Trusted joint-root installation isolates native read semantics. Both refs
+    // and compared bodies come from immutable roots; only editorial rows use SQL.
     let source_ref = format!("refs/heads/source-{number}");
     let base_ref = format!("refs/heads/base-{number}");
+    let store = Arc::new(ArtifactStore::new(
+        server.repositories.external_store.clone(),
+        repository.repository_id(),
+    ));
+    let snapshot = repository
+        .serving_snapshot(ReadIdentity::Account("canopy"))
+        .await?;
+    let fact = snapshot.fact();
+    let mut refs = fact.refs.ok_or("joint refs absent")?.read(&store).await?;
+    let index =
+        crate::packs::ref_state::RefStateIndex::new(store.clone(), repository.object_format());
+    let mut cursor = index.cursor(refs.root.clone(), None, false)?;
+    let mut records = Vec::new();
+    while let Some(record) = cursor.next().await? {
+        records.push(record);
+    }
+    for (name, oid) in [(&source_ref, source), (&base_ref, base)] {
+        records.push(crate::packs::ref_state::RefStateRecord::new(
+            name,
+            crate::refs::RefExpectation {
+                oid: Some(oid),
+                version: 1,
+            },
+            repository.object_format(),
+        )?);
+    }
+    records.sort_by(|a, b| a.name().cmp(b.name()));
+    refs.root =
+        crate::packs::ref_state::RefStateTree::new(store.clone(), repository.object_format())
+            .build_sorted(
+                operation(300 + 2 * number as u64),
+                records.into_iter().map(Ok),
+            )
+            .await?;
+    refs.generation = fact.generation + 1;
+    let root =
+        RefStateSnapshotRoot::upload(&store, operation(301 + 2 * number as u64), refs).await?;
+    drop(snapshot);
+    install(
+        repository,
+        (fact.generation + 1) as i64,
+        fact.catalog.ok_or("joint catalog absent")?,
+        root,
+    )
+    .await?;
+
     repository.sql.batch(crate::server::mutation_identity()?,SqlBatch{statements:vec![
-        SqlStatement{sql:"INSERT INTO refs(name,oid,version) VALUES(?1,?2,1),(?3,?4,1)".into(),parameters:vec![SqlValue::Text(source_ref.clone()),SqlValue::Blob(source.to_vec()),SqlValue::Text(base_ref.clone()),SqlValue::Blob(base.to_vec())]},
         SqlStatement{sql:"INSERT INTO pull_requests(number,id,creation_digest,author,title,body,state,draft,version,source_ref,base_ref,initial_source_oid,initial_base_oid,created_ms,updated_ms) VALUES(?1,?2,?3,'canopy','native comparison','','open',0,1,?4,?5,?6,?7,0,0)".into(),parameters:vec![SqlValue::Integer(number),SqlValue::Blob(uuid::Uuid::new_v4().into_bytes().to_vec()),SqlValue::Blob(vec![42;32]),SqlValue::Text(source_ref),SqlValue::Text(base_ref),SqlValue::Blob(source.to_vec()),SqlValue::Blob(base.to_vec())]},
     ]}).await?;
     Ok(
@@ -332,7 +380,7 @@ async fn production_native_comparisons_read_certified_ancestry_patches_and_previ
             (2, native.main, native.side, native.side),
             (3, native.main, native.main, native.main),
         ] {
-            let target = editorial_pull(&repository, number, source, base).await?;
+            let target = editorial_pull(&server, &repository, number, source, base).await?;
             let response = request(
                 &server,
                 &format!("pulls/{number}/comparison"),
@@ -390,7 +438,7 @@ async fn production_native_comparisons_read_certified_ancestry_patches_and_previ
             .find(|edge| edge.expected_kind == crate::ObjectKind::Blob)
             .ok_or("blob edge")?
             .child;
-        let target = editorial_pull(&repository, 4, blob, blob).await?;
+        let target = editorial_pull(&server, &repository, 4, blob, blob).await?;
         assert_eq!(
             request(
                 &server,
@@ -401,7 +449,8 @@ async fn production_native_comparisons_read_certified_ancestry_patches_and_previ
             .status(),
             reqwest::StatusCode::SERVICE_UNAVAILABLE
         );
-        let target = editorial_pull(&repository, 5, missing(format), missing(format)).await?;
+        let target =
+            editorial_pull(&server, &repository, 5, missing(format), missing(format)).await?;
         assert_eq!(
             request(
                 &server,
@@ -541,7 +590,7 @@ async fn production_certified_edge_pages_cover_wide_trees_and_parent_boundaries(
             })
             .ok_or("last parent")?;
         assert!(ordinal >= 512);
-        let target = editorial_pull(&repository, 1, wide, last.child).await?;
+        let target = editorial_pull(&server, &repository, 1, wide, last.child).await?;
         let response = request(&server,"pulls/1/comparison",json!({"repository_id":uuid::Uuid::from_bytes(entry.repository_id).to_string(),"target":target,"query":{"kind":"files"}})).await?;
         let status = response.status();
         let body = response.text().await?;
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
new file mode 100644
index 00000000..f569d3a4
--- /dev/null
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
@@ -0,0 +1,501 @@
+//! Real resident, immutable ref roots and final typed receiver authorization.
+use super::*;
+use crate::pulls::{
+    NewPull, PullChange, PullEdit, PullRevision, PullState, ReviewKind,
+    native::{
+        CreateData, CreateNativePull, CreateRequest, ReadData, ReadKind, ReadNativePulls,
+        ReadReply, ReadRequest, ReviewData, ReviewNativePull, ReviewRequest,
+    },
+};
+use cellule_runtime::codec::BoundedDecoder;
+use cellule_runtime::{Committed, InvocationError};
+
+fn data(native: &BrowseFixture) -> CreateData {
+    CreateData {
+        id: uuid::Uuid::new_v4().into_bytes(),
+        title: "Native review".into(),
+        body: "Immutable refs".into(),
+        draft: false,
+        source_ref: "refs/heads/main".into(),
+        source_oid: hex::encode(native.main),
+        base_ref: "refs/heads/side".into(),
+        base_oid: hex::encode(native.side),
+    }
+}
+async fn prepare(
+    repository: &RepositoryCell,
+    actor: &str,
+    data: CreateData,
+) -> Result<(crate::packs::publication::ServingSnapshot, CreateRequest)> {
+    let snapshot = repository
+        .serving_snapshot(ReadIdentity::Account(actor))
+        .await?;
+    let mut names = vec![data.source_ref.clone(), data.base_ref.clone()];
+    names.sort();
+    let selection = snapshot.ref_selection(data.digest()?, &names).await?;
+    Ok((snapshot, CreateRequest { selection, data }))
+}
+async fn execute(
+    repository: &RepositoryCell,
+    input: CreateRequest,
+) -> Result<Committed<PullChange>> {
+    match repository
+        .application
+        .command::<CreateNativePull>(
+            &repository.target,
+            crate::server::mutation_identity()?,
+            input,
+        )
+        .await
+    {
+        Ok(value) => Ok(value),
+        Err(InvocationError::Rejected(value)) => Ok(*value),
+        Err(error) => Err(error.into()),
+    }
+}
+async fn count(repository: &RepositoryCell) -> Result<i64> {
+    let result = repository
+        .sql
+        .query(
+            None,
+            SqlBatch {
+                statements: vec![SqlStatement {
+                    sql: "SELECT count(*) FROM pull_requests".into(),
+                    parameters: vec![],
+                }],
+            },
+        )
+        .await?;
+    let Some([SqlValue::Integer(n)]) = result.output[0].rows.first().map(Vec::as_slice) else {
+        return Err("pull count missing".into());
+    };
+    Ok(*n)
+}
+fn damaged<T: WireValue>(proof: &T) -> Result<T> {
+    let mut e = BoundedEncoder::new(1024)?;
+    proof.encode(&mut e)?;
+    let mut bytes = e.finish();
+    *bytes.last_mut().ok_or("proof empty")? ^= 1;
+    let mut d = BoundedDecoder::new(&bytes, 1024)?;
+    let proof = T::decode(&mut d)?;
+    d.finish()?;
+    Ok(proof)
+}
+#[tokio::test]
+async fn native_pull_receivers_bind_request_actor_cell_exact_refs_and_current_generation() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let (snapshot, input) = prepare(&repository, "canopy", data(&native)).await?;
+        assert_eq!(
+            execute(&repository, input.clone()).await?.output,
+            PullChange::Applied(1)
+        );
+        assert_eq!(
+            repository
+                .pull("canopy", 1)
+                .await?
+                .output
+                .ok_or("pull absent")?
+                .summary
+                .source
+                .oid,
+            Some(hex::encode(native.main))
+        );
+        let mut invalid = Vec::new();
+        let mut forged = input.clone();
+        forged.selection.proof = Some(damaged(
+            forged.selection.proof.as_ref().ok_or("proof absent")?,
+        )?);
+        invalid.push(forged);
+        let mut changed_payload = input.clone();
+        changed_payload.data.title.push_str(" substituted");
+        invalid.push(changed_payload);
+        let mut wrong_repo = input.clone();
+        wrong_repo.selection.repository = uuid::Uuid::new_v4().into_bytes();
+        invalid.push(wrong_repo);
+        let mut changed_oid = input.clone();
+        changed_oid.selection.facts[0]
+            .state
+            .as_mut()
+            .ok_or("ref absent")?
+            .oid = Some(native.previous);
+        invalid.push(changed_oid);
+        let mut changed_version = input.clone();
+        changed_version.selection.facts[0]
+            .state
+            .as_mut()
+            .ok_or("ref absent")?
+            .version += 1;
+        invalid.push(changed_version);
+        let mut changed_name = input.clone();
+        changed_name.selection.facts[0].name = "refs/heads/other".into();
+        invalid.push(changed_name);
+        let mut missing_proof = input.clone();
+        missing_proof.selection.proof = None;
+        invalid.push(missing_proof);
+        let mut missing_fact = input.clone();
+        missing_fact.selection.facts.remove(0);
+        invalid.push(missing_fact);
+        repository
+            .grant_member(
+                crate::server::mutation_identity()?,
+                "canopy",
+                "reader",
+                crate::server::TokenScope::Read,
+            )
+            .await?;
+        let mut wrong_actor = input.clone();
+        wrong_actor.selection.actor = Some("reader".into());
+        invalid.push(wrong_actor);
+        for input in invalid {
+            assert_eq!(
+                execute(&repository, input).await?.output,
+                PullChange::Conflict
+            );
+            assert_eq!(count(&repository).await?, 1);
+        }
+        let entry = create(&server.repositories, "foreign-pull", format).await?;
+        let (other, _, _) = loaded(&server.repositories, entry.repository_id).await?;
+        assert_eq!(
+            execute(&other, input.clone()).await?.output,
+            PullChange::Conflict
+        );
+        assert_eq!(count(&other).await?, 0);
+        drop(other);
+        let result = repository
+            .application
+            .query::<ReadNativePulls>(
+                &repository.target,
+                None,
+                ReadRequest {
+                    selection: input.selection.clone(),
+                    data: ReadData {
+                        kind: ReadKind::Detail(1),
+                        metadata: [42; 32],
+                    },
+                },
+            )
+            .await?;
+        assert!(
+            matches!(result.output, ReadReply::Changed),
+            "creation proof cannot authorize another purpose"
+        );
+        // Large valid names increase the admitted request, not certificate size.
+        let mut long = data(&native);
+        long.source_ref = format!("refs/heads/{}", "x".repeat(60_000));
+        let (long_snapshot, long_input) = prepare(&repository, "canopy", long).await?;
+        let mut e = BoundedEncoder::new(1024)?;
+        long_input
+            .selection
+            .proof
+            .as_ref()
+            .ok_or("long proof absent")?
+            .encode(&mut e)?;
+        assert!(e.finish().len() < 1024);
+        assert_eq!(
+            execute(&repository, long_input).await?.output,
+            PullChange::Conflict
+        );
+        drop(long_snapshot);
+        // Same immutable roots under a later joint fact cannot authorize old ref policy.
+        install(&repository, 3, native.catalog, native.refs).await?;
+        assert_eq!(
+            execute(&repository, input.clone()).await?.output,
+            PullChange::Conflict
+        );
+        let original = &input.data;
+        assert_eq!(
+            repository
+                .create_pull(
+                    crate::server::mutation_identity()?,
+                    "canopy",
+                    NewPull {
+                        id: original.id,
+                        title: &original.title,
+                        body: &original.body,
+                        draft: original.draft,
+                        source_ref: &original.source_ref,
+                        source_oid: &original.source_oid,
+                        base_ref: &original.base_ref,
+                        base_oid: &original.base_oid
+                    }
+                )
+                .await?
+                .output,
+            PullChange::Applied(1)
+        );
+        drop(snapshot);
+        timeout(Duration::from_secs(15), async {
+            let pool = repository
+                .serving
+                .lock()
+                .unwrap()
+                .as_ref()
+                .and_then(std::sync::Weak::upgrade)
+                .ok_or("pool absent")?;
+            pool.close_and_drain().await;
+            Result::Ok(())
+        })
+        .await??;
+        assert_eq!(retained(&repository).await?, 0);
+        assert_eq!(
+            execute(&repository, input).await?.output,
+            PullChange::Conflict
+        );
+        drop(repository);
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_pull_receivers_recheck_late_revocation_without_creating_editorial_rows() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        repository
+            .grant_member(
+                crate::server::mutation_identity()?,
+                "canopy",
+                "reader",
+                crate::server::TokenScope::Read,
+            )
+            .await?;
+        let (snapshot, input) = prepare(&repository, "reader", data(&native)).await?;
+        repository
+            .revoke_member(crate::server::mutation_identity()?, "canopy", "reader")
+            .await?;
+        assert_eq!(
+            execute(&repository, input).await?.output,
+            PullChange::NotFound
+        );
+        assert_eq!(count(&repository).await?, 0);
+        assert!(repository.pulls("reader", 0, None).await?.output.is_none());
+        drop(snapshot);
+        drop(repository);
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
+
+async fn read_request(
+    repository: &RepositoryCell,
+    actor: ReadIdentity<'_>,
+) -> Result<(crate::packs::publication::ServingSnapshot, ReadRequest)> {
+    let selected = repository
+        .sql
+        .query(
+            None,
+            SqlBatch {
+                statements: vec![SqlStatement {
+        sql: "SELECT number,version,source_ref,base_ref FROM pull_requests WHERE number=1".into(),
+        parameters: vec![],
+    }],
+            },
+        )
+        .await?;
+    let (data, names) = ReadData::selected(ReadKind::Detail(1), &selected.output[0].rows)?;
+    let snapshot = repository.serving_snapshot(actor).await?;
+    let selection = snapshot.ref_selection(data.digest()?, &names).await?;
+    Ok((snapshot, ReadRequest { selection, data }))
+}
+async fn read(repository: &RepositoryCell, input: ReadRequest) -> Result<ReadReply> {
+    Ok(repository
+        .application
+        .query::<ReadNativePulls>(&repository.target, None, input)
+        .await?
+        .output)
+}
+async fn review(repository: &RepositoryCell, input: ReviewRequest) -> Result<PullChange> {
+    match repository
+        .application
+        .command::<ReviewNativePull>(
+            &repository.target,
+            crate::server::mutation_identity()?,
+            input,
+        )
+        .await
+    {
+        Ok(value) => Ok(value.output),
+        Err(InvocationError::Rejected(value)) => Ok(value.output),
+        Err(error) => Err(error.into()),
+    }
+}
+
+#[tokio::test]
+async fn native_pull_receivers_recheck_editorial_version_and_review_payload_in_final_transaction()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let (creation, input) = prepare(&repository, "canopy", data(&native)).await?;
+        assert_eq!(
+            execute(&repository, input).await?.output,
+            PullChange::Applied(1)
+        );
+        repository
+            .grant_member(
+                crate::server::mutation_identity()?,
+                "canopy",
+                "reviewer",
+                crate::server::TokenScope::Write,
+            )
+            .await?;
+        let (observation, old_read) =
+            read_request(&repository, ReadIdentity::Account("canopy")).await?;
+        assert!(matches!(
+            read(&repository, old_read.clone()).await?,
+            ReadReply::Rows(Some(_))
+        ));
+        let data = ReviewData {
+            number: 1,
+            id: uuid::Uuid::new_v4().into_bytes(),
+            revision: PullRevision {
+                pull_version: 1,
+                source_oid: hex::encode(native.main),
+                source_version: 1,
+                base_oid: hex::encode(native.side),
+                base_version: 1,
+            },
+            kind: ReviewKind::Approve,
+            body: "Approved exact revision".into(),
+        };
+        let reviewer = repository
+            .serving_snapshot(ReadIdentity::Account("reviewer"))
+            .await?;
+        let selection = reviewer
+            .ref_selection(
+                data.digest()?,
+                &["refs/heads/main".into(), "refs/heads/side".into()],
+            )
+            .await?;
+        let old_review = ReviewRequest { selection, data };
+        let mut altered = old_review.clone();
+        altered.data.body.push_str(" substituted");
+        assert_eq!(review(&repository, altered).await?, PullChange::Conflict);
+        assert_eq!(
+            repository
+                .edit_pull(
+                    crate::server::mutation_identity()?,
+                    "canopy",
+                    1,
+                    PullEdit {
+                        expected_version: 1,
+                        title: "Edited after preparation",
+                        body: "",
+                        state: PullState::Open,
+                        draft: false,
+                    }
+                )
+                .await?
+                .output,
+            PullChange::Applied(1)
+        );
+        // Git generation is unchanged. The final query must still detect the
+        // intervening editorial edit; a prepared review cannot approve it.
+        assert!(matches!(
+            read(&repository, old_read).await?,
+            ReadReply::Changed
+        ));
+        assert_eq!(
+            review(&repository, old_review.clone()).await?,
+            PullChange::Conflict
+        );
+        assert!(
+            repository
+                .pull_reviews("canopy", 1, 0)
+                .await?
+                .output
+                .ok_or("reviews absent")?
+                .is_empty()
+        );
+        let (fresh, request) = read_request(&repository, ReadIdentity::Account("canopy")).await?;
+        assert!(matches!(
+            read(&repository, request).await?,
+            ReadReply::Rows(Some(_))
+        ));
+        repository
+            .revoke_member(crate::server::mutation_identity()?, "canopy", "reviewer")
+            .await?;
+        assert_eq!(review(&repository, old_review).await?, PullChange::NotFound);
+        assert!(
+            repository
+                .pull_reviews("canopy", 1, 0)
+                .await?
+                .output
+                .ok_or("reviews absent")?
+                .is_empty()
+        );
+        drop((creation, observation, reviewer, fresh, repository));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_pull_receivers_recheck_anonymous_visibility_after_proof_preparation() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let (creation, input) = prepare(&repository, "canopy", data(&native)).await?;
+        assert_eq!(
+            execute(&repository, input).await?.output,
+            PullChange::Applied(1)
+        );
+        repository
+            .sql
+            .batch(
+                crate::server::mutation_identity()?,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "UPDATE ref_generation SET visibility='public' WHERE singleton=1"
+                            .into(),
+                        parameters: vec![],
+                    }],
+                },
+            )
+            .await?;
+        let (snapshot, request) = read_request(&repository, ReadIdentity::Anonymous).await?;
+        assert!(matches!(
+            read(&repository, request.clone()).await?,
+            ReadReply::Rows(Some(_))
+        ));
+        assert_eq!(
+            repository
+                .pulls(ReadIdentity::Anonymous, 0, None)
+                .await?
+                .output
+                .ok_or("public list absent")?
+                .len(),
+            1
+        );
+        repository
+            .sql
+            .batch(
+                crate::server::mutation_identity()?,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "UPDATE ref_generation SET visibility='private' WHERE singleton=1"
+                            .into(),
+                        parameters: vec![],
+                    }],
+                },
+            )
+            .await?;
+        assert!(matches!(
+            read(&repository, request).await?,
+            ReadReply::Rows(None)
+        ));
+        assert!(
+            repository
+                .pulls(ReadIdentity::Anonymous, 0, None)
+                .await?
+                .output
+                .is_none()
+        );
+        drop((creation, snapshot, repository));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
diff --git a/docs/contracts.md b/docs/contracts.md
index f9dfbe57..00504559 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -1821,8 +1821,9 @@ backfill path for old object certificates lacking parent rows.
 author, editorial content, open/closed state, draft flag, optimistic version,
 fixed source/base branch names, initial commit OIDs and timestamps. Pull and issue
 numbers have separate sequences. A pull does not store a mutable copy of current
-branch state: reads join the two durable `refs` rows in the same Cell observation.
-This avoids fanout writes to every open pull after a push. Retained ref tombstones
+branch state: reads join privately authenticated facts from the current immutable
+ref snapshot with editorial rows in one final Cell observation. This avoids
+fanout writes to every open pull after a push. Retained ref tombstones
 expose deleted tips as null without losing their versions. Original commit OIDs
 remain available in details. Pulls may share the same source/base pair.
 
@@ -1867,9 +1868,9 @@ results continue to use their configured context versions, as documented above.
 A fresh development prefix is required; old memberships have no generation
 backfill. A future migration must initialize those before enabling these APIs.
 
-All three mutations are bounded guarded SQL batches through the registered Cell
-SQL command. Their recorded pre-mutation domain decision, conditional write and
-result number share the same transaction. Runtime receipt replay preserves the
+Creation and review use typed commands 51 and 53; editorial edits use the existing
+registered Cell SQL command. Their recorded pre-mutation domain decision,
+conditional write and result number share the same transaction. Runtime receipt replay preserves the
 original outcome. Application UUID bindings provide HTTP retry semantics across
 fresh command identities. Failed domain decisions leave pull/review content
 unchanged. The SDK accepts an authenticated actor assertion; HTTP authenticates
@@ -1877,6 +1878,38 @@ before reading the body and the Cell rechecks membership/authority at mutation.
 As with issues, already admitted token revocation follows the existing admission
 boundary; repository revocation is checked again in the write.
 
+Native ref observations reuse the MAC envelope, serving token and joint catalog/ref
+fact. Issuance derives exact OIDs, versions, tombstones and never-present names
+from the immutable ref tree inside the tracked physical read owner. Its
+constant-sized certificate binds repository, actor, actual Cell, request purpose
+and payload digest, and the complete sorted fact vector digest. Receivers verify
+the repository seed/MAC, fresh access, exact unexpired serving pin, admitted command
+owner fence and equality with the **current** joint generation before using facts.
+A retained historical generation alone cannot authorize current ref policy.
+Altered payloads or facts, another Cell, later joint publication and physical pin
+release invalidate the observation. Ref lookup requires no native pack bodies.
+
+Facts shadow `refs` only in a parameterized statement-local CTE. No SQL ref mirror
+is populated; the fresh production schema removes the obsolete source/base foreign
+keys into that table. Existing editorial rows, UUID digests, member versions and
+review-head ordering remain authoritative for collaboration. Inputs admit at most
+128 unique sorted refs, 512 KiB of total name bytes and 65,535 bytes per name, within
+an 816 KiB operation input bound. Mutation results admit 16 bytes. Unknown names
+and deleted tombstones remain distinct authenticated facts; neither supplies a
+live tip for a new pull or review.
+
+Query 52 reads lists, details and review applicability with a 1 MiB output bound.
+The initial bounded selection binds pull numbers, editorial versions and ref names.
+The final query repeats that selection and rejects a mismatch before joining the
+certified refs. The adapter makes at most three attempts with fresh selections;
+continued movement returns an explicit error, never a partial or skewed page.
+Each final transaction rechecks current access, including anonymous public access
+and public-to-private changes after preparation. Known denied mutations still
+reach the final command without a proof; its fresh access decision records
+NotFound while access remains denied, or Conflict if it has changed. Pending or
+transport failures remain errors. Merge-policy and generated Git producers still
+need their native ref conversion and are not qualified by these pull operations.
+
 Six HTTP operations live under `/api/repositories/<name>/pulls`: GET/POST the
 collection, GET/PUT `/<number>`, GET/POST `/<number>/reviews`. Every mutation
 carries the repository UUID, checked against the resolved Cell. Create/review
diff --git a/docs/evidence/native-pulls-ci-20261005.json b/docs/evidence/native-pulls-ci-20261005.json
new file mode 100644
index 00000000..ebaa33ca
--- /dev/null
+++ b/docs/evidence/native-pulls-ci-20261005.json
@@ -0,0 +1,632 @@
+{
+  "recorded_at_utc": "2026-10-05T17:24:03.277163+00:00",
+  "base_head": "4eb4fd0b6594ec71d6e7f7cec36ce63705556c2b",
+  "host": "macOS, Rust 1.98.0; final Linux qualification remains required",
+  "source_files": 510,
+  "rust_files": 492,
+  "source_hash_digest": "98f83b2614325e981544abf21949ed9e96c779c7aeff702178a2dbbf44f2b477",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256; source manifest /tmp/canopy-native-pulls-final-source.json",
+  "source_unchanged_during_validation": true,
+  "release_qualified": false,
+  "reproduction": {
+    "exit_code": 101,
+    "path": "/tmp/canopy-native-pulls-baseline.log",
+    "sha256": "297188583bce3eb5af8275037e18bc1cd05f9f764b39865a7fda8eaea83509c7",
+    "summaries": [
+      "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 2.62s"
+    ],
+    "baseline_head": "4eb4fd0b6594ec71d6e7f7cec36ce63705556c2b",
+    "baseline_source_hash_digest": "57004d2198c0001dfed9c02c60d4e979f1905a2e887607b48f3d52d7f28138d0",
+    "result": "Original compiled HTTP pull family returns 409 after real native push because creation checks the retired SQL ref table."
+  },
+  "intermediate_attempts": [
+    {
+      "result": "Compile failure from helper visibility, missing codec conversion and boxed recorded rejection handling; not a runtime reproduction.",
+      "path": "/tmp/canopy-native-pulls-check1.log",
+      "sha256": "b7421e5c4c4c0f716d907147001279eec49b6a6ba589b54a927a0e2697628338",
+      "summaries": []
+    },
+    {
+      "result": "HTTP family reaches delayed revocation and returns 503 instead of 404. Known denied adapters now route to a final typed command with no proof, retaining its original durable NotFound receipt.",
+      "path": "/tmp/canopy-native-pulls-e2e1.log",
+      "sha256": "cbc3dee324e06e247af9758b3dc1ab9618a12562f8c3a559299118ca69b1da23",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 5.09s"
+      ]
+    },
+    {
+      "result": "HTTP family passes before the final added receiver tests/fixture correction. Not counted as final frozen-source workspace evidence.",
+      "path": "/tmp/canopy-native-pulls-e2e2.log",
+      "sha256": "1153f24598518106b10a36cb11bbcf9a61bec2ff133ef906185c6113ef971bad",
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 114 filtered out; finished in 11.19s"
+      ]
+    },
+    {
+      "provenance": "Recorded from tool output for the first broader browser invocation; its raw log path was reused by the final validator. This is a result transcription, not a full original log.",
+      "command": [
+        "cargo",
+        "+1.98.0",
+        "test",
+        "-p",
+        "canopy-server",
+        "--lib",
+        "server::residency::tests::serving::browser::",
+        "--locked",
+        "--",
+        "--nocapture"
+      ],
+      "exit_code": 101,
+      "summary": "test result: FAILED. 9 passed; 2 failed; 0 ignored; 0 measured; 711 filtered out; finished in 9.56s",
+      "failed_cases": [
+        "server::residency::tests::serving::browser::production_certified_edge_pages_cover_wide_trees_and_parent_boundaries",
+        "server::residency::tests::serving::browser::production_native_comparisons_read_certified_ancestry_patches_and_previews"
+      ],
+      "error": "Root(Codec(Invalid(\"invalid preparation context\")))",
+      "cause": "Trusted native ref fixture used UUID artifact operation identifiers instead of the validated CANOPY01 sequence. Fixed fixture identifiers; no production validation relaxed."
+    }
+  ],
+  "pre_box_validation": {
+    "source_hash_digest": "8fe11937310c76559e3a1277fd0ec7a7ace7d77ee9e6f20c552cd50bf844fb47",
+    "manifest": "/tmp/canopy-native-pulls-source.json",
+    "validation": {
+      "source_digest": "8fe11937310c76559e3a1277fd0ec7a7ace7d77ee9e6f20c552cd50bf844fb47",
+      "phases": [
+        {
+          "name": "browser",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "test",
+            "-p",
+            "canopy-server",
+            "--lib",
+            "server::residency::tests::serving::browser::",
+            "--locked",
+            "--",
+            "--nocapture"
+          ],
+          "exit_code": 0,
+          "seconds": 123.52,
+          "log": "/tmp/canopy-native-pulls-browser-final.log",
+          "log_sha256": "400d67ee0a7ab13ad203e6c799b04dc2450622a242aaa2533eb45ea569e4452b",
+          "summaries": [
+            "test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 711 filtered out; finished in 14.51s"
+          ],
+          "failed_cases": []
+        },
+        {
+          "name": "workspace",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "test",
+            "--workspace",
+            "--locked",
+            "--no-fail-fast"
+          ],
+          "exit_code": 101,
+          "seconds": 794.45,
+          "log": "/tmp/canopy-native-pulls-workspace-final.log",
+          "log_sha256": "f97e5520e5c33f850d139607dabd27e4182f6060cdb2ab855a7245efc35712c7",
+          "summaries": [
+            "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.00s",
+            "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.57s",
+            "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 721 filtered out; finished in 0.01s",
+            "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 721 filtered out; finished in 0.10s",
+            "test result: ok. 722 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 343.77s",
+            "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+            "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.95s",
+            "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.10s",
+            "test result: FAILED. 82 passed; 24 failed; 9 ignored; 0 measured; 0 filtered out; finished in 360.36s",
+            "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.26s",
+            "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.31s",
+            "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.46s",
+            "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+            "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+            "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+          ],
+          "failed_cases": [
+            "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+            "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+            "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+            "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+            "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+            "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+            "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+            "leased_server_recovers_two_repositories_with_git_and_lfs",
+            "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+            "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+            "merge::merge_rechecks_revisions_authority_and_competing_publications",
+            "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+            "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+            "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+            "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+            "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+            "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+            "sha256::sha256_checks_reviews_and_merge_survive_restore",
+            "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+            "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+            "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+            "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+            "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+            "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+            "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+            "repository_cell_publishes_objects_and_refs_atomically",
+            "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+          ]
+        },
+        {
+          "name": "clippy",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "clippy",
+            "--workspace",
+            "--all-targets",
+            "--locked",
+            "--",
+            "-D",
+            "warnings"
+          ],
+          "exit_code": 101,
+          "seconds": 42.68,
+          "log": "/tmp/canopy-native-pulls-clippy-final.log",
+          "log_sha256": "94eb8f2d2b926cedfceba1ffecccba9aba1df671751b9380848080257347835f",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "build",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "build",
+            "--locked",
+            "--bin",
+            "canopy"
+          ],
+          "exit_code": 0,
+          "seconds": 64.68,
+          "log": "/tmp/canopy-native-pulls-build-final.log",
+          "log_sha256": "0900ec22ab155c16e1caea5a43d4c5f9d9cd5d0898632803a9736b4a4740f671",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "fmt",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "fmt",
+            "--all",
+            "--",
+            "--check"
+          ],
+          "exit_code": 0,
+          "seconds": 1.59,
+          "log": "/tmp/canopy-native-pulls-fmt-final.log",
+          "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "harness",
+          "command": [
+            "python3",
+            "-B",
+            "-m",
+            "unittest",
+            "discover",
+            "-s",
+            "scripts",
+            "-p",
+            "test_*.py"
+          ],
+          "exit_code": 0,
+          "seconds": 42.44,
+          "log": "/tmp/canopy-native-pulls-harness-final.log",
+          "log_sha256": "1134e53160dd26d782712c1313bdad2f19d8bd6dca4b21c7ffefdfba7a14d860",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "diff",
+          "command": [
+            "git",
+            "diff",
+            "--check"
+          ],
+          "exit_code": 0,
+          "seconds": 0.06,
+          "log": "/tmp/canopy-native-pulls-diff-final.log",
+          "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "summaries": [],
+          "failed_cases": []
+        }
+      ],
+      "complete": true,
+      "release_qualified": false,
+      "source_unchanged": true
+    },
+    "result": "All 722 server libraries pass, matrix 82/24/9, three standalone failures. Clippy rejects the oversized new git_read::ReadError variant; fixed by boxing only its NativePullError source. This earlier source is not final-source qualification."
+  },
+  "validation": {
+    "source_digest": "98f83b2614325e981544abf21949ed9e96c779c7aeff702178a2dbbf44f2b477",
+    "phases": [
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 48.79,
+        "log": "/tmp/canopy-native-pulls-final-clippy-final.log",
+        "log_sha256": "8b679661943726b3f0b75740583640f6585e5b3c5cb37d46c271ee6ab612069e",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 847.12,
+        "log": "/tmp/canopy-native-pulls-final-workspace-final.log",
+        "log_sha256": "70cc1cecd6868272abd9dbfa4157daade7d96dcd8fd0f713f8226eeb26b3ed22",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.19s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.07s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 721 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 721 filtered out; finished in 0.09s",
+          "test result: ok. 722 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 324.15s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.35s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+          "test result: FAILED. 81 passed; 25 failed; 9 ignored; 0 measured; 0 filtered out; finished in 350.74s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.31s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.19s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.25s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "lifecycle::startup_rejects_ignored_conditional_writes_before_enrollment",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 42.04,
+        "log": "/tmp/canopy-native-pulls-final-build-final.log",
+        "log_sha256": "fd2a411ad01d8c18877f2e7bec595dca45a4521e5cf1a7dfcaca2ef57e71649e",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.24,
+        "log": "/tmp/canopy-native-pulls-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 42.19,
+        "log": "/tmp/canopy-native-pulls-final-harness-final.log",
+        "log_sha256": "c463ce564853df7c65609655034b8c355aa09c4f6a1e50301d8fe13d3c55941f",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.04,
+        "log": "/tmp/canopy-native-pulls-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 722,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 81,
+      "failed": 25,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 841,
+    "failed": 28,
+    "ignored": 9,
+    "executed": 869,
+    "total": 878
+  },
+  "counting": "Last summary in each Cargo Running section; nested child summaries and focused reruns excluded. Ordinary ignored cases remain unexecuted.",
+  "parent_linux_ci": [
+    {
+      "head": "4eb4fd0b6594ec71d6e7f7cec36ce63705556c2b",
+      "run": 37338375281,
+      "job": 111858847192,
+      "conclusion": "failure",
+      "log": "/tmp/canopy-native-pulls-parent-pr-full.log",
+      "sha256": "f29b90ef2d9e9cf8071195e82f98b0090796be1044708df25d3ff85cf3bbd417",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.43s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.85s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 717 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 717 filtered out; finished in 0.03s",
+        "test result: ok. 718 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 470.27s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.83s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: FAILED. 78 passed; 32 failed; 9 ignored; 0 measured; 0 filtered out; finished in 551.42s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    },
+    {
+      "head": "4eb4fd0b6594ec71d6e7f7cec36ce63705556c2b",
+      "run": 37338371454,
+      "job": 111858834134,
+      "conclusion": "failure",
+      "log": "/tmp/canopy-native-pulls-parent-push-full.log",
+      "sha256": "c889611ad759c14c703da2d0706cf0879eeb138d9029cc51eecd069385d45218",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.43s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.91s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 717 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 717 filtered out; finished in 0.01s",
+        "test result: ok. 718 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 453.72s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.75s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: FAILED. 77 passed; 33 failed; 9 ignored; 0 measured; 0 filtered out; finished in 540.63s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::comparison_matches_git_and_preserves_exact_views_across_recovery",
+        "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::comparison_merge_bases_match_git_for_wide_unrelated_and_crisscross_histories",
+        "comparison::patches::patches_apply_with_stock_git_and_reject_excess_work_without_truncation",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "bulk_refs::bulk_mirror_publication_is_atomic_and_survives_restart",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "pulls::pull_reviews_follow_exact_revisions_and_membership_across_recovery",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    }
+  ],
+  "changes": [
+    "Core pull creation/review and list/detail/applicability consume privately issued exact native ref facts in final typed transactions.",
+    "Reuses editorial rows, UUID bindings, membership versions, review heads, immutable ref state, MAC envelope, serving token and joint fact; no SQL ref mirror.",
+    "Current-generation and live-pin proof checks bind request purpose/payload/facts, actor, actual Cell and command owner, with fresh ACL.",
+    "Bounded editorial selection is rechecked before final reads; at most three fresh attempts prevent skew.",
+    "Fresh production DDL removes obsolete ref foreign keys; trusted reader fixtures install native roots using validated artifact operation identifiers.",
+    "Build fingerprint now includes native pull/ref and previously omitted native check/membership files."
+  ],
+  "limits": {
+    "facts": 128,
+    "total_name_bytes": 524288,
+    "single_name_bytes": 65535,
+    "input_bytes": 835584,
+    "query_output_bytes": 1048576,
+    "command_output_bytes": 16,
+    "read_attempts": 3
+  },
+  "remaining": "Merge-policy/current-thread ref consumers, default-branch joint mutation, generated merge/rebase/candidate producers, Linux rejected-push workload and pre-Bind terminal refusal, real peers/residency and source-independent backup, reachable-only cold/filtered fetch, standalone real residents, physical custody/owner adoption/startup/retention/final DDL and full Linux/K8s/Chromium + 10k-engineer capacity qualification.",
+  "additional_final_failure": {
+    "case": "lifecycle::startup_rejects_ignored_conditional_writes_before_enrollment",
+    "error": "Os { code: 48, kind: AddrInUse, message: \"Address already in use\" }",
+    "qualification": "Passed in pre-box full run; failed in final full run. The port allocation/rebind test needs actual port/descriptor ownership diagnosis. No assertion, cleanup requirement or concurrency limit was weakened."
+  }
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 0355bc3e..d803302d 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,60 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Native pull/ref metadata conversion (2026-10-05 checkpoint)
+
+Pull creation still selected the retired SQL `refs` table after native push,
+reproducibly returning HTTP 409. Pull list/detail/review applicability joined the
+same retired authority, and the fresh schema required obsolete foreign keys into
+it. Core pull operations now derive bounded exact facts from the immutable native
+ref tree under the actual resident serving snapshot. Typed commands 51/53 and
+query 52 consume a purpose-specific private certificate that reuses the MAC
+envelope, serving token and joint fact. The final transaction independently checks
+actual Cell/command owner, current access, the exact unexpired pin, payload/fact
+digests and equality with the current joint generation. Historical retained
+generations alone cannot authorize moving ref policy.
+
+Editorial rows, UUID bindings, membership versions and review-head ordering are
+reused. Authenticated facts form a parameterized statement-local CTE; no SQL ref
+mirror is written. The fresh schema removes only the obsolete pull source/base
+ref foreign keys. Lists/details/reviews bind and recheck the initial bounded
+editorial row selection before joining refs, with at most three fresh attempts.
+Inputs admit 128 sorted facts and 512 KiB total ref-name bytes within an 816 KiB
+wire limit; query output is capped at 1 MiB and mutation output at 16 bytes. The
+certificate remains constant-sized even with long names. Ref issuance reads
+metadata without hydrating native pack bodies.
+
+The stock-Git HTTP pull/review/recovery family passes, including UUID retries,
+ref/editorial ABA, membership changes and delayed repository revocation. Four new
+actual-resident receiver families exercise both object formats: proof/payload,
+actor/Cell/ref substitution; pin drain and current-generation advance; late
+revocation; prepared editorial-version/review conflicts; and anonymous
+public-to-private visibility. A broader fixture run caught invalid UUID artifact
+operation IDs in the trusted native ref fixture; it now uses validated CANOPY01
+operations without relaxing production validation. Clippy also caught the larger
+Git read error variant; its native-pull error source is now boxed.
+
+Final frozen-source validation passes all 722 server library cases, all-target
+Clippy with warnings denied, server build, formatting/diff checks and all 96
+Python harness cases. The five repaired HTTP pull/comparison/patch integrations
+pass in the full workload. Multi-server finishes at 81 passed / 25 failed /
+9 ignored; the three standalone aggregates also fail. Unique workspace totals
+are 841 passed / 28 failed / 9 unexecuted ignores. One additional startup test
+returns `AddrInUse`; port ownership/rebind causality remains unresolved. The
+pre-box run had 842/27/9 but failed Clippy and does not supersede final-source
+results. Fingerprints, both full runs and intermediate failures are recorded in
+[native pull evidence](evidence/native-pulls-ci-20261005.json). New-head Linux
+qualification remains required; this is not a green-CI or release claim.
+
+Parent `4eb4fd0` Linux PR Verify passes all 718 server library cases and fails
+multi-server at 78 passed / 32 failed / 9 ignored. Its push run passes the same
+libraries and fails at 77/33/9, with an additional bulk mirror failure. These
+parent results do not qualify this new source. Merge-policy readers, line-thread
+current-revision checks, generated merge/rebase/candidate writers, default-branch
+mutation, peer residency, source-independent backup and reachable-only filtered
+fetch remain open. Complete physical custody/recovery/final DDL and full
+large-history/team capacity gates are still required. The full goal remains active.
+
 ## Serving rollover and expiry observation (2026-10-05 checkpoint)
 
 Initial authenticated Cell selection used to consume the pool's two-second idle

From 6fc9483570423b9674e9f4e3d5f70d151b47b668 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 11:10:41 -0700
Subject: [PATCH 38/55] fix: read native review policy and join failed startup

---
 crates/canopy-server/src/pulls/merge/mod.rs   |  51 +-
 .../canopy-server/src/pulls/native/codec.rs   |   8 +
 .../canopy-server/src/pulls/native/reads.rs   |   8 +-
 crates/canopy-server/src/server/lifecycle.rs  |  35 +-
 .../src/server/lifecycle/tests.rs             |  49 ++
 .../residency/tests/serving/browser/pulls.rs  | 329 +++++++++-
 .../tests/multi_server/lifecycle/mod.rs       |  13 +-
 docs/contracts.md                             |  21 +-
 .../native-policy-startup-ci-20261005.json    | 560 ++++++++++++++++++
 .../large-repository-implementation-status.md |  50 ++
 10 files changed, 1080 insertions(+), 44 deletions(-)
 create mode 100644 docs/evidence/native-policy-startup-ci-20261005.json

diff --git a/crates/canopy-server/src/pulls/merge/mod.rs b/crates/canopy-server/src/pulls/merge/mod.rs
index 6e28a4df..842d8158 100644
--- a/crates/canopy-server/src/pulls/merge/mod.rs
+++ b/crates/canopy-server/src/pulls/merge/mod.rs
@@ -117,27 +117,36 @@ pub(crate) fn valid_request(request: &MergeRequest) -> bool {
 }
 
 impl RepositoryCell {
-    /// Reads current review requirements and eligible decisions in one Cell observation.
+    /// Reads current review requirements against authenticated native ref facts.
     pub async fn pull_review_policy<'a>(
         &self,
         actor: impl Into<ReadIdentity<'a>>,
         number: i64,
-    ) -> Result<Observed<Option<ReviewPolicy>>, Invocation> {
-        let actor = actor.into();
-        actor.validate().map_err(Invocation::NotStarted)?;
+    ) -> Result<Observed<Option<ReviewPolicy>>, super::native::NativePullError> {
+        let result = self.pull_review_state(actor.into(), number).await?;
+        Ok(Observed {
+            output: result.output.map(|state| state.policy),
+            receipt: result.receipt,
+        })
+    }
+    async fn pull_review_state(
+        &self,
+        actor: ReadIdentity<'_>,
+        number: i64,
+    ) -> Result<Observed<Option<ReviewState>>, super::native::NativePullError> {
+        if number < 1 {
+            return Err(Error::Command("invalid pull number").into());
+        }
         let result = self
-            .sql
-            .query(
-                None,
-                SqlBatch {
-                    statements: vec![policy_statement(actor, number)],
-                },
-            )
+            .native_pull_rows(actor, super::native::ReadKind::ReviewPolicy(number))
             .await?;
         Ok(Observed {
-            output: policy_state(&result.output)
-                .map_err(Invocation::NotStarted)?
-                .map(|state| state.policy),
+            output: result
+                .output
+                .as_deref()
+                .map(policy_state)
+                .transpose()?
+                .flatten(),
             receipt: result.receipt,
         })
     }
@@ -157,17 +166,11 @@ impl RepositoryCell {
                 "invalid merge request",
             )));
         }
-        let observed = self
-            .sql
-            .query(
-                None,
-                SqlBatch {
-                    statements: vec![policy_statement(actor, number)],
-                },
-            )
+        let state = self
+            .pull_review_state(ReadIdentity::Account(actor), number)
             .await
-            .map_err(preparation)?;
-        let state = policy_state(&observed.output).map_err(InvocationError::NotStarted)?;
+            .map_err(preparation)?
+            .output;
         if state.is_some_and(|state| {
             state.writable
                 && state.policy.ready
diff --git a/crates/canopy-server/src/pulls/native/codec.rs b/crates/canopy-server/src/pulls/native/codec.rs
index ffbcd708..deb66584 100644
--- a/crates/canopy-server/src/pulls/native/codec.rs
+++ b/crates/canopy-server/src/pulls/native/codec.rs
@@ -160,6 +160,13 @@ impl WireValue for ReadData {
                 e.write_u8(1)?;
                 e.write_i64(*number)?;
             }
+            ReadKind::ReviewPolicy(number) => {
+                if *number < 1 {
+                    return Err(invalid());
+                }
+                e.write_u8(3)?;
+                e.write_i64(*number)?;
+            }
             ReadKind::Reviews { number, after } => {
                 if *number < 1 || *after < 0 {
                     return Err(invalid());
@@ -181,6 +188,7 @@ impl WireValue for ReadData {
                 state: Option::<PullState>::decode(d)?,
             },
             1 => ReadKind::Detail(d.read_i64()?),
+            3 => ReadKind::ReviewPolicy(d.read_i64()?),
             2 => ReadKind::Reviews {
                 number: d.read_i64()?,
                 after: d.read_i64()?,
diff --git a/crates/canopy-server/src/pulls/native/reads.rs b/crates/canopy-server/src/pulls/native/reads.rs
index 122aca4b..2366fded 100644
--- a/crates/canopy-server/src/pulls/native/reads.rs
+++ b/crates/canopy-server/src/pulls/native/reads.rs
@@ -6,6 +6,7 @@ pub(crate) enum ReadKind {
         state: Option<PullState>,
     },
     Detail(i64),
+    ReviewPolicy(i64),
     Reviews {
         number: i64,
         after: i64,
@@ -54,7 +55,9 @@ pub(super) fn selector(actor: ReadIdentity<'_>, kind: &ReadKind) -> SqlStatement
             };
             (format!("p.number>?2{extra}"), p)
         }
-        ReadKind::Detail(number) | ReadKind::Reviews { number, .. } => (
+        ReadKind::Detail(number)
+        | ReadKind::ReviewPolicy(number)
+        | ReadKind::Reviews { number, .. } => (
             "p.number=?2".into(),
             vec![actor.parameter(), SqlValue::Integer(*number)],
         ),
@@ -135,7 +138,7 @@ pub(crate) struct ReadNativePulls;
 impl Query for ReadNativePulls {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 52;
-    const CODEC_VERSION: u32 = 1;
+    const CODEC_VERSION: u32 = 2;
     type Input = ReadRequest;
     type Output = ReadReply;
     fn execute(
@@ -202,6 +205,7 @@ impl Query for ReadNativePulls {
                 ),
                 parameters: vec![actor.parameter(), SqlValue::Integer(number)],
             },
+            ReadKind::ReviewPolicy(number) => super::super::merge::policy_statement(actor, number),
             ReadKind::Reviews { number, after } => {
                 if rows.is_empty() {
                     return Ok(ReadReply::Rows(None));
diff --git a/crates/canopy-server/src/server/lifecycle.rs b/crates/canopy-server/src/server/lifecycle.rs
index 24275ca3..f9c1b90c 100644
--- a/crates/canopy-server/src/server/lifecycle.rs
+++ b/crates/canopy-server/src/server/lifecycle.rs
@@ -1,5 +1,30 @@
 use super::*;
 
+type ReadyAddresses = (std::net::SocketAddr, Option<std::net::SocketAddr>);
+type StartupSupervisor = JoinHandle<Result<(), ServerError>>;
+
+async fn receive_startup(
+    receive_ready: oneshot::Receiver<Result<ReadyAddresses, ServerError>>,
+    finished: StartupSupervisor,
+) -> Result<(ReadyAddresses, StartupSupervisor), ServerError> {
+    let addresses = match receive_ready.await {
+        Ok(Ok(addresses)) => addresses,
+        Ok(Err(error)) => {
+            // The readiness channel may wake its caller before the supervisor
+            // drops task-owned startup resources. An error is a cleanup barrier.
+            finished.await??;
+            return Err(error);
+        }
+        Err(_) => {
+            finished.await??;
+            return Err(ServerError::Repository(
+                "node supervisor ended before readiness",
+            ));
+        }
+    };
+    Ok((addresses, finished))
+}
+
 impl CanopyServer {
     /// Starts a node only after storage fencing, authority and Git ingress are ready.
     /// Cancelling startup requests cleanup after admitted initialization settles.
@@ -54,15 +79,7 @@ impl CanopyServer {
             }
             result
         });
-        let (address, ssh_address) = match receive_ready.await {
-            Ok(address) => address?,
-            Err(_) => {
-                finished.await??;
-                return Err(ServerError::Repository(
-                    "node supervisor ended before readiness",
-                ));
-            }
-        };
+        let ((address, ssh_address), finished) = receive_startup(receive_ready, finished).await?;
         Ok(Self {
             address,
             ssh_address,
diff --git a/crates/canopy-server/src/server/lifecycle/tests.rs b/crates/canopy-server/src/server/lifecycle/tests.rs
index 2873276d..579406a2 100644
--- a/crates/canopy-server/src/server/lifecycle/tests.rs
+++ b/crates/canopy-server/src/server/lifecycle/tests.rs
@@ -2,6 +2,55 @@ use super::*;
 use crate::native_resources::{NativeClass, NativeLimits, NativeWork};
 use object_store::memory::InMemory;
 
+#[tokio::test(flavor = "multi_thread")]
+async fn failed_startup_waits_for_supervisor_completion_and_owned_listener_release()
+-> Result<(), Box<dyn std::error::Error>> {
+    let listener = listeners::ReservedListener::new(TcpListener::bind("127.0.0.1:0").await?)?;
+    let address = listener.local_addr()?;
+    let (ready, receive_ready) = oneshot::channel();
+    let (entered, receive_entered) = oneshot::channel();
+    let (release, receive_release) = oneshot::channel();
+    let (drained, receive_drained) = oneshot::channel();
+    let finished = tokio::spawn(async move {
+        // The actual supervisor can publish its error before its task-owned
+        // resources finish dropping. Hold a real reserved listener here.
+        let _ = ready.send(Err(ServerError::Repository("injected startup failure")));
+        let _ = entered.send(());
+        let _ = receive_release.await;
+        drop(listener);
+        let _ = drained.send(());
+        Ok(())
+    });
+    let mut startup = tokio::spawn(receive_startup(receive_ready, finished));
+    tokio::time::timeout(Duration::from_secs(5), receive_entered).await??;
+    let early = tokio::time::timeout(Duration::from_millis(50), &mut startup)
+        .await
+        .ok();
+    let returned_before_drain = early.is_some();
+    assert!(
+        TcpListener::bind(address)
+            .await
+            .is_err_and(|e| e.kind() == std::io::ErrorKind::AddrInUse)
+    );
+    let _ = release.send(());
+    tokio::time::timeout(Duration::from_secs(5), receive_drained).await??;
+    let result = match early {
+        Some(result) => result?,
+        None => tokio::time::timeout(Duration::from_secs(5), startup).await??,
+    };
+    assert!(matches!(
+        result,
+        Err(ServerError::Repository("injected startup failure"))
+    ));
+    assert!(
+        !returned_before_drain,
+        "startup error returned while supervisor still owned the listener"
+    );
+    let rebound = TcpListener::bind(address).await?;
+    assert_eq!(rebound.local_addr()?, address);
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn native_drain_retains_cell_workspace_and_lease_past_one_lease()
 -> Result<(), Box<dyn std::error::Error>> {
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
index f569d3a4..3273c5eb 100644
--- a/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
@@ -1,7 +1,7 @@
 //! Real resident, immutable ref roots and final typed receiver authorization.
 use super::*;
 use crate::pulls::{
-    NewPull, PullChange, PullEdit, PullRevision, PullState, ReviewKind,
+    NewPull, NewReview, PullChange, PullEdit, PullRevision, PullState, ReviewKind,
     native::{
         CreateData, CreateNativePull, CreateRequest, ReadData, ReadKind, ReadNativePulls,
         ReadReply, ReadRequest, ReviewData, ReviewNativePull, ReviewRequest,
@@ -282,6 +282,13 @@ async fn native_pull_receivers_recheck_late_revocation_without_creating_editoria
 async fn read_request(
     repository: &RepositoryCell,
     actor: ReadIdentity<'_>,
+) -> Result<(crate::packs::publication::ServingSnapshot, ReadRequest)> {
+    read_kind_request(repository, actor, ReadKind::Detail(1)).await
+}
+async fn read_kind_request(
+    repository: &RepositoryCell,
+    actor: ReadIdentity<'_>,
+    kind: ReadKind,
 ) -> Result<(crate::packs::publication::ServingSnapshot, ReadRequest)> {
     let selected = repository
         .sql
@@ -295,7 +302,7 @@ async fn read_request(
             },
         )
         .await?;
-    let (data, names) = ReadData::selected(ReadKind::Detail(1), &selected.output[0].rows)?;
+    let (data, names) = ReadData::selected(kind, &selected.output[0].rows)?;
     let snapshot = repository.serving_snapshot(actor).await?;
     let selection = snapshot.ref_selection(data.digest()?, &names).await?;
     Ok((snapshot, ReadRequest { selection, data }))
@@ -307,6 +314,18 @@ async fn read(repository: &RepositoryCell, input: ReadRequest) -> Result<ReadRep
         .await?
         .output)
 }
+async fn prepared_policy(
+    repository: &RepositoryCell,
+    request: &ReadRequest,
+) -> Result<Vec<SqlValue>> {
+    let ReadReply::Rows(Some(mut sets)) = read(repository, request.clone()).await? else {
+        return Err("prepared native policy unavailable".into());
+    };
+    if sets.len() != 1 || sets[0].rows.len() != 1 {
+        return Err("prepared native policy row count".into());
+    }
+    Ok(sets.remove(0).rows.remove(0))
+}
 async fn review(repository: &RepositoryCell, input: ReviewRequest) -> Result<PullChange> {
     match repository
         .application
@@ -499,3 +518,309 @@ async fn native_pull_receivers_recheck_anonymous_visibility_after_proof_preparat
     }
     Ok(())
 }
+
+async fn replace_main_ref(
+    server: &crate::server::RunningServer,
+    repository: &RepositoryCell,
+    oid: Option<ObjectId>,
+    expected: crate::refs::RefExpectation,
+) -> Result {
+    let store = Arc::new(ArtifactStore::new(
+        server.repositories.external_store.clone(),
+        repository.repository_id(),
+    ));
+    let snapshot = repository
+        .serving_snapshot(ReadIdentity::Account("canopy"))
+        .await?;
+    let fact = snapshot.fact();
+    let mut refs = fact.refs.ok_or("refs absent")?.read(&store).await?;
+    let index =
+        crate::packs::ref_state::RefStateIndex::new(store.clone(), repository.object_format());
+    let transition = index
+        .prepare(
+            refs.root.clone(),
+            operation(500 + 2 * fact.generation),
+            &crate::PushPlan {
+                actor: "canopy".into(),
+                updates: vec![crate::RefUpdate {
+                    name: "refs/heads/main".into(),
+                    expected: Some(expected),
+                    new_oid: oid,
+                }],
+            },
+        )
+        .await?;
+    refs.root = Some(transition.root());
+    refs.generation = fact.generation + 1;
+    let root =
+        RefStateSnapshotRoot::upload(&store, operation(501 + 2 * fact.generation), refs).await?;
+    drop(snapshot);
+    // Trusted immutable-root fixture; this qualifies the reader, not a merge writer.
+    install(
+        repository,
+        (fact.generation + 1) as i64,
+        fact.catalog.ok_or("catalog absent")?,
+        root,
+    )
+    .await
+}
+
+#[tokio::test]
+async fn native_review_policy_observes_current_rules_reviews_membership_and_ref_aba() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let (creation, input) = prepare(&repository, "canopy", data(&native)).await?;
+        assert_eq!(
+            execute(&repository, input).await?.output,
+            PullChange::Applied(1)
+        );
+        let initial = repository
+            .pull_review_policy("canopy", 1)
+            .await?
+            .output
+            .ok_or("native review policy missing")?;
+        assert!(initial.ready && initial.reviews_satisfied);
+        assert_eq!(initial.required_approvals, 0);
+        let revision = initial.revision.ok_or("revision absent")?;
+        assert_eq!(revision.source_oid, hex::encode(native.main));
+        assert_eq!(revision.base_oid, hex::encode(native.side));
+        let (policy_snapshot, policy_request) = read_kind_request(
+            &repository,
+            ReadIdentity::Account("canopy"),
+            ReadKind::ReviewPolicy(1),
+        )
+        .await?;
+        let mut different_purpose = policy_request.clone();
+        different_purpose.data.kind = ReadKind::Detail(1);
+        assert!(matches!(
+            read(&repository, different_purpose).await?,
+            ReadReply::Changed
+        ));
+        let mut different_number = policy_request.clone();
+        different_number.data.kind = ReadKind::ReviewPolicy(2);
+        assert!(matches!(
+            read(&repository, different_number).await?,
+            ReadReply::Changed
+        ));
+        repository
+            .set_branch_rule(
+                crate::server::mutation_identity()?,
+                "canopy",
+                crate::branch_rules::BranchRuleEdit {
+                    reference: "refs/heads/side".into(),
+                    expected_version: 0,
+                    enabled: true,
+                    deny_deletions: false,
+                    fast_forward_only: false,
+                    required_checks: vec![],
+                    require_pull_request: true,
+                    required_approvals: 2,
+                },
+            )
+            .await?;
+        let mut old = None;
+        for reviewer in ["one", "two"] {
+            repository
+                .grant_member(
+                    crate::server::mutation_identity()?,
+                    "canopy",
+                    reviewer,
+                    crate::server::TokenScope::Write,
+                )
+                .await?;
+            let id = uuid::Uuid::new_v4().into_bytes();
+            let value = repository
+                .review_pull(
+                    crate::server::mutation_identity()?,
+                    reviewer,
+                    1,
+                    NewReview {
+                        id,
+                        revision: &revision,
+                        kind: ReviewKind::Approve,
+                        body: "Reviewed exact refs",
+                    },
+                )
+                .await?;
+            assert!(matches!(value.output, PullChange::Applied(_)));
+            if reviewer == "two" {
+                old = Some(id);
+            }
+        }
+        let current = repository
+            .pull_review_policy("canopy", 1)
+            .await?
+            .output
+            .ok_or("policy absent")?;
+        assert_eq!(
+            (
+                current.rule_version,
+                current.required_approvals,
+                current.approvals
+            ),
+            (1, 2, 2)
+        );
+        assert!(current.reviews_satisfied);
+        // Prepared before the rule and reviews existed: final policy is fresh
+        // SQL, while the exact native refs and editorial selection stay bound.
+        let prepared = prepared_policy(&repository, &policy_request).await?;
+        assert_eq!(
+            &prepared[9..14],
+            &[
+                SqlValue::Integer(1),
+                SqlValue::Integer(1),
+                SqlValue::Integer(2),
+                SqlValue::Integer(2),
+                SqlValue::Integer(0),
+            ]
+        );
+        let (reviewer_snapshot, reviewer_request) = read_kind_request(
+            &repository,
+            ReadIdentity::Account("two"),
+            ReadKind::ReviewPolicy(1),
+        )
+        .await?;
+        repository
+            .revoke_member(crate::server::mutation_identity()?, "canopy", "two")
+            .await?;
+        assert!(matches!(
+            read(&repository, reviewer_request).await?,
+            ReadReply::Rows(None)
+        ));
+        repository
+            .grant_member(
+                crate::server::mutation_identity()?,
+                "canopy",
+                "two",
+                crate::server::TokenScope::Write,
+            )
+            .await?;
+        let retry = repository
+            .review_pull(
+                crate::server::mutation_identity()?,
+                "two",
+                1,
+                NewReview {
+                    id: old.ok_or("old review absent")?,
+                    revision: &revision,
+                    kind: ReviewKind::Approve,
+                    body: "Reviewed exact refs",
+                },
+            )
+            .await?;
+        assert!(matches!(retry.output, PullChange::Applied(_)));
+        let current = repository
+            .pull_review_policy("canopy", 1)
+            .await?
+            .output
+            .ok_or("policy absent")?;
+        assert_eq!(current.approvals, 1);
+        assert!(!current.reviews_satisfied);
+        assert_eq!(
+            prepared_policy(&repository, &policy_request).await?[12],
+            SqlValue::Integer(1)
+        );
+        repository
+            .review_pull(
+                crate::server::mutation_identity()?,
+                "two",
+                1,
+                NewReview {
+                    id: uuid::Uuid::new_v4().into_bytes(),
+                    revision: &revision,
+                    kind: ReviewKind::Approve,
+                    body: "Fresh grant",
+                },
+            )
+            .await?;
+        assert_eq!(
+            repository
+                .pull_review_policy("canopy", 1)
+                .await?
+                .output
+                .ok_or("policy absent")?
+                .approvals,
+            2
+        );
+        for (kind, approvals, changes) in [
+            (ReviewKind::RequestChanges, 1, 1),
+            (ReviewKind::Comment, 1, 1),
+            (ReviewKind::Approve, 2, 0),
+        ] {
+            repository
+                .review_pull(
+                    crate::server::mutation_identity()?,
+                    "two",
+                    1,
+                    NewReview {
+                        id: uuid::Uuid::new_v4().into_bytes(),
+                        revision: &revision,
+                        kind,
+                        body: "Current decision",
+                    },
+                )
+                .await?;
+            let current = prepared_policy(&repository, &policy_request).await?;
+            assert_eq!(
+                &current[12..14],
+                &[SqlValue::Integer(approvals), SqlValue::Integer(changes)]
+            );
+            let public = repository
+                .pull_review_policy("canopy", 1)
+                .await?
+                .output
+                .ok_or("policy absent")?;
+            assert_eq!(public.reviews_satisfied, kind == ReviewKind::Approve);
+        }
+        replace_main_ref(
+            &server,
+            &repository,
+            None,
+            crate::refs::RefExpectation {
+                oid: Some(native.main),
+                version: 1,
+            },
+        )
+        .await?;
+        let deleted = repository
+            .pull_review_policy("canopy", 1)
+            .await?
+            .output
+            .ok_or("deleted policy absent")?;
+        assert!(!deleted.ready && deleted.revision.is_none());
+        assert_eq!(deleted.approvals, 0);
+        assert!(matches!(
+            read(&repository, policy_request).await?,
+            ReadReply::Changed
+        ));
+        replace_main_ref(
+            &server,
+            &repository,
+            Some(native.main),
+            crate::refs::RefExpectation {
+                oid: None,
+                version: 2,
+            },
+        )
+        .await?;
+        let recreated = repository
+            .pull_review_policy("canopy", 1)
+            .await?
+            .output
+            .ok_or("recreated policy absent")?;
+        assert!(recreated.ready);
+        assert_eq!(
+            recreated
+                .revision
+                .ok_or("recreated revision absent")?
+                .source_version,
+            3
+        );
+        assert_eq!(recreated.approvals, 0);
+        assert!(!recreated.reviews_satisfied);
+        drop((creation, policy_snapshot, reviewer_snapshot, repository));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/tests/multi_server/lifecycle/mod.rs b/crates/canopy-server/tests/multi_server/lifecycle/mod.rs
index 815ef14e..75d9a4f6 100644
--- a/crates/canopy-server/tests/multi_server/lifecycle/mod.rs
+++ b/crates/canopy-server/tests/multi_server/lifecycle/mod.rs
@@ -634,11 +634,19 @@ async fn startup_rejects_ignored_conditional_writes_before_enrollment() -> Resul
         let files = tempfile::TempDir::new()?;
         let listener = TcpListener::bind("127.0.0.1:0").await?;
         let address = listener.local_addr()?;
+        let mut caller_listener = Some(listener);
         let settings = config(address, files.path().join("server"));
         let result = if prebound {
-            CanopyServer::start_with_listener(settings, store.clone(), listener).await
+            CanopyServer::start_with_listener(
+                settings,
+                store.clone(),
+                caller_listener.take().unwrap(),
+            )
+            .await
         } else {
-            drop(listener);
+            // This failure precedes listener creation. Keep the caller's
+            // reservation through the probe and verify startup refuses bad
+            // storage even while its requested address is occupied.
             CanopyServer::start(settings, store.clone()).await
         };
         assert!(matches!(
@@ -649,6 +657,7 @@ async fn startup_rejects_ignored_conditional_writes_before_enrollment() -> Resul
         ));
         let remaining = store.list_with_delimiter(None).await?;
         assert!(remaining.objects.is_empty() && remaining.common_prefixes.is_empty());
+        drop(caller_listener);
         let rebound = TcpListener::bind(address).await?;
         assert_eq!(rebound.local_addr()?, address);
     }
diff --git a/docs/contracts.md b/docs/contracts.md
index 00504559..9d289fcb 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -1142,8 +1142,10 @@ acknowledged state is recovered from object storage. Normal shutdown may leave
 local files for the next startup to reclaim.
 
 One supervisor owns node startup, the listener, Cell drain and the workspace.
-`CanopyServer::start` waits for its readiness result; cancelling that wait closes
-the control channel and requests drain after admitted initialization settles.
+`CanopyServer::start` waits for its readiness result. A reported startup error
+also joins the supervisor before returning, so completion includes release of
+its task-owned startup resources. Successful readiness retains the running
+supervisor in the handle. Cancelling either wait closes the control channel and requests drain after admitted initialization settles.
 Dropping a returned handle also requests drain. `shutdown()` waits for completion,
 but cancelling the wait leaves that same supervisor running. The Tokio runtime
 must stay alive for cleanup to finish. This does not make runtime destruction,
@@ -1898,7 +1900,9 @@ an 816 KiB operation input bound. Mutation results admit 16 bytes. Unknown names
 and deleted tombstones remain distinct authenticated facts; neither supplies a
 live tip for a new pull or review.
 
-Query 52 reads lists, details and review applicability with a 1 MiB output bound.
+Query 52, codec 2, reads lists, details, review applicability and review policy
+with a 1 MiB output bound. Policy is a distinct request purpose: a prepared policy
+observation cannot authorize a detail query or another pull number.
 The initial bounded selection binds pull numbers, editorial versions and ref names.
 The final query repeats that selection and rejects a mismatch before joining the
 certified refs. The adapter makes at most three attempts with fresh selections;
@@ -1907,8 +1911,15 @@ Each final transaction rechecks current access, including anonymous public acces
 and public-to-private changes after preparation. Known denied mutations still
 reach the final command without a proof; its fresh access decision records
 NotFound while access remains denied, or Conflict if it has changed. Pending or
-transport failures remain errors. Merge-policy and generated Git producers still
-need their native ref conversion and are not qualified by these pull operations.
+transport failures remain errors. Review-policy reads join the authenticated
+native tips with current rules, review heads and member generations in the final
+query. Changes to rules or decisions after preparation are reflected immediately;
+ref/editorial changes invalidate the prepared observation. Tombstones remove the
+reviewed revision; recreating the same OID with a later ref version cannot restore
+old approvals. Merge ancestry preparation uses this same native policy reader.
+The final merge command and generated Git producers still need native atomic
+publication and are not qualified by these read operations. Codec 2 is a hard
+cutover of this unreleased query; no old input decoder is retained.
 
 Six HTTP operations live under `/api/repositories/<name>/pulls`: GET/POST the
 collection, GET/PUT `/<number>`, GET/POST `/<number>/reviews`. Every mutation
diff --git a/docs/evidence/native-policy-startup-ci-20261005.json b/docs/evidence/native-policy-startup-ci-20261005.json
new file mode 100644
index 00000000..332617a9
--- /dev/null
+++ b/docs/evidence/native-policy-startup-ci-20261005.json
@@ -0,0 +1,560 @@
+{
+  "recorded_at_utc": "2026-10-05T18:10:26.030001+00:00",
+  "base_head": "ef765d449ab09488af1712d72dc39aa1894dc555",
+  "host": "macOS, Rust 1.98.0; exact-head Linux qualification remains required",
+  "source_files": 510,
+  "rust_files": 492,
+  "source_hash_digest": "08ef5b30a9be622dc4ebccc592cd66d7cbf20a72e6912aeddb364e2f8ddcbd39",
+  "source_manifest": "/tmp/canopy-native-policy-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "release_qualified": false,
+  "reproductions": [
+    {
+      "result": "Shared public startup completion seam returns error before the actual supervisor releases its held reserved listener. Regression fails before join fix.",
+      "source_manifest": "/tmp/canopy-native-policy-startup-baseline-source.json",
+      "source_digest": "c519e829fcb5e781cc75b8a91cf0eaa78407a0ae8b361e7b214fa24df72656eb",
+      "path": "/tmp/canopy-native-policy-startup-baseline.log",
+      "sha256": "9ab02b5dd3436c2cddebb9770be2b613a2be14618d99bbb79e1030f2b644eabf",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 722 filtered out; finished in 0.03s"
+      ]
+    },
+    {
+      "result": "Actual resident review-policy returns None because it joins retired SQL refs after a native fixture creates a pull. Fails before reader conversion.",
+      "source_manifest": "/tmp/canopy-native-policy-reader-baseline-source.json",
+      "source_digest": "1a5ed060f279f159e023eb4c7516a55a7d64665335cccecd0572c32f04c27d61",
+      "path": "/tmp/canopy-native-policy-reader-baseline.log",
+      "sha256": "6561575e8b5ee1f75fae6db68e546390090eedabbeea8352c917f77467066177",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.72s"
+      ]
+    },
+    {
+      "result": "Previously compiled ef765d4 stock-Git HTTP merge family fails at its initial review-policy GET with 404. This binary reproduction is not validation of uncommitted source at execution.",
+      "compiled_source_manifest": "/tmp/canopy-native-pulls-final-source.json",
+      "path": "/tmp/canopy-native-policy-http-baseline.log",
+      "sha256": "5c38801db6586a3508862cfcb66e3fe3df4cd703551b3c398f612df10dfbfed7",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 2.28s"
+      ]
+    }
+  ],
+  "intermediate_attempts": [
+    {
+      "result": "Initial reader conversion passes the first native-policy regression before expanded prepared-query checks. Not final-source qualification.",
+      "path": "/tmp/canopy-native-policy-reader-fixed.log",
+      "sha256": "a2c7854608136eb8f84605c2c09c5dd01bf07df43c762586a28c3c66a5432512",
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 2.42s"
+      ]
+    },
+    {
+      "result": "Expanded regression incorrectly expected a comment to clear a prior request-changes decision. Production behavior matches documented non-comment review-head semantics; correct expected changes=1. Our partial workspace compiler was terminated before source correction; no foreign process stopped.",
+      "validation": {
+        "source_digest": "83c4f50c16d5927ed457fc9e35c9953b3ecf11002e5825c76331637ee50271c8",
+        "phases": [
+          {
+            "name": "clippy",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "clippy",
+              "--workspace",
+              "--all-targets",
+              "--locked",
+              "--",
+              "-D",
+              "warnings"
+            ],
+            "exit_code": 0,
+            "seconds": 33.31,
+            "log": "/tmp/canopy-native-policy-first-clippy-final.log",
+            "log_sha256": "af9d5539cad7c82e3d2d31390d2bea14957b4492dd3feed01db68eff5d74f1ca",
+            "summaries": [],
+            "failed_cases": []
+          },
+          {
+            "name": "policy",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "test",
+              "-p",
+              "canopy-server",
+              "--lib",
+              "native_review_policy_observes_current_rules_reviews_membership_and_ref_aba",
+              "--locked",
+              "--",
+              "--nocapture"
+            ],
+            "exit_code": 101,
+            "seconds": 77.39,
+            "log": "/tmp/canopy-native-policy-first-policy-first.log",
+            "log_sha256": "3bd733eac119f91dbc72a46ce05ec8646da157aec7d7a57b3157b318af312b14",
+            "summaries": [
+              "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.86s"
+            ],
+            "failed_cases": [
+              "server::residency::tests::serving::browser::pulls::native_review_policy_observes_current_rules_reviews_membership_and_ref_aba"
+            ]
+          },
+          {
+            "name": "startup",
+            "command": [
+              "cargo",
+              "+1.98.0",
+              "test",
+              "-p",
+              "canopy-server",
+              "--lib",
+              "failed_startup_waits_for_supervisor_completion_and_owned_listener_release",
+              "--locked",
+              "--",
+              "--nocapture"
+            ],
+            "exit_code": 0,
+            "seconds": 0.74,
+            "log": "/tmp/canopy-native-policy-first-startup-final.log",
+            "log_sha256": "26612f455fbaa6f0f78a049bf091b2227fb7c5dc9ccf49ab6f4eb7eb84fd2d8d",
+            "summaries": [
+              "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.05s"
+            ],
+            "failed_cases": []
+          }
+        ],
+        "complete": false,
+        "release_qualified": false,
+        "interrupted": true,
+        "interruption_record": "/tmp/canopy-native-policy-first-interruption.json"
+      },
+      "source_manifest": "/tmp/canopy-native-policy-first-source.json",
+      "interruption": {
+        "reason": "Stop our validation after regression exposes incorrect comment expectation; preserve all completed phases and partial workspace log before correcting test.",
+        "processes": {
+          "57223": [
+            30109,
+            "/opt/homebrew/Cellar/python@3.14/3.14.6/Frameworks/Python.framework/Versions/3.14/Resources/Python.app/Contents/MacOS/Python -u /tmp/canopy_native_policy_validate.py"
+          ],
+          "57958": [
+            57223,
+            "/Users/haipingfu/.rustup/toolchains/1.98.0-aarch64-apple-darwin/bin/cargo test --workspace --locked --no-fail-fast"
+          ],
+          "58144": [
+            57958,
+            "/Users/haipingfu/.rustup/toolchains/1.98.0-aarch64-apple-darwin/bin/rustc --crate-name multi_server --edition=2024 crates/canopy-server/tests/multi_server/main.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --emit=dep-info,link -C embed-bitcode=no -C debuginfo=2 -C split-debuginfo=unpacked --test --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=181874f3bf65c835 -C extra-filename=-3e08ee00a07d7bde --out-dir /Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps -L dependency=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps --extern async_trait=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libasync_trait-264adbdf16f2d6bb.dylib --extern axum=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libaxum-64e276c868a1333d.rlib --extern base64=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libbase64-b543fed2f0293468.rlib --extern blake3=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libblake3-ccf2879731550d36.rlib --extern bytes=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libbytes-258f462c5e906be1.rlib --extern canopy_git_format=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libcanopy_git_format-47331bdc9c9e8b2d.rlib --extern canopy_object_storage=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libcanopy_object_storage-b50a50d07ced2114.rlib --extern canopy_server=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libcanopy_server-737729dd7418b4df.rlib --extern cellule_app=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libcellule_app-37270f04fe254f2c.rlib --extern cellule_host=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libcellule_host-d934a2c86b6ded1f.rlib --extern cellule_ltx=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libcellule_ltx-c03e13c2108bfd42.rlib --extern cellule_runtime=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libcellule_runtime-0cbcd9ec23d93de9.rlib --extern cellule_store=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libcellule_store-ff151c59722e759d.rlib --extern ed25519_dalek=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libed25519_dalek-8cb1fbe14113f307.rlib --extern flate2=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libflate2-4c659b2504bcde03.rlib --extern futures_core=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libfutures_core-eb34df332aa694e8.rlib --extern futures_util=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libfutures_util-e0a1ab9539c3c127.rlib --extern hex=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libhex-d8b113cf0abdd414.rlib --extern http_body=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libhttp_body-15944d5a62cbd2dd.rlib --extern libc=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/liblibc-1bdbc5d94638008d.rlib --extern object_store=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libobject_store-24b6fc0ca49d1c41.rlib --extern percent_encoding=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libpercent_encoding-76226f1a5c7d4040.rlib --extern rcgen=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/librcgen-e34af303a837c49c.rlib --extern reqwest=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libreqwest-1843dd4e2c5ea820.rlib --extern rusqlite=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/librusqlite-1255a978c6680481.rlib --extern russh=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/librussh-284e98d7a0ec41b7.rlib --extern serde=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libserde-718e4da2dae12fe2.rlib --extern serde_json=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libserde_json-29d6a1871be8ccb4.rlib --extern sha1=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libsha1-a587e3b4251863cb.rlib --extern sha2=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libsha2-7c643b52fee5e057.rlib --extern ssh_key=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libssh_key-3cb8b3f90f07f4cc.rlib --extern tempfile=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libtempfile-2a7959d794f25bf9.rlib --extern thiserror=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libthiserror-d2acbff21d4177b1.rlib --extern tokio=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libtokio-4b19c8c8af5c60af.rlib --extern tokio_rustls=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libtokio_rustls-51d53d321968bcee.rlib --extern tokio_util=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libtokio_util-5cfdd31275f97490.rlib --extern tower=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libtower-c8013d21ed30a066.rlib --extern tracing=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libtracing-a9cf8244c3c83909.rlib --extern tracing_appender=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libtracing_appender-164fcb77ccb03877.rlib --extern tracing_subscriber=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libtracing_subscriber-98f6a9959a9e3652.rlib --extern url=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/liburl-269058e59acc5dd8.rlib --extern uuid=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/libuuid-f99bd28e327e2af1.rlib -L native=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/build/blake3-afb1f6c10ed84bad/out -L native=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/build/aws-lc-sys-2bdb6e07e75aa555/out -L native=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/build/ring-8ea5519ffb1e7330/out -L native=/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/build/libsqlite3-sys-c4209bb4f57153f5/out"
+          ]
+        }
+      },
+      "partial_workspace_log": {
+        "path": "/tmp/canopy-native-policy-first-workspace-final.log",
+        "sha256": "c5eb0cf3885ca7b9fd71752200e85c3d1290e5a3173eeec3a40b1dd0760860cd",
+        "summaries": []
+      }
+    }
+  ],
+  "validation": {
+    "source_digest": "08ef5b30a9be622dc4ebccc592cd66d7cbf20a72e6912aeddb364e2f8ddcbd39",
+    "phases": [
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 30.66,
+        "log": "/tmp/canopy-native-policy-final-clippy-final.log",
+        "log_sha256": "e0ab0a2ed6a1eff099473dc983c8e7b042844d340a327cf4f489494ddb206258",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "policy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "native_review_policy_observes_current_rules_reviews_membership_and_ref_aba",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 85.49,
+        "log": "/tmp/canopy-native-policy-final-policy-final.log",
+        "log_sha256": "1cc4b79822f0894caf82b980b81cabf130b91c58c57ccfa0092de09132c7578f",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 2.60s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "startup",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "failed_startup_waits_for_supervisor_completion_and_owned_listener_release",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 0.76,
+        "log": "/tmp/canopy-native-policy-final-startup-final.log",
+        "log_sha256": "d797bf59919151ea4431f9bdf585ac190a2d145315081695a6372a72d148db39",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.05s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 669.8,
+        "log": "/tmp/canopy-native-policy-final-workspace-final.log",
+        "log_sha256": "210f69b7cc2988bbd04477ad90eabb03145c6cffa5a94d98aa854fc89273ccf5",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.71s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.27s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.08s",
+          "test result: ok. 724 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 287.29s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.57s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s",
+          "test result: FAILED. 82 passed; 24 failed; 9 ignored; 0 measured; 0 filtered out; finished in 352.72s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.26s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 42.23,
+        "log": "/tmp/canopy-native-policy-final-build-final.log",
+        "log_sha256": "55b2c9b98406e7846b9bdf62055ecb1261f3028de4299ca852a0853e8ec496d1",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.24,
+        "log": "/tmp/canopy-native-policy-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 42.2,
+        "log": "/tmp/canopy-native-policy-final-harness-final.log",
+        "log_sha256": "788897927721b6e97f074403bc69ca4d1360d4b877e2c09089d257dfd0bf611f",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.05,
+        "log": "/tmp/canopy-native-policy-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 724,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 82,
+      "failed": 24,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 844,
+    "failed": 27,
+    "ignored": 9,
+    "executed": 871,
+    "total": 880
+  },
+  "counting": "Last summary per Cargo Running section; nested child summaries and focused reruns excluded. Ordinary ignored cases remain unexecuted.",
+  "parent_linux_ci": [
+    {
+      "head": "ef765d449ab09488af1712d72dc39aa1894dc555",
+      "run": 37348401382,
+      "job": 111892756665,
+      "conclusion": "failure",
+      "log": "/tmp/canopy-policy-parent-pr-full.log",
+      "sha256": "ed2700812c12e18ab37de67fe6ce663153195a534a73684d9737da197afd400d",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.53s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.87s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 721 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 721 filtered out; finished in 0.03s",
+        "test result: ok. 722 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 499.48s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.12s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 657.90s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    },
+    {
+      "head": "ef765d449ab09488af1712d72dc39aa1894dc555",
+      "run": 37348395260,
+      "job": 111892735724,
+      "conclusion": "failure",
+      "log": "/tmp/canopy-policy-parent-push-full.log",
+      "sha256": "69b061e52d575e3d8ea78da60ee4f649deabcc42714dd1df2b6aff88a508dbc4",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.68s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.03s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 721 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 721 filtered out; finished in 0.01s",
+        "test result: ok. 722 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 366.32s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.31s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 515.12s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    }
+  ],
+  "changes": [
+    "Review-policy query 52 codec 2 reuses private native ref observations, bounded metadata selection and final fresh SQL rules/heads/membership/access. Merge ancestry preflight uses this reader; final merge writer remains legacy and unqualified.",
+    "Actual-resident regression for both formats covers prepared query freshness, purpose/number substitution, delayed access revocation, membership ABA, comment-preserved decisions, tombstones and same-OID ref ABA.",
+    "Startup error completion joins its actual supervisor before returning; successful readiness and cancellation ownership stay unchanged.",
+    "Conditional-storage fixture retains caller port reservation through the probe while preserving exact domain/empty-store/rebind assertions. This does not establish the cause of every earlier AddrInUse failure."
+  ],
+  "limits": {
+    "facts": 128,
+    "total_name_bytes": 524288,
+    "single_name_bytes": 65535,
+    "input_bytes": 835584,
+    "query_output_bytes": 1048576,
+    "read_attempts": 3
+  },
+  "remaining": "Native atomic merge/rebase/candidate publication and thread revisions, default-branch joint mutation, Linux rejected-push workloads and pre-Bind durable refusal, real peers/source-independent backup, reachable-only cold/filtered fetch and standalone actual residents, physical ownership/recovery/retention/final DDL, accelerators/fair maintenance and complete large-history/10k-engineer qualification."
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index d803302d..02e74c32 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,56 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Native review-policy and failed-startup supervision (2026-10-05 checkpoint)
+
+Review-policy still joined retired SQL refs after core pulls were converted. An
+existing stock-Git HTTP merge family reproducibly returned 404 at its first
+policy read. A new actual-resident regression also returned no policy for both
+native refs. Query 52, codec 2, now adds a distinct policy purpose and reuses the
+same authenticated ref observation and bounded editorial selection. Current
+branch rules, review heads, account generations and access are read in its final
+Cell transaction. Merge ancestry preparation uses that reader; the final legacy
+merge writer remains unfinished.
+
+The actual-resident regression covers SHA-1 and SHA-256, preparations before
+rule/review changes, substituted purposes and pull numbers, delayed access
+revocation, revoked/regranted reviewer decisions, request-changes decisions and comments
+that preserve the latest decision,
+and ref deletion/recreation with the same OID. It does not populate legacy refs
+or qualify a generated writer.
+
+Public startup formerly returned a reported readiness error before joining its
+supervisor. A regression holds a real reserved listener in the supervisor after
+reporting an error: before the fix startup returns early; afterward it waits for
+release and preserves the original error. The existing conditional-storage
+startup fixture now retains its caller reservation through the storage probe,
+then checks exact rebind after release. Domain rejection and empty-store checks
+remain intact. These prove supervision and remove a fixture's unowned probe
+window; they do not establish the cause of every historical `AddrInUse` failure.
+
+Frozen-source validation passes all 724 server library cases, all-target Clippy
+with warnings denied, server build, formatting/diff checks and all 96 Python
+harness cases. The existing failed-storage startup case passes in the full
+workload. Multi-server finishes at 82 passed / 24 failed / 9 ignored; the three
+standalone aggregates still fail. Unique totals are 844 passed / 27 failed /
+9 unexecuted ignores, excluding nested summaries and focused reruns. The HTTP
+merge reproduction now proceeds past policy reads and fails later at legacy
+merge preparation/publication (503); the merge workflow is not qualified.
+
+The expanded regression initially expected a comment to clear request-changes;
+that contradicted the documented decision-head contract. Its failed run and the
+interrupted partial compiler run are preserved alongside the corrected regression
+and complete final run in [policy/startup evidence](evidence/native-policy-startup-ci-20261005.json).
+The 510-file frozen-source digest is
+`08ef5b30a9be622dc4ebccc592cd66d7cbf20a72e6912aeddb364e2f8ddcbd39`.
+Parent `ef765d4` Linux PR and push Verify pass all 722 server libraries, formatting
+and Clippy but each fail multi-server at 83 passed / 27 failed / 9 ignored. Those
+results remain failures; exact new-head Linux validation is still required.
+
+Native atomic merge/candidate/rebase publication, thread revisions, default-branch
+publication, rejected-push workload failures, peer/backup recovery and selective
+fetch remain priority work. The full implementation/capacity goal stays active.
+
 ## Native pull/ref metadata conversion (2026-10-05 checkpoint)
 
 Pull creation still selected the retired SQL `refs` table after native push,

From 0b8d3b5c397fb11532f09b8a71e023e604d7a6c1 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 11:46:10 -0700
Subject: [PATCH 39/55] feat: certify native merge ancestry independently of
 branch rules

---
 .../src/packs/publication/ref_proof.rs        |  89 +++-
 .../src/packs/publication/tests/publishing.rs | 111 ++++-
 docs/contracts.md                             |  18 +
 .../native-merge-ancestry-ci-20261005.json    | 394 ++++++++++++++++++
 .../large-repository-implementation-status.md |  44 ++
 5 files changed, 637 insertions(+), 19 deletions(-)
 create mode 100644 docs/evidence/native-merge-ancestry-ci-20261005.json

diff --git a/crates/canopy-server/src/packs/publication/ref_proof.rs b/crates/canopy-server/src/packs/publication/ref_proof.rs
index 8f69525b..089b3ad4 100644
--- a/crates/canopy-server/src/packs/publication/ref_proof.rs
+++ b/crates/canopy-server/src/packs/publication/ref_proof.rs
@@ -182,6 +182,11 @@ fn ancestry_policy_page(
     }
     Ok((end, SqlBatch { statements }))
 }
+#[derive(Clone, Copy)]
+enum AncestryRequirement {
+    Policy,
+    Required,
+}
 impl PreparedCatalog {
     /// Validate targets through this prepared catalog. Ancestry is computed
     /// only for currently enabled fast-forward rules; final publication checks
@@ -194,9 +199,35 @@ impl PreparedCatalog {
         limits: MetadataLimits,
     ) -> Result<RefPublicationProof, RefProofError> {
         let (_, deadline) = self.base.live_lease()?;
-        timeout_at(deadline, self.ref_proof_inner(plan, root, budget, limits))
-            .await
-            .map_err(|_| PreparationBaseError::Inactive)?
+        timeout_at(
+            deadline,
+            self.ref_proof_inner(plan, root, budget, limits, AncestryRequirement::Policy),
+        )
+        .await
+        .map_err(|_| PreparationBaseError::Inactive)?
+    }
+    /// Certify every non-vacuous ancestry predicate through the privately
+    /// verified native catalog, independent of branch rules. Reviewed merge
+    /// publication must use this path: even an unprotected branch requires
+    /// ancestry evidence. False bits remain explicit negative facts.
+    ///
+    /// Reuses the ordinary proof/MAC and bounded disk-backed walker. This is
+    /// preparation only; final publication must still check current refs,
+    /// reviews/checks/access and its actual owner/lease in one transaction.
+    pub async fn ref_proof_with_required_ancestry(
+        &self,
+        plan: PushPlan,
+        root: &Path,
+        budget: DiskBudget,
+        limits: MetadataLimits,
+    ) -> Result<RefPublicationProof, RefProofError> {
+        let (_, deadline) = self.base.live_lease()?;
+        timeout_at(
+            deadline,
+            self.ref_proof_inner(plan, root, budget, limits, AncestryRequirement::Required),
+        )
+        .await
+        .map_err(|_| PreparationBaseError::Inactive)?
     }
     async fn ref_proof_inner(
         &self,
@@ -204,8 +235,11 @@ impl PreparedCatalog {
         root: &Path,
         budget: DiskBudget,
         limits: MetadataLimits,
+        ancestry: AncestryRequirement,
     ) -> Result<RefPublicationProof, RefProofError> {
-        let (plan, bits) = self.ref_evidence(plan, root, budget, limits).await?;
+        let (plan, bits) = self
+            .ref_evidence_with_ancestry(plan, root, budget, limits, ancestry)
+            .await?;
         let certificate = self
             .issue_certificate(Some(binding(&plan, &bits)?), None)
             .await?;
@@ -224,6 +258,17 @@ impl PreparedCatalog {
         root: &Path,
         budget: DiskBudget,
         limits: MetadataLimits,
+    ) -> Result<(PushPlan, Vec<u8>), RefProofError> {
+        self.ref_evidence_with_ancestry(plan, root, budget, limits, AncestryRequirement::Policy)
+            .await
+    }
+    async fn ref_evidence_with_ancestry(
+        &self,
+        plan: PushPlan,
+        root: &Path,
+        budget: DiskBudget,
+        limits: MetadataLimits,
+        ancestry: AncestryRequirement,
     ) -> Result<(PushPlan, Vec<u8>), RefProofError> {
         shape(&plan, self.catalog().format)?;
         if plan.actor != self.base.capability().2.actor {
@@ -256,21 +301,31 @@ impl PreparedCatalog {
         let mut start = 0;
         while start < plan.updates.len() {
             self.ensure_live()?;
-            let (end, batch) = ancestry_policy_page(&plan.updates, start)?;
-            let policies = sql
-                .query(None, batch)
-                .await
-                .map_err(|error| RefProofError::Query(Box::new(error)))?;
+            let (end, policies) = match ancestry {
+                AncestryRequirement::Required => ((start + 128).min(plan.updates.len()), None),
+                AncestryRequirement::Policy => {
+                    let (end, batch) = ancestry_policy_page(&plan.updates, start)?;
+                    let policies = sql
+                        .query(None, batch)
+                        .await
+                        .map_err(|error| RefProofError::Query(Box::new(error)))?
+                        .output;
+                    if policies.len() != end - start {
+                        return Err(RefProofError::Invalid);
+                    }
+                    (end, Some(policies))
+                }
+            };
             let updates = &plan.updates[start..end];
-            if policies.output.len() != updates.len() {
-                return Err(RefProofError::Invalid);
-            }
-            for (at, (update, policy)) in updates.iter().zip(policies.output).enumerate() {
+            for (at, update) in updates.iter().enumerate() {
                 let index = start + at;
-                let required = match policy.rows.first().map(Vec::as_slice) {
-                    Some([SqlValue::Integer(0)]) => false,
-                    Some([SqlValue::Integer(1)]) => true,
-                    _ => return Err(RefProofError::Invalid),
+                let required = match policies.as_ref() {
+                    None => true,
+                    Some(policies) => match policies[at].rows.first().map(Vec::as_slice) {
+                        Some([SqlValue::Integer(0)]) => false,
+                        Some([SqlValue::Integer(1)]) => true,
+                        _ => return Err(RefProofError::Invalid),
+                    },
                 };
                 let old = update.expected.as_ref().and_then(|old| old.oid);
                 if old.is_none() || old == update.new_oid || update.new_oid.is_none() {
diff --git a/crates/canopy-server/src/packs/publication/tests/publishing.rs b/crates/canopy-server/src/packs/publication/tests/publishing.rs
index f508b4ba..6f9a7639 100644
--- a/crates/canopy-server/src/packs/publication/tests/publishing.rs
+++ b/crates/canopy-server/src/packs/publication/tests/publishing.rs
@@ -401,7 +401,7 @@ async fn catalog_ref_membership_kind_and_tampered_bindings_cannot_publish() -> R
                     limits()
                 )
                 .await,
-            Err(RefProofError::Invalid)
+            Err(super::super::RefProofError::Invalid)
         ));
     }
     let input = proof(
@@ -573,7 +573,7 @@ async fn ancestry_growth_reuses_pairs_only_in_one_exact_native_catalog() -> Resu
                 &other.prepared.base
             )
             .await,
-            Err(RefProofError::Invalid)
+            Err(super::super::RefProofError::Invalid)
         ));
         assert!(matches!(
             walk.is_ancestor(
@@ -956,3 +956,110 @@ async fn expired_and_claimed_proofs_and_mutable_publication_facts_fail_closed()
     fixture.runtime.shutdown().await?;
     Ok(())
 }
+
+#[tokio::test]
+async fn reviewed_merge_requires_native_ancestry_without_a_fast_forward_branch_rule() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let fixture = Fixture::new(format).await?;
+        let graph = assembled(&fixture, [241; 16], 16).await?;
+        let changes = plan(vec![
+            update(
+                "refs/heads/merge",
+                Some((graph.initial, 1)),
+                Some(graph.tip),
+            ),
+            update(
+                "refs/heads/unrelated",
+                Some((graph.initial, 1)),
+                Some(graph.other),
+            ),
+            update(
+                "refs/heads/backwards",
+                Some((graph.tip, 1)),
+                Some(graph.initial),
+            ),
+            update(
+                "refs/heads/unchanged",
+                Some((graph.tip, 1)),
+                Some(graph.tip),
+            ),
+            update("refs/heads/created", None, Some(graph.tip)),
+            update("refs/heads/deleted", Some((graph.initial, 1)), None),
+        ]);
+        let before = state(&fixture.handle).await?;
+        let proof = graph
+            .prepared
+            .ref_proof_with_required_ancestry(
+                changes.clone(),
+                graph.root.path(),
+                graph.budget.clone(),
+                limits(),
+            )
+            .await?;
+        assert_eq!(
+            proof.ancestry,
+            vec![0b0011_1001],
+            "merges require native ancestry evidence even without a branch fast-forward rule"
+        );
+        assert_eq!(
+            proof.certificate.data()?.refs_digest,
+            Some(super::super::ref_proof::binding(&changes, &proof.ancestry)?)
+        );
+        assert_eq!(
+            state(&fixture.handle).await?,
+            before,
+            "proof construction must not publish or populate SQL refs"
+        );
+        let selective = graph
+            .prepared
+            .ref_proof(
+                changes.clone(),
+                graph.root.path(),
+                graph.budget.clone(),
+                limits(),
+            )
+            .await?;
+        assert_eq!(
+            selective.ancestry,
+            vec![0b0011_1000],
+            "ordinary pushes must retain policy-driven ancestry work"
+        );
+        assert_ne!(
+            proof.certificate.data()?.refs_digest,
+            selective.certificate.data()?.refs_digest
+        );
+        let mut forged = proof.clone();
+        forged.ancestry[0] |= 2;
+        assert_ne!(
+            forged.certificate.data()?.refs_digest,
+            Some(super::super::ref_proof::binding(
+                &forged.plan,
+                &forged.ancestry
+            )?),
+            "an unrelated history cannot become proven by changing transport bits"
+        );
+        let invalid = plan(vec![update(
+            "refs/heads/not-a-commit",
+            Some((graph.initial, 1)),
+            Some(graph.blob),
+        )]);
+        assert!(matches!(
+            graph
+                .prepared
+                .ref_proof_with_required_ancestry(
+                    invalid,
+                    graph.root.path(),
+                    graph.budget.clone(),
+                    limits(),
+                )
+                .await,
+            Err(super::super::RefProofError::Invalid)
+        ));
+        assert_eq!(state(&fixture.handle).await?, before);
+
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        fixture.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/docs/contracts.md b/docs/contracts.md
index 9d289fcb..3942d759 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -1921,6 +1921,24 @@ The final merge command and generated Git producers still need native atomic
 publication and are not qualified by these read operations. Codec 2 is a hard
 cutover of this unreleased query; no old input decoder is retained.
 
+Native merge preparation has a separate
+`PreparedCatalog::ref_proof_with_required_ancestry` factory. Unlike ordinary
+`ref_proof`, it walks every non-vacuous base-to-target predicate regardless of
+branch rules. It reuses `RefPublicationProof`, the signed plan/evidence digest,
+verified native commit headers and the bounded disk-backed walker. False bits
+remain negative facts; a decoded bit vector grants no authority. Creation,
+deletion and identical tips retain the existing vacuous predicate semantics,
+with deletion permissions checked separately at publication. Ordinary pushes
+continue to compute ancestry only where their current policy requires it.
+
+Both factories retain the preparation's live lease, timeout, cancellation and
+scratch budget. Neither publishes roots or populates SQL refs/ancestry. A final
+native merge receiver must authenticate the exact proof and conditional ref
+snapshot, check current access/reviews/checks and ref versions, and commit joint
+roots, pull state and UUID result under the actual owner fence and durable
+recovery journal. That receiver and its resident adapter remain unfinished; the
+legacy operation 9 description below is not qualification of the native writer.
+
 Six HTTP operations live under `/api/repositories/<name>/pulls`: GET/POST the
 collection, GET/PUT `/<number>`, GET/POST `/<number>/reviews`. Every mutation
 carries the repository UUID, checked against the resolved Cell. Create/review
diff --git a/docs/evidence/native-merge-ancestry-ci-20261005.json b/docs/evidence/native-merge-ancestry-ci-20261005.json
new file mode 100644
index 00000000..b077ff01
--- /dev/null
+++ b/docs/evidence/native-merge-ancestry-ci-20261005.json
@@ -0,0 +1,394 @@
+{
+  "recorded_at_utc": "2026-10-05T18:45:22.065095+00:00",
+  "base_head": "6fc9483570423b9674e9f4e3d5f70d151b47b668",
+  "host": "macOS, Rust 1.98.0; exact-head Linux qualification remains required",
+  "source_files": 510,
+  "rust_files": 492,
+  "source_hash_digest": "8c242912a383fbfa5ef5c2023163b2491bf0013eb9c0d16b1256a7b3f89897d8",
+  "source_manifest": "/tmp/canopy-native-merge-ancestry-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "release_qualified": false,
+  "reproduction": {
+    "result": "Ordinary policy-selective proof omits the true base-to-descendant bit when the branch has no fast-forward rule. The new mandatory-ancestry regression fails before the factory is added; actual 56, expected 57. This reproduces a missing preparation primitive, not an implemented or fixed native merge endpoint.",
+    "source_manifest": "/tmp/canopy-native-merge-ancestry-baseline-source.json",
+    "source_digest": "c93ec7158e511405fe9ee3c9d847659fc4574dfbbb0c4dd79477e8d4608b3c78",
+    "path": "/tmp/canopy-native-merge-ancestry-baseline.log",
+    "sha256": "e775e5f90bd0692682b5d0d49596d08c9bd90b6fbb0343ee0a6f0d0998e2d070",
+    "summaries": [
+      "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.52s"
+    ]
+  },
+  "validation": {
+    "source_digest": "8c242912a383fbfa5ef5c2023163b2491bf0013eb9c0d16b1256a7b3f89897d8",
+    "phases": [
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 52.93,
+        "log": "/tmp/canopy-native-merge-ancestry-final-clippy-final.log",
+        "log_sha256": "cc51973db5cf58ad335560712df6fc48048f3b4662a843e3421d5451c044ed5f",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "ancestry",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "reviewed_merge_requires_native_ancestry_without_a_fast_forward_branch_rule",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 2.52,
+        "log": "/tmp/canopy-native-merge-ancestry-final-ancestry-final.log",
+        "log_sha256": "0b599018f93bdb039509685f01524a685992e8f40cd1acdf1feca7a2c2cca092",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 1.41s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 790.87,
+        "log": "/tmp/canopy-native-merge-ancestry-final-workspace-final.log",
+        "log_sha256": "4ef8f2613c196cd046b3262281f5be6aa9c82433992b5bdf2b52083a8dfa9f44",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.15s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.11s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.07s",
+          "test result: ok. 725 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 354.95s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.62s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+          "test result: FAILED. 82 passed; 24 failed; 9 ignored; 0 measured; 0 filtered out; finished in 348.75s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.32s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.14s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 41.81,
+        "log": "/tmp/canopy-native-merge-ancestry-final-build-final.log",
+        "log_sha256": "da2722ffab0462a401624f58b0464533063e4ac8668ca2037d13b4b9944aa49e",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.34,
+        "log": "/tmp/canopy-native-merge-ancestry-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 41.06,
+        "log": "/tmp/canopy-native-merge-ancestry-final-harness-final.log",
+        "log_sha256": "977ba385ed294539a83621a1949a741f34d62bf24bb1edcdeb0a4e9414e628a2",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.06,
+        "log": "/tmp/canopy-native-merge-ancestry-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 725,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 82,
+      "failed": 24,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 845,
+    "failed": 27,
+    "ignored": 9,
+    "executed": 872,
+    "total": 881
+  },
+  "counting": "Last summary per Cargo Running/Doc-tests section; nested child summaries and focused reruns excluded. Ordinary ignored cases remain unexecuted.",
+  "parent_linux_ci": [
+    {
+      "head": "6fc9483570423b9674e9f4e3d5f70d151b47b668",
+      "run": 37353990783,
+      "job": 111911623913,
+      "conclusion": "failure",
+      "path": "/tmp/canopy-native-merge-parent-pr-full.log",
+      "sha256": "5a9157513dcd053d93beba7ad78c1063cc7f1d205dee44453a39cc6239cdf0d4",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.48s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.69s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.02s",
+        "test result: ok. 724 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 368.32s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.99s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 525.36s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    },
+    {
+      "head": "6fc9483570423b9674e9f4e3d5f70d151b47b668",
+      "run": 37353984202,
+      "job": 111911602108,
+      "conclusion": "failure",
+      "path": "/tmp/canopy-native-merge-parent-push-full.log",
+      "sha256": "5d6554918f30d27f8dbbfeaa4b189bc26f8d227ce5f7ba86f514c3ee0e3f2509",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.01s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 723 filtered out; finished in 0.02s",
+        "test result: ok. 724 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 476.75s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.05s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 620.95s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    }
+  ],
+  "changes": [
+    "PreparedCatalog::ref_proof_with_required_ancestry reuses the existing native header verification, MAC-bound plan/evidence, bounded disk-backed walker, live lease, timeout and scratch custody. It computes every non-vacuous predicate independently of SQL branch rules.",
+    "Ordinary pushes retain policy-selective ancestry work. No new proof format, table, decoder or SQL ref/ancestry mirror is introduced.",
+    "Genuine native catalog regression covers SHA-1/SHA-256 descendant, unrelated and backwards histories, vacuous predicates, negative evidence digest binding, invalid branch tip kind and unchanged persistent publication state. It is not qualification of the immutable-root merge receiver, resident merge adapter or generated candidate writer."
+  ],
+  "remaining": "Integrate mandatory evidence into a private conditional native merge snapshot and typed owner-fenced transaction, durable exact-command recovery/terminal release, and actual resident/public merge adapter. Native candidates/rebase, thread revisions, default branch, rejected pushes, peer/backup recovery, selective fetch, physical ownership/retention/GC/final DDL, accelerators/fair maintenance and full-history/10k-engineer qualification remain open."
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 02e74c32..38c260d7 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,50 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Mandatory native merge ancestry (2026-10-05 checkpoint)
+
+The ordinary ref-proof factory computes ancestry only for enabled fast-forward
+branch rules. Reviewed merges must prove base-to-target ancestry even on an
+unprotected branch. A new native catalog regression fails before the mandatory
+factory exists: the valid descendant bit is absent (56 instead of 57). This is a
+reproduction of missing preparation evidence, not a fixed merge endpoint.
+
+`PreparedCatalog::ref_proof_with_required_ancestry` now verifies every
+non-vacuous predicate independently of branch rules. It reuses the existing
+proof, signed plan/evidence binding, verified commit headers, disk-backed walker,
+lease/deadline, cancellation and scratch budget. Ordinary pushes retain selective
+ancestry work. No proof format, compatibility decoder, table or SQL ref/ancestry
+mirror is added.
+
+The genuine native catalog regression passes for SHA-1 and SHA-256. It covers
+descendants, unrelated and backwards histories, vacuous predicates, negative
+evidence binding, invalid branch tip kind and unchanged publication state. It
+does not qualify an immutable-root merge receiver or resident merge adapter.
+
+Frozen-source validation passes all 725 server library tests, all-target Clippy
+with warnings denied, server build, formatting/diff checks and all 96 Python
+harness cases. Multi-server remains at 82 passed / 24 failed / 9 ignored, and
+three standalone aggregates fail. Unique workspace totals are 845 passed /
+27 failed / 9 unexecuted ignores, excluding nested child summaries and focused
+reruns. The 510-file source digest is
+`8c242912a383fbfa5ef5c2023163b2491bf0013eb9c0d16b1256a7b3f89897d8`.
+The full failed run and failing-first regression are preserved in
+[ancestry evidence](evidence/native-merge-ancestry-ci-20261005.json).
+
+Parent `6fc9483` Linux PR and push Verify runs pass all 724 server library cases,
+formatting and Clippy; each fails multi-server at 83 passed / 27 failed /
+9 ignored. Three additional Linux failures involve durable HTTP/SSH push-option
+refusals. Both full logs are preserved in the ancestry evidence. Exact new-head
+Linux and RustFS qualification remain required; this PR is not green or release
+qualified.
+
+Atomic native merge publication remains the next implementation priority: bind
+these facts to the private conditional ref snapshot, commit joint roots, pull
+state and UUID result with fresh reviews/checks/access under the actual owner
+fence, and retain exact command recovery through cancellation and restart.
+Generated candidates/rebase, other writers and the full capacity goal remain
+open.
+
 ## Native review-policy and failed-startup supervision (2026-10-05 checkpoint)
 
 Review-policy still joined retired SQL refs after core pulls were converted. An

From 2ed3d58f9a3ee1b3020f6100555febaca4e01330 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 12:54:25 -0700
Subject: [PATCH 40/55] feat: publish reviewed merges through native root
 transactions

Bind exact merge intent, native ref versions, mandatory ancestry and the
conditional ref snapshot in the existing catalog certificate. Atomically
publish joint roots, pull state, applied UUID and original-command recovery.
Reuse private ownership, fair dispatch, current reviews/checks and typed
recovery; include both new implementations in the Cell source fingerprint.

Keep public merge integration and terminal graph certification explicitly
open. Preserve complete failed integration results and both-format rollback,
UUID replay and owner-restoration evidence.
---
 crates/canopy-server/src/branch_rules/mod.rs  |   7 +
 crates/canopy-server/src/lib.rs               |   4 +
 .../src/packs/publication/coordinator.rs      |   2 +
 .../publication/coordinator/native_merge.rs   |  84 ++
 .../src/packs/publication/coordinator/work.rs |   5 +
 .../src/packs/publication/mod.rs              |  11 +-
 .../src/packs/publication/native_merge.rs     | 481 ++++++++++
 .../src/packs/publication/recovery/archive.rs |   6 +
 .../src/packs/publication/recovery/codec.rs   |   4 +
 .../src/packs/publication/recovery/mod.rs     |  23 +-
 .../src/packs/publication/recovery/phase.rs   |   7 +
 .../src/packs/publication/recovery/ready.rs   |   4 +
 .../src/packs/publication/ref_proof.rs        |  10 +
 .../src/packs/publication/registry.rs         |  11 +-
 .../src/packs/publication/tests.rs            |   1 +
 .../packs/publication/tests/native_merge.rs   | 546 +++++++++++
 .../canopy-server/src/pulls/merge/command.rs  |  38 +-
 crates/canopy-server/src/pulls/merge/mod.rs   |  42 +-
 crates/canopy-server/src/pulls/native/mod.rs  |   2 +-
 docs/contracts.md                             |  65 +-
 .../native-merge-atomic-ci-20261005.json      | 852 ++++++++++++++++++
 .../large-repository-implementation-status.md |  49 +
 22 files changed, 2217 insertions(+), 37 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/coordinator/native_merge.rs
 create mode 100644 crates/canopy-server/src/packs/publication/native_merge.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/native_merge.rs
 create mode 100644 docs/evidence/native-merge-atomic-ci-20261005.json

diff --git a/crates/canopy-server/src/branch_rules/mod.rs b/crates/canopy-server/src/branch_rules/mod.rs
index f90692e6..b4a21490 100644
--- a/crates/canopy-server/src/branch_rules/mod.rs
+++ b/crates/canopy-server/src/branch_rules/mod.rs
@@ -253,6 +253,13 @@ pub(crate) struct Policy {
     require_pull_request: bool,
 }
 impl Policy {
+    pub(crate) fn allows_reviewed(
+        &self,
+        update: &RefUpdate,
+        reviewed: &crate::pulls::merge::ReviewedMerge,
+    ) -> bool {
+        self.allows_ref(update, true) && (!self.require_pull_request || reviewed.authorizes(update))
+    }
     pub(crate) fn allows(&self, update: &RefUpdate, require_ancestry: bool) -> bool {
         !self.require_pull_request && self.allows_ref(update, require_ancestry)
     }
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index b88a1f21..ae13b914 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -270,6 +270,10 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/completion.rs"));
                 source.update(include_bytes!("packs/publication/ref_proof.rs"));
                 source.update(include_bytes!("packs/publication/ref_snapshot.rs"));
+                source.update(include_bytes!("packs/publication/native_merge.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/coordinator/native_merge.rs"
+                ));
                 source.update(include_bytes!("packs/publication/initialization.rs"));
                 source.update(include_bytes!(
                     "packs/publication/coordinator/initialization.rs"
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index 1dcecdc8..666554d2 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -23,6 +23,8 @@ use tokio::{
 const COMMAND_RESERVATION: u64 = 8 << 20;
 const INLINE_BYTES: u32 = 4 << 20;
 mod initialization;
+mod native_merge;
+pub use native_merge::ReadyNativeMerge;
 mod inputs;
 pub use initialization::ReadyInitialization;
 pub use inputs::{NativeInputReadyError, ReadyNativeInputs, RegisteredNativeInputs};
diff --git a/crates/canopy-server/src/packs/publication/coordinator/native_merge.rs b/crates/canopy-server/src/packs/publication/coordinator/native_merge.rs
new file mode 100644
index 00000000..6a77d494
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/coordinator/native_merge.rs
@@ -0,0 +1,84 @@
+//! Native merges share the original private owner and exact registered dispatch.
+use super::*;
+use crate::pulls::merge::{MergeRequest, command::MergeInput};
+use canopy_object_storage::artifact::ArtifactStore;
+
+#[must_use]
+pub struct ReadyNativeMerge {
+    owner: Arc<PreparedCatalog>,
+    command: PreparedCommand<PublishReviewedMerge>,
+}
+impl PreparedCatalog {
+    pub async fn ready_native_merge(
+        self: &Arc<Self>,
+        identity: MutationIdentity,
+        number: i64,
+        request: MergeRequest,
+        directory: &Path,
+        budget: DiskBudget,
+        limits: MetadataLimits,
+    ) -> Result<ReadyNativeMerge, NativeMergePreparationError> {
+        let input = MergeInput {
+            actor: self.base.capability().2.actor.clone(),
+            number,
+            request,
+            issued_at_ms: identity.issued_at_ms,
+        };
+        let proof = self
+            .native_merge_proof(input, directory, budget, limits)
+            .await?;
+        self.ensure_live()?;
+        let (client, target, _) = self.base.capability();
+        let command = client
+            .prepare_command::<PublishReviewedMerge>(target, identity, proof)
+            .await
+            .map_err(|e| NativeMergePreparationError::Command(Box::new(e)))?;
+        self.ensure_live()?;
+        Ok(ReadyNativeMerge {
+            owner: self.clone(),
+            command,
+        })
+    }
+}
+impl ReadyNativeMerge {
+    pub async fn persist_recovery(
+        &self,
+        store: &ArtifactStore,
+        identity: MutationIdentity,
+    ) -> Result<RegisteredRootRecovery, RootRecoveryError> {
+        super::super::recovery::persist(
+            &self.owner.base.session,
+            &self.command,
+            super::super::recovery::Kind::Merge,
+            store,
+            identity,
+            0,
+        )
+        .await
+    }
+    pub fn bind_recovery(
+        self,
+        registered: RegisteredRootRecovery,
+        store: &ArtifactStore,
+    ) -> Result<ReadyBoundRecovery, Box<RecoveryBindingFailure<Self>>> {
+        if !registered.matches_original(
+            super::super::recovery::Kind::Merge,
+            self.command.evidence(),
+            None,
+            &self.owner.base.session,
+            store,
+        ) {
+            return Err(Box::new(RecoveryBindingFailure {
+                original: self,
+                registered,
+            }));
+        }
+        Ok(ReadyBoundRecovery::new(
+            PushPreparation::Catalog(self.owner),
+            None,
+            false,
+            registered,
+            store,
+        ))
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index 7bc2b5fd..e6ac2c30 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -335,6 +335,7 @@ impl ReadyPublication {
 
 #[derive(Clone, Debug)]
 pub enum PublicationOutcome {
+    Merge(Committed<crate::pulls::merge::MergeOutcome>),
     ServingRelease(Committed<ServingReleaseReply>),
     ServingCommand(Committed<ServingReply>),
     Initialization(Committed<InitializationReply>),
@@ -350,6 +351,8 @@ pub enum PublicationOutcome {
 }
 #[derive(Debug, thiserror::Error)]
 pub enum PublicationError {
+    #[error("native reviewed merge publication: {0}")]
+    Merge(#[source] InvocationError<crate::pulls::merge::MergeOutcome>),
     #[error("serving pin release: {0}")]
     ServingRelease(#[source] InvocationError<ServingReleaseReply>),
     #[error("serving custody command: {0}")]
@@ -401,6 +404,7 @@ impl PublicationError {
             Self::ServingRelease(error) => kind(error),
             Self::ServingCommand(error) => kind(error),
             Self::Initialization(error) => kind(error),
+            Self::Merge(error) => kind(error),
             Self::Push(error) => kind(error),
             Self::RootPush(error) => kind(error),
             Self::PolicyPage(error) => kind(error),
@@ -424,6 +428,7 @@ impl PublicationError {
             Self::ServingRelease(error) => unknown(error),
             Self::ServingCommand(error) => unknown(error),
             Self::Initialization(error) => unknown(error),
+            Self::Merge(error) => unknown(error),
             Self::Push(error) => unknown(error),
             Self::RootPush(error) => unknown(error),
             Self::PolicyPage(error) => unknown(error),
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index b61c9e09..0b7e9874 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -55,6 +55,10 @@ pub use initialization::{
 };
 mod ref_snapshot;
 pub use ref_snapshot::{PreparedRefSnapshot, RefSnapshotPreparationError};
+mod native_merge;
+pub use native_merge::{
+    NATIVE_MERGE_BYTES, NativeMergePreparationError, NativeMergeProof, PublishReviewedMerge,
+};
 mod ref_policy;
 pub use ref_policy::{
     CheckRefPolicyGuard, MAX_REF_POLICY_GUARDS, MAX_REF_POLICY_WATCHES, PreparedRefPolicyGuard,
@@ -81,9 +85,9 @@ pub use coordinator::{
     PublicationClass, PublicationCoordinator, PublicationError, PublicationLimits,
     PublicationOutcome, PublicationScheduleError, PublicationState, PublicationStats,
     PublicationTicket, ReadyBoundRecovery, ReadyCatalogCompaction, ReadyCatalogPush,
-    ReadyInitialization, ReadyNativeInputs, ReadyPreparation, ReadyPublication, ReadyRefPolicyPage,
-    ReadyRootPush, RecoveryBindingFailure, RefPolicyReadyError, RefPolicyRefusalFailure,
-    RegisteredNativeInputs, RootPushReadyError, ServingDrainAdmission,
+    ReadyInitialization, ReadyNativeInputs, ReadyNativeMerge, ReadyPreparation, ReadyPublication,
+    ReadyRefPolicyPage, ReadyRootPush, RecoveryBindingFailure, RefPolicyReadyError,
+    RefPolicyRefusalFailure, RegisteredNativeInputs, RootPushReadyError, ServingDrainAdmission,
 };
 pub use scan::{RecoveryScanBudget, RecoveryScanSettings};
 mod commands;
@@ -251,6 +255,7 @@ pub struct MaintenanceRequest {
 /// Bind the packed production contract. Inline publication/completion adapters
 /// are deliberately excluded; qualification binds its historical fixtures itself.
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
+    registry.bind_command::<PublishReviewedMerge>()?;
     registry.bind_command::<crate::branch_rules::command::SetBranchRule>()?;
     registry.bind_command::<crate::checks::native::StartCommitCheck>()?;
     registry.bind_query::<crate::checks::native::ReadCommitChecks>()?;
diff --git a/crates/canopy-server/src/packs/publication/native_merge.rs b/crates/canopy-server/src/packs/publication/native_merge.rs
new file mode 100644
index 00000000..7f612d79
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/native_merge.rs
@@ -0,0 +1,481 @@
+//! Private native ref preparation and one owner-fenced reviewed-merge transaction.
+//! Transport DTOs grant no authority; the final receiver authenticates every
+//! proposed fact before evaluating current editorial and branch predicates.
+use super::*;
+use super::{
+    commands::{check_pin, fact, load, matched},
+    publish::{authenticate, changed, checkpoint, retention_matches},
+    ref_observation::RefFact,
+    sql::*,
+};
+use crate::{
+    PushPlan,
+    packs::{
+        metadata::MetadataLimits,
+        ref_state::{RefSnapshotError, RefStateError, RefStateIndex},
+    },
+    pulls::merge::{
+        MergeOutcome, MergeRecord, MergeStrategy,
+        command::{MergeInput, request_binding},
+    },
+};
+use cellule_ltx::DiskBudget;
+use cellule_runtime::{InvocationError, primitives::sql::SqlCell};
+use std::path::Path;
+use tokio::time::timeout_at;
+
+pub const NATIVE_MERGE_BYTES: u32 = 256 << 10;
+
+#[derive(Clone, Debug)]
+struct Transition {
+    plan: PushPlan,
+    ancestry: Vec<u8>,
+    refs: Option<RefStateSnapshotRoot>,
+}
+
+/// Exact request, native ref facts and conditional snapshot. Only a privately
+/// constructed PreparedCatalog can issue its MAC. No serving-only observation
+/// or client-selected root can create write authority.
+#[derive(Clone, Debug)]
+pub struct NativeMergeProof {
+    certificate: CatalogCertificate,
+    input: MergeInput,
+    selection: RefSelection,
+    transition: Option<Transition>,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum NativeMergePreparationError {
+    #[error("native merge preparation is inactive")]
+    Base(#[from] PreparationBaseError),
+    #[error("native merge encoding failed")]
+    Codec(#[from] CodecError),
+    #[error("native merge metadata capability failed")]
+    Capability(#[from] Error),
+    #[error("native merge editorial query failed")]
+    Query(#[source] Box<InvocationError<Vec<SqlResultSet>>>),
+    #[error("native merge refs failed")]
+    Refs(#[from] RefStateError),
+    #[error("native merge snapshot failed")]
+    Snapshot(#[from] RefSnapshotError),
+    #[error("native merge transition failed")]
+    Transition(#[from] RefSnapshotPreparationError),
+    #[error("native merge ancestry failed")]
+    Ancestry(#[from] RefProofError),
+    #[error("native merge attestation failed")]
+    Attestation(#[from] CatalogAttestationError),
+    #[error("native merge context or strategy differs")]
+    Context,
+    #[error("native merge command preparation failed")]
+    Command(#[source] Box<InvocationError<MergeOutcome>>),
+}
+
+impl NativeMergeProof {
+    fn shape(&self) -> Result<(), CodecError> {
+        let data = self.certificate.data()?;
+        self.input.encode(&mut BoundedEncoder::new(4096)?)?;
+        if data.compaction
+            || data.input_count != 0
+            || data.input_checkpoint_digest.is_some()
+            || data.base.refs.is_none()
+            || data.actor != self.input.actor
+            || self.selection.repository != data.token.repository
+            || self.selection.actor.as_deref() != Some(&self.input.actor)
+            || self.selection.proof.is_some()
+            || self.selection.facts.len() > 2
+            || self.input.request.strategy != MergeStrategy::FastForward
+        {
+            return Err(CodecError::Invalid("invalid native merge scope"));
+        }
+        self.selection
+            .encode(&mut BoundedEncoder::new(NATIVE_MERGE_BYTES)?)?;
+        if self.selection.facts.iter().any(|f| {
+            f.state
+                .as_ref()
+                .and_then(|s| s.oid)
+                .is_some_and(|o| o.format() != data.catalog.format)
+        }) {
+            return Err(CodecError::Invalid("native merge ref format"));
+        }
+        if let Some(t) = &self.transition {
+            super::ref_proof::shape(&t.plan, data.catalog.format)
+                .map_err(|_| CodecError::Invalid("native merge plan"))?;
+            super::ref_proof::binding(&t.plan, &t.ancestry)?;
+            if t.plan.actor != self.input.actor
+                || t.plan.updates.len() != 1
+                || t.plan.updates[0].new_oid.is_none()
+                || t.plan.updates[0]
+                    .expected
+                    .as_ref()
+                    .and_then(|s| s.oid)
+                    .is_none()
+                || t.refs
+                    .is_some_and(|r| r.operation() != data.token.artifact_operation)
+                || t.refs.is_some() != super::ref_proof::proven(&t.ancestry, 0)
+            {
+                return Err(CodecError::Invalid("invalid native merge transition"));
+            }
+        }
+        Ok(())
+    }
+    fn binding(&self) -> Result<[u8; 32], CodecError> {
+        Self::payload_binding(&self.input, &self.selection, &self.transition)
+    }
+    fn payload_binding(
+        input: &MergeInput,
+        selection: &RefSelection,
+        transition: &Option<Transition>,
+    ) -> Result<[u8; 32], CodecError> {
+        let mut e = BoundedEncoder::new(4096)?;
+        input.encode(&mut e)?;
+        let request = *blake3::hash(&e.finish()).as_bytes();
+        let mut h = blake3::Hasher::new();
+        h.update(b"canopy.native-reviewed-merge.v1\0");
+        h.update(&selection.binding(request)?);
+        h.update(&[u8::from(transition.is_some())]);
+        if let Some(t) = transition {
+            h.update(&super::ref_proof::binding(&t.plan, &t.ancestry)?);
+            let mut e = BoundedEncoder::new(128)?;
+            t.refs.encode(&mut e)?;
+            h.update(&e.finish());
+        }
+        Ok(*h.finalize().as_bytes())
+    }
+}
+impl WireValue for NativeMergeProof {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.shape()?;
+        self.certificate.encode(e)?;
+        self.input.encode(e)?;
+        self.selection.encode(e)?;
+        e.write_bool(self.transition.is_some())?;
+        if let Some(t) = &self.transition {
+            t.plan.encode(e)?;
+            e.write_bytes(&t.ancestry)?;
+            t.refs.encode(e)?;
+        }
+        Ok(())
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            certificate: CatalogCertificate::decode(d)?,
+            input: MergeInput::decode(d)?,
+            selection: RefSelection::decode(d)?,
+            transition: if d.read_bool()? {
+                Some(Transition {
+                    plan: PushPlan::decode(d)?,
+                    ancestry: d.read_bytes()?.to_vec(),
+                    refs: Option::<RefStateSnapshotRoot>::decode(d)?,
+                })
+            } else {
+                None
+            },
+        };
+        value.shape()?;
+        Ok(value)
+    }
+}
+impl PreparedCatalog {
+    pub(crate) async fn native_merge_proof(
+        &self,
+        input: MergeInput,
+        directory: &Path,
+        budget: DiskBudget,
+        limits: MetadataLimits,
+    ) -> Result<NativeMergeProof, NativeMergePreparationError> {
+        let (_, deadline) = self.base.live_lease()?;
+        timeout_at(
+            deadline,
+            Box::pin(async {
+                input.encode(&mut BoundedEncoder::new(4096)?)?;
+                if self.input_count() != 0
+                    || self.input_checkpoint_digest.is_some()
+                    || input.actor != self.base.capability().2.actor
+                    || input.request.strategy != MergeStrategy::FastForward
+                {
+                    return Err(NativeMergePreparationError::Context);
+                }
+                let (client, target, _) = self.base.capability();
+                let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
+                let selected = sql
+                    .query(
+                        None,
+                        statement(
+                            "SELECT source_ref,base_ref FROM pull_requests WHERE number=?1",
+                            vec![SqlValue::Integer(input.number)],
+                        ),
+                    )
+                    .await
+                    .map_err(|e| NativeMergePreparationError::Query(Box::new(e)))?;
+                let store = self.base.indexes().store();
+                let snapshot = self
+                    .base()
+                    .refs
+                    .ok_or(NativeMergePreparationError::Context)?
+                    .read(&store)
+                    .await?;
+                if snapshot.repository != self.token().repository
+                    || snapshot.format != self.catalog().format
+                {
+                    return Err(NativeMergePreparationError::Context);
+                }
+                let refs = RefStateIndex::new(store, snapshot.format);
+                let mut selection = RefSelection {
+                    repository: self.token().repository,
+                    actor: Some(input.actor.clone()),
+                    facts: Vec::new(),
+                    proof: None,
+                };
+                let names = match rows(&selected.output)?.first().map(Vec::as_slice) {
+                    Some([SqlValue::Text(source), SqlValue::Text(base)]) => {
+                        Some((source.clone(), base.clone()))
+                    }
+                    None => None,
+                    _ => return Err(NativeMergePreparationError::Context),
+                };
+                let mut transition = None;
+                if let Some((source, base)) = names {
+                    let source_state = refs.read(snapshot.root.clone(), &source).await?;
+                    let base_state = refs.read(snapshot.root, &base).await?;
+                    selection.facts.push(RefFact {
+                        name: source.clone(),
+                        state: source_state.clone(),
+                    });
+                    if source != base {
+                        selection.facts.push(RefFact {
+                            name: base.clone(),
+                            state: base_state.clone(),
+                        });
+                    }
+                    selection.facts.sort_by(|a, b| a.name.cmp(&b.name));
+                    if let (Some(source_oid), Some(base_state)) =
+                        (source_state.and_then(|s| s.oid), base_state)
+                        && base_state.oid.is_some()
+                        && base_state.oid != Some(source_oid)
+                    {
+                        let plan = PushPlan {
+                            actor: input.actor.clone(),
+                            updates: vec![crate::RefUpdate {
+                                name: base,
+                                expected: Some(base_state),
+                                new_oid: Some(source_oid),
+                            }],
+                        };
+                        let (plan, ancestry) = self
+                            .required_ref_evidence(plan, directory, budget, limits)
+                            .await?;
+                        let proposed = if super::ref_proof::proven(&ancestry, 0) {
+                            Some(self.prepare_ref_snapshot(&plan).await?.snapshot())
+                        } else {
+                            None
+                        };
+                        transition = Some(Transition {
+                            plan,
+                            ancestry,
+                            refs: proposed,
+                        });
+                    }
+                }
+                let binding = NativeMergeProof::payload_binding(&input, &selection, &transition)?;
+                let proof = NativeMergeProof {
+                    certificate: self.issue_certificate(Some(binding), None).await?,
+                    input,
+                    selection,
+                    transition,
+                };
+                proof.encode(&mut BoundedEncoder::new(NATIVE_MERGE_BYTES)?)?;
+                self.ensure_live()?;
+                Ok(proof)
+            }),
+        )
+        .await
+        .map_err(|_| PreparationBaseError::Inactive)?
+    }
+}
+
+pub struct PublishReviewedMerge;
+impl Command for PublishReviewedMerge {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 9;
+    const CODEC_VERSION: u32 = 5;
+    type Input = NativeMergeProof;
+    type Output = MergeOutcome;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        let data = input.certificate.data()?;
+        let check = LeaseCheck {
+            token: data.token,
+            actor: data.actor,
+        };
+        recovery::execute(context, &check, recovery::Kind::Merge, |context| {
+            publish(context, input)
+        })
+    }
+}
+fn denied(outcome: MergeOutcome) -> CommandResult<MergeOutcome> {
+    CommandResult::Rejected(outcome)
+}
+
+fn publish(
+    context: &mut CommandContext<'_, '_>,
+    proof: NativeMergeProof,
+) -> cellule_runtime::Result<CommandResult<MergeOutcome>> {
+    proof.shape()?;
+    let Some((data, key)) =
+        authenticate(context, &proof.certificate, Some(proof.binding()?), None)?
+    else {
+        return Ok(denied(MergeOutcome::Conflict));
+    };
+    let input = proof.input;
+    let role = crate::access::decode_access(&context.sql(&SqlBatch {
+        statements: vec![crate::access::access_statement(&input.actor)],
+    })?)?;
+    let Some(role) = role else {
+        return Ok(denied(MergeOutcome::NotFound));
+    };
+    if role < TokenScope::Write {
+        return Ok(denied(MergeOutcome::Forbidden));
+    }
+    let id = uuid::Uuid::parse_str(&input.request.id)
+        .map_err(|_| Error::Command("invalid merge UUID"))?;
+    let binding = request_binding(&input);
+    let previous = context.sql(&statement(
+        "SELECT binding,id,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version FROM pull_merges WHERE id=?1",
+        vec![blob(id.as_bytes())],
+    ))?;
+    if let Some(row) = rows(&previous)?.first() {
+        let Some(SqlValue::Blob(old)) = row.first() else {
+            return Err(Error::Command("invalid merge binding"));
+        };
+        if *old != binding {
+            return Ok(denied(MergeOutcome::Conflict));
+        }
+        return Ok(CommandResult::Success(MergeOutcome::Applied {
+            merge: crate::pulls::merge::record(&row[1..])?,
+        }));
+    }
+    if data.token.owner != context.owner_fence() {
+        return Ok(denied(MergeOutcome::Conflict));
+    }
+    let Some(row) = load(context, data.token)? else {
+        return Ok(denied(MergeOutcome::Conflict));
+    };
+    if !matched(
+        &row,
+        &LeaseCheck {
+            token: data.token,
+            actor: data.actor.clone(),
+        },
+    ) || row.expires <= now(context.now_ms())?
+    {
+        return Ok(denied(MergeOutcome::Conflict));
+    }
+    check_pin(context, &row)?;
+    if !retention_matches(context, &data, row.generation, data.catalog.format)?
+        || fact(context, data.token.repository, data.catalog.format, None)? != data.base
+    {
+        return Ok(denied(MergeOutcome::Conflict));
+    }
+    let reviewed =
+        match crate::pulls::merge::reviewed_native_update(context, &input, &proof.selection)? {
+            Ok(value) => value,
+            Err(outcome) => return Ok(denied(outcome)),
+        };
+    let Some(transition) = proof.transition else {
+        return Ok(denied(MergeOutcome::Conflict));
+    };
+    let update = reviewed.update();
+    if !reviewed.authorizes(&transition.plan.updates[0]) {
+        return Ok(denied(MergeOutcome::Conflict));
+    }
+    if !super::ref_proof::proven(&transition.ancestry, 0) {
+        return Ok(denied(MergeOutcome::NotFastForward));
+    }
+    let Some(refs) = transition.refs else {
+        return Ok(denied(MergeOutcome::Conflict));
+    };
+    let policy = context.sql(&SqlBatch {
+        statements: vec![crate::branch_rules::policy_statement_with_ancestry(
+            update, true,
+        )],
+    })?;
+    if crate::branch_rules::decode_policy(&policy)?
+        .is_some_and(|p| !p.allows_reviewed(update, &reviewed))
+    {
+        return Ok(denied(MergeOutcome::BranchPolicy));
+    }
+    let count = context.sql(&statement(
+        "SELECT count(*) FROM (SELECT generation FROM catalog_generations LIMIT ?1)",
+        vec![number(MAX_RETAINED_GENERATIONS)?],
+    ))?;
+    let Some([count]) = rows(&count)?.first().map(Vec::as_slice) else {
+        return Err(Error::Command("missing merge generation count"));
+    };
+    if unsigned(count)? >= MAX_RETAINED_GENERATIONS {
+        return Ok(denied(MergeOutcome::Conflict));
+    }
+    let Some(missing) = checkpoint(context, &data, &key)? else {
+        return Ok(denied(MergeOutcome::Conflict));
+    };
+    let bytes = proof.certificate.bytes()?;
+    let digest = *blake3::hash(&bytes).as_bytes();
+    let generation = data
+        .base
+        .generation
+        .checked_add(1)
+        .filter(|g| *g <= i64::MAX as u64)
+        .ok_or(Error::Command("merge generation exhausted"))?;
+    let source = update
+        .new_oid
+        .ok_or(Error::Command("missing merge source"))?;
+    let base = update
+        .expected
+        .as_ref()
+        .and_then(|s| s.oid)
+        .ok_or(Error::Command("missing merge base"))?;
+    let result = MergeOutcome::Applied {
+        merge: MergeRecord {
+            id: input.request.id.clone(),
+            number: input.number,
+            oid: hex::encode(source),
+            merged_at_ms: input.issued_at_ms,
+            revision: input.request.revision.clone(),
+        },
+    };
+    result.encode(&mut BoundedEncoder::new(512)?)?;
+    let mut catalog = BoundedEncoder::new(256)?;
+    data.catalog.encode(&mut catalog)?;
+    let mut encoded_refs = BoundedEncoder::new(128)?;
+    refs.encode(&mut encoded_refs)?;
+    if row.expires <= now(context.now_ms())? {
+        return Ok(denied(MergeOutcome::Conflict));
+    }
+    // Every later error rolls back roots, pull/UUID state, checkpoint, operation
+    // consumption and the exact recovery journal together. No later rejection.
+    if missing {
+        changed(context.sql(&statement("UPDATE catalog_operations SET attestation=?1,attestation_digest=?2 WHERE id=?3 AND attestation IS NULL", vec![blob(&bytes),blob(digest),blob(data.token.operation)]))?)?;
+        changed(context.sql(&statement("UPDATE catalog_leases SET attestation=?1,attestation_digest=?2 WHERE incarnation=?3 AND admission_sequence=?4 AND attestation IS NULL", vec![blob(&bytes),blob(digest),blob(data.token.owner.incarnation.as_bytes()),number(data.token.attempt)?]))?)?;
+    }
+    changed(context.sql(&statement(
+        "INSERT INTO catalog_generations(generation,catalog,certificate,refs) VALUES(?1,?2,?3,?4)",
+        vec![
+            number(generation)?,
+            blob(catalog.finish()),
+            blob(digest),
+            blob(encoded_refs.finish()),
+        ],
+    ))?)?;
+    changed(context.sql(&statement(
+        "UPDATE catalog_state SET generation=?1 WHERE singleton=1 AND generation=?2",
+        vec![number(generation)?, number(data.base.generation)?],
+    ))?)?;
+    changed(context.sql(&statement("UPDATE pull_requests SET state='merged',version=version+1,updated_ms=max(updated_ms,?2) WHERE number=?1 AND state='open' AND version=?3 AND version<9223372036854775807", vec![SqlValue::Integer(input.number),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version)]))?)?;
+    changed(context.sql(&statement("INSERT INTO pull_merges(id,binding,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9,?10)", vec![blob(id.as_bytes()),blob(binding),SqlValue::Integer(input.number),blob(source),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version),blob(crate::pulls::merge::oid(&input.request.revision.source_oid)?),SqlValue::Integer(input.request.revision.source_version),blob(base),SqlValue::Integer(input.request.revision.base_version)]))?)?;
+    changed(context.sql(&statement(
+        "DELETE FROM catalog_operations WHERE id=?1",
+        vec![blob(data.token.operation)],
+    ))?)?;
+    Ok(CommandResult::Success(result))
+}
diff --git a/crates/canopy-server/src/packs/publication/recovery/archive.rs b/crates/canopy-server/src/packs/publication/recovery/archive.rs
index 6178eb3d..5e9219a6 100644
--- a/crates/canopy-server/src/packs/publication/recovery/archive.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/archive.rs
@@ -195,6 +195,12 @@ impl phase::Journal {
     pub(super) fn terminal(&self, record: &Record) -> Result<Option<Terminal>, CodecError> {
         // Validation is required even when only a primary result is selected.
         self.may_advance(record)?;
+        // Merge recovery retains its physical pin until its selected catalog/ref
+        // graph and UUID outcome can be certified for terminal release. It must
+        // not be misdecoded or released as a push/empty initialization graph.
+        if record.kind == Kind::Merge {
+            return Ok(None);
+        }
         if record.kind == Kind::Initialization {
             return self
                 .primary
diff --git a/crates/canopy-server/src/packs/publication/recovery/codec.rs b/crates/canopy-server/src/packs/publication/recovery/codec.rs
index e0e15658..69476b24 100644
--- a/crates/canopy-server/src/packs/publication/recovery/codec.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/codec.rs
@@ -28,6 +28,7 @@ impl WireValue for Record {
             Kind::Outcome => 1,
             Kind::Policy => 2,
             Kind::Initialization => 3,
+            Kind::Merge => 4,
         })?;
         self.primary.encode(e)?;
         e.write_bool(self.refusal.is_some())?;
@@ -54,6 +55,7 @@ impl WireValue for Record {
                 1 => Kind::Outcome,
                 2 => Kind::Policy,
                 3 => Kind::Initialization,
+                4 => Kind::Merge,
                 _ => return Err(CodecError::Invalid("root recovery command")),
             },
             primary: Stamp::decode(d)?,
@@ -89,6 +91,7 @@ impl WireValue for Bundle {
             Kind::Outcome => 1,
             Kind::Policy => 2,
             Kind::Initialization => 3,
+            Kind::Merge => 4,
         })?;
         self.primary.encode(e)?;
         e.write_bool(self.refusal.is_some())?;
@@ -107,6 +110,7 @@ impl WireValue for Bundle {
                 1 => Kind::Outcome,
                 2 => Kind::Policy,
                 3 => Kind::Initialization,
+                4 => Kind::Merge,
                 _ => return Err(CodecError::Invalid("unknown recovery kind")),
             },
             primary: SavedCommand::decode(d)?,
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index 918aeccb..296f29af 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -78,10 +78,13 @@ pub(super) enum Kind {
     Outcome,
     Policy,
     Initialization,
+    Merge,
 }
 impl Kind {
     fn body_limit(self) -> u32 {
-        if self == Self::Initialization {
+        if self == Self::Merge {
+            NATIVE_MERGE_BYTES
+        } else if self == Self::Initialization {
             INITIALIZATION_BYTES
         } else if self == Self::Policy {
             REF_POLICY_PAGE_BYTES
@@ -333,7 +336,7 @@ impl RegisteredRootRecovery {
                 )
                 .await
             }
-            Kind::Policy | Kind::Initialization => {
+            Kind::Policy | Kind::Initialization | Kind::Merge => {
                 Err(AttemptError::Invocation(InvocationError::NotStarted(
                     Error::Command("recovery kind requires typed phase dispatch"),
                 )))
@@ -377,6 +380,22 @@ impl RegisteredRootRecovery {
                 .await
                 .map(PublicationOutcome::Initialization);
         }
+        if self.record.kind == Kind::Merge {
+            let result = self
+                .dispatch_command::<PublishReviewedMerge>(client, store, authority, false, original)
+                .await
+                .map_err(|e| e.publication(self.evidence(), PublicationError::Merge))?;
+            return if matches!(
+                result.output,
+                crate::pulls::merge::MergeOutcome::Applied { .. }
+            ) {
+                Ok(PublicationOutcome::Merge(result))
+            } else {
+                Err(PublicationError::Merge(InvocationError::Rejected(
+                    Box::new(result),
+                )))
+            };
+        }
         if self.record.kind != Kind::Policy {
             let result = match original {
                 Some(original) => {
diff --git a/crates/canopy-server/src/packs/publication/recovery/phase.rs b/crates/canopy-server/src/packs/publication/recovery/phase.rs
index 90219713..08a365b8 100644
--- a/crates/canopy-server/src/packs/publication/recovery/phase.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/phase.rs
@@ -89,6 +89,11 @@ impl Journal {
                     primary.decode_reply::<InitializationReply>()?,
                     InitializationReply::Denied(_)
                 )
+            } else if record.kind == Kind::Merge {
+                !matches!(
+                    primary.decode_reply::<crate::pulls::merge::MergeOutcome>()?,
+                    crate::pulls::merge::MergeOutcome::Applied { .. }
+                )
             } else if record.kind == Kind::Policy {
                 matches!(
                     primary.decode_reply::<RefPolicyReply>()?,
@@ -150,6 +155,8 @@ impl Journal {
                 primary.decode_reply::<InitializationReply>()?,
                 InitializationReply::Denied(_)
             )
+        } else if record.kind == Kind::Merge {
+            false
         } else if record.kind == Kind::Policy {
             matches!(primary.decode_reply::<RefPolicyReply>()?, RefPolicyReply::Registered(value) if value.valid)
         } else {
diff --git a/crates/canopy-server/src/packs/publication/recovery/ready.rs b/crates/canopy-server/src/packs/publication/recovery/ready.rs
index ce064874..d4eea5e6 100644
--- a/crates/canopy-server/src/packs/publication/recovery/ready.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/ready.rs
@@ -105,6 +105,10 @@ impl ReadyRootRecovery {
             PublicationError::Initialization(InvocationError::Pending(Box::new(
                 self.recovery.evidence().clone(),
             )))
+        } else if self.recovery.record.kind == Kind::Merge {
+            PublicationError::Merge(InvocationError::Pending(Box::new(
+                self.recovery.evidence().clone(),
+            )))
         } else if self.recovery.record.kind == Kind::Policy {
             PublicationError::PolicyPage(InvocationError::Pending(Box::new(
                 self.recovery.evidence().clone(),
diff --git a/crates/canopy-server/src/packs/publication/ref_proof.rs b/crates/canopy-server/src/packs/publication/ref_proof.rs
index 089b3ad4..e436eebc 100644
--- a/crates/canopy-server/src/packs/publication/ref_proof.rs
+++ b/crates/canopy-server/src/packs/publication/ref_proof.rs
@@ -262,6 +262,16 @@ impl PreparedCatalog {
         self.ref_evidence_with_ancestry(plan, root, budget, limits, AncestryRequirement::Policy)
             .await
     }
+    pub(super) async fn required_ref_evidence(
+        &self,
+        plan: PushPlan,
+        root: &Path,
+        budget: DiskBudget,
+        limits: MetadataLimits,
+    ) -> Result<(PushPlan, Vec<u8>), RefProofError> {
+        self.ref_evidence_with_ancestry(plan, root, budget, limits, AncestryRequirement::Required)
+            .await
+    }
     async fn ref_evidence_with_ancestry(
         &self,
         plan: PushPlan,
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index ddbcc0cd..0ca39bbe 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,9 +23,10 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 21] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 22] = [
     crate::operation(1),
     command::<crate::branch_rules::command::SetBranchRule>(64 << 10, 64),
+    command::<PublishReviewedMerge>(NATIVE_MERGE_BYTES, 512),
     command::<AbortPreparation>(4096, 4096),
     command::<ReapPreparation>(4096, 4096),
     command::<RegisterCatalogAttestation>(4096, 4096),
@@ -93,7 +94,7 @@ mod tests {
         assert_eq!(
             ids,
             vec![
-                1, 8, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49, 51, 53
+                1, 8, 9, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49, 51, 53
             ]
         );
         assert_eq!(
@@ -105,6 +106,12 @@ mod tests {
             vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48, 50, 52]
         );
         for (id, codec, input, output) in [
+            (
+                9,
+                PublishReviewedMerge::CODEC_VERSION,
+                NATIVE_MERGE_BYTES,
+                512,
+            ),
             (
                 33,
                 RegisterRefPolicyPage::CODEC_VERSION,
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 61abf81b..d16b48cd 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -15,6 +15,7 @@ mod inputs;
 mod mandatory_registration;
 mod namespaces;
 mod native_capture;
+mod native_merge;
 mod policy_dispatch;
 mod policy_refusal;
 mod preparation_receipt;
diff --git a/crates/canopy-server/src/packs/publication/tests/native_merge.rs b/crates/canopy-server/src/packs/publication/tests/native_merge.rs
new file mode 100644
index 00000000..5eeb9e53
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/native_merge.rs
@@ -0,0 +1,546 @@
+//! Trusted initial root fixtures isolate the native transaction and exact SDK
+//! recovery. Pack/catalog bytes come from verified stock-Git witnesses; this
+//! does not qualify the public merge adapter or generated candidate producer.
+use super::*;
+use super::{
+    prepare::{cleaned, opened},
+    publishing::{Graph, assembled, edit, plan, state, update},
+};
+use crate::{
+    packs::{
+        metadata::tests::limits,
+        ref_state::{RefStateIndex, RefStateSnapshot},
+    },
+    pulls::PullRevision,
+    pulls::merge::{MergeOutcome, MergeRecord, MergeRequest, MergeStrategy, command::MergeInput},
+};
+use cellule_ltx::DiskBudget;
+use cellule_runtime::{PreparedCommand, Resolution};
+
+async fn initial(format: ObjectFormat, unrelated: bool) -> Result<(Fixture, Graph, MergeRequest)> {
+    let f = Fixture::new(format).await?;
+    let graph = assembled(&f, [245; 16], 16).await?;
+    let source = if unrelated { graph.other } else { graph.tip };
+    let store = graph.store.clone();
+    let namespace = graph.prepared.token().artifact_operation;
+    let index = RefStateIndex::new(store.clone(), format);
+    let refs = index
+        .prepare(
+            None,
+            namespace,
+            &plan(vec![
+                update("refs/heads/main", None, Some(graph.initial)),
+                update("refs/heads/feature", None, Some(source)),
+            ]),
+        )
+        .await?;
+    let refs = RefStateSnapshotRoot::upload(
+        &store,
+        namespace,
+        RefStateSnapshot {
+            repository: f.repository,
+            format,
+            generation: 1,
+            default_branch: "refs/heads/main".into(),
+            root: Some(refs.root()),
+        },
+    )
+    .await?;
+    let mut catalog = BoundedEncoder::new(256)?;
+    graph.prepared.catalog().encode(&mut catalog)?;
+    let mut encoded_refs = BoundedEncoder::new(128)?;
+    refs.encode(&mut encoded_refs)?;
+    let catalog = catalog.finish();
+    let refs = encoded_refs.finish();
+    let base = graph.initial.to_vec();
+    let source_bytes = source.to_vec();
+    f.handle.execute(identity()?, Digest::from_bytes([145;32]), sql::now(0)?, 4096, 0, move |tx| {
+        tx.execute("INSERT INTO catalog_generations(generation,catalog,certificate,refs) VALUES(1,?1,?2,?3)", rusqlite::params![catalog,[4u8;32].as_slice(),refs])?;
+        tx.execute("UPDATE catalog_state SET generation=1 WHERE singleton=1", [])?;
+        tx.execute("INSERT INTO pull_requests(number,id,creation_digest,author,title,body,state,draft,version,source_ref,base_ref,initial_source_oid,initial_base_oid,created_ms,updated_ms) VALUES(1,?1,?2,'writer','Merge','', 'open',0,1,'refs/heads/feature','refs/heads/main',?3,?4,0,0)",rusqlite::params![[25u8;16].as_slice(),[26u8;32].as_slice(),source_bytes,base])?;
+        Ok(cellule_runtime::cell::executor::HandlerOutcome::Success(Vec::new()))
+    }).await?;
+    let request = MergeRequest {
+        id: uuid::Uuid::new_v4().to_string(),
+        strategy: MergeStrategy::FastForward,
+        candidate_id: None,
+        revision: PullRevision {
+            pull_version: 1,
+            source_oid: hex::encode(source),
+            source_version: 1,
+            base_oid: hex::encode(graph.initial),
+            base_version: 1,
+        },
+    };
+    Ok((f, graph, request))
+}
+async fn preparation(
+    f: &Fixture,
+    graph: &Graph,
+) -> Result<(Arc<PreparedCatalog>, tempfile::TempDir, DiskBudget)> {
+    let (base, _, _) = opened(f, *uuid::Uuid::new_v4().as_bytes(), graph.store.clone()).await?;
+    let root = tempfile::TempDir::new()?;
+    let budget = DiskBudget::new(256 << 20);
+    let prepared = Arc::new(
+        CatalogPreparation::new(root.path(), budget.clone(), base, limits())
+            .await?
+            .finish()
+            .await?,
+    );
+    assert_eq!(prepared.input_count(), 0);
+    Ok((prepared, root, budget))
+}
+async fn prepared_command(
+    f: &Fixture,
+    prepared: &PreparedCatalog,
+    request: MergeRequest,
+    root: &std::path::Path,
+    budget: DiskBudget,
+) -> Result<(
+    PreparedCommand<PublishReviewedMerge>,
+    RegisteredRootRecovery,
+)> {
+    let mutation = identity()?;
+    let proof = prepared
+        .native_merge_proof(
+            MergeInput {
+                actor: "owner".into(),
+                number: 1,
+                request,
+                issued_at_ms: mutation.issued_at_ms,
+            },
+            root,
+            budget,
+            limits(),
+        )
+        .await?;
+    let command = f
+        .client()
+        .prepare_command::<PublishReviewedMerge>(&f.target, mutation, proof)
+        .await?;
+    let registered = super::super::recovery::persist(
+        &prepared.base.session,
+        &command,
+        super::super::recovery::Kind::Merge,
+        &prepared.base.indexes().store(),
+        identity()?,
+        0,
+    )
+    .await?;
+    Ok((command, registered))
+}
+async fn domain_state(f: &Fixture) -> Result<Vec<u8>> {
+    let roots = state(&f.handle).await?;
+    let editorial = f
+        .handle
+        .query(0, 4096, |db| {
+            let pull = db.query_row(
+                "SELECT state,version,updated_ms FROM pull_requests WHERE number=1",
+                [],
+                |r| {
+                    Ok((
+                        r.get::<_, String>(0)?,
+                        r.get::<_, i64>(1)?,
+                        r.get::<_, i64>(2)?,
+                    ))
+                },
+            )?;
+            let merges = db.query_row("SELECT count(*) FROM pull_merges", [], |r| {
+                r.get::<_, u64>(0)
+            })?;
+            serde_json::to_vec(&(pull, merges)).map_err(|_| Error::Command("merge fixture state"))
+        })
+        .await?;
+    Ok([roots, editorial].concat())
+}
+async fn merged_roots(f: &Fixture, graph: &Graph) -> Result {
+    let bytes=f.handle.query(0,4096,|db| {
+        let result=db.query_row("SELECT s.generation,g.refs,(SELECT count(*) FROM refs),(SELECT generation FROM ref_generation),(SELECT state FROM pull_requests WHERE number=1),(SELECT count(*) FROM pull_merges) FROM catalog_state s JOIN catalog_generations g ON g.generation=s.generation",[],|r|Ok((r.get::<_,u64>(0)?,r.get::<_,Vec<u8>>(1)?,r.get::<_,u64>(2)?,r.get::<_,u64>(3)?,r.get::<_,String>(4)?,r.get::<_,u64>(5)?)))?;
+        serde_json::to_vec(&result).map_err(|_|Error::Command("merge fixture roots"))
+    }).await?;
+    let (generation, refs, legacy, legacy_generation, pull, merges): (
+        u64,
+        Vec<u8>,
+        u64,
+        u64,
+        String,
+        u64,
+    ) = serde_json::from_slice(&bytes)?;
+    assert_eq!(
+        (generation, legacy, legacy_generation, pull.as_str(), merges),
+        (2, 0, 0, "merged", 1)
+    );
+    let mut d = BoundedDecoder::new(&refs, 128)?;
+    let root = RefStateSnapshotRoot::decode(&mut d)?;
+    d.finish()?;
+    let snapshot = root.read(&graph.store).await?;
+    assert_eq!(snapshot.generation, 2);
+    let index = RefStateIndex::new(graph.store.clone(), f.format);
+    let base = index
+        .read(snapshot.root.clone(), "refs/heads/main")
+        .await?
+        .ok_or("merged base")?;
+    let source = index
+        .read(snapshot.root, "refs/heads/feature")
+        .await?
+        .ok_or("source")?;
+    assert_eq!(
+        (base.oid, base.version, source.oid, source.version),
+        (Some(graph.tip), 2, Some(graph.tip), 1)
+    );
+    Ok(())
+}
+#[tokio::test]
+async fn native_merge_commits_joint_roots_pull_uuid_and_original_receipt_without_sql_ref_authority()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let (command, registered) =
+            prepared_command(&f, &prepared, request.clone(), root.path(), budget.clone()).await?;
+        let result = command.clone().execute().await?;
+        let MergeOutcome::Applied { ref merge } = result.output else {
+            return Err("merge denied".into());
+        };
+        assert_eq!(
+            (merge.id.as_str(), merge.oid.as_str()),
+            (request.id.as_str(), request.revision.source_oid.as_str())
+        );
+        merged_roots(&f, &graph).await?;
+        let recovered = registered
+            .dispatch_any(
+                &f.client(),
+                &graph.store,
+                &f.authority(),
+                &std::sync::atomic::AtomicBool::new(false),
+            )
+            .await?;
+        let PublicationOutcome::Merge(recovered) = recovered else {
+            return Err("wrong recovered purpose".into());
+        };
+        assert_eq!(recovered.receipt, result.receipt);
+        assert_eq!(recovered.output, result.output);
+        // A fresh SDK identity and privately owned attempt replay the original
+        // application UUID, even though the pull and base revision have advanced.
+        let (retry, retry_root, retry_budget) = preparation(&f, &graph).await?;
+        let (retry_command, _) =
+            prepared_command(&f, &retry, request, retry_root.path(), retry_budget.clone()).await?;
+        assert_eq!(retry_command.execute().await?.output, result.output);
+        merged_roots(&f, &graph).await?;
+        drop(retry);
+        cleaned(retry_root.path(), &retry_budget).await?;
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_merge_unprotected_unrelated_history_records_refusal_without_publishing() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, true).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let (command, registered) =
+            prepared_command(&f, &prepared, request, root.path(), budget.clone()).await?;
+        let before = domain_state(&f).await?;
+        let result = command.execute().await?;
+        assert_eq!(result.output, MergeOutcome::NotFastForward);
+        assert_eq!(domain_state(&f).await?, before);
+        let recovered = registered
+            .dispatch_any(
+                &f.client(),
+                &graph.store,
+                &f.authority(),
+                &std::sync::atomic::AtomicBool::new(false),
+            )
+            .await;
+        assert!(
+            matches!(recovered,Err(PublicationError::Merge(InvocationError::Rejected(value))) if value.receipt==result.receipt && value.output==MergeOutcome::NotFastForward)
+        );
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_merge_late_review_requirement_is_current_and_does_not_bind_a_rejected_application_uuid()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let (first, registered) =
+            prepared_command(&f, &prepared, request.clone(), root.path(), budget.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO branch_rules VALUES('refs/heads/main',1,1,1,1,1,1)",
+        )
+        .await?;
+        let before = domain_state(&f).await?;
+        let result = first.execute().await?;
+        assert_eq!(result.output, MergeOutcome::ReviewsRequired);
+        assert_eq!(domain_state(&f).await?, before);
+        // Remove only the review requirement, retain require-PR, ancestry and
+        // deletion policy. Only the reviewed command may satisfy this PR gate.
+        edit(&f,"UPDATE branch_rules SET required_approvals=0,version=2 WHERE reference='refs/heads/main'").await?;
+        let (retry, retry_root, retry_budget) = preparation(&f, &graph).await?;
+        let (retry_command, _) =
+            prepared_command(&f, &retry, request, retry_root.path(), retry_budget.clone()).await?;
+        assert!(matches!(
+            retry_command.execute().await?.output,
+            MergeOutcome::Applied { .. }
+        ));
+        merged_roots(&f, &graph).await?;
+        assert!(
+            matches!(registered.dispatch_any(&f.client(),&graph.store,&f.authority(),&std::sync::atomic::AtomicBool::new(false)).await,
+            Err(PublicationError::Merge(InvocationError::Rejected(value))) if value.receipt==result.receipt && value.output==MergeOutcome::ReviewsRequired)
+        );
+        drop(retry);
+        cleaned(retry_root.path(), &retry_budget).await?;
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_merge_late_sql_abort_rolls_back_roots_pull_uuid_checkpoint_and_recovery_phase()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let (command, _registered) =
+            prepared_command(&f, &prepared, request, root.path(), budget.clone()).await?;
+        edit(&f,"CREATE TRIGGER abort_merge BEFORE INSERT ON pull_merges BEGIN SELECT RAISE(ABORT,'late merge failure'); END;").await?;
+        let phase_before = phase_state(&f).await?;
+        let before = domain_state(&f).await?;
+        assert!(command.clone().execute().await.is_err());
+        assert_eq!(domain_state(&f).await?, before);
+        assert!(matches!(
+            f.client().resolve(command.evidence()).await?,
+            Resolution::Absent
+        ));
+        assert_eq!(phase_state(&f).await?, phase_before);
+        edit(&f, "DROP TRIGGER abort_merge").await?;
+        assert!(matches!(
+            command.execute().await?.output,
+            MergeOutcome::Applied { .. }
+        ));
+        merged_roots(&f, &graph).await?;
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+#[test]
+fn maximum_sha256_merge_result_fits_existing_512_byte_recovery_contract() -> Result {
+    let max = i64::MAX;
+    let result = MergeOutcome::Applied {
+        merge: MergeRecord {
+            id: "12345678-1234-1234-1234-123456789abc".into(),
+            number: max,
+            oid: "c".repeat(64),
+            merged_at_ms: max,
+            revision: PullRevision {
+                pull_version: max - 1,
+                source_oid: "a".repeat(64),
+                source_version: max - 1,
+                base_oid: "b".repeat(64),
+                base_version: max - 1,
+            },
+        },
+    };
+    let mut e = BoundedEncoder::new(512)?;
+    result.encode(&mut e)?;
+    let bytes = e.finish();
+    assert_eq!(bytes.len(), 493);
+    let mut d = BoundedDecoder::new(&bytes, 512)?;
+    assert_eq!(MergeOutcome::decode(&mut d)?, result);
+    d.finish()?;
+    Ok(())
+}
+
+async fn phase_state(f: &Fixture) -> Result<Vec<u8>> {
+    Ok(f.handle.query(0,65536,|db| {
+        let mut statement=db.prepare("SELECT recovery_phase,recovery_phase_revision FROM catalog_leases ORDER BY admission_sequence")?;
+        let rows=statement.query_map([],|r|Ok((r.get::<_,Option<Vec<u8>>>(0)?,r.get::<_,u64>(1)?)))?.collect::<rusqlite::Result<Vec<_>>>()?;
+        serde_json::to_vec(&rows).map_err(|_|Error::Command("merge fixture phase state"))
+    }).await?)
+}
+
+#[tokio::test]
+async fn native_merge_changed_request_and_later_joint_generation_cannot_publish() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for altered_request in [true, false] {
+            let (f, graph, request) = initial(format, false).await?;
+            let (prepared, root, budget) = preparation(&f, &graph).await?;
+            let mutation = identity()?;
+            let proof = prepared
+                .native_merge_proof(
+                    MergeInput {
+                        actor: "owner".into(),
+                        number: 1,
+                        request: request.clone(),
+                        issued_at_ms: mutation.issued_at_ms,
+                    },
+                    root.path(),
+                    budget.clone(),
+                    limits(),
+                )
+                .await?;
+            let mut e = BoundedEncoder::new(NATIVE_MERGE_BYTES)?;
+            proof.encode(&mut e)?;
+            let mut bytes = e.finish();
+            if altered_request {
+                let locations: Vec<_> = bytes
+                    .windows(request.id.len())
+                    .enumerate()
+                    .filter(|(_, b)| *b == request.id.as_bytes())
+                    .map(|(i, _)| i)
+                    .collect();
+                assert_eq!(locations.len(), 1);
+                let last = locations[0] + request.id.len() - 1;
+                bytes[last] = if bytes[last] == b'a' { b'b' } else { b'a' };
+            }
+            let mut d = BoundedDecoder::new(&bytes, NATIVE_MERGE_BYTES)?;
+            let proof = NativeMergeProof::decode(&mut d)?;
+            d.finish()?;
+            let command = f
+                .client()
+                .prepare_command::<PublishReviewedMerge>(&f.target, mutation, proof)
+                .await?;
+            super::super::recovery::persist(
+                &prepared.base.session,
+                &command,
+                super::super::recovery::Kind::Merge,
+                &graph.store,
+                identity()?,
+                0,
+            )
+            .await?;
+            if !altered_request {
+                // Model an authoritative unrelated catalog publication with
+                // identical ref facts. The joint generation alone must fence it.
+                edit(&f, "INSERT INTO catalog_generations SELECT 2,catalog,certificate,refs FROM catalog_generations WHERE generation=1; UPDATE catalog_state SET generation=2 WHERE singleton=1;").await?;
+            }
+            let before = domain_state(&f).await?;
+            assert_eq!(command.execute().await?.output, MergeOutcome::Conflict);
+            assert_eq!(domain_state(&f).await?, before);
+            drop(prepared);
+            cleaned(root.path(), &budget).await?;
+            drop(graph.prepared);
+            cleaned(graph.root.path(), &graph.budget).await?;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_merge_requires_registered_original_command_before_its_first_domain_write() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let mutation = identity()?;
+        let proof = prepared
+            .native_merge_proof(
+                MergeInput {
+                    actor: "owner".into(),
+                    number: 1,
+                    request,
+                    issued_at_ms: mutation.issued_at_ms,
+                },
+                root.path(),
+                budget.clone(),
+                limits(),
+            )
+            .await?;
+        let command = f
+            .client()
+            .prepare_command::<PublishReviewedMerge>(&f.target, mutation, proof)
+            .await?;
+        let before = domain_state(&f).await?;
+        assert!(command.clone().execute().await.is_err());
+        assert_eq!(domain_state(&f).await?, before);
+        assert!(matches!(
+            f.client().resolve(command.evidence()).await?,
+            Resolution::Absent
+        ));
+        super::super::recovery::persist(
+            &prepared.base.session,
+            &command,
+            super::super::recovery::Kind::Merge,
+            &graph.store,
+            identity()?,
+            0,
+        )
+        .await?;
+        assert!(matches!(
+            command.execute().await?.output,
+            MergeOutcome::Applied { .. }
+        ));
+        merged_roots(&f, &graph).await?;
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_merge_original_result_survives_sqlite_loss_and_actual_owner_restoration() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let check = prepared.base.capability().2.clone();
+        let (command, registered) =
+            prepared_command(&f, &prepared, request, root.path(), budget.clone()).await?;
+        let result = command.execute().await?;
+        assert!(matches!(result.output, MergeOutcome::Applied { .. }));
+        let evidence = registered.evidence().clone();
+        drop(registered);
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        let (runtime, handle, client) = super::durable_recovery::restore_owner(&f, &check).await?;
+        let loaded = RegisteredRootRecovery::load(&client, &f.target, &graph.store, &check)
+            .await?
+            .ok_or("native merge recovery pin missing")?;
+        assert_eq!(loaded.evidence(), &evidence);
+        let recovered = loaded
+            .dispatch_any(
+                &client,
+                &graph.store,
+                &f.authority(),
+                &std::sync::atomic::AtomicBool::new(false),
+            )
+            .await?;
+        let PublicationOutcome::Merge(recovered) = recovered else {
+            return Err("wrong restored result purpose".into());
+        };
+        assert_eq!(recovered.receipt, result.receipt);
+        assert_eq!(recovered.output, result.output);
+        assert!(handle.owner_fence().epoch > check.token.owner.epoch);
+        let rows = handle.query(0, 128, |db| {
+            let result: (u64,u64) = db.query_row("SELECT (SELECT generation FROM catalog_state),(SELECT count(*) FROM pull_merges)", [], |r| Ok((r.get(0)?,r.get(1)?)))?;
+            serde_json::to_vec(&result).map_err(|_| Error::Command("restored merge fixture"))
+        }).await?;
+        assert_eq!(serde_json::from_slice::<(u64, u64)>(&rows)?, (2, 1));
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/pulls/merge/command.rs b/crates/canopy-server/src/pulls/merge/command.rs
index 492b717f..706ff12b 100644
--- a/crates/canopy-server/src/pulls/merge/command.rs
+++ b/crates/canopy-server/src/pulls/merge/command.rs
@@ -8,7 +8,7 @@ use cellule_runtime::{
     codec::WireValue, registry::CommandContext, registry::CommandResult,
 };
 
-#[derive(Deserialize, Serialize)]
+#[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub(crate) struct MergeInput {
     pub actor: String,
@@ -82,22 +82,7 @@ impl Command for MergePull {
             .map_err(|_| Error::Command("invalid merge UUID"))?;
         // Bind actor, parent and full intent. Command timestamps are not part of
         // application retry identity, so a lost reply can use a fresh command.
-        let binding = super::super::mutations::binding(&[
-            &input.actor,
-            &input.number.to_string(),
-            &input.request.revision.pull_version.to_string(),
-            &input.request.revision.source_oid,
-            &input.request.revision.source_version.to_string(),
-            &input.request.revision.base_oid,
-            &input.request.revision.base_version.to_string(),
-            match input.request.strategy {
-                MergeStrategy::FastForward => "fast_forward",
-                MergeStrategy::MergeCommit => "merge_commit",
-                MergeStrategy::Squash => "squash",
-                MergeStrategy::Rebase => "rebase",
-            },
-            input.request.candidate_id.as_deref().unwrap_or(""),
-        ]);
+        let binding = request_binding(&input);
         let previous = context.sql(&SqlBatch {
             statements: vec![SqlStatement {
                 sql: "SELECT binding, id, pull_number, oid, merged_ms, pull_version, source_oid, source_version, base_oid, base_version FROM pull_merges WHERE id = ?1"
@@ -193,3 +178,22 @@ impl Command for MergePull {
         }))
     }
 }
+
+pub(crate) fn request_binding(input: &MergeInput) -> Vec<u8> {
+    super::super::mutations::binding(&[
+        &input.actor,
+        &input.number.to_string(),
+        &input.request.revision.pull_version.to_string(),
+        &input.request.revision.source_oid,
+        &input.request.revision.source_version.to_string(),
+        &input.request.revision.base_oid,
+        &input.request.revision.base_version.to_string(),
+        match input.request.strategy {
+            MergeStrategy::FastForward => "fast_forward",
+            MergeStrategy::MergeCommit => "merge_commit",
+            MergeStrategy::Squash => "squash",
+            MergeStrategy::Rebase => "rebase",
+        },
+        input.request.candidate_id.as_deref().unwrap_or(""),
+    ])
+}
diff --git a/crates/canopy-server/src/pulls/merge/mod.rs b/crates/canopy-server/src/pulls/merge/mod.rs
index 842d8158..68a35cef 100644
--- a/crates/canopy-server/src/pulls/merge/mod.rs
+++ b/crates/canopy-server/src/pulls/merge/mod.rs
@@ -32,7 +32,7 @@ pub struct MergeRecord {
     pub merged_at_ms: i64,
     pub revision: PullRevision,
 }
-pub(super) fn record(row: &[SqlValue]) -> cellule_runtime::Result<MergeRecord> {
+pub(crate) fn record(row: &[SqlValue]) -> cellule_runtime::Result<MergeRecord> {
     let [
         SqlValue::Blob(id),
         SqlValue::Integer(number),
@@ -67,7 +67,7 @@ pub struct ReviewPolicy {
     pub reviews_satisfied: bool,
 }
 /// The final transaction's domain outcome; only Applied moves refs.
-#[derive(Debug, PartialEq, Eq, Deserialize, Serialize)]
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize)]
 #[serde(tag = "status", rename_all = "snake_case")]
 pub enum MergeOutcome {
     Applied { merge: MergeRecord },
@@ -85,10 +85,46 @@ pub(crate) struct ReviewedMerge {
     update: RefUpdate,
 }
 impl ReviewedMerge {
+    pub(crate) fn update(&self) -> &RefUpdate {
+        &self.update
+    }
     pub(crate) fn authorizes(&self, update: &RefUpdate) -> bool {
         self.update == *update
     }
 }
+/// Called only inside the native publisher's authenticated final transaction.
+/// This constructs the same exact-update capability as the original merge
+/// command; client facts alone cannot satisfy the current review predicate.
+pub(crate) fn reviewed_native_update(
+    context: &cellule_runtime::registry::CommandContext<'_, '_>,
+    input: &command::MergeInput,
+    selection: &crate::packs::publication::RefSelection,
+) -> cellule_runtime::Result<Result<ReviewedMerge, MergeOutcome>> {
+    let statement =
+        super::native::with_refs(policy_statement(&input.actor, input.number), selection);
+    let Some(state) = policy_state(&context.sql(&SqlBatch {
+        statements: vec![statement],
+    })?)?
+    else {
+        return Ok(Err(MergeOutcome::NotFound));
+    };
+    if !state.policy.ready || state.policy.revision.as_ref() != Some(&input.request.revision) {
+        return Ok(Err(MergeOutcome::Conflict));
+    }
+    if !state.policy.reviews_satisfied {
+        return Ok(Err(MergeOutcome::ReviewsRequired));
+    }
+    Ok(Ok(ReviewedMerge {
+        update: RefUpdate {
+            name: state.base,
+            expected: Some(RefExpectation {
+                oid: Some(oid(&input.request.revision.base_oid)?),
+                version: input.request.revision.base_version,
+            }),
+            new_oid: Some(oid(&input.request.revision.source_oid)?),
+        },
+    }))
+}
 pub(super) struct ReviewState {
     pub(super) policy: ReviewPolicy,
     base: String,
@@ -226,7 +262,7 @@ fn preparation(
         source: Box::new(error),
     })
 }
-pub(super) fn oid(text: &str) -> cellule_runtime::Result<crate::ObjectId> {
+pub(crate) fn oid(text: &str) -> cellule_runtime::Result<crate::ObjectId> {
     parse_oid(text)
         .and_then(|value| value.try_into().ok())
         .ok_or(Error::Command("invalid merge object ID"))
diff --git a/crates/canopy-server/src/pulls/native/mod.rs b/crates/canopy-server/src/pulls/native/mod.rs
index ba75db36..f09c7489 100644
--- a/crates/canopy-server/src/pulls/native/mod.rs
+++ b/crates/canopy-server/src/pulls/native/mod.rs
@@ -91,7 +91,7 @@ pub(crate) struct ReviewRequest {
 
 /// Shadow the retired table only within this statement with authenticated facts.
 /// Names/OIDs/versions are bound parameters, never interpolated client SQL.
-fn with_refs(mut statement: SqlStatement, selection: &RefSelection) -> SqlStatement {
+pub(crate) fn with_refs(mut statement: SqlStatement, selection: &RefSelection) -> SqlStatement {
     if !statement.sql.contains("FROM refs ") && !statement.sql.contains("JOIN refs ") {
         return statement;
     }
diff --git a/docs/contracts.md b/docs/contracts.md
index 3942d759..89a5103a 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -1729,8 +1729,10 @@ admin-scoped owner token and `{repository_id, rule}`. `rule` contains `reference
 are 422. Repository identity is a UUID precondition. The body limit is 16 KiB
 with a 30-second receive deadline. The Cell command rechecks owner authority.
 
-The one authoritative `refs::apply_refs` function applies to typed
-`FinalizePush`, HTTP `CompletePush`, and `MergePull`. Before any ref writes, each enabled rule
+The historical SQL publisher used `refs::apply_refs` for typed
+`FinalizePush`, HTTP `CompletePush`, and `MergePull`. Native publication instead
+uses privately certified immutable ref roots and reuses current branch/check
+predicates; native reviewed merge operation 9, codec 5 is described below. Before any ref writes, each enabled rule
 checks deletion policy, ancestry and every required check. For a non-deletion,
 the selected attempt is the greatest creation number matching the proposed
 commit, context and current context version. It must have state `success` and
@@ -1742,8 +1744,11 @@ ref mutation, including deletion and recreation. Otherwise deletion depends on
 `deny_deletions`; checks and fast-forward policy govern non-deletions. Branch
 creation needs checks but has no old ancestry to prove.
 
-Verified commit objects provide `commit_parents(child, parent)` when graph
-closure is certified. Only commit-parent edges enter that table. Immutable
+In the retired SQL graph contract, verified commit objects provided
+`commit_parents(child, parent)` when graph closure was certified. Native
+preparation reads verified catalog commit headers and uses MAC-bound ancestry
+evidence; it does not populate these retired tables. The historical contract
+below does not describe native production authority. Only commit-parent edges enter that table. Immutable
 `commit_ancestry(ancestor, descendant)` certificates avoid graph traversal in the
 ref transaction. Operation 7, codec 1 accepts at most 128 child/parent steps.
 Every step must exist in verified parent links and lead either to the claimed
@@ -1917,8 +1922,8 @@ query. Changes to rules or decisions after preparation are reflected immediately
 ref/editorial changes invalidate the prepared observation. Tombstones remove the
 reviewed revision; recreating the same OID with a later ref version cannot restore
 old approvals. Merge ancestry preparation uses this same native policy reader.
-The final merge command and generated Git producers still need native atomic
-publication and are not qualified by these read operations. Codec 2 is a hard
+The public merge adapter and generated Git producers still need native
+publication integration and are not qualified by these read operations. Codec 2 is a hard
 cutover of this unreleased query; no old input decoder is retained.
 
 Native merge preparation has a separate
@@ -1936,8 +1941,46 @@ scratch budget. Neither publishes roots or populates SQL refs/ancestry. A final
 native merge receiver must authenticate the exact proof and conditional ref
 snapshot, check current access/reviews/checks and ref versions, and commit joint
 roots, pull state and UUID result under the actual owner fence and durable
-recovery journal. That receiver and its resident adapter remain unfinished; the
-legacy operation 9 description below is not qualification of the native writer.
+recovery journal. The native receiver described below exists; its resident
+adapter and terminal pin release remain unfinished. The historical SQL merge
+description below is not qualification of the native product workflow.
+
+`PublishReviewedMerge` reuses operation 9 with codec 5 and a 256 KiB input / 512
+byte output contract. It replaces the registered contract rather than decoding
+legacy codec 4. Its private factory requires a ref-only `PreparedCatalog`: no
+incoming pack or native push-result checkpoint is accepted. It reads at most two
+source/base facts from that preparation's immutable ref root, verifies native
+ancestry, and prepares the conditional ref snapshot while preserving HEAD.
+The existing catalog MAC binds actor, exact request including preparation time,
+fact vector, plan/evidence and proposed ref root under a distinct merge purpose.
+No serving-only proof, arbitrary root or transport bit grants write authority.
+
+The final command requires its exact registered SDK command and body before
+evaluating the domain transition. It authenticates the catalog certificate,
+checks current write authority, then replays an exactly bound application UUID
+before testing new policy. A new merge requires the actual owner fence, live
+matching operation and pin, retained base and equality with the current joint
+generation. Authenticated facts join current editorial, review-head and member
+metadata in the same statement-local CTE as native pull reads. The exact reviewed
+update privately satisfies only its require-PR gate; ancestry and current check
+context/reporter results remain mandatory even on unprotected branches.
+
+Joint catalog/ref roots, pull state/version, immutable UUID result, preparation
+checkpoint and operation consumption share the final Cell transaction and its
+durable recovery journal. Errors after the first write roll back all of them.
+Rejected requests do not insert `pull_merges`, so a fresh owned attempt may retry
+the same application UUID after policy changes. The older attempt still recovers
+its original refusal and receipt. `ReadyNativeMerge` binds its exact original
+command and private owner into the existing fair `ReadyBoundRecovery` dispatcher;
+Kind `Merge` cannot be restored or decoded as a push outcome.
+
+The current SHA-256 maximum result encodes to 493 bytes, within the unchanged
+512-byte journal cap. Known results survive original factory loss, SQLite loss
+and actual owner restoration. Merge pins deliberately remain retained: terminal
+release has not yet certified their selected catalog/ref graph and UUID outcome.
+The public adapter still invokes retired preparation/codec 4, so network merge
+remains unqualified. Generated merge/squash/rebase strategies are not accepted by
+this factory; their producers and integration remain required work.
 
 Six HTTP operations live under `/api/repositories/<name>/pulls`: GET/POST the
 collection, GET/PUT `/<number>`, GET/POST `/<number>/reviews`. Every mutation
@@ -2237,7 +2280,11 @@ moves refs. Source must descend from base for this strategy even when the branch
 rule does not require fast-forward pushes. Non-ancestor or unrelated histories
 conflict. There is no synthesized commit, implicit rebase or strategy fallback.
 
-Operation 9, codec 4 publishes the merge in one Repository Cell command:
+Historical SQL merge contract (operation 9, codec 4; no longer registered in
+the native production registry): the old command performed the following
+transaction. The native operation 9, codec 5 contract above replaces its storage
+authority. Public/resident adapter conversion remains open; this historical
+section is not evidence that the current merge endpoint works.
 
 1. Check current write authority. For an existing application UUID, compare its
    binding to actor, pull number, full requested revision and strategy; an exact
diff --git a/docs/evidence/native-merge-atomic-ci-20261005.json b/docs/evidence/native-merge-atomic-ci-20261005.json
new file mode 100644
index 00000000..ede62eac
--- /dev/null
+++ b/docs/evidence/native-merge-atomic-ci-20261005.json
@@ -0,0 +1,852 @@
+{
+  "recorded_at_utc": "2026-10-05T19:54:15.723235+00:00",
+  "base_head": "0b8d3b5c397fb11532f09b8a71e023e604d7a6c1",
+  "host": "macOS, Rust 1.98.0; exact-head Linux qualification remains required",
+  "source_files": 513,
+  "rust_files": 495,
+  "source_hash_digest": "214b64e819382822ffa9bac28434d2ea2bd42a4247421e69025569188b9cf198",
+  "source_manifest": "/tmp/canopy-native-merge-atomic-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "release_qualified": false,
+  "baseline": {
+    "result": "Compiled parent HTTP merge workflow returns 503 where 409 is required. This remains an unresolved public adapter failure; the new private receiver tests do not fix or qualify that endpoint.",
+    "source_digest": "8c242912a383fbfa5ef5c2023163b2491bf0013eb9c0d16b1256a7b3f89897d8",
+    "path": "/tmp/canopy-native-merge-atomic-baseline.log",
+    "sha256": "590de417ee8531b6c2d6300983c4b4311408ed7970a9a9ec3b468a0599764437",
+    "summaries": [
+      "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 1.80s"
+    ]
+  },
+  "intermediate_failed_runs": [
+    {
+      "reason": "First check rejected a moved ref snapshot root and unused import; corrected before regression validation.",
+      "path": "/tmp/canopy-native-merge-atomic-check-first.log",
+      "sha256": "9a976c57c17378c76d3aab61d5d0baa98cbd1aeea25fa3990f0cea5b4198dae3",
+      "summaries": []
+    },
+    {
+      "reason": "First focused compile rejected a wrong PullRevision import; corrected to crate::pulls::PullRevision.",
+      "path": "/tmp/canopy-native-merge-atomic-focused-first.log",
+      "sha256": "634445258d3969468d51ca1691876ae477ea5081f78ff7a904b02c9cbb57eff0",
+      "summaries": []
+    },
+    {
+      "reason": "Focused fixture used literal clock zero and failed mutation identity lifetime validation before the factory ran. Changed fixture to actual sql::now(0); no production checks or assertions relaxed.",
+      "path": "/tmp/canopy-native-merge-atomic-focused-second.log",
+      "sha256": "0f5b526a1206c8b4107efaf2cefe3b92c0818d3077a5ea57596e45044dd2cace",
+      "summaries": [
+        "test result: FAILED. 1 passed; 4 failed; 0 ignored; 0 measured; 725 filtered out; finished in 0.73s"
+      ]
+    }
+  ],
+  "focused": {
+    "source_digest": "214b64e819382822ffa9bac28434d2ea2bd42a4247421e69025569188b9cf198",
+    "result": "8 passed, 0 failed; cases exercise both SHA-1 and SHA-256 where applicable",
+    "path": "/tmp/canopy-native-merge-atomic-final-focused-final.log",
+    "sha256": "070c51bc934daed1f82e76dfa0f320324e5779e8c4dbc1f84a23f8071ea1cb79",
+    "summaries": [
+      "test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 725 filtered out; finished in 3.73s"
+    ]
+  },
+  "source_fingerprint_correction": {
+    "recorded_at_utc": "2026-10-05T19:32:52.974698+00:00",
+    "baseline_source_digest": "f9ba7219fc0d96193935bb46454b975b1071e0dfdef92843b06fcbd805b6ce38",
+    "lib_sha256": "11c9d5461a82e43b5b8d81f99b8de259015841ada0d249885229d28afcb23378",
+    "missing_repository_module_source_inputs": [
+      "packs/publication/native_merge.rs",
+      "packs/publication/coordinator/native_merge.rs"
+    ],
+    "impact": "Explicit RepositoryModule source digest omits new private merge command/ready factory implementation bytes. Add these inputs after current validator is terminal, and revalidate changed source before commit.",
+    "corrected_lib_sha256": "ebaffa1560562db8fd863299c66e2288d72acbf02e3a8ce4d779181ce06156b6",
+    "corrected_source_digest": "214b64e819382822ffa9bac28434d2ea2bd42a4247421e69025569188b9cf198",
+    "missing_after_correction": []
+  },
+  "pre_correction_validation": {
+    "recorded_at_utc": "2026-10-05T19:36:46.613092+00:00",
+    "base_head": "0b8d3b5c397fb11532f09b8a71e023e604d7a6c1",
+    "host": "macOS, Rust 1.98.0; exact-head Linux qualification remains required",
+    "source_files": 513,
+    "rust_files": 495,
+    "source_hash_digest": "f9ba7219fc0d96193935bb46454b975b1071e0dfdef92843b06fcbd805b6ce38",
+    "source_manifest": "/tmp/canopy-native-merge-atomic-before-fingerprint-source.json",
+    "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+    "source_unchanged_during_validation": true,
+    "release_qualified": false,
+    "baseline": {
+      "result": "Compiled parent HTTP merge workflow returns 503 where 409 is required. This remains an unresolved public adapter failure; the new private receiver tests do not fix or qualify that endpoint.",
+      "source_digest": "8c242912a383fbfa5ef5c2023163b2491bf0013eb9c0d16b1256a7b3f89897d8",
+      "path": "/tmp/canopy-native-merge-atomic-baseline.log",
+      "sha256": "590de417ee8531b6c2d6300983c4b4311408ed7970a9a9ec3b468a0599764437",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 1.80s"
+      ]
+    },
+    "intermediate_failed_runs": [
+      {
+        "reason": "First check rejected a moved ref snapshot root and unused import; corrected before regression validation.",
+        "path": "/tmp/canopy-native-merge-atomic-check-first.log",
+        "sha256": "9a976c57c17378c76d3aab61d5d0baa98cbd1aeea25fa3990f0cea5b4198dae3",
+        "summaries": []
+      },
+      {
+        "reason": "First focused compile rejected a wrong PullRevision import; corrected to crate::pulls::PullRevision.",
+        "path": "/tmp/canopy-native-merge-atomic-focused-first.log",
+        "sha256": "634445258d3969468d51ca1691876ae477ea5081f78ff7a904b02c9cbb57eff0",
+        "summaries": []
+      },
+      {
+        "reason": "Focused fixture used literal clock zero and failed mutation identity lifetime validation before the factory ran. Changed fixture to actual sql::now(0); no production checks or assertions relaxed.",
+        "path": "/tmp/canopy-native-merge-atomic-focused-second.log",
+        "sha256": "0f5b526a1206c8b4107efaf2cefe3b92c0818d3077a5ea57596e45044dd2cace",
+        "summaries": [
+          "test result: FAILED. 1 passed; 4 failed; 0 ignored; 0 measured; 725 filtered out; finished in 0.73s"
+        ]
+      }
+    ],
+    "focused": {
+      "source_digest": "f9ba7219fc0d96193935bb46454b975b1071e0dfdef92843b06fcbd805b6ce38",
+      "result": "8 passed, 0 failed; cases exercise both SHA-1 and SHA-256 where applicable",
+      "path": "/tmp/canopy-native-merge-atomic-focused-third.log",
+      "sha256": "ec6705946bb702f874f1b6a45e4fcdd81491ccc86a40bc859ff2e7e4b7a656e1",
+      "summaries": [
+        "test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 725 filtered out; finished in 4.68s"
+      ]
+    },
+    "validation": {
+      "source_digest": "f9ba7219fc0d96193935bb46454b975b1071e0dfdef92843b06fcbd805b6ce38",
+      "phases": [
+        {
+          "name": "clippy",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "clippy",
+            "--workspace",
+            "--all-targets",
+            "--locked",
+            "--",
+            "-D",
+            "warnings"
+          ],
+          "exit_code": 0,
+          "seconds": 44.47,
+          "log": "/tmp/canopy-native-merge-atomic-before-fingerprint-clippy.log",
+          "log_sha256": "87a7146810d65889efebb29c068638b400da9412b132caaca0edab70edf739a3",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "workspace",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "test",
+            "--workspace",
+            "--locked",
+            "--no-fail-fast"
+          ],
+          "exit_code": 101,
+          "seconds": 739.36,
+          "log": "/tmp/canopy-native-merge-atomic-before-fingerprint-workspace.log",
+          "log_sha256": "163f0a12d22e7ae9eb2410ce13b8f356fecd1e03db149e1aa3d705b21236feb5",
+          "summaries": [
+            "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.77s",
+            "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.45s",
+            "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 732 filtered out; finished in 0.00s",
+            "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 732 filtered out; finished in 0.08s",
+            "test result: ok. 733 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 314.83s",
+            "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+            "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.52s",
+            "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+            "test result: FAILED. 82 passed; 24 failed; 9 ignored; 0 measured; 0 filtered out; finished in 353.22s",
+            "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.43s",
+            "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.23s",
+            "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.35s",
+            "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+            "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+            "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+          ],
+          "failed_cases": [
+            "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+            "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+            "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+            "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+            "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+            "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+            "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+            "leased_server_recovers_two_repositories_with_git_and_lfs",
+            "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+            "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+            "merge::merge_rechecks_revisions_authority_and_competing_publications",
+            "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+            "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+            "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+            "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+            "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+            "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+            "sha256::sha256_checks_reviews_and_merge_survive_restore",
+            "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+            "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+            "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+            "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+            "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+            "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+            "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+            "repository_cell_publishes_objects_and_refs_atomically",
+            "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+          ]
+        },
+        {
+          "name": "build",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "build",
+            "--locked",
+            "--bin",
+            "canopy"
+          ],
+          "exit_code": 0,
+          "seconds": 60.04,
+          "log": "/tmp/canopy-native-merge-atomic-before-fingerprint-build.log",
+          "log_sha256": "34566228b3affe91123c22f0f35627811f697d606ca025fe8dbef9c302e6ecf1",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "fmt",
+          "command": [
+            "cargo",
+            "+1.98.0",
+            "fmt",
+            "--all",
+            "--",
+            "--check"
+          ],
+          "exit_code": 0,
+          "seconds": 1.47,
+          "log": "/tmp/canopy-native-merge-atomic-before-fingerprint-fmt.log",
+          "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "harness",
+          "command": [
+            "python3",
+            "-B",
+            "-m",
+            "unittest",
+            "discover",
+            "-s",
+            "scripts",
+            "-p",
+            "test_*.py"
+          ],
+          "exit_code": 0,
+          "seconds": 44.79,
+          "log": "/tmp/canopy-native-merge-atomic-before-fingerprint-harness.log",
+          "log_sha256": "cb01e415cf1f4b7710be7e4585b058921656c8fb9a6b883d961641f128abd933",
+          "summaries": [],
+          "failed_cases": []
+        },
+        {
+          "name": "diff",
+          "command": [
+            "git",
+            "diff",
+            "--check"
+          ],
+          "exit_code": 0,
+          "seconds": 0.12,
+          "log": "/tmp/canopy-native-merge-atomic-before-fingerprint-diff.log",
+          "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "summaries": [],
+          "failed_cases": []
+        }
+      ],
+      "complete": true,
+      "release_qualified": false,
+      "source_unchanged": true
+    },
+    "workspace_terminal_inventory": [
+      {
+        "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+        "passed": 6,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+        "passed": 15,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+        "passed": 733,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+        "passed": 2,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+        "passed": 13,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+        "passed": 2,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+        "passed": 82,
+        "failed": 24,
+        "ignored": 9
+      },
+      {
+        "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+        "passed": 0,
+        "failed": 1,
+        "ignored": 0
+      },
+      {
+        "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+        "passed": 0,
+        "failed": 1,
+        "ignored": 0
+      },
+      {
+        "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+        "passed": 0,
+        "failed": 1,
+        "ignored": 0
+      },
+      {
+        "binary": "canopy_git_format",
+        "passed": 0,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "binary": "canopy_object_storage",
+        "passed": 0,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "binary": "canopy_server",
+        "passed": 0,
+        "failed": 0,
+        "ignored": 0
+      }
+    ],
+    "workspace_unique_totals": {
+      "passed": 853,
+      "failed": 27,
+      "ignored": 9,
+      "executed": 880,
+      "total": 889
+    },
+    "counting": "Last summary per Cargo Running/Doc-tests section; nested child summaries and focused reruns excluded. Ordinary ignored cases remain unexecuted.",
+    "parent_linux_ci": [
+      {
+        "head": "0b8d3b5c397fb11532f09b8a71e023e604d7a6c1",
+        "run": 37358483334,
+        "job": 111926817450,
+        "conclusion": "failure",
+        "path": "/tmp/canopy-native-merge-atomic-parent-pr-full.log",
+        "sha256": "07ba5e1cd626f38fe91accf43dc8a1d4b320009b8f2c63ec467d6f516cf5b34d",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.79s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.87s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.00s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.01s",
+          "test result: ok. 725 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 359.44s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.57s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 512.80s"
+        ],
+        "failed_cases": [
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+          "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+        ]
+      },
+      {
+        "head": "0b8d3b5c397fb11532f09b8a71e023e604d7a6c1",
+        "run": 37358473334,
+        "job": 111926783807,
+        "conclusion": "failure",
+        "path": "/tmp/canopy-native-merge-atomic-parent-push-full.log",
+        "sha256": "cbbe193b62d24f69d566b1da47b3715430e77b8ebbd51438325347ab492a430c",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.46s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.93s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.00s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.02s",
+          "test result: ok. 725 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 471.27s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.34s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s",
+          "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 620.69s"
+        ],
+        "failed_cases": [
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+        ]
+      }
+    ],
+    "changes": [
+      "Private ref-only fast-forward preparation binds exact actor/request/native ref versions, mandatory verified ancestry and conditional COW snapshot in the existing CatalogCertificate envelope.",
+      "Native operation 9 codec 5 commits fresh owner/access/review/check/ref predicates, joint generation, pull state, applied application UUID, checkpoint/operation consumption and exact-command phase atomically. No SQL ref/ancestry mirror or backward decoder is introduced.",
+      "Typed ReadyNativeMerge retains actual preparation ownership and reuses ReadyBoundRecovery, fair dispatch and original registered SDK command recovery. Denials do not bind application UUID; applied retries preserve original result.",
+      "Eight focused cases cover native publication, unrelated ancestry, late review changes, mandatory registration, payload/generation conflicts, late SQL rollback, UUID replay, real owner restoration after SQLite loss and actual Rust maximum SHA-256 result of 493 wire bytes under existing 512 cap."
+    ],
+    "qualification_limits": [
+      "Native merge fixture installs a genuine verified stock-Git catalog and immutable ref tree using a synthetic initial catalog certificate. This isolates private preparation/receiver/recovery, not initial-root production or HTTP/resident integration.",
+      "Public merge adapter still invokes retired codec 4 and legacy SQL ancestry. No endpoint fix or full CI success is claimed.",
+      "Merge terminal release currently deliberately retains physical pins pending selected native graph and exact UUID outcome certification. Retention/capacity are not qualified.",
+      "Generated merge/squash/rebase producers, native thread/default-branch writers, rejected-push workload failures, replication/backup, selective fetch, physical recovery/GC/final schema, accelerators/fair maintenance and full-history/10k-engineer qualification remain open."
+    ],
+    "validation_manifest": "/tmp/canopy-native-merge-atomic-before-fingerprint-validation.json"
+  },
+  "validation": {
+    "source_digest": "214b64e819382822ffa9bac28434d2ea2bd42a4247421e69025569188b9cf198",
+    "phases": [
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 54.49,
+        "log": "/tmp/canopy-native-merge-atomic-final-clippy-final.log",
+        "log_sha256": "abd2b8f7dcf558a21949ae0db1ca7f9b2720edf9820fc920e0f0a81fb17ebed8",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::tests::native_merge::",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 134.15,
+        "log": "/tmp/canopy-native-merge-atomic-final-focused-final.log",
+        "log_sha256": "070c51bc934daed1f82e76dfa0f320324e5779e8c4dbc1f84a23f8071ea1cb79",
+        "summaries": [
+          "test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 725 filtered out; finished in 3.73s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 735.77,
+        "log": "/tmp/canopy-native-merge-atomic-final-workspace-final.log",
+        "log_sha256": "12bc5be366ffddb500febeb08540c3ba966e3358fc7a8429b26c0998c92d2b2c",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.22s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.26s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 732 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 732 filtered out; finished in 0.10s",
+          "test result: ok. 733 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 299.05s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.05s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s",
+          "test result: FAILED. 82 passed; 24 failed; 9 ignored; 0 measured; 0 filtered out; finished in 345.61s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.31s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.18s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.26s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 42.65,
+        "log": "/tmp/canopy-native-merge-atomic-final-build-final.log",
+        "log_sha256": "b038fbceddb7b684c15b344b2d4c7ab7ab6e43efd9ef7a98716d9af24bf00137",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.28,
+        "log": "/tmp/canopy-native-merge-atomic-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 41.83,
+        "log": "/tmp/canopy-native-merge-atomic-final-harness-final.log",
+        "log_sha256": "6561098ae5cb3a98d96b5561170ea706ebc24954e072b199241a0639845fd6dc",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.06,
+        "log": "/tmp/canopy-native-merge-atomic-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 733,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 82,
+      "failed": 24,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 853,
+    "failed": 27,
+    "ignored": 9,
+    "executed": 880,
+    "total": 889
+  },
+  "counting": "Last summary per Cargo Running/Doc-tests section; nested child summaries and focused reruns excluded. Ordinary ignored cases remain unexecuted.",
+  "parent_linux_ci": [
+    {
+      "head": "0b8d3b5c397fb11532f09b8a71e023e604d7a6c1",
+      "run": 37358483334,
+      "job": 111926817450,
+      "conclusion": "failure",
+      "path": "/tmp/canopy-native-merge-atomic-parent-pr-full.log",
+      "sha256": "07ba5e1cd626f38fe91accf43dc8a1d4b320009b8f2c63ec467d6f516cf5b34d",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.79s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.87s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.01s",
+        "test result: ok. 725 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 359.44s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.57s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 512.80s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    },
+    {
+      "head": "0b8d3b5c397fb11532f09b8a71e023e604d7a6c1",
+      "run": 37358473334,
+      "job": 111926783807,
+      "conclusion": "failure",
+      "path": "/tmp/canopy-native-merge-atomic-parent-push-full.log",
+      "sha256": "cbbe193b62d24f69d566b1da47b3715430e77b8ebbd51438325347ab492a430c",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.46s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.93s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 0.02s",
+        "test result: ok. 725 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 471.27s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.34s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s",
+        "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 620.69s"
+      ],
+      "failed_cases": [
+        "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+        "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+        "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+        "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+        "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+        "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+        "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+        "leased_server_recovers_two_repositories_with_git_and_lfs",
+        "merge::merge_rechecks_revisions_authority_and_competing_publications",
+        "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+        "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+        "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+        "push_options::mismatched_signed_push_options_return_a_durable_git_rejection",
+        "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+        "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+        "push_options::stock_git_push_options_are_validated_recorded_and_recovered",
+        "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+        "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+        "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+        "sha256::sha256_checks_reviews_and_merge_survive_restore",
+        "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+        "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+        "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+        "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+        "ssh::ssh_push_options_cover_pack_and_delete_only_requests",
+        "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+        "visibility::public_reads_and_private_revocation_survive_cell_recovery"
+      ]
+    }
+  ],
+  "changes": [
+    "Private ref-only fast-forward preparation binds exact actor/request/native ref versions, mandatory verified ancestry and conditional COW snapshot in the existing CatalogCertificate envelope.",
+    "Native operation 9 codec 5 commits fresh owner/access/review/check/ref predicates, joint generation, pull state, applied application UUID, checkpoint/operation consumption and exact-command phase atomically. No SQL ref/ancestry mirror or backward decoder is introduced.",
+    "RepositoryModule explicit source fingerprint includes both new native merge implementation files; prior incomplete-fingerprint validation remains separately attributed.",
+    "Typed ReadyNativeMerge retains actual preparation ownership and reuses ReadyBoundRecovery, fair dispatch and original registered SDK command recovery. Denials do not bind application UUID; applied retries preserve original result.",
+    "Eight focused cases cover native publication, unrelated ancestry, late review changes, mandatory registration, payload/generation conflicts, late SQL rollback, UUID replay, real owner restoration after SQLite loss and actual Rust maximum SHA-256 result of 493 wire bytes under existing 512 cap."
+  ],
+  "qualification_limits": [
+    "Native merge fixture installs a genuine verified stock-Git catalog and immutable ref tree using a synthetic initial catalog certificate. This isolates private preparation/receiver/recovery, not initial-root production or HTTP/resident integration.",
+    "Public merge adapter still invokes retired codec 4 and legacy SQL ancestry. No endpoint fix or full CI success is claimed.",
+    "Merge terminal release currently deliberately retains physical pins pending selected native graph and exact UUID outcome certification. Retention/capacity are not qualified.",
+    "Generated merge/squash/rebase producers, native thread/default-branch writers, rejected-push workload failures, replication/backup, selective fetch, physical recovery/GC/final schema, accelerators/fair maintenance and full-history/10k-engineer qualification remain open."
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 38c260d7..eba7eda2 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,55 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Atomic native reviewed-merge transaction (2026-10-05 checkpoint)
+
+The private factory now binds the exact merge request, actor, source/base ref
+versions, mandatory ancestry evidence and conditional immutable ref snapshot to
+the existing catalog certificate. It reads verified native metadata, without a
+SQL ref or ancestry mirror. This increment supports fast-forward intent;
+generated merge, squash and rebase producers remain open.
+
+Operation 9, codec 5 replaces the production registration of the retired SQL
+merge command. Its final owner-fenced transaction checks current access, pull
+revision, applicable reviews, branch rules and required checks, then atomically
+commits the joint catalog/ref generation, pull state, application UUID result,
+checkpoint, operation consumption and original-command recovery journal. Errors
+after the first domain write roll back the whole transaction. An applied UUID
+replays its original record; a rejected review request can be retried under a
+fresh admitted command after policy changes.
+
+The ready capability retains the actual preparation owner and reuses typed
+`ReadyBoundRecovery` dispatch. Eight focused regressions pass for SHA-1 and
+SHA-256, including native roots without SQL ref authority, unrelated history,
+late review changes, payload substitution, generation conflict, mandatory
+original-command registration, late SQL rollback, UUID replay and original
+receipt recovery after SQLite loss and actual owner restoration. The maximum
+SHA-256 response is 493 wire bytes within the unchanged 512-byte recovery cap.
+Both new implementation files are included in the Repository Cell source
+fingerprint, so future implementation changes alter the runtime contract.
+The fixtures install a trusted initial native root with a synthetic certificate;
+they qualify the private factory/receiver/recovery, not the initial-root producer
+or public endpoint. Frozen-source validation passes all 733 server library tests, all-target
+Clippy with warnings denied, server build, formatting/diff checks and all 96
+Python harness cases. Multi-server remains at 82 passed /24 failed /9 ignored;
+three standalone aggregates also fail. Unique totals are 853 passed /27 failed
+/9 unexecuted ignores, excluding nested child summaries and focused reruns.
+The exact 513-file corrected source digest is
+`214b64e819382822ffa9bac28434d2ea2bd42a4247421e69025569188b9cf198`.
+The complete run, separately attributed pre-fingerprint run, intermediate
+compile/fixture failures and source-fingerprint correction are preserved in
+[atomic merge evidence](evidence/native-merge-atomic-ci-20261005.json).
+Parent `0b8d3b5` Linux PR/push runs each pass 725 server library cases and fail
+the matrix at 83 passed /27 failed /9 ignored. Exact new-head Linux and RustFS
+qualification remain required; this PR is not green or release qualified.
+
+The public merge adapter still calls the retired command and fails. Merge
+terminal release deliberately retains its preparation pin until the selected
+native graph and exact UUID outcome can be certified. These are explicit
+integration and retention gaps, not completed endpoint or capacity work. The
+next priority is safe terminal graph certification and actual resident/public
+merge dispatch, followed by generated writers and full CI.
+
 ## Mandatory native merge ancestry (2026-10-05 checkpoint)
 
 The ordinary ref-proof factory computes ancestry only for enabled fast-forward

From 75814b4c692364b4476e57456d439001bd5abbf2 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 13:30:11 -0700
Subject: [PATCH 41/55] fix: retire closed native merge recovery pins

Bind a permanent StoredInputRoot audit in native merge codec 6 and save
its descriptor atomically with the immutable UUID result. Verify the
selected original audit before archiving recovery and releasing a pin.

Keep negative and replay attempt receipts independent, require actual
operation closure, and preserve merge/release receipts across body loss
and owner restoration. Reuse existing root and archive structures.

Add five retirement regression families and preserve frozen validation
and unchanged integration failures. Public merge and full qualification
remain open.
---
 crates/canopy-server/src/lib.rs               |   1 +
 .../src/packs/publication/mod.rs              |   1 +
 .../src/packs/publication/native_merge.rs     |  33 +-
 .../packs/publication/native_merge/audit.rs   | 248 ++++++++++
 .../src/packs/publication/recovery/archive.rs |  43 +-
 .../src/packs/publication/recovery/mod.rs     |   8 +
 .../src/packs/publication/schema.sql          |  10 +-
 .../packs/publication/tests/native_merge.rs   |   2 +
 .../tests/native_merge/retirement.rs          | 462 ++++++++++++++++++
 .../src/packs/publication/tests/publishing.rs |   3 +
 .../src/packs/publication/tests/reconcile.rs  |   1 +
 .../publication/tests/ref_policy/fixture.rs   |   1 +
 .../src/packs/verification/physical/tests.rs  |   2 +-
 docs/contracts.md                             |  25 +-
 docs/design/terminal-publication-retention.md |  45 +-
 .../native-merge-retirement-ci-20261005.json  | 377 ++++++++++++++
 .../large-repository-implementation-status.md |  49 ++
 17 files changed, 1290 insertions(+), 21 deletions(-)
 create mode 100644 crates/canopy-server/src/packs/publication/native_merge/audit.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs
 create mode 100644 docs/evidence/native-merge-retirement-ci-20261005.json

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index ae13b914..59f40b6e 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -271,6 +271,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/ref_proof.rs"));
                 source.update(include_bytes!("packs/publication/ref_snapshot.rs"));
                 source.update(include_bytes!("packs/publication/native_merge.rs"));
+                source.update(include_bytes!("packs/publication/native_merge/audit.rs"));
                 source.update(include_bytes!(
                     "packs/publication/coordinator/native_merge.rs"
                 ));
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 0b7e9874..fe226c4b 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -56,6 +56,7 @@ pub use initialization::{
 mod ref_snapshot;
 pub use ref_snapshot::{PreparedRefSnapshot, RefSnapshotPreparationError};
 mod native_merge;
+pub use native_merge::audit::NativeMergeAuditError;
 pub use native_merge::{
     NATIVE_MERGE_BYTES, NativeMergePreparationError, NativeMergeProof, PublishReviewedMerge,
 };
diff --git a/crates/canopy-server/src/packs/publication/native_merge.rs b/crates/canopy-server/src/packs/publication/native_merge.rs
index 7f612d79..20bf8cb7 100644
--- a/crates/canopy-server/src/packs/publication/native_merge.rs
+++ b/crates/canopy-server/src/packs/publication/native_merge.rs
@@ -24,6 +24,8 @@ use cellule_runtime::{InvocationError, primitives::sql::SqlCell};
 use std::path::Path;
 use tokio::time::timeout_at;
 
+pub(super) mod audit;
+
 pub const NATIVE_MERGE_BYTES: u32 = 256 << 10;
 
 #[derive(Clone, Debug)]
@@ -31,6 +33,7 @@ struct Transition {
     plan: PushPlan,
     ancestry: Vec<u8>,
     refs: Option<RefStateSnapshotRoot>,
+    audit: Option<crate::packs::input_artifact::StoredInputRoot>,
 }
 
 /// Exact request, native ref facts and conditional snapshot. Only a privately
@@ -46,6 +49,8 @@ pub struct NativeMergeProof {
 
 #[derive(Debug, thiserror::Error)]
 pub enum NativeMergePreparationError {
+    #[error("native merge audit root failed")]
+    Root(#[from] crate::packs::InputRootError),
     #[error("native merge preparation is inactive")]
     Base(#[from] PreparationBaseError),
     #[error("native merge encoding failed")]
@@ -98,6 +103,9 @@ impl NativeMergeProof {
             return Err(CodecError::Invalid("native merge ref format"));
         }
         if let Some(t) = &self.transition {
+            if let Some(audit) = t.audit {
+                audit.validate(crate::packs::input_artifact::INPUT_ROOT_BYTES)?;
+            }
             super::ref_proof::shape(&t.plan, data.catalog.format)
                 .map_err(|_| CodecError::Invalid("native merge plan"))?;
             super::ref_proof::binding(&t.plan, &t.ancestry)?;
@@ -111,6 +119,9 @@ impl NativeMergeProof {
                     .is_none()
                 || t.refs
                     .is_some_and(|r| r.operation() != data.token.artifact_operation)
+                || t.audit
+                    .is_some_and(|r| r.operation != data.token.artifact_operation)
+                || t.audit.is_some() != t.refs.is_some()
                 || t.refs.is_some() != super::ref_proof::proven(&t.ancestry, 0)
             {
                 return Err(CodecError::Invalid("invalid native merge transition"));
@@ -135,8 +146,9 @@ impl NativeMergeProof {
         h.update(&[u8::from(transition.is_some())]);
         if let Some(t) = transition {
             h.update(&super::ref_proof::binding(&t.plan, &t.ancestry)?);
-            let mut e = BoundedEncoder::new(128)?;
+            let mut e = BoundedEncoder::new(256)?;
             t.refs.encode(&mut e)?;
+            t.audit.encode(&mut e)?;
             h.update(&e.finish());
         }
         Ok(*h.finalize().as_bytes())
@@ -153,6 +165,7 @@ impl WireValue for NativeMergeProof {
             t.plan.encode(e)?;
             e.write_bytes(&t.ancestry)?;
             t.refs.encode(e)?;
+            t.audit.encode(e)?;
         }
         Ok(())
     }
@@ -166,6 +179,7 @@ impl WireValue for NativeMergeProof {
                     plan: PushPlan::decode(d)?,
                     ancestry: d.read_bytes()?.to_vec(),
                     refs: Option::<RefStateSnapshotRoot>::decode(d)?,
+                    audit: Option::<crate::packs::input_artifact::StoredInputRoot>::decode(d)?,
                 })
             } else {
                 None
@@ -269,10 +283,17 @@ impl PreparedCatalog {
                         } else {
                             None
                         };
+                        let audit = match proposed {
+                            Some(refs) => Some(
+                                audit::prepare(self, &input, &plan.updates[0].name, refs).await?,
+                            ),
+                            None => None,
+                        };
                         transition = Some(Transition {
                             plan,
                             ancestry,
                             refs: proposed,
+                            audit,
                         });
                     }
                 }
@@ -297,7 +318,7 @@ pub struct PublishReviewedMerge;
 impl Command for PublishReviewedMerge {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 9;
-    const CODEC_VERSION: u32 = 5;
+    const CODEC_VERSION: u32 = 6;
     type Input = NativeMergeProof;
     type Output = MergeOutcome;
     fn execute(
@@ -396,6 +417,12 @@ fn publish(
     let Some(refs) = transition.refs else {
         return Ok(denied(MergeOutcome::Conflict));
     };
+    let Some(audit) = transition.audit else {
+        return Ok(denied(MergeOutcome::Conflict));
+    };
+    let mut encoded_audit = BoundedEncoder::new(128)?;
+    audit.encode(&mut encoded_audit)?;
+    let encoded_audit = encoded_audit.finish();
     let policy = context.sql(&SqlBatch {
         statements: vec![crate::branch_rules::policy_statement_with_ancestry(
             update, true,
@@ -472,7 +499,7 @@ fn publish(
         vec![number(generation)?, number(data.base.generation)?],
     ))?)?;
     changed(context.sql(&statement("UPDATE pull_requests SET state='merged',version=version+1,updated_ms=max(updated_ms,?2) WHERE number=?1 AND state='open' AND version=?3 AND version<9223372036854775807", vec![SqlValue::Integer(input.number),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version)]))?)?;
-    changed(context.sql(&statement("INSERT INTO pull_merges(id,binding,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9,?10)", vec![blob(id.as_bytes()),blob(binding),SqlValue::Integer(input.number),blob(source),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version),blob(crate::pulls::merge::oid(&input.request.revision.source_oid)?),SqlValue::Integer(input.request.revision.source_version),blob(base),SqlValue::Integer(input.request.revision.base_version)]))?)?;
+    changed(context.sql(&statement("INSERT INTO pull_merges(id,binding,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version,publication) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9,?10,?11)", vec![blob(id.as_bytes()),blob(binding),SqlValue::Integer(input.number),blob(source),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version),blob(crate::pulls::merge::oid(&input.request.revision.source_oid)?),SqlValue::Integer(input.request.revision.source_version),blob(base),SqlValue::Integer(input.request.revision.base_version),blob(encoded_audit)]))?)?;
     changed(context.sql(&statement(
         "DELETE FROM catalog_operations WHERE id=?1",
         vec![blob(data.token.operation)],
diff --git a/crates/canopy-server/src/packs/publication/native_merge/audit.rs b/crates/canopy-server/src/packs/publication/native_merge/audit.rs
new file mode 100644
index 00000000..8e8c48f2
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/native_merge/audit.rs
@@ -0,0 +1,248 @@
+//! Permanent selected merge metadata, independent of transient preparation pins.
+//! The existing input root retains typed catalog/ref edges, not an SDK request
+//! body. Selection from an immutable UUID row precedes all artifact traversal.
+use super::*;
+use crate::packs::{
+    catalog::{CatalogIndexes, CatalogReader, CatalogSnapshot},
+    directory::index::IndexError,
+    input_artifact::{INPUT_ROOT_BYTES, StoredInputRoot},
+};
+use canopy_object_storage::artifact::{ArtifactKind, ArtifactStore};
+use std::sync::Arc;
+
+const DOMAIN: &[u8] = b"canopy.native-reviewed-merge-audit.v1\0";
+pub(super) const SAVED: &str = "SELECT binding,id,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version,publication FROM pull_merges WHERE id=?1";
+
+#[derive(Debug, thiserror::Error)]
+pub enum NativeMergeAuditError {
+    #[error("merge audit codec failed")]
+    Codec(#[from] CodecError),
+    #[error("merge audit root failed")]
+    Root(#[from] crate::packs::InputRootError),
+    #[error("merge audit catalog failed")]
+    Catalog(#[from] IndexError),
+    #[error("merge audit ref snapshot failed")]
+    Snapshot(#[from] RefSnapshotError),
+    #[error("merge audit ref lookup failed")]
+    Refs(#[from] RefStateError),
+    #[error("selected merge audit context differs")]
+    Context,
+}
+struct Audit {
+    input: MergeInput,
+    base_ref: String,
+    catalog: StoredCatalog,
+    refs: RefStateSnapshotRoot,
+    ref_generation: u64,
+}
+impl Audit {
+    fn shape(&self) -> Result<(), CodecError> {
+        self.input.encode(&mut BoundedEncoder::new(4096)?)?;
+        if self.input.request.strategy != MergeStrategy::FastForward
+            || !self.base_ref.starts_with("refs/heads/")
+            || self.base_ref.len() > crate::packs::ref_state::MAX_NAME_BYTES
+            || !crate::refs::valid_ref_name(&self.base_ref)
+            || self.ref_generation == 0
+            || self.ref_generation > i64::MAX as u64
+            || [
+                &self.input.request.revision.source_oid,
+                &self.input.request.revision.base_oid,
+            ]
+            .iter()
+            .any(|oid| {
+                crate::pulls::merge::oid(oid).is_err()
+                    || oid.len() != self.catalog.format.bytes() * 2
+            })
+        {
+            return Err(CodecError::Invalid("native merge audit scope"));
+        }
+        self.catalog.encode(&mut BoundedEncoder::new(256)?)?;
+        self.refs.encode(&mut BoundedEncoder::new(128)?)
+    }
+    fn outcome(&self) -> MergeOutcome {
+        MergeOutcome::Applied {
+            merge: MergeRecord {
+                id: self.input.request.id.clone(),
+                number: self.input.number,
+                oid: self.input.request.revision.source_oid.clone(),
+                merged_at_ms: self.input.issued_at_ms,
+                revision: self.input.request.revision.clone(),
+            },
+        }
+    }
+}
+impl WireValue for Audit {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.shape()?;
+        e.write_bytes(DOMAIN)?;
+        self.input.encode(e)?;
+        e.write_text(&self.base_ref)?;
+        self.catalog.encode(e)?;
+        self.refs.encode(e)?;
+        e.write_u64(self.ref_generation)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != DOMAIN {
+            return Err(CodecError::Invalid("merge audit purpose"));
+        }
+        let value = Self {
+            input: MergeInput::decode(d)?,
+            base_ref: d.read_text()?.to_owned(),
+            catalog: StoredCatalog::decode(d)?,
+            refs: RefStateSnapshotRoot::decode(d)?,
+            ref_generation: d.read_u64()?,
+        };
+        value.shape()?;
+        Ok(value)
+    }
+}
+
+pub(super) async fn prepare(
+    prepared: &PreparedCatalog,
+    input: &MergeInput,
+    base_ref: &str,
+    refs: RefStateSnapshotRoot,
+) -> Result<StoredInputRoot, NativeMergePreparationError> {
+    let store = prepared.base.indexes().store();
+    let record = Audit {
+        input: input.clone(),
+        base_ref: base_ref.to_owned(),
+        catalog: prepared.catalog(),
+        refs,
+        ref_generation: refs.read(&store).await?.generation,
+    };
+    Ok(StoredInputRoot::upload(
+        &store,
+        prepared.token().artifact_operation,
+        &record,
+        INPUT_ROOT_BYTES,
+    )
+    .await?)
+}
+
+pub(in crate::packs::publication) fn statement(outcome: &MergeOutcome) -> SqlStatement {
+    let parameter = match outcome {
+        MergeOutcome::Applied { merge } => uuid::Uuid::parse_str(&merge.id)
+            .ok()
+            .map_or(SqlValue::Null, |id| blob(id.as_bytes())),
+        _ => SqlValue::Null,
+    };
+    SqlStatement {
+        sql: SAVED.into(),
+        parameters: vec![parameter],
+    }
+}
+/// Replays may select a prior attempt's permanent root. Never substitute the
+/// new attempt's proposal, generation or creating namespace for that result.
+pub(in crate::packs::publication) fn selected(
+    result: &[SqlResultSet],
+    outcome: &MergeOutcome,
+    actor: &str,
+) -> Result<Option<StoredInputRoot>, Error> {
+    let MergeOutcome::Applied { merge } = outcome else {
+        return Ok(None);
+    };
+    let Some(row) = rows(result)?.first() else {
+        return Ok(None);
+    };
+    if row.len() != 11 {
+        return Err(Error::Command("invalid selected merge audit"));
+    }
+    let (SqlValue::Blob(binding), SqlValue::Blob(publication)) = (&row[0], &row[10]) else {
+        return Err(Error::Command("invalid merge audit binding"));
+    };
+    let expected = MergeInput {
+        actor: actor.into(),
+        number: merge.number,
+        issued_at_ms: merge.merged_at_ms,
+        request: crate::pulls::merge::MergeRequest {
+            id: merge.id.clone(),
+            revision: merge.revision.clone(),
+            strategy: MergeStrategy::FastForward,
+            candidate_id: None,
+        },
+    };
+    if *binding != request_binding(&expected) || crate::pulls::merge::record(&row[1..10])? != *merge
+    {
+        return Ok(None);
+    }
+    let mut d = BoundedDecoder::new(publication, 128)?;
+    let root = StoredInputRoot::decode(&mut d)?;
+    d.finish()?;
+    root.validate(INPUT_ROOT_BYTES)?;
+    Ok(Some(root))
+}
+
+async fn verify(
+    store: &ArtifactStore,
+    root: StoredInputRoot,
+    outcome: &MergeOutcome,
+    check: &LeaseCheck,
+) -> Result<(Audit, CatalogSnapshot), NativeMergeAuditError> {
+    let audit: Audit = root.read(store, INPUT_ROOT_BYTES).await?;
+    if audit.input.actor != check.actor
+        || audit.outcome() != *outcome
+        || audit.catalog.repository != check.token.repository
+        || audit.refs.operation() != root.operation
+    {
+        return Err(NativeMergeAuditError::Context);
+    }
+    let indexes = Arc::new(CatalogIndexes::new(
+        Arc::new(store.clone()),
+        audit.catalog.format,
+    ));
+    // At most 48 range roots and one source root. Descendant descriptors stay
+    // reachable through the permanent audit; this performs no provider deletion
+    // and does not rescan all historical objects or reprove their closure.
+    let reader = CatalogReader::open(indexes, audit.catalog).await?;
+    let snapshot = CatalogSnapshot::download(store, reader.stored()).await?;
+    let refs = audit.refs.read(store).await?;
+    if refs.format != audit.catalog.format || refs.generation != audit.ref_generation {
+        return Err(NativeMergeAuditError::Context);
+    }
+    let state = RefStateIndex::new(Arc::new(store.clone()), refs.format)
+        .read(refs.root, &audit.base_ref)
+        .await?;
+    if state
+        != Some(crate::RefExpectation {
+            oid: Some(
+                crate::pulls::merge::oid(&audit.input.request.revision.source_oid)
+                    .map_err(|_| NativeMergeAuditError::Context)?,
+            ),
+            version: audit.input.request.revision.base_version + 1,
+        })
+    {
+        return Err(NativeMergeAuditError::Context);
+    }
+    Ok((audit, snapshot))
+}
+pub(in crate::packs::publication) async fn closed_graph(
+    store: &ArtifactStore,
+    root: StoredInputRoot,
+    outcome: &MergeOutcome,
+    check: &LeaseCheck,
+    hash: &mut blake3::Hasher,
+) -> Result<(), RootRecoveryError> {
+    let (audit, snapshot) = verify(store, root, outcome, check).await?;
+    let descriptor = super::super::recovery::archive::descriptor;
+    descriptor(hash, root.operation, ArtifactKind::InputRoot, root.artifact)?;
+    descriptor(
+        hash,
+        audit.catalog.operation,
+        ArtifactKind::CatalogNode,
+        audit.catalog.artifact,
+    )?;
+    descriptor(
+        hash,
+        snapshot.directory.operation,
+        ArtifactKind::CatalogNode,
+        snapshot.directory.artifact,
+    )?;
+    descriptor(
+        hash,
+        audit.refs.operation(),
+        ArtifactKind::InputRoot,
+        audit.refs.artifact(),
+    )?;
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/recovery/archive.rs b/crates/canopy-server/src/packs/publication/recovery/archive.rs
index 5e9219a6..8e8d9fb4 100644
--- a/crates/canopy-server/src/packs/publication/recovery/archive.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/archive.rs
@@ -123,6 +123,7 @@ impl WireValue for TerminalReleaseReply {
 pub(super) enum Terminal {
     Push(Box<CompletedRootPush>),
     Initialization(InitializationReply),
+    Merge(crate::pulls::merge::MergeOutcome),
 }
 impl Terminal {
     fn selected_statement(&self, operation: [u8; 16]) -> SqlStatement {
@@ -130,6 +131,9 @@ impl Terminal {
             sql: match self {
                 Self::Push(_) => super::super::root_completion::read::SAVED,
                 Self::Initialization(_) => super::super::initialization::publish::SAVED,
+                Self::Merge(outcome) => {
+                    return super::super::native_merge::audit::statement(outcome);
+                }
             }
             .into(),
             parameters: vec![blob(operation)],
@@ -150,14 +154,34 @@ impl Terminal {
             // A known negative is the original phase knowledge. A later attempt
             // may initialize this logical operation, without rewriting that denial.
             Self::Initialization(InitializationReply::Denied(_)) => true,
+            Self::Merge(outcome) => {
+                !matches!(outcome, crate::pulls::merge::MergeOutcome::Applied { .. })
+                    || super::super::native_merge::audit::selected(result, outcome, &check.actor)?
+                        .is_some()
+            }
         })
     }
     async fn closed_graph(
         &self,
         store: &ArtifactStore,
+        selected: &[SqlResultSet],
+        check: &LeaseCheck,
         hash: &mut blake3::Hasher,
     ) -> Result<(), RootRecoveryError> {
         match self {
+            Self::Merge(outcome) => {
+                hash.update(&encoded(outcome, 512)?);
+                if let Some(root) =
+                    super::super::native_merge::audit::selected(selected, outcome, &check.actor)?
+                {
+                    super::super::native_merge::audit::closed_graph(
+                        store, root, outcome, check, hash,
+                    )
+                    .await?;
+                } else if matches!(outcome, crate::pulls::merge::MergeOutcome::Applied { .. }) {
+                    return Err(RootRecoveryError::Context);
+                }
+            }
             Self::Push(terminal) => {
                 super::super::root_completion::closed_graph(store, terminal.root, hash).await?
             }
@@ -195,11 +219,18 @@ impl phase::Journal {
     pub(super) fn terminal(&self, record: &Record) -> Result<Option<Terminal>, CodecError> {
         // Validation is required even when only a primary result is selected.
         self.may_advance(record)?;
-        // Merge recovery retains its physical pin until its selected catalog/ref
-        // graph and UUID outcome can be certified for terminal release. It must
-        // not be misdecoded or released as a push/empty initialization graph.
+        // A merge has its own typed permanent audit selection. Known denials
+        // retain their original phase even if a later UUID attempt succeeds.
         if record.kind == Kind::Merge {
-            return Ok(None);
+            return self
+                .primary
+                .as_ref()
+                .map(|value| {
+                    value
+                        .decode_reply::<crate::pulls::merge::MergeOutcome>()
+                        .map(Terminal::Merge)
+                })
+                .transpose();
         }
         if record.kind == Kind::Initialization {
             return self
@@ -338,7 +369,9 @@ impl RegisteredRootRecovery {
             )?;
             record = next;
         }
-        terminal.closed_graph(store, &mut hash).await?;
+        terminal
+            .closed_graph(store, &row.output, &self.record.check, &mut hash)
+            .await?;
         let proof = Proof {
             recovery: self.certificate.clone(),
             phase: *blake3::hash(&encoded(&journal, 2048)?).as_bytes(),
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index 296f29af..ea7282ac 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -39,6 +39,8 @@ const DOMAIN: &[u8] = b"canopy.publication-command-recovery.v4\0";
 
 #[derive(Debug, thiserror::Error)]
 pub enum RootRecoveryError {
+    #[error("selected native merge audit failed")]
+    MergeAudit(#[source] Box<NativeMergeAuditError>),
     #[error("closed initialization graph failed")]
     Initialization(#[from] super::initialization::InitializationVerificationError),
     #[error("closed native audit graph failed")]
@@ -65,6 +67,12 @@ pub enum RootRecoveryError {
     Context,
 }
 
+impl From<NativeMergeAuditError> for RootRecoveryError {
+    fn from(error: NativeMergeAuditError) -> Self {
+        Self::MergeAudit(Box::new(error))
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct RootRecoveryCertificate(CertificateEnvelope);
 #[derive(Clone, Debug, PartialEq, Eq)]
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index a55068a0..c154ed52 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -282,8 +282,16 @@ CREATE TABLE pull_merges (
     source_oid BLOB NOT NULL CHECK(length(source_oid) IN (20, 32)),
     source_version INTEGER NOT NULL CHECK(source_version > 0),
     base_oid BLOB NOT NULL CHECK(length(base_oid) IN (20, 32)),
-    base_version INTEGER NOT NULL CHECK(base_version > 0)
+    base_version INTEGER NOT NULL CHECK(base_version > 0),
+    publication BLOB NOT NULL CHECK(length(publication) BETWEEN 1 AND 128)
 ) WITHOUT ROWID;
+CREATE TRIGGER pull_merge_immutable BEFORE UPDATE ON pull_merges
+BEGIN SELECT RAISE(ABORT,'merge result immutable'); END;
+CREATE TRIGGER pull_merge_not_replaced BEFORE INSERT ON pull_merges
+WHEN EXISTS(SELECT 1 FROM pull_merges WHERE id=NEW.id OR pull_number=NEW.pull_number)
+BEGIN SELECT RAISE(ABORT,'merge result immutable'); END;
+CREATE TRIGGER pull_merge_retained BEFORE DELETE ON pull_merges
+BEGIN SELECT RAISE(ABORT,'merge audit retained'); END;
 
 CREATE TABLE merge_candidates (
     id BLOB PRIMARY KEY CHECK(length(id) = 16),
diff --git a/crates/canopy-server/src/packs/publication/tests/native_merge.rs b/crates/canopy-server/src/packs/publication/tests/native_merge.rs
index 5eeb9e53..51713a1d 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_merge.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_merge.rs
@@ -544,3 +544,5 @@ async fn native_merge_original_result_survives_sqlite_loss_and_actual_owner_rest
     }
     Ok(())
 }
+
+mod retirement;
diff --git a/crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs b/crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs
new file mode 100644
index 00000000..43a35ad9
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs
@@ -0,0 +1,462 @@
+//! Selected audit retention and exact recovery after transient pins are released.
+use super::super::{durable_recovery, terminal_retention};
+use super::*;
+use canopy_object_storage::artifact::{ArtifactKey, ArtifactKind};
+use object_store::ObjectStoreExt;
+
+async fn archived_result(
+    f: &Fixture,
+    graph: &Graph,
+    check: &LeaseCheck,
+) -> Result<cellule_runtime::Committed<MergeOutcome>> {
+    let saved = RegisteredRootRecovery::load(&f.client(), &f.target, &graph.store, check)
+        .await?
+        .ok_or("merge archive missing")?;
+    match saved
+        .dispatch_any(
+            &f.client(),
+            &graph.store,
+            &f.authority(),
+            &std::sync::atomic::AtomicBool::new(false),
+        )
+        .await
+    {
+        Ok(PublicationOutcome::Merge(value)) => Ok(value),
+        Err(PublicationError::Merge(InvocationError::Rejected(value))) => Ok(*value),
+        other => Err(format!("unexpected archived merge: {other:?}").into()),
+    }
+}
+
+async fn retained_pin(f: &Fixture, check: &LeaseCheck, expected: u64) -> Result {
+    let token = check.token;
+    f.handle.query(0,128,move |db| {
+        assert_eq!(db.query_row("SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2 AND recovery IS NOT NULL",rusqlite::params![token.owner.incarnation.as_bytes().as_slice(),token.attempt],|r|r.get::<_,u64>(0))?,expected);
+        Ok(Vec::new())
+    }).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_merge_applied_attempt_releases_pin_without_losing_original_uuid_or_receipt()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let check = prepared.base.capability().2.clone();
+        let (command, registered) =
+            prepared_command(&f, &prepared, request.clone(), root.path(), budget.clone()).await?;
+        let admin = terminal_retention::maintenance(&f.handle, f.repository).await?;
+        assert!(
+            registered
+                .ready_terminal_release(f.client(), &graph.store, admin.clone(), identity()?)
+                .await
+                .is_err()
+        );
+        let original = command.execute().await?;
+        let released = registered
+            .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
+            .await?
+            .complete()
+            .await?;
+        assert_eq!(released.output, TerminalReleaseReply::Released);
+        let token = check.token;
+        f.handle.query(0,128,move |db| {
+            assert_eq!(db.query_row("SELECT count(*) FROM catalog_leases WHERE incarnation=?1 AND admission_sequence=?2",rusqlite::params![token.owner.incarnation.as_bytes().as_slice(),token.attempt],|r|r.get::<_,u64>(0))?,0);
+            assert_eq!(db.query_row("SELECT count(*) FROM catalog_recovery_receipts",[],|r|r.get::<_,u64>(0))?,1);
+            Ok(Vec::new())
+        }).await?;
+        drop(registered);
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        let restored = RegisteredRootRecovery::load(&f.client(), &f.target, &graph.store, &check)
+            .await?
+            .ok_or("merge archive absent")?;
+        let PublicationOutcome::Merge(recovered) = restored
+            .dispatch_any(
+                &f.client(),
+                &graph.store,
+                &f.authority(),
+                &std::sync::atomic::AtomicBool::new(false),
+            )
+            .await?
+        else {
+            return Err("merge archive purpose".into());
+        };
+        assert_eq!(
+            (recovered.output, recovered.receipt),
+            (original.output.clone(), original.receipt)
+        );
+        let (retry, retry_root, retry_budget) = preparation(&f, &graph).await?;
+        let (retry_command, retry_recovery) =
+            prepared_command(&f, &retry, request, retry_root.path(), retry_budget.clone()).await?;
+        assert_eq!(retry_command.execute().await?.output, original.output);
+        // An application replay does not consume its fresh preparation. Actual
+        // owner closure is required before its independent pin can be released.
+        let admin = terminal_retention::maintenance(&f.handle, f.repository).await?;
+        assert!(
+            retry_recovery
+                .ready_terminal_release(f.client(), &graph.store, admin.clone(), identity()?)
+                .await
+                .is_err()
+        );
+        assert!(
+            f.client()
+                .command::<AbortPreparation>(
+                    &f.target,
+                    identity()?,
+                    retry.base.capability().2.clone()
+                )
+                .await?
+                .output
+        );
+        assert_eq!(
+            retry_recovery
+                .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
+                .await?
+                .complete()
+                .await?
+                .output,
+            TerminalReleaseReply::Released
+        );
+        merged_roots(&f, &graph).await?;
+        drop(retry);
+        cleaned(retry_root.path(), &retry_budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn negative_merge_archive_keeps_its_denial_after_same_uuid_succeeds() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let check = prepared.base.capability().2.clone();
+        let (command, saved) =
+            prepared_command(&f, &prepared, request.clone(), root.path(), budget.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO branch_rules VALUES('refs/heads/main',1,1,1,1,1,1)",
+        )
+        .await?;
+        let original = command.execute().await?;
+        assert_eq!(original.output, MergeOutcome::ReviewsRequired);
+        let admin = terminal_retention::maintenance(&f.handle, f.repository).await?;
+        assert!(
+            saved
+                .ready_terminal_release(f.client(), &graph.store, admin.clone(), identity()?)
+                .await
+                .is_err()
+        );
+        retained_pin(&f, &check, 1).await?;
+        assert!(
+            f.client()
+                .command::<AbortPreparation>(&f.target, identity()?, check.clone())
+                .await?
+                .output
+        );
+        let release = saved
+            .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
+            .await?;
+        assert_eq!(
+            release.complete().await?.output,
+            TerminalReleaseReply::Released
+        );
+        retained_pin(&f, &check, 0).await?;
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+
+        edit(&f,"UPDATE branch_rules SET required_approvals=0,version=2 WHERE reference='refs/heads/main'").await?;
+        let (retry, retry_root, retry_budget) = preparation(&f, &graph).await?;
+        let (command, saved) =
+            prepared_command(&f, &retry, request, retry_root.path(), retry_budget.clone()).await?;
+        assert!(matches!(
+            command.execute().await?.output,
+            MergeOutcome::Applied { .. }
+        ));
+        assert_eq!(
+            saved
+                .ready_terminal_release(
+                    f.client(),
+                    &graph.store,
+                    terminal_retention::maintenance(&f.handle, f.repository).await?,
+                    identity()?
+                )
+                .await?
+                .complete()
+                .await?
+                .output,
+            TerminalReleaseReply::Released
+        );
+        let recovered = archived_result(&f, &graph, &check).await?;
+        assert_eq!(
+            (recovered.output, recovered.receipt),
+            (original.output, original.receipt)
+        );
+        merged_roots(&f, &graph).await?;
+        drop(retry);
+        cleaned(retry_root.path(), &retry_budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn missing_or_corrupt_selected_merge_metadata_retains_pin_and_original_result() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let check = prepared.base.capability().2.clone();
+        let (command, saved) =
+            prepared_command(&f, &prepared, request, root.path(), budget.clone()).await?;
+        let original = command.execute().await?;
+        let publication = f
+            .handle
+            .query(0, 128, |db| {
+                Ok(db.query_row(
+                    "SELECT publication FROM pull_merges WHERE pull_number=1",
+                    [],
+                    |r| r.get::<_, Vec<u8>>(0),
+                )?)
+            })
+            .await?;
+        let mut d = BoundedDecoder::new(&publication, 128)?;
+        let audit = crate::packs::input_artifact::StoredInputRoot::decode(&mut d)?;
+        d.finish()?;
+        let catalog = prepared.catalog();
+        let snapshot =
+            crate::packs::catalog::CatalogSnapshot::download(&graph.store, catalog).await?;
+        let encoded = f
+            .handle
+            .query(0, 128, |db| {
+                Ok(db.query_row(
+                    "SELECT refs FROM catalog_generations WHERE generation=2",
+                    [],
+                    |r| r.get::<_, Vec<u8>>(0),
+                )?)
+            })
+            .await?;
+        let mut d = BoundedDecoder::new(&encoded, 128)?;
+        let refs = RefStateSnapshotRoot::decode(&mut d)?;
+        d.finish()?;
+        let ref_node = refs
+            .read(&graph.store)
+            .await?
+            .root
+            .ok_or("ref index missing")?;
+        let edges = [
+            (audit.operation, ArtifactKind::InputRoot, audit.artifact),
+            (
+                catalog.operation,
+                ArtifactKind::CatalogNode,
+                catalog.artifact,
+            ),
+            (
+                snapshot.directory.operation,
+                ArtifactKind::CatalogNode,
+                snapshot.directory.artifact,
+            ),
+            (refs.operation(), ArtifactKind::InputRoot, refs.artifact()),
+            (
+                ref_node.operation,
+                ArtifactKind::CatalogNode,
+                ref_node.artifact,
+            ),
+        ];
+        let admin = terminal_retention::maintenance(&f.handle, f.repository).await?;
+        for (operation, kind, artifact) in edges {
+            let path = graph.store.path(
+                ArtifactKey {
+                    operation,
+                    kind,
+                    binding_digest: artifact.digest,
+                },
+                artifact.digest,
+            )?;
+            let bytes = graph.provider.get(&path).await?.bytes().await?;
+            for corrupt in [false, true] {
+                graph.provider.delete(&path).await?;
+                if corrupt {
+                    graph
+                        .provider
+                        .put(&path, vec![0u8; bytes.len()].into())
+                        .await?;
+                }
+                assert!(
+                    saved
+                        .ready_terminal_release(
+                            f.client(),
+                            &graph.store,
+                            admin.clone(),
+                            identity()?
+                        )
+                        .await
+                        .is_err(),
+                    "accepted missing/corrupt {kind:?}"
+                );
+                retained_pin(&f, &check, 1).await?;
+                let recovered = archived_result(&f, &graph, &check).await?;
+                assert_eq!(
+                    (recovered.output, recovered.receipt),
+                    (original.output.clone(), original.receipt)
+                );
+                graph.provider.put(&path, bytes.clone().into()).await?;
+            }
+        }
+        assert_eq!(
+            saved
+                .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
+                .await?
+                .complete()
+                .await?
+                .output,
+            TerminalReleaseReply::Released
+        );
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn merge_retirement_fences_authority_and_rolls_back_archive_and_pin_together() -> Result {
+    let (f, graph, request) = initial(ObjectFormat::Sha256, false).await?;
+    let (prepared, root, budget) = preparation(&f, &graph).await?;
+    let check = prepared.base.capability().2.clone();
+    let (command, saved) =
+        prepared_command(&f, &prepared, request, root.path(), budget.clone()).await?;
+    let original = command.execute().await?;
+    let admin = terminal_retention::maintenance(&f.handle, f.repository).await?;
+    for wrong_owner in [true, false] {
+        let mut wrong = admin.clone();
+        if wrong_owner {
+            wrong.owner.epoch += 1;
+        } else {
+            wrong.actor = "outsider".into();
+        }
+        let release = saved
+            .ready_terminal_release(f.client(), &graph.store, wrong, identity()?)
+            .await?;
+        assert!(
+            matches!(release.complete().await,Err(PublicationError::TerminalRelease(InvocationError::Rejected(value))) if value.output==TerminalReleaseReply::Denied(PreparationDenial::Unauthorized))
+        );
+        retained_pin(&f, &check, 1).await?;
+    }
+    let release = saved
+        .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
+        .await?;
+    edit(&f,"CREATE TRIGGER merge_release_late_fault BEFORE DELETE ON catalog_leases WHEN OLD.recovery IS NOT NULL BEGIN SELECT RAISE(ABORT,'late merge release fault'); END").await?;
+    let failed = release.clone().complete().await;
+    assert!(
+        matches!(failed,Err(PublicationError::TerminalRelease(InvocationError::NotStarted(Error::Sqlite(rusqlite::Error::SqliteFailure(_,Some(ref message)))))) if message=="late merge release fault"),
+        "{failed:?}"
+    );
+    assert!(matches!(
+        f.client().resolve(&release.evidence_for_test()).await?,
+        Resolution::Absent
+    ));
+    retained_pin(&f, &check, 1).await?;
+    f.handle
+        .query(0, 128, |db| {
+            assert_eq!(
+                db.query_row("SELECT count(*) FROM catalog_recovery_receipts", [], |r| {
+                    r.get::<_, u64>(0)
+                })?,
+                0
+            );
+            Ok(Vec::new())
+        })
+        .await?;
+    edit(&f, "DROP TRIGGER merge_release_late_fault").await?;
+    assert_eq!(
+        release.complete().await?.output,
+        TerminalReleaseReply::Released
+    );
+    retained_pin(&f, &check, 0).await?;
+    for mutation in [
+        "UPDATE pull_merges SET publication=zeroblob(32)",
+        "DELETE FROM pull_merges",
+        "INSERT OR REPLACE INTO pull_merges SELECT * FROM pull_merges",
+    ] {
+        assert!(
+            edit(&f, mutation).await.is_err(),
+            "mutable permanent audit: {mutation}"
+        );
+    }
+    let recovered = archived_result(&f, &graph, &check).await?;
+    assert_eq!(
+        (recovered.output, recovered.receipt),
+        (original.output, original.receipt)
+    );
+    merged_roots(&f, &graph).await?;
+    drop(prepared);
+    cleaned(root.path(), &budget).await?;
+    drop(graph.prepared);
+    cleaned(graph.root.path(), &graph.budget).await?;
+    f.runtime.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn archived_merge_and_release_receipts_survive_sqlite_loss_and_owner_restoration() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let check = prepared.base.capability().2.clone();
+        let (command, saved) =
+            prepared_command(&f, &prepared, request, root.path(), budget.clone()).await?;
+        let original = command.execute().await?;
+        let release = saved
+            .ready_terminal_release(
+                f.client(),
+                &graph.store,
+                terminal_retention::maintenance(&f.handle, f.repository).await?,
+                identity()?,
+            )
+            .await?;
+        let released = release.clone().complete().await?;
+        retained_pin(&f, &check, 0).await?;
+        for (key, descriptor) in saved.command_bodies_for_test() {
+            let path = graph.store.path(key, descriptor.digest)?;
+            graph.provider.delete(&path).await?;
+        }
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        let (runtime, handle, client) = durable_recovery::restore_owner(&f, &check).await?;
+        assert!(handle.owner_fence().epoch > check.token.owner.epoch);
+        let restored = RegisteredRootRecovery::load(&client, &f.target, &graph.store, &check)
+            .await?
+            .ok_or("restored merge archive missing")?;
+        let PublicationOutcome::Merge(recovered) = restored
+            .dispatch_any(
+                &client,
+                &graph.store,
+                &f.authority(),
+                &std::sync::atomic::AtomicBool::new(false),
+            )
+            .await?
+        else {
+            return Err("restored merge purpose".into());
+        };
+        assert_eq!(
+            (recovered.output, recovered.receipt),
+            (original.output, original.receipt)
+        );
+        let recovered_release = release.with_client_for_test(client).complete().await?;
+        assert_eq!(
+            (recovered_release.output, recovered_release.receipt),
+            (released.output, released.receipt)
+        );
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/publishing.rs b/crates/canopy-server/src/packs/publication/tests/publishing.rs
index 6f9a7639..ee64a2b6 100644
--- a/crates/canopy-server/src/packs/publication/tests/publishing.rs
+++ b/crates/canopy-server/src/packs/publication/tests/publishing.rs
@@ -18,6 +18,7 @@ pub(super) struct Graph {
     pub(super) other: ObjectId,
     pub(super) blob: ObjectId,
     pub(super) store: Arc<canopy_object_storage::artifact::ArtifactStore>,
+    pub(super) provider: Arc<dyn object_store::ObjectStore>,
 }
 pub(super) fn update(name: &str, old: Option<(ObjectId, i64)>, new: Option<ObjectId>) -> RefUpdate {
     RefUpdate {
@@ -82,6 +83,7 @@ pub(super) async fn assembled(
             other,
             blob,
             store: native.store,
+            provider: native.provider,
         })
     })
     .await
@@ -300,6 +302,7 @@ pub(super) async fn next_graph(
         other: old.other,
         blob: old.blob,
         store: Arc::clone(&old.store),
+        provider: Arc::clone(&old.provider),
     })
 }
 
diff --git a/crates/canopy-server/src/packs/publication/tests/reconcile.rs b/crates/canopy-server/src/packs/publication/tests/reconcile.rs
index 2567e0ad..6cfaa51b 100644
--- a/crates/canopy-server/src/packs/publication/tests/reconcile.rs
+++ b/crates/canopy-server/src/packs/publication/tests/reconcile.rs
@@ -88,6 +88,7 @@ pub(super) async fn graph_with_run_limits(
         other: initial,
         blob,
         store,
+        provider: native.provider,
     })
 }
 async fn publish(
diff --git a/crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs b/crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs
index 89ec11df..5c6db2b8 100644
--- a/crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs
+++ b/crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs
@@ -214,6 +214,7 @@ pub(super) fn attempt<'a>(
                 other: tip,
                 blob,
                 store,
+                provider: provider.clone(),
             },
             staging,
             ticket,
diff --git a/crates/canopy-server/src/packs/verification/physical/tests.rs b/crates/canopy-server/src/packs/verification/physical/tests.rs
index 32babc10..91950c2a 100644
--- a/crates/canopy-server/src/packs/verification/physical/tests.rs
+++ b/crates/canopy-server/src/packs/verification/physical/tests.rs
@@ -13,7 +13,7 @@ use std::{future::Future, path::Path};
 type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error>>;
 pub(in crate::packs) struct Prepared {
     pub(in crate::packs) fixture: Fixture,
-    provider: Arc<dyn ObjectStore>,
+    pub(in crate::packs) provider: Arc<dyn ObjectStore>,
     pub(in crate::packs) store: Arc<ArtifactStore>,
     pub(in crate::packs) descriptor: NativePackDescriptor,
 }
diff --git a/docs/contracts.md b/docs/contracts.md
index 89a5103a..84dbb38f 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -1732,7 +1732,7 @@ with a 30-second receive deadline. The Cell command rechecks owner authority.
 The historical SQL publisher used `refs::apply_refs` for typed
 `FinalizePush`, HTTP `CompletePush`, and `MergePull`. Native publication instead
 uses privately certified immutable ref roots and reuses current branch/check
-predicates; native reviewed merge operation 9, codec 5 is described below. Before any ref writes, each enabled rule
+predicates; native reviewed merge operation 9, codec 6 is described below. Before any ref writes, each enabled rule
 checks deletion policy, ancestry and every required check. For a non-deletion,
 the selected attempt is the greatest creation number matching the proposed
 commit, context and current context version. It must have state `success` and
@@ -1942,17 +1942,18 @@ native merge receiver must authenticate the exact proof and conditional ref
 snapshot, check current access/reviews/checks and ref versions, and commit joint
 roots, pull state and UUID result under the actual owner fence and durable
 recovery journal. The native receiver described below exists; its resident
-adapter and terminal pin release remain unfinished. The historical SQL merge
+adapter remains unfinished; typed terminal release is described below. The historical SQL merge
 description below is not qualification of the native product workflow.
 
-`PublishReviewedMerge` reuses operation 9 with codec 5 and a 256 KiB input / 512
+`PublishReviewedMerge` reuses operation 9 with codec 6 and a 256 KiB input / 512
 byte output contract. It replaces the registered contract rather than decoding
 legacy codec 4. Its private factory requires a ref-only `PreparedCatalog`: no
 incoming pack or native push-result checkpoint is accepted. It reads at most two
 source/base facts from that preparation's immutable ref root, verifies native
 ancestry, and prepares the conditional ref snapshot while preserving HEAD.
 The existing catalog MAC binds actor, exact request including preparation time,
-fact vector, plan/evidence and proposed ref root under a distinct merge purpose.
+fact vector, plan/evidence, proposed ref root and permanent audit root under a
+distinct merge purpose.
 No serving-only proof, arbitrary root or transport bit grants write authority.
 
 The final command requires its exact registered SDK command and body before
@@ -1976,8 +1977,18 @@ Kind `Merge` cannot be restored or decoded as a push outcome.
 
 The current SHA-256 maximum result encodes to 493 bytes, within the unchanged
 512-byte journal cap. Known results survive original factory loss, SQLite loss
-and actual owner restoration. Merge pins deliberately remain retained: terminal
-release has not yet certified their selected catalog/ref graph and UUID outcome.
+and actual owner restoration. An applied UUID row also retains a bounded
+`StoredInputRoot` descriptor containing its typed request, catalog and ref
+snapshot. The final merge transaction saves that descriptor atomically with the
+result; SQL guards prohibit replacing, updating or deleting the row. Terminal
+release selects the original UUID audit, authenticates its typed catalog roots
+and exact published base-ref path, and transfers the original recovery phase
+into the existing immutable receipt archive before deleting the pin. A fresh
+UUID replay must close its own operation first and selects the original audit,
+not its new proposal. Known denials retain their original phase after later
+success and require authoritative operation closure. This authorizes no provider
+deletion; complete retained-root inventory and descendant reclamation remain
+required. See [terminal retention](design/terminal-publication-retention.md).
 The public adapter still invokes retired preparation/codec 4, so network merge
 remains unqualified. Generated merge/squash/rebase strategies are not accepted by
 this factory; their producers and integration remain required work.
@@ -2282,7 +2293,7 @@ conflict. There is no synthesized commit, implicit rebase or strategy fallback.
 
 Historical SQL merge contract (operation 9, codec 4; no longer registered in
 the native production registry): the old command performed the following
-transaction. The native operation 9, codec 5 contract above replaces its storage
+transaction. The native operation 9, codec 6 contract above replaces its storage
 authority. Public/resident adapter conversion remains open; this historical
 section is not evidence that the current merge endpoint works.
 
diff --git a/docs/design/terminal-publication-retention.md b/docs/design/terminal-publication-retention.md
index 6fe01b40..e4b51c48 100644
--- a/docs/design/terminal-publication-retention.md
+++ b/docs/design/terminal-publication-retention.md
@@ -1,20 +1,43 @@
 # Terminal publication recovery retention
 
-Completed pushes and closed initialization attempts must release their independent preparation pins without losing original command receipts. Leaving successful pins forever eventually exhausts the 4,096-pin admission cap and retains unnecessary catalog floors. This protocol transfers the same authenticated recovery certificate and phase journal into the immutable shared `catalog_recovery_receipts` table, then deletes the matching pin in one transaction. It uses the fresh publication schema and existing certificate, journal, SDK receipt and artifact structures; it adds no durable queue or per-object rows. The archive is keyed by original incarnation/admission sequence, with an operation index for typed enumeration. Different attempts of the same logical initialization retain independent original receipts.
+Completed pushes and closed initialization or reviewed-merge attempts must release their independent preparation pins without losing original command receipts. Leaving successful pins forever eventually exhausts the 4,096-pin admission cap and retains unnecessary catalog floors. This protocol transfers the same authenticated recovery certificate and phase journal into the immutable shared `catalog_recovery_receipts` table, then deletes the matching pin in one transaction. It uses the fresh publication schema and existing certificate, journal, SDK receipt and artifact structures; it adds no durable queue or per-object rows. The archive is keyed by original incarnation/admission sequence, with an operation index for typed enumeration. Different attempts of the same logical initialization retain independent original receipts.
 
 The protocol releases a preparation pin. It does not authorize provider deletion. Complete retained-root enumeration, reader and worker drain, backup, isolated restore, and repository-scoped collection remain required before any production artifact deletion.
 
 ## Release eligibility and authority
 
-`RegisteredRootRecovery::ready_terminal_release` accepts only the current canonical recovery head with a recorded completed root outcome. A policy head is terminal only when its original refusal is recorded and its pre-frozen fallback root command has completed. A known initialization result is terminal after its exact attempt is closed. A positive must match the immutable selected initialization fact; a known denial may retire only after Claim or bounded operation reaping has removed that exact active binding. A successor of the same logical operation keeps its own pin. Unknown acceptance, passed intermediate pages, denied push root commands, historical heads, and a refused page without completed fallback cannot produce a release proof.
+`RegisteredRootRecovery::ready_terminal_release` accepts only the current canonical recovery head with a recorded completed root outcome. A policy head is terminal only when its original refusal is recorded and its pre-frozen fallback root command has completed. A known initialization result is terminal after its exact attempt is closed. A positive must match the immutable selected initialization fact; a known denial may retire only after Claim or bounded operation reaping has removed that exact active binding. A successor of the same logical operation keeps its own pin. A typed merge
+result is terminal only after its exact attempt closes. An applied result must
+match the permanent UUID row and selected native audit; a denial retains its
+original phase even if a later fresh command succeeds with the same UUID.
+Unknown acceptance, passed intermediate pages, denied push root commands, historical heads, and a refused page without completed fallback cannot produce a release proof.
 
 The private factory checks the saved actor and request selection against that exact completed outcome. It authenticates the current bundle and each predecessor frame, verifying repository MACs, tenant/application, lease identity, original SDK stamps, and strictly decreasing phase steps. Each header is bounded by 8 KiB. It then authenticates the selected outcome/native metadata and streams the selected response and native audit bodies to verified EOF. Missing or corrupt required bytes prevent proof creation. For positive initialization, the same verifier used by route activation downloads the catalog, directory and ref snapshot and checks their complete typed empty graph. The graph transcript includes the original fact and all three authenticated descriptors. A known negative has no positive graph edges; its original typed denial remains bound by the phase digest.
 
+For native fast-forward merges, `pull_merges.publication` reuses the existing
+bounded `StoredInputRoot` representation. The private factory uploads logical
+merge intent, base ref, catalog descriptor, ref snapshot and ref generation;
+the catalog MAC binds this audit descriptor alongside the conditional ref
+proposal. Operation 9 codec 6 saves it atomically with the immutable UUID result.
+SQL guards reject result mutation, deletion and replacement. Fresh deployments
+use this schema directly; no backward decoder or SQL ref mirror is introduced.
+
+Terminal verification reconstructs the exact actor/request binding and original
+result from that UUID row, then reads the purpose-specific audit. It checks the
+repository, original result, at most 48 directory range roots and one source
+root through a fresh bounded `CatalogReader`, and the exact published base-ref
+path/version through the selected immutable ref snapshot. Replays select the
+first applied attempt's creating namespace, even when the new attempt proposed
+no ref update. Verification does not enumerate historical objects or prove
+physical closure again. The permanent audit retains its catalog/ref descendant
+edges; the future complete collector must walk these edges as retained roots
+before any deletion. Missing or corrupt selected metadata prevents pin release.
+
 The purpose-specific MAC proof binds the original recovery certificate, phase-journal digest, and verified closed-graph digest. `ReleaseTerminalRecovery` is command 40, codec version 2, using purpose `canopy.terminal-recovery-release.v2\0`, with input limited to 4 KiB and output to 128 bytes. The actual command receiver separately requires current repository Admin authorization and its admitted owner fence. A proof prepared under an old owner or by a subsequently unauthorized administrator cannot bypass those checks.
 
 ## Atomic transfer and original receipts
 
-Before its first write, the receiver verifies the proof and embedded original certificate, exact current pin identity/head/phase, terminal selection, the immutable selected push or positive initialization outcome, and absence of an active binding for that exact incarnation/admission sequence. All semantic refusals precede writes.
+Before its first write, the receiver verifies the proof and embedded original certificate, exact current pin identity/head/phase, terminal selection, the immutable selected push, positive initialization or applied merge outcome, and absence of an active binding for that exact incarnation/admission sequence. All semantic refusals precede writes.
 
 The receiver obtains its release command's actual SDK mutation evidence and sequence from `CommandContext`. It inserts one shared archive row containing the original pin key and logical operation, and three bounded values: the original recovery certificate, original phase journal, and release identity/result/sequence. An exact CAS then deletes the matching preparation pin. Any later SQL failure rolls back both writes and SDK acceptance. SQL guards prohibit archive replacement, mutation or deletion; the lease deletion guard requires the same certificate and phase in the exact shared archive row.
 
@@ -32,6 +55,7 @@ An owner SQL query is not an arbitrary local SQLite read. The pinned Cellule exe
 | Selected response body | Required; its creating namespace can belong to a prior admitted attempt |
 | Native plan and signed certificate bodies | Required native audit edges, when present |
 | Original wire request, original command bodies, unselected responses and unpublished candidate artifacts | No permanent edge from this closed audit role; other retained snapshots, unknown attempts, readers or backups can still require them |
+| Applied merge audit input root | Retained by the immutable UUID result; includes exact intent and typed catalog/ref descendants, independently of SQL generation reaping |
 | Initial empty catalog, directory and ref snapshot | Retained through the immutable initialization fact; its original pin identity also names receipt recovery |
 | Published catalog, refs, packs and indexes | Retained through their own certified catalog/generation and reader/backup roots |
 
@@ -45,7 +69,7 @@ Only eligible closed attempts transfer into the shared archive. An older denied
 
 Before each bounded keyset scan, the supervisor also recovers uncertain factory-owned terminal-release jobs from that same coordinator. This is necessary after a committed release removes its pin but loses its acknowledgement: a pin-only scan would no longer discover the still-charged command. Recovery retains the original SDK command, identity and receipt, including after coordinator close or scanner stop/restart. It does not retry compaction or replace a live producer's uncertain command.
 
-An active denied initialization is deferred before release preparation or SDK admission. Successful repository startup retires its initial pin before exposing the route, and recovered positive startup discovers the original pin by the immutable initialization outcome’s exact incarnation/admission sequence. Pending startup retires an original known denial only after a successful Claim. Current maintenance fencing comes from the validated durable Cell Control and its live node advertisement; the receiver still independently checks its actual admitted fence and current Admin role. The existing tracked transition owns this constant-size work through cancellation.
+An active denied initialization or merge is deferred before release preparation or SDK admission. Successful repository startup retires its initial pin before exposing the route, and recovered positive startup discovers the original pin by the immutable initialization outcome’s exact incarnation/admission sequence. Pending startup retires an original known denial only after a successful Claim. Current maintenance fencing comes from the validated durable Cell Control and its live node advertisement; the receiver still independently checks its actual admitted fence and current Admin role. The existing tracked transition owns this constant-size work through cancellation.
 
 Stopping the scanner requests stop between scans and joins its current work. It does not cancel an admitted release. Close and drain the publication coordinator separately. On owner succession, restart the service with current maintenance authority; original receipt lookup remains independent of that fresh authority. Production routing must use the SDK's ownership-aware transport rather than keeping a stopped owner's fixed local handle.
 
@@ -55,4 +79,17 @@ Native SHA-1/SHA-256 tests exercise quota release at the existing 4,096-pin cap,
 
 Six typed initialization families additionally qualify both formats, immutable shared archives, denied-old/successful-new receipt separation, missing typed empty metadata, actual Admin/owner checks, last-write rollback, automatic release recovery after pin disappearance, SDK expiry, saved-body loss and fresh-owner restoration. The complete frozen-source publication suite passes 264 tests in 175.94 seconds with four threads and standard stacks.
 
+Five native merge retirement families qualify both formats where applicable:
+original applied UUID replay selects the first audit after releasing its pin;
+a denied attempt closes and keeps its original refusal after a fresh attempt
+succeeds; missing and corrupt audit, catalog, directory, ref snapshot and ref
+index metadata prevent release without losing the result; current Admin/owner
+checks and a fault at the final delete preserve atomic archive/pin rollback;
+and archive plus release receipts survive original command-body removal, SQLite
+loss and actual owner restoration. Permanent merge rows reject update, delete
+and replacement. These use verified stock-Git pack/catalog bytes and a trusted
+synthetic initial certificate, isolating transaction and recovery invariants.
+They do not qualify the public endpoint, actual automatic merge retirement,
+generation reaping under a merge workload or complete provider garbage collection.
+
 These fixtures prove the covered transaction, receipt and lifecycle invariants. They do not establish throughput for 10,000 developers. Proof preparation is currently serialized by the repository scanner; node-wide fair verification admission, provider I/O budgets and full-history measurements remain mandatory. Complete production producer/reader and background-service wiring, initial Begin/Claim/Renew/pre-registration uncertainty, retained-input Claim/adoption/repreparation, complete typed collection and isolated restore, file-backed intents/reports, OS containment, accelerated reads, physical rewriting and continuous hot-root maintenance remain open under the [implementation plan](../large-repository-implementation-plan.md) and [large-team requirements](../large-team-scalability.md).
diff --git a/docs/evidence/native-merge-retirement-ci-20261005.json b/docs/evidence/native-merge-retirement-ci-20261005.json
new file mode 100644
index 00000000..8a7807ef
--- /dev/null
+++ b/docs/evidence/native-merge-retirement-ci-20261005.json
@@ -0,0 +1,377 @@
+{
+  "recorded_at_utc": "2026-10-05T20:29:32.209793+00:00",
+  "base_head": "2ed3d58f9a3ee1b3020f6100555febaca4e01330",
+  "host": "macOS, Rust 1.98.0; exact-head Linux qualification remains required",
+  "source_files": 515,
+  "rust_files": 497,
+  "source_hash_digest": "ec37049731e41eb420dac90a67c20fa49c2efc603a6ff206c38da674ce9fa2eb",
+  "source_manifest": "/tmp/canopy-native-merge-retirement-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "release_qualified": false,
+  "baseline": {
+    "source_digest": "82e7d1c7014e1431125b5a9af0e0072d1e39311311e147328ec2337daaf8a9c5",
+    "result": "Compiled regression fails Error::Context when an applied merge attempts terminal pin release; original implementation deliberately provided no typed Merge terminal.",
+    "path": "/tmp/canopy-native-merge-retirement-baseline.log",
+    "sha256": "a0f048d817a9879318885f8ea67b0b15894c1d2a997ae85a7d5a33fda0147a9e",
+    "summaries": [
+      "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 733 filtered out; finished in 0.52s"
+    ]
+  },
+  "intermediate_failed_runs": [
+    {
+      "reason": "CatalogReader::open arguments were reversed. Corrected before focused validation. No frozen source manifest was captured for this intermediate compile; no exact-source qualification is claimed.",
+      "path": "/tmp/canopy-native-merge-retirement-check-first.log",
+      "sha256": "e11041d36cb9ce2f2c964e3dc9f70335d4da1329bd789cdca937f9fbf628d363",
+      "summaries": []
+    },
+    {
+      "reason": "New test helper needed to unbox Rejected result and two additional Graph fixture constructors needed the provider handle. Corrected without changing production authorization or assertions.",
+      "source_digest": "80cb311d59467cc883ab48b7f81cd05dde6fbbd14b931874324ea8011a24f32f",
+      "path": "/tmp/canopy-native-merge-retirement-focused-first.log",
+      "sha256": "6704639364b4cb603ae2d558e85360d702716bdad7789ed47bdce6a27a9d305e",
+      "summaries": []
+    }
+  ],
+  "focused": {
+    "result": "13 passed, 0 failed; five new retirement families cover both SHA-1/SHA-256 where applicable",
+    "path": "/tmp/canopy-native-merge-retirement-final-focused-final.log",
+    "sha256": "63bd04b359b514fc40358e5ed80baa45507b8d1180716d8044ffee7ef2a92cb3",
+    "summaries": [
+      "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 725 filtered out; finished in 4.13s"
+    ]
+  },
+  "validation": {
+    "source_digest": "ec37049731e41eb420dac90a67c20fa49c2efc603a6ff206c38da674ce9fa2eb",
+    "phases": [
+      {
+        "name": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::tests::native_merge::",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 83.03,
+        "log": "/tmp/canopy-native-merge-retirement-final-focused-final.log",
+        "log_sha256": "63bd04b359b514fc40358e5ed80baa45507b8d1180716d8044ffee7ef2a92cb3",
+        "summaries": [
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 725 filtered out; finished in 4.13s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 34.62,
+        "log": "/tmp/canopy-native-merge-retirement-final-clippy-final.log",
+        "log_sha256": "6dc013c5421e14d5bf81bb68c6ba2263e86afb401c45cebf5b5639f691873586",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 696.39,
+        "log": "/tmp/canopy-native-merge-retirement-final-workspace-final.log",
+        "log_sha256": "f2da3c4d0382ea8a604b7fe52127042f71e55f0789333b3c8a49c064fa825757",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.65s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.23s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 737 filtered out; finished in 0.00s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 737 filtered out; finished in 0.06s",
+          "test result: ok. 738 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 287.28s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.71s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+          "test result: FAILED. 82 passed; 24 failed; 9 ignored; 0 measured; 0 filtered out; finished in 348.96s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.32s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.16s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.22s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "sha256::sha256_checks_reviews_and_merge_survive_restore",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 38.51,
+        "log": "/tmp/canopy-native-merge-retirement-final-build-final.log",
+        "log_sha256": "696a3334cc2e62576200113f74213b1e3d1e78a14665704cdf04e76fdcab0e7a",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.25,
+        "log": "/tmp/canopy-native-merge-retirement-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 41.98,
+        "log": "/tmp/canopy-native-merge-retirement-final-harness-final.log",
+        "log_sha256": "5eef478c1e991f316ac5a6e1c49d19adbfff7e6d7a05f2b0edeaea4d9cec0a2e",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.05,
+        "log": "/tmp/canopy-native-merge-retirement-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 738,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 82,
+      "failed": 24,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 858,
+    "failed": 27,
+    "ignored": 9,
+    "executed": 885,
+    "total": 894
+  },
+  "counting": "Last summary per Cargo Running/Doc-tests section; nested child summaries and focused reruns excluded. Ignored cases remain unexecuted.",
+  "workspace_failure_delta": {
+    "added": [],
+    "removed": []
+  },
+  "parent_ci": {
+    "headRefOid": "2ed3d58f9a3ee1b3020f6100555febaca4e01330",
+    "statusCheckRollup": [
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T20:09:41Z",
+        "conclusion": "CANCELLED",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37366430531/job/111952638748",
+        "name": "harness",
+        "startedAt": "2026-10-05T19:54:39Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T20:05:27Z",
+        "conclusion": "SUCCESS",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37366434267/job/111952651018",
+        "name": "harness",
+        "startedAt": "2026-10-05T20:04:46Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T20:09:43Z",
+        "conclusion": "CANCELLED",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37366434267/job/111952650597",
+        "name": "rust",
+        "startedAt": "2026-10-05T19:54:41Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T20:09:41Z",
+        "conclusion": "CANCELLED",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37366430531/job/111952638834",
+        "name": "rust",
+        "startedAt": "2026-10-05T19:54:39Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      }
+    ]
+  },
+  "parent_ci_interpretation": "Parent 2ed3d58 Rust checks were observed terminal CANCELLED, not successful. One PR harness completed SUCCESS. No Linux Rust qualification is inferred.",
+  "changes": [
+    "Operation 9 codec 6 binds a permanent audit descriptor in the existing catalog certificate and atomically saves it with the applied UUID result. It reuses StoredInputRoot and pull_merges rather than SQL ref/ancestry mirrors or a compatibility decoder.",
+    "Fresh schema guards prevent UUID result/audit update, deletion or replacement. Selected typed audit contains logical request, base ref, catalog, ref snapshot and ref generation.",
+    "Merge terminal release selects the original applied UUID audit, checks actor/request/result and native catalog top roots plus exact published base-ref path, then atomically archives original recovery and release receipt before deleting its pin.",
+    "New UUID replay attempts and negative attempts require their own actual operation closure. Archived negative results remain original after a later fresh command succeeds.",
+    "Five new families cover both-format applied/replayed pin release, denied-then-successful original receipt separation, missing/corrupt five metadata roles, actual authority and last-write rollback, immutable UUID rows, and saved-command-body loss/SQLite loss/owner restoration of merge and release receipts."
+  ],
+  "qualification_limits": [
+    "Native fixture installs genuine verified stock-Git catalog/ref bytes using a synthetic initial certificate. Tests isolate private publication/retirement/recovery and do not qualify public HTTP/resident integration.",
+    "Verification is bounded top-metadata and selected-ref-path verification, not exhaustive historical object/closure traversal. Permanent audit retains typed descendants. No provider deletion is authorized; complete root inventory, backup/restore and physical GC remain required.",
+    "Actual automatic merge retirement and generation-reaping workload coverage remain required. Existing supervisor uses shared typed terminal protocol but no merge-specific service test is claimed.",
+    "Public merge endpoint still invokes retired codec4/SQL preparation and remains unqualified. Generated strategies and native thread/default-branch writers remain open.",
+    "macOS lib-test linker reports an oversized __eh_frame compact-unwind warning; all-target Clippy is a separate check. Production server build and exact-head Linux results must be assessed independently.",
+    "Full CI, pre-Bind/late-ACL refusal, peer recovery/backup, selective fetch, final DDL/physical retention, accelerators/fair maintenance, asynchronous file attribution and full-history/10k-engineer capacity gates remain open."
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index eba7eda2..04e27163 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,55 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Native merge audit and terminal retirement (2026-10-05 checkpoint)
+
+Operation 9 codec 6 now binds a permanent merge audit in the existing catalog
+certificate. The fresh `pull_merges` schema stores a bounded `StoredInputRoot`
+descriptor beside the immutable UUID result; SQL guards reject result/audit
+updates, deletion and replacement. It reuses existing request, catalog, ref
+snapshot and recovery structures, without a SQL ref mirror or backward decoder.
+The final transaction saves the audit descriptor with joint roots and result.
+
+Typed terminal retirement selects the first applied UUID's permanent audit,
+checks its exact actor/request/result and native catalog top roots plus published
+base-ref path, and atomically archives original recovery and release receipts
+before deleting the closed preparation pin. A fresh replay must close its own
+operation and selects the old audit rather than its new proposal. Known denials
+remain their original phase after a later fresh attempt succeeds. Missing or
+corrupt selected metadata prevents release. This grants no provider deletion;
+the complete retained-root collector must include the audit's typed descendants.
+
+The failing-first applied-retirement regression compiled and returned
+`Error::Context` on the parent implementation. Thirteen focused merge tests now
+pass, including five new retirement families for applied/replayed release,
+denied-then-successful receipt separation, missing/corrupt metadata, actual
+Admin/owner checks, last-write rollback, immutable result rows, original body
+removal and SQLite-loss/owner restoration of both merge and release receipts.
+Both formats are exercised where applicable. Fixtures use verified stock-Git
+bytes with a trusted synthetic initial certificate; they do not qualify the
+public merge adapter or initial-root production path.
+
+Frozen validation passes all 738 server library tests, all-target Clippy with
+warnings denied, the production server build, formatting/diff checks and all
+96 Python harness tests. Full Rust results are 858 passed /27 failed /9 ignored;
+the exact failed-case set is unchanged from the prior atomic-merge run.
+Exact source digest across
+515 files (497 Rust) is
+`ec37049731e41eb420dac90a67c20fa49c2efc603a6ff206c38da674ce9fa2eb`.
+The final results and preserved baseline/intermediate failures are recorded
+in [merge retirement evidence](evidence/native-merge-retirement-ci-20261005.json).
+Parent `2ed3d58` Rust checks were cancelled, not passed; one PR harness completed
+successfully. Exact new-head Linux qualification remains required.
+
+Next: qualify actual automatic merge retirement and selected audits after SQL
+generation reaping; connect the public/resident fast-forward endpoint through
+owned staging and exact registered dispatch; then generated merge/squash/rebase,
+thread/default-branch writers and the remaining full CI failures. Physical
+collection/backup/restore, peer recovery, selective fetch, fair maintenance and
+accelerators, asynchronous file attribution and full-history/10,000-engineer
+capacity gates remain open. The historical checkpoints below describe earlier
+revisions; the current full goal is not achieved or release qualified.
+
 ## Atomic native reviewed-merge transaction (2026-10-05 checkpoint)
 
 The private factory now binds the exact merge request, actor, source/base ref

From c8c49e8ff3e9467e2b0ca9f1610ab67245c48c58 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 14:07:00 -0700
Subject: [PATCH 42/55] fix: publish reviewed merges through native staging

---
 crates/canopy-server/src/git_gateway/merge.rs | 201 +++++
 crates/canopy-server/src/git_gateway/mod.rs   |   1 +
 crates/canopy-server/src/git_gateway/push.rs  |   2 +-
 .../src/git_gateway/push/native.rs            |  12 +-
 crates/canopy-server/src/lib.rs               |   1 +
 .../src/packs/publication/native_merge.rs     |  27 +
 .../packs/publication/tests/native_merge.rs   |  53 +-
 .../tests/native_merge/retirement.rs          |  93 ++-
 .../src/packs/publication/tests/publishing.rs |  14 +-
 .../src/repository_http/merge.rs              |   6 +-
 .../canopy-server/tests/multi_server/merge.rs |  93 +++
 docs/contracts.md                             |  34 +-
 docs/design/terminal-publication-retention.md |   7 +-
 .../native-merge-endpoint-ci-20261005.json    | 736 ++++++++++++++++++
 .../large-repository-implementation-status.md |  58 ++
 15 files changed, 1281 insertions(+), 57 deletions(-)
 create mode 100644 crates/canopy-server/src/git_gateway/merge.rs
 create mode 100644 docs/evidence/native-merge-endpoint-ci-20261005.json

diff --git a/crates/canopy-server/src/git_gateway/merge.rs b/crates/canopy-server/src/git_gateway/merge.rs
new file mode 100644
index 00000000..fe35560b
--- /dev/null
+++ b/crates/canopy-server/src/git_gateway/merge.rs
@@ -0,0 +1,201 @@
+//! Reviewed merges use the same resident-owned staging and exact publication
+//! lifecycle as pushes. HTTP observers own no producer or recovery command.
+use super::push::native::{active, bound, final_publication};
+use super::*;
+use crate::{
+    packs::{
+        catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes},
+        metadata::MetadataLimits,
+        publication::{
+            BeginRequest, CatalogPreparation, DEFAULT_LEASE_MS, PublicationCoordinator,
+            PublicationError, PublicationOutcome, StagingCoordinator, StagingError, StagingState,
+            StagingTicket,
+        },
+    },
+    pulls::merge::{MergeOutcome, MergeRequest, MergeStrategy, command::MergeInput, valid_request},
+};
+use cellule_runtime::{
+    InvocationError,
+    codec::{BoundedEncoder, WireValue},
+};
+
+fn work(error: impl StdError + Send + Sync + 'static) -> StagingError {
+    StagingError::Input(Box::new(error))
+}
+fn failed(error: impl StdError + Send + Sync + 'static) -> GatewayError {
+    GatewayError::Cell(Box::new(error))
+}
+
+impl GitGateway {
+    /// Admit a fresh attempt for each request observation. Application UUID
+    /// selection is atomic in the final command; a previously denied SDK
+    /// identity is never reused with changed policy or proof bytes.
+    pub async fn merge_pull(
+        &self,
+        identity: MutationIdentity,
+        actor: &str,
+        number: i64,
+        request: MergeRequest,
+    ) -> Result<MergeOutcome, GatewayError> {
+        if number < 1
+            || !valid_request(&request)
+            || crate::directory::validate_component(actor).is_err()
+        {
+            return Err(failed(cellule_runtime::Error::Command(
+                "invalid merge request",
+            )));
+        }
+        // This fresh query follows HTTP body ingestion. The final receiver
+        // independently rechecks authority after queueing and preparation.
+        let access = self
+            .repository
+            .access_level(ReadIdentity::Account(actor), None)
+            .await
+            .map_err(failed)?
+            .output;
+        match access {
+            None => return Ok(MergeOutcome::NotFound),
+            Some(role) if role < TokenScope::Write => return Ok(MergeOutcome::Forbidden),
+            _ => {}
+        }
+        if request.strategy != MergeStrategy::FastForward {
+            return Err(failed(cellule_runtime::Error::Command(
+                "native generated merge preparation is unavailable",
+            )));
+        }
+        let input = MergeInput {
+            actor: actor.into(),
+            number,
+            request: request.clone(),
+            issued_at_ms: identity.issued_at_ms,
+        };
+        let mut encoded = BoundedEncoder::new(4096).map_err(failed)?;
+        input.encode(&mut encoded).map_err(failed)?;
+        let mut digest = blake3::Hasher::new();
+        digest.update(b"canopy.reviewed-merge-workflow.v1\0");
+        digest.update(&self.repository.repository_id());
+        digest.update(&encoded.finish());
+        let staging = self.repository.staging_coordinator().map_err(failed)?;
+        let ready = staging
+            .ready_request(
+                BeginRequest {
+                    repository: self.repository.repository_id(),
+                    operation: uuid::Uuid::new_v4().into_bytes(),
+                    request_digest: *digest.finalize().as_bytes(),
+                    actor: actor.into(),
+                    lease_ms: DEFAULT_LEASE_MS,
+                },
+                new_identity()?,
+            )
+            .await
+            .map_err(failed)?;
+        let ticket = staging.submit(ready).map_err(|(error, _)| failed(error))?;
+        let gateway = self.clone();
+        let owner = staging.clone();
+        ticket
+            .drive(move |ticket, publication| async move {
+                Box::pin(gateway.drive_merge(owner, ticket, publication, identity, number, request))
+                    .await
+            })
+            .map_err(failed)?;
+        match ticket.wait_completion().await {
+            StagingState::Published(Ok(PublicationOutcome::Merge(value))) => Ok(value.output),
+            StagingState::Published(Err(error)) => match error.as_ref() {
+                PublicationError::Merge(InvocationError::Rejected(value)) => {
+                    Ok(value.output.clone())
+                }
+                _ => Err(failed(error)),
+            },
+            StagingState::Uncertain(error) | StagingState::Fenced(error) => Err(failed(error)),
+            _ => Err(failed(StagingError::NotReady)),
+        }
+    }
+
+    async fn drive_merge(
+        &self,
+        staging: Arc<StagingCoordinator>,
+        ticket: StagingTicket,
+        publication: PublicationCoordinator,
+        identity: MutationIdentity,
+        number: i64,
+        request: MergeRequest,
+    ) -> Result<(), StagingError> {
+        active(&staging, &ticket).await?;
+        // Ref-only work has no incoming physical inputs. Bind selects the
+        // current certified joint generation after all staged work drains.
+        ticket.seal()?;
+        bound(&staging, &ticket).await?;
+        let format = self.repository.object_format();
+        let indexes = Arc::new(CatalogIndexes::new(self.artifacts.clone(), format));
+        let files = Arc::new(
+            CatalogFiles::new(
+                &self.scratch_root,
+                self.disk_budget.clone(),
+                self.artifacts.clone(),
+                format,
+                CatalogFileLimits::default(),
+            )
+            .map_err(work)?
+            .with_native(self.native.clone()),
+        );
+        let base = Arc::new(ticket.open_base(indexes, files).await?);
+        let gateway = self.clone();
+        let ready = ticket
+            .spawn_bound(move |_, context| async move {
+                let prepared = Arc::new(
+                    CatalogPreparation::new_staged(
+                        &context,
+                        &gateway.scratch_root,
+                        gateway.disk_budget.clone(),
+                        base,
+                        MetadataLimits::default(),
+                    )
+                    .await
+                    .map_err(work)?
+                    .finish()
+                    .await
+                    .map_err(work)?,
+                );
+                prepared
+                    .ready_native_merge(
+                        identity,
+                        number,
+                        request,
+                        &gateway.scratch_root,
+                        gateway.disk_budget.clone(),
+                        MetadataLimits::default(),
+                    )
+                    .await
+                    .map_err(work)
+            })?
+            .wait()
+            .await
+            .map_err(work)?;
+        let registered = ready
+            .persist_recovery(&self.artifacts, new_identity().map_err(work)?)
+            .await
+            .map_err(work)?;
+        let ready = ready
+            .bind_recovery(registered, &self.artifacts)
+            .map_err(work)?;
+        // Retrieve the producer result before Finishing so it cannot wait for
+        // its own worker drain. The lifecycle captures the exact ready owner.
+        let observer = ticket
+            .publish_wait(&publication, ready)
+            .await
+            .map_err(work)?;
+        match final_publication(&staging, &ticket, &observer).await {
+            Ok(PublicationOutcome::Merge(_)) => Ok(()),
+            Err(StagingError::Publication(error))
+                if matches!(
+                    error.as_ref(),
+                    PublicationError::Merge(InvocationError::Rejected(_))
+                ) =>
+            {
+                Ok(())
+            }
+            Err(error) => Err(error),
+            _ => Err(StagingError::Context),
+        }
+    }
+}
diff --git a/crates/canopy-server/src/git_gateway/mod.rs b/crates/canopy-server/src/git_gateway/mod.rs
index 91348cc5..527f8c7c 100644
--- a/crates/canopy-server/src/git_gateway/mod.rs
+++ b/crates/canopy-server/src/git_gateway/mod.rs
@@ -34,6 +34,7 @@ mod branch_policy;
 mod candidates;
 mod discovery;
 mod fetch;
+mod merge;
 pub mod preflight;
 mod push;
 mod ssh;
diff --git a/crates/canopy-server/src/git_gateway/push.rs b/crates/canopy-server/src/git_gateway/push.rs
index e341419a..2426be67 100644
--- a/crates/canopy-server/src/git_gateway/push.rs
+++ b/crates/canopy-server/src/git_gateway/push.rs
@@ -1,4 +1,4 @@
-mod native;
+pub(super) mod native;
 use super::*;
 
 impl GitGateway {
diff --git a/crates/canopy-server/src/git_gateway/push/native.rs b/crates/canopy-server/src/git_gateway/push/native.rs
index 0e5ea542..974dae16 100644
--- a/crates/canopy-server/src/git_gateway/push/native.rs
+++ b/crates/canopy-server/src/git_gateway/push/native.rs
@@ -471,7 +471,10 @@ impl GitGateway {
     }
 }
 
-async fn active(staging: &StagingCoordinator, ticket: &StagingTicket) -> Result<(), StagingError> {
+pub(in crate::git_gateway) async fn active(
+    staging: &StagingCoordinator,
+    ticket: &StagingTicket,
+) -> Result<(), StagingError> {
     loop {
         match ticket.wait().await {
             StagingState::Active(_) => return Ok(()),
@@ -484,7 +487,10 @@ async fn active(staging: &StagingCoordinator, ticket: &StagingTicket) -> Result<
         }
     }
 }
-async fn bound(staging: &StagingCoordinator, ticket: &StagingTicket) -> Result<(), StagingError> {
+pub(in crate::git_gateway) async fn bound(
+    staging: &StagingCoordinator,
+    ticket: &StagingTicket,
+) -> Result<(), StagingError> {
     loop {
         match ticket.wait_terminal().await {
             StagingState::Bound(_) => return Ok(()),
@@ -516,7 +522,7 @@ async fn checkpoint(
         }
     }
 }
-async fn final_publication(
+pub(in crate::git_gateway) async fn final_publication(
     staging: &StagingCoordinator,
     ticket: &StagingTicket,
     observer: &StagedPublicationTicket,
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 59f40b6e..5d4772ef 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -208,6 +208,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("native_git/process.rs"));
                 source.update(include_bytes!("native_git/process/fence.rs"));
                 source.update(include_bytes!("git_gateway/mod.rs"));
+                source.update(include_bytes!("git_gateway/merge.rs"));
                 source.update(include_bytes!("git_gateway/candidates/mod.rs"));
                 source.update(include_bytes!("git_gateway/fetch.rs"));
                 source.update(include_bytes!("git_gateway/discovery.rs"));
diff --git a/crates/canopy-server/src/packs/publication/native_merge.rs b/crates/canopy-server/src/packs/publication/native_merge.rs
index 20bf8cb7..927013f6 100644
--- a/crates/canopy-server/src/packs/publication/native_merge.rs
+++ b/crates/canopy-server/src/packs/publication/native_merge.rs
@@ -349,6 +349,33 @@ fn publish(
     else {
         return Ok(denied(MergeOutcome::Conflict));
     };
+    let check = LeaseCheck {
+        token: data.token,
+        actor: data.actor.clone(),
+    };
+    let result = publish_authenticated(context, proof, data, key)?;
+    // Every authenticated result is terminal for this exact command. Close its
+    // own binding atomically with the recovery phase, including denials and
+    // application UUID replays. Never close a successor or an unauthenticated
+    // proposal. The independent pin remains until typed terminal retirement.
+    if check.token.owner == context.owner_fence()
+        && let Some(row) = load(context, check.token)?
+        && matched(&row, &check)
+    {
+        check_pin(context, &row)?;
+        changed(context.sql(&statement(
+            "DELETE FROM catalog_operations WHERE id=?1",
+            vec![blob(check.token.operation)],
+        ))?)?;
+    }
+    Ok(result)
+}
+fn publish_authenticated(
+    context: &mut CommandContext<'_, '_>,
+    proof: NativeMergeProof,
+    data: super::certificate::CertificateData,
+    key: [u8; 32],
+) -> cellule_runtime::Result<CommandResult<MergeOutcome>> {
     let input = proof.input;
     let role = crate::access::decode_access(&context.sql(&SqlBatch {
         statements: vec![crate::access::access_statement(&input.actor)],
diff --git a/crates/canopy-server/src/packs/publication/tests/native_merge.rs b/crates/canopy-server/src/packs/publication/tests/native_merge.rs
index 51713a1d..d0af4554 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_merge.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_merge.rs
@@ -4,7 +4,7 @@
 use super::*;
 use super::{
     prepare::{cleaned, opened},
-    publishing::{Graph, assembled, edit, plan, state, update},
+    publishing::{Graph, assembled, edit, plan, update},
 };
 use crate::{
     packs::{
@@ -130,7 +130,10 @@ async fn prepared_command(
     Ok((command, registered))
 }
 async fn domain_state(f: &Fixture) -> Result<Vec<u8>> {
-    let roots = state(&f.handle).await?;
+    domain_state_except_attempt(f, None).await
+}
+async fn domain_state_except_attempt(f: &Fixture, operation: Option<[u8; 16]>) -> Result<Vec<u8>> {
+    let roots = super::publishing::state_except_operation(&f.handle, operation).await?;
     let editorial = f
         .handle
         .query(0, 4096, |db| {
@@ -244,10 +247,15 @@ async fn native_merge_unprotected_unrelated_history_records_refusal_without_publ
         let (prepared, root, budget) = preparation(&f, &graph).await?;
         let (command, registered) =
             prepared_command(&f, &prepared, request, root.path(), budget.clone()).await?;
-        let before = domain_state(&f).await?;
+        let operation = prepared.token().operation;
+        let before = domain_state_except_attempt(&f, Some(operation)).await?;
         let result = command.execute().await?;
         assert_eq!(result.output, MergeOutcome::NotFastForward);
-        assert_eq!(domain_state(&f).await?, before);
+        assert_eq!(
+            domain_state_except_attempt(&f, Some(operation)).await?,
+            before
+        );
+        assert_operation(&f, operation, 0).await?;
         let recovered = registered
             .dispatch_any(
                 &f.client(),
@@ -280,10 +288,15 @@ async fn native_merge_late_review_requirement_is_current_and_does_not_bind_a_rej
             "INSERT INTO branch_rules VALUES('refs/heads/main',1,1,1,1,1,1)",
         )
         .await?;
-        let before = domain_state(&f).await?;
+        let operation = prepared.token().operation;
+        let before = domain_state_except_attempt(&f, Some(operation)).await?;
         let result = first.execute().await?;
         assert_eq!(result.output, MergeOutcome::ReviewsRequired);
-        assert_eq!(domain_state(&f).await?, before);
+        assert_eq!(
+            domain_state_except_attempt(&f, Some(operation)).await?,
+            before
+        );
+        assert_operation(&f, operation, 0).await?;
         // Remove only the review requirement, retain require-PR, ancestry and
         // deletion policy. Only the reviewed command may satisfy this PR gate.
         edit(&f,"UPDATE branch_rules SET required_approvals=0,version=2 WHERE reference='refs/heads/main'").await?;
@@ -432,9 +445,16 @@ async fn native_merge_changed_request_and_later_joint_generation_cannot_publish(
                 // identical ref facts. The joint generation alone must fence it.
                 edit(&f, "INSERT INTO catalog_generations SELECT 2,catalog,certificate,refs FROM catalog_generations WHERE generation=1; UPDATE catalog_state SET generation=2 WHERE singleton=1;").await?;
             }
-            let before = domain_state(&f).await?;
+            let operation = prepared.token().operation;
+            let excluded = if altered_request {
+                None
+            } else {
+                Some(operation)
+            };
+            let before = domain_state_except_attempt(&f, excluded).await?;
             assert_eq!(command.execute().await?.output, MergeOutcome::Conflict);
-            assert_eq!(domain_state(&f).await?, before);
+            assert_eq!(domain_state_except_attempt(&f, excluded).await?, before);
+            assert_operation(&f, operation, u64::from(altered_request)).await?;
             drop(prepared);
             cleaned(root.path(), &budget).await?;
             drop(graph.prepared);
@@ -546,3 +566,20 @@ async fn native_merge_original_result_survives_sqlite_loss_and_actual_owner_rest
 }
 
 mod retirement;
+
+async fn assert_operation(f: &Fixture, operation: [u8; 16], expected: u64) -> Result {
+    f.handle
+        .query(0, 128, move |db| {
+            assert_eq!(
+                db.query_row(
+                    "SELECT count(*) FROM catalog_operations WHERE id=?1",
+                    [operation.as_slice()],
+                    |r| r.get::<_, u64>(0)
+                )?,
+                expected
+            );
+            Ok(Vec::new())
+        })
+        .await?;
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs b/crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs
index 43a35ad9..6a3a3b87 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs
@@ -90,25 +90,9 @@ async fn native_merge_applied_attempt_releases_pin_without_losing_original_uuid_
         let (retry_command, retry_recovery) =
             prepared_command(&f, &retry, request, retry_root.path(), retry_budget.clone()).await?;
         assert_eq!(retry_command.execute().await?.output, original.output);
-        // An application replay does not consume its fresh preparation. Actual
-        // owner closure is required before its independent pin can be released.
+        // A terminal replay closes only its fresh operation in the same final
+        // transaction. Its independent pin can then select the original audit.
         let admin = terminal_retention::maintenance(&f.handle, f.repository).await?;
-        assert!(
-            retry_recovery
-                .ready_terminal_release(f.client(), &graph.store, admin.clone(), identity()?)
-                .await
-                .is_err()
-        );
-        assert!(
-            f.client()
-                .command::<AbortPreparation>(
-                    &f.target,
-                    identity()?,
-                    retry.base.capability().2.clone()
-                )
-                .await?
-                .output
-        );
         assert_eq!(
             retry_recovery
                 .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
@@ -144,19 +128,7 @@ async fn negative_merge_archive_keeps_its_denial_after_same_uuid_succeeds() -> R
         let original = command.execute().await?;
         assert_eq!(original.output, MergeOutcome::ReviewsRequired);
         let admin = terminal_retention::maintenance(&f.handle, f.repository).await?;
-        assert!(
-            saved
-                .ready_terminal_release(f.client(), &graph.store, admin.clone(), identity()?)
-                .await
-                .is_err()
-        );
         retained_pin(&f, &check, 1).await?;
-        assert!(
-            f.client()
-                .command::<AbortPreparation>(&f.target, identity()?, check.clone())
-                .await?
-                .output
-        );
         let release = saved
             .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
             .await?;
@@ -460,3 +432,64 @@ async fn archived_merge_and_release_receipts_survive_sqlite_loss_and_owner_resto
     }
     Ok(())
 }
+
+#[tokio::test]
+async fn terminal_merge_refusal_closure_rolls_back_with_original_phase_and_sdk_acceptance() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, request) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let (command, saved) =
+            prepared_command(&f, &prepared, request, root.path(), budget.clone()).await?;
+        edit(
+            &f,
+            "INSERT INTO branch_rules VALUES('refs/heads/main',1,1,1,1,1,1)",
+        )
+        .await?;
+        edit(&f,"CREATE TRIGGER terminal_merge_close_fault BEFORE DELETE ON catalog_operations BEGIN SELECT RAISE(ABORT,'terminal merge close fault'); END").await?;
+        let before = phase_state(&f).await?;
+        let domain = domain_state(&f).await?;
+        let operation = prepared.token().operation;
+        let remaining = domain_state_except_attempt(&f, Some(operation)).await?;
+        assert!(command.clone().execute().await.is_err());
+        assert_eq!(phase_state(&f).await?, before);
+        assert_eq!(domain_state(&f).await?, domain);
+        assert!(matches!(
+            f.client().resolve(command.evidence()).await?,
+            Resolution::Absent
+        ));
+        edit(&f, "DROP TRIGGER terminal_merge_close_fault").await?;
+        let original = command.execute().await?;
+        assert_eq!(original.output, MergeOutcome::ReviewsRequired);
+        assert_eq!(
+            domain_state_except_attempt(&f, Some(operation)).await?,
+            remaining
+        );
+        assert_operation(&f, operation, 0).await?;
+        assert_eq!(
+            saved
+                .ready_terminal_release(
+                    f.client(),
+                    &graph.store,
+                    terminal_retention::maintenance(&f.handle, f.repository).await?,
+                    identity()?
+                )
+                .await?
+                .complete()
+                .await?
+                .output,
+            TerminalReleaseReply::Released
+        );
+        let recovered = archived_result(&f, &graph, prepared.base.capability().2).await?;
+        assert_eq!(
+            (recovered.output, recovered.receipt),
+            (original.output, original.receipt)
+        );
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/publishing.rs b/crates/canopy-server/src/packs/publication/tests/publishing.rs
index ee64a2b6..f4d85720 100644
--- a/crates/canopy-server/src/packs/publication/tests/publishing.rs
+++ b/crates/canopy-server/src/packs/publication/tests/publishing.rs
@@ -184,7 +184,15 @@ async fn proof(graph: &Graph, updates: Vec<RefUpdate>) -> Result<RefPublicationP
     .await?)
 }
 pub(super) async fn state(handle: &CellHandle) -> Result<Vec<u8>> {
-    Ok(handle.query(0, 64 << 10, |connection| {
+    state_except_operation(handle, None).await
+}
+// Terminal merge semantics intentionally close only one exact operation.
+// All other operation, root, ref, checkpoint and policy facts remain compared.
+pub(super) async fn state_except_operation(
+    handle: &CellHandle,
+    exclude: Option<[u8; 16]>,
+) -> Result<Vec<u8>> {
+    Ok(handle.query(0, 64 << 10, move |connection| {
         let mut refs = connection.prepare("SELECT name,oid,version FROM refs ORDER BY name")?;
         let refs = refs.query_map([], |row| Ok((row.get::<_,String>(0)?,row.get::<_,Option<Vec<u8>>>(1)?,row.get::<_,i64>(2)?)))?.collect::<rusqlite::Result<Vec<_>>>()?;
         let mut catalog = connection.prepare("SELECT generation,catalog,certificate,refs FROM catalog_generations ORDER BY generation")?;
@@ -218,8 +226,8 @@ pub(super) async fn state(handle: &CellHandle) -> Result<Vec<u8>> {
             let record=(row.get::<_,Vec<u8>>(0)?,row.get::<_,String>(1)?,row.get::<_,Vec<u8>>(2)?,row.get::<_,Option<Vec<u8>>>(3)?,row.get::<_,Option<Vec<u8>>>(4)?,row.get::<_,Option<i64>>(5)?,row.get::<_,Option<Vec<u8>>>(6)?,row.get::<_,Option<Vec<u8>>>(7)?,row.get::<_,Option<Vec<u8>>>(8)?,row.get::<_,Option<Vec<u8>>>(9)?,row.get::<_,Option<Vec<u8>>>(10)?);
             hash.update(&serde_json::to_vec(&record).map_err(|_|Error::Command("fixture root outcome hash"))?);
         }
-        let mut operations=connection.prepare("SELECT id,actor,request_digest,artifact_operation,generation,attestation,attestation_digest FROM catalog_operations ORDER BY id")?;
-        let mut rows=operations.query([])?;
+        let mut operations=connection.prepare("SELECT id,actor,request_digest,artifact_operation,generation,attestation,attestation_digest FROM catalog_operations WHERE ?1 IS NULL OR id!=?1 ORDER BY id")?;
+        let mut rows=operations.query([exclude.map(|id|id.to_vec())])?;
         while let Some(row)=rows.next()? {
             let record=(row.get::<_,Vec<u8>>(0)?,row.get::<_,String>(1)?,row.get::<_,Vec<u8>>(2)?,row.get::<_,Vec<u8>>(3)?,row.get::<_,Option<u64>>(4)?,row.get::<_,Option<Vec<u8>>>(5)?,row.get::<_,Option<Vec<u8>>>(6)?);
             hash.update(&serde_json::to_vec(&record).map_err(|_|Error::Command("fixture root operation hash"))?);
diff --git a/crates/canopy-server/src/repository_http/merge.rs b/crates/canopy-server/src/repository_http/merge.rs
index 2e46bd52..52bd98e4 100644
--- a/crates/canopy-server/src/repository_http/merge.rs
+++ b/crates/canopy-server/src/repository_http/merge.rs
@@ -3,7 +3,6 @@ use crate::pulls::{
     PullRevision,
     merge::{MergeOutcome, MergeRequest, MergeStrategy, valid_request},
 };
-use cellule_runtime::InvocationError;
 use std::time::Duration;
 
 const WORK_TIMEOUT_MS: u32 = 120_000;
@@ -118,14 +117,13 @@ async fn serve(
     };
     identity.expires_at_ms = expires_at_ms;
     let operation = route
-        .repository
+        .gateway
         .merge_pull(identity, &actor.account, number, request);
     let outcome =
         match tokio::time::timeout(Duration::from_millis(u64::from(WORK_TIMEOUT_MS)), operation)
             .await
         {
-            Ok(Ok(result)) if (state.manager.ready)() => result.output,
-            Ok(Err(InvocationError::Rejected(rejected))) => rejected.output,
+            Ok(Ok(result)) if (state.manager.ready)() => result,
             Ok(Err(error)) => return failed(error),
             Ok(Ok(_)) => return unavailable(),
             Err(_) => {
diff --git a/crates/canopy-server/tests/multi_server/merge.rs b/crates/canopy-server/tests/multi_server/merge.rs
index c49571f7..4e7c5385 100644
--- a/crates/canopy-server/tests/multi_server/merge.rs
+++ b/crates/canopy-server/tests/multi_server/merge.rs
@@ -557,3 +557,96 @@ async fn merge_rechecks_revisions_authority_and_competing_publications() -> Resu
     server.shutdown().await?;
     Ok(())
 }
+
+#[tokio::test(flavor = "multi_thread")]
+async fn native_fast_forward_endpoint_replays_original_uuid_and_exposes_joint_refs_for_both_formats()
+-> Result {
+    for format in ["sha1", "sha256"] {
+        let workspace = tempfile::TempDir::new()?;
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let address = listener.local_addr()?;
+        let server = CanopyServer::start_with_listener(
+            config(address, workspace.path().join("node")),
+            Arc::new(InMemory::new()),
+            listener,
+        )
+        .await?;
+        let client = Client::new();
+        let created = value(
+            client
+                .post(format!("http://{address}/api/repositories"))
+                .bearer_auth(OWNER)
+                .json(&json!({"name":"native-merge","object_format":format})),
+        )
+        .await?;
+        let repository = created["repository_id"].clone();
+        let url = created["clone_url"].as_str().ok_or("clone URL absent")?;
+        let repo = format!("http://{address}/api/repositories/native-merge");
+        let local = workspace.path().join("local");
+        run_git(
+            None,
+            &[
+                "init",
+                "-b",
+                "main",
+                &format!("--object-format={format}"),
+                path_str(&local)?,
+            ],
+        )
+        .await?;
+        run_git(Some(&local), &["config", "user.name", "Native Merge"]).await?;
+        run_git(
+            Some(&local),
+            &["config", "user.email", "merge@example.invalid"],
+        )
+        .await?;
+        run_git(Some(&local), &["commit", "--allow-empty", "-m", "Base"]).await?;
+        let base = oid(&local, "HEAD").await?;
+        push(&local, url, &["HEAD:refs/heads/main"], true).await?;
+        tokio::fs::write(local.join("feature.txt"), b"native merge endpoint\n").await?;
+        run_git(Some(&local), &["add", "."]).await?;
+        run_git(Some(&local), &["commit", "-m", "Feature"]).await?;
+        let source = oid(&local, "HEAD").await?;
+        push(&local, url, &["HEAD:refs/heads/feature"], true).await?;
+        let api = new_pull(
+            &client,
+            &repo,
+            &repository,
+            "refs/heads/feature",
+            &source,
+            &base,
+        )
+        .await?;
+        let input = intent(&client, &api, &repository).await?;
+        let merge_api = format!("{api}/merge");
+        let original = value(client.post(&merge_api).bearer_auth(OWNER).json(&input)).await?;
+        assert_eq!(original["merge"]["oid"], source);
+        assert_eq!(
+            value(client.post(&merge_api).bearer_auth(OWNER).json(&input)).await?,
+            original
+        );
+        let mut collision = input.clone();
+        collision["revision"]["source_oid"] = json!(base);
+        status(
+            client.post(&merge_api).bearer_auth(OWNER).json(&collision),
+            StatusCode::CONFLICT,
+        )
+        .await?;
+        let pull = current(&client, &api).await?;
+        assert_eq!(pull["state"], "merged");
+        assert_eq!(pull["base"]["oid"], source);
+        assert_eq!(pull["base"]["version"], 2);
+        let refs = String::from_utf8(
+            run_git(None, &["-c", AUTH, "ls-remote", url, "refs/heads/main"]).await?,
+        )?;
+        assert_eq!(refs.trim(), format!("{source}\trefs/heads/main"));
+        let clone = workspace.path().join("clone");
+        run_git(None, &["-c", AUTH, "clone", url, path_str(&clone)?]).await?;
+        assert_eq!(
+            tokio::fs::read(clone.join("feature.txt")).await?,
+            b"native merge endpoint\n"
+        );
+        server.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/docs/contracts.md b/docs/contracts.md
index 84dbb38f..3aa3001c 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -1941,9 +1941,9 @@ scratch budget. Neither publishes roots or populates SQL refs/ancestry. A final
 native merge receiver must authenticate the exact proof and conditional ref
 snapshot, check current access/reviews/checks and ref versions, and commit joint
 roots, pull state and UUID result under the actual owner fence and durable
-recovery journal. The native receiver described below exists; its resident
-adapter remains unfinished; typed terminal release is described below. The historical SQL merge
-description below is not qualification of the native product workflow.
+recovery journal. The native receiver and resident fast-forward adapter described below exist.
+Typed terminal release is described below. The historical SQL merge description
+below is not qualification of generated native merge strategies.
 
 `PublishReviewedMerge` reuses operation 9 with codec 6 and a 256 KiB input / 512
 byte output contract. It replaces the registered contract rather than decoding
@@ -1968,7 +1968,11 @@ context/reporter results remain mandatory even on unprotected branches.
 
 Joint catalog/ref roots, pull state/version, immutable UUID result, preparation
 checkpoint and operation consumption share the final Cell transaction and its
-durable recovery journal. Errors after the first write roll back all of them.
+durable recovery journal. Every authenticated terminal result also closes its
+exact matching operation under the actual owner fence, including domain refusals
+and applied UUID replays. It cannot close a successor or unauthenticated
+proposal; the independent pin remains until typed retirement. Errors after the
+first write roll back operation closure, domain changes, phase and SDK acceptance.
 Rejected requests do not insert `pull_merges`, so a fresh owned attempt may retry
 the same application UUID after policy changes. The older attempt still recovers
 its original refusal and receipt. `ReadyNativeMerge` binds its exact original
@@ -1989,9 +1993,25 @@ not its new proposal. Known denials retain their original phase after later
 success and require authoritative operation closure. This authorizes no provider
 deletion; complete retained-root inventory and descendant reclamation remain
 required. See [terminal retention](design/terminal-publication-retention.md).
-The public adapter still invokes retired preparation/codec 4, so network merge
-remains unqualified. Generated merge/squash/rebase strategies are not accepted by
-this factory; their producers and integration remain required work.
+The HTTP fast-forward adapter now uses `GitGateway::merge_pull`. It checks
+current access after body ingestion, then gives an independent fresh attempt to
+the resident staging controller. A bounded, domain-separated intent digest binds
+the repository, actor, pull and exact request. A fresh SDK identity is never
+substituted for an uncertain original command. Ref-only Bind selects the current
+certified joint generation; an admitted bound worker owns catalog preparation
+and ancestry verification using the gateway's scratch, disk and native resources.
+The producer result is retrieved before Finishing, then `ReadyNativeMerge`
+registers and binds its original command into fair publication. HTTP timeout or
+observer cancellation leaves this resident-owned workflow and exact recovery
+intact. Known refusals use the normal 404/403/409 mappings; unknown acceptance
+remains unavailable and asks for the same application UUID/revision.
+
+The direct historical `RepositoryCell::merge_pull` API still uses retired codec
+4 and is not the product HTTP path. Generated merge/squash/rebase strategies are
+not accepted by this factory; their producers and native publication remain
+required work. Complete merge-specific cancellation/startup reconstruction,
+queued authority/policy races and pre-Bind intent retention qualification remain
+required beyond the generic resident lifecycle tests.
 
 Six HTTP operations live under `/api/repositories/<name>/pulls`: GET/POST the
 collection, GET/PUT `/<number>`, GET/POST `/<number>/reviews`. Every mutation
diff --git a/docs/design/terminal-publication-retention.md b/docs/design/terminal-publication-retention.md
index e4b51c48..d8a98243 100644
--- a/docs/design/terminal-publication-retention.md
+++ b/docs/design/terminal-publication-retention.md
@@ -19,6 +19,11 @@ bounded `StoredInputRoot` representation. The private factory uploads logical
 merge intent, base ref, catalog descriptor, ref snapshot and ref generation;
 the catalog MAC binds this audit descriptor alongside the conditional ref
 proposal. Operation 9 codec 6 saves it atomically with the immutable UUID result.
+The authenticated final merge command closes only its exact matching operation
+when recording any terminal result, including a refusal or application replay.
+This shares the original recovery/SDK transaction and avoids an independent
+abort command. Closure failure rolls back the original phase and acceptance;
+unauthenticated proposals and successor operations stay protected.
 SQL guards reject result mutation, deletion and replacement. Fresh deployments
 use this schema directly; no backward decoder or SQL ref mirror is introduced.
 
@@ -81,7 +86,7 @@ Six typed initialization families additionally qualify both formats, immutable s
 
 Five native merge retirement families qualify both formats where applicable:
 original applied UUID replay selects the first audit after releasing its pin;
-a denied attempt closes and keeps its original refusal after a fresh attempt
+a denied attempt closes atomically and keeps its original refusal after a fresh attempt
 succeeds; missing and corrupt audit, catalog, directory, ref snapshot and ref
 index metadata prevent release without losing the result; current Admin/owner
 checks and a fault at the final delete preserve atomic archive/pin rollback;
diff --git a/docs/evidence/native-merge-endpoint-ci-20261005.json b/docs/evidence/native-merge-endpoint-ci-20261005.json
new file mode 100644
index 00000000..b12ca76c
--- /dev/null
+++ b/docs/evidence/native-merge-endpoint-ci-20261005.json
@@ -0,0 +1,736 @@
+{
+  "recorded_at_utc": "2026-10-05T21:05:40.578599+00:00",
+  "base_head": "75814b4c692364b4476e57456d439001bd5abbf2",
+  "host": "macOS, Rust 1.98.0; exact-head Linux qualification remains required",
+  "source_files": 516,
+  "rust_files": 498,
+  "source_hash_digest": "d1aa115a3c9e7ff266c3d71e50fc3d2054648af58e52d70c845ef817e2acd53a",
+  "source_manifest": "/tmp/canopy-native-merge-endpoint-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "release_qualified": false,
+  "baselines": [
+    {
+      "source_digest": "ec37049731e41eb420dac90a67c20fa49c2efc603a6ff206c38da674ce9fa2eb",
+      "reason": "Unmodified parent HTTP merge race test returns 503 where 409 is required because the product route invokes retired SQL preparation.",
+      "path": "/tmp/canopy-native-merge-endpoint-baseline.log",
+      "sha256": "58df66f0c8a59197631eb92e5c2a4f4902beba2d211e89aa44b2a13c67edf574",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 114 filtered out; finished in 4.17s"
+      ]
+    },
+    {
+      "source_digest": "6a178aef7aedc91828a06d28614f1e17015e7b2b0d9d9da9766a44e0ecd46f77",
+      "reason": "Compiled failing-first immediate terminal release after native merge denial returns Error::Context because the authenticated operation remains open.",
+      "path": "/tmp/canopy-native-merge-endpoint-closure-baseline.log",
+      "sha256": "f26f66b4112a38557c25cc36cb087e3c1f67a342a7a80de69d3419078983807f",
+      "summaries": [
+        "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 737 filtered out; finished in 0.65s"
+      ]
+    }
+  ],
+  "intermediate_failed_runs": [
+    {
+      "source_digest": "89bb2bd7e2fcdbcc98bce9a8ed81b20d7753668a37278f7b860531498f038292",
+      "reason": "Ten focused cases passed and four failed after intended atomic terminal operation closure. Existing state oracles forbade the expected deletion of the actual terminal operation. Corrected only that projection: all other domain state and other operations remain compared, explicit own-operation counts distinguish authenticated closure from unauthenticated refusal, and rollback still compares complete state and SDK absence.",
+      "path": "/tmp/canopy-native-merge-endpoint-focused-first.log",
+      "sha256": "6fed7d1bd32a45a0f4a873d4c535beca1c5c96dc6870e5774338d5764c06b6dd",
+      "summaries": [
+        "test result: FAILED. 10 passed; 4 failed; 0 ignored; 0 measured; 725 filtered out; finished in 4.09s"
+      ]
+    }
+  ],
+  "validation": {
+    "source_digest": "d1aa115a3c9e7ff266c3d71e50fc3d2054648af58e52d70c845ef817e2acd53a",
+    "phases": [
+      {
+        "name": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::tests::native_merge::",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 104.18,
+        "log": "/tmp/canopy-native-merge-endpoint-final-focused-final.log",
+        "log_sha256": "786e3a27e6a7c16f402d4d11d956cbf2a79648d4e497e3e732b9dd9553423f24",
+        "summaries": [
+          "test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 725 filtered out; finished in 5.30s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "endpoint",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "multi_server",
+          "merge::native_fast_forward_endpoint_replays_original_uuid_and_exposes_joint_refs_for_both_formats",
+          "--locked",
+          "--",
+          "--exact",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 82.55,
+        "log": "/tmp/canopy-native-merge-endpoint-final-endpoint-final.log",
+        "log_sha256": "36dc4d70a890361c43ca979a2072a338cfa1dd7479d2155c1e113153fca23292",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 9.69s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "races",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "multi_server",
+          "merge::merge_rechecks_revisions_authority_and_competing_publications",
+          "--locked",
+          "--",
+          "--exact",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 8.66,
+        "log": "/tmp/canopy-native-merge-endpoint-final-races-final.log",
+        "log_sha256": "6fdd39ecf86689c0e6cfea4193c1cdbfad7c23345e366262a84300e8227f8262",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 7.67s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 57.79,
+        "log": "/tmp/canopy-native-merge-endpoint-final-clippy-final.log",
+        "log_sha256": "566ebe7bd72ab2948999391bccf1e518235fbd63a5df89bd2f9eaa6c49f446a6",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 747.83,
+        "log": "/tmp/canopy-native-merge-endpoint-final-workspace-final.log",
+        "log_sha256": "7ffa3b5bec87507c39d3d718d5e3801ec9dc62d4aacb0456c5e6ebdd6e612367",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.33s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.43s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 738 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 738 filtered out; finished in 0.09s",
+          "test result: ok. 739 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 346.33s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.97s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s",
+          "test result: FAILED. 87 passed; 20 failed; 9 ignored; 0 measured; 0 filtered out; finished in 371.83s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.42s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.54s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.36s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 44.99,
+        "log": "/tmp/canopy-native-merge-endpoint-final-build-final.log",
+        "log_sha256": "690dfa3c8b4fe81dc1f8417f9291a3ab3f59527cf8ade3f2c3216d0c96b8ff38",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.22,
+        "log": "/tmp/canopy-native-merge-endpoint-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 41.57,
+        "log": "/tmp/canopy-native-merge-endpoint-final-harness-final.log",
+        "log_sha256": "d3474fb327b2a19d198e57c275dcfbaee1acd9883374de1778e90a29f6182047",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.11,
+        "log": "/tmp/canopy-native-merge-endpoint-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 739,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 87,
+      "failed": 20,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 864,
+    "failed": 23,
+    "ignored": 9,
+    "executed": 887,
+    "total": 896
+  },
+  "counting": "Last summary per Cargo Running/Doc-tests section; nested child summaries and focused reruns excluded. Ignored cases remain unexecuted.",
+  "workspace_failure_delta": {
+    "added": [],
+    "removed": [
+      "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+      "merge::merge_rechecks_revisions_authority_and_competing_publications",
+      "merge::reviewed_merge_is_atomic_replayable_and_visible_to_git_after_recovery",
+      "sha256::sha256_checks_reviews_and_merge_survive_restore"
+    ]
+  },
+  "parent_ci": {
+    "headRefOid": "75814b4c692364b4476e57456d439001bd5abbf2",
+    "mergeable": "MERGEABLE",
+    "statusCheckRollup": [
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T20:45:38Z",
+        "conclusion": "CANCELLED",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37370177305/job/111965091142",
+        "name": "harness",
+        "startedAt": "2026-10-05T20:30:37Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T20:41:42Z",
+        "conclusion": "SUCCESS",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37370182670/job/111965108638",
+        "name": "harness",
+        "startedAt": "2026-10-05T20:40:54Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T21:00:22Z",
+        "conclusion": "FAILURE",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37370182670/job/111965108917",
+        "name": "rust",
+        "startedAt": "2026-10-05T20:40:57Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T21:01:47Z",
+        "conclusion": "FAILURE",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37370177305/job/111965091486",
+        "name": "rust",
+        "startedAt": "2026-10-05T20:35:59Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      }
+    ]
+  },
+  "parent_linux_runs": [
+    {
+      "run_id": 37370182670,
+      "metadata": {
+        "conclusion": "failure",
+        "headSha": "75814b4c692364b4476e57456d439001bd5abbf2",
+        "jobs": [
+          {
+            "completedAt": "2026-10-05T20:41:42Z",
+            "conclusion": "success",
+            "databaseId": 111965108638,
+            "name": "harness",
+            "startedAt": "2026-10-05T20:40:54Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T20:40:56Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T20:40:54Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:41:00Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T20:40:56Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:41:39Z",
+                "conclusion": "success",
+                "name": "Check Python qualification harness",
+                "number": 3,
+                "startedAt": "2026-10-05T20:41:00Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:41:39Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 6,
+                "startedAt": "2026-10-05T20:41:39Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:41:39Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 7,
+                "startedAt": "2026-10-05T20:41:39Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37370182670/job/111965108638"
+          },
+          {
+            "completedAt": "2026-10-05T21:00:22Z",
+            "conclusion": "failure",
+            "databaseId": 111965108917,
+            "name": "rust",
+            "startedAt": "2026-10-05T20:40:57Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T20:40:58Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T20:40:58Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:41:00Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T20:40:58Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:41:13Z",
+                "conclusion": "success",
+                "name": "Install tools",
+                "number": 3,
+                "startedAt": "2026-10-05T20:41:00Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:41:17Z",
+                "conclusion": "success",
+                "name": "Report tool versions",
+                "number": 4,
+                "startedAt": "2026-10-05T20:41:13Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:41:22Z",
+                "conclusion": "success",
+                "name": "Check formatting",
+                "number": 5,
+                "startedAt": "2026-10-05T20:41:17Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:43:02Z",
+                "conclusion": "success",
+                "name": "Check lints",
+                "number": 6,
+                "startedAt": "2026-10-05T20:41:22Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:00:20Z",
+                "conclusion": "failure",
+                "name": "Test",
+                "number": 7,
+                "startedAt": "2026-10-05T20:43:02Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:00:20Z",
+                "conclusion": "skipped",
+                "name": "Qualify Git compatibility against RustFS",
+                "number": 8,
+                "startedAt": "2026-10-05T21:00:20Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:00:20Z",
+                "conclusion": "skipped",
+                "name": "Build server",
+                "number": 9,
+                "startedAt": "2026-10-05T21:00:20Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:00:20Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 18,
+                "startedAt": "2026-10-05T21:00:20Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:00:20Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 19,
+                "startedAt": "2026-10-05T21:00:20Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37370182670/job/111965108917"
+          }
+        ],
+        "status": "completed"
+      },
+      "path": "/tmp/canopy-native-merge-endpoint-parent-pr-full.log",
+      "sha256": "829f11c999f17c6961513deca8ed49e74f273c71872273f1dba8d28909e2d9c8",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.83s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.66s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 737 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 737 filtered out; finished in 0.01s",
+        "test result: ok. 738 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 357.70s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.31s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 507.55s"
+      ]
+    },
+    {
+      "run_id": 37370177305,
+      "metadata": {
+        "conclusion": "failure",
+        "headSha": "75814b4c692364b4476e57456d439001bd5abbf2",
+        "jobs": [
+          {
+            "completedAt": "2026-10-05T20:45:38Z",
+            "conclusion": "cancelled",
+            "databaseId": 111965091142,
+            "name": "harness",
+            "startedAt": "2026-10-05T20:30:37Z",
+            "status": "completed",
+            "steps": [],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37370177305/job/111965091142"
+          },
+          {
+            "completedAt": "2026-10-05T21:01:47Z",
+            "conclusion": "failure",
+            "databaseId": 111965091486,
+            "name": "rust",
+            "startedAt": "2026-10-05T20:35:59Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T20:36:00Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T20:36:00Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:36:02Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T20:36:00Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:36:08Z",
+                "conclusion": "success",
+                "name": "Install tools",
+                "number": 3,
+                "startedAt": "2026-10-05T20:36:02Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:36:10Z",
+                "conclusion": "success",
+                "name": "Report tool versions",
+                "number": 4,
+                "startedAt": "2026-10-05T20:36:08Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:36:15Z",
+                "conclusion": "success",
+                "name": "Check formatting",
+                "number": 5,
+                "startedAt": "2026-10-05T20:36:10Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T20:38:35Z",
+                "conclusion": "success",
+                "name": "Check lints",
+                "number": 6,
+                "startedAt": "2026-10-05T20:36:15Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:01:44Z",
+                "conclusion": "failure",
+                "name": "Test",
+                "number": 7,
+                "startedAt": "2026-10-05T20:38:35Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:01:44Z",
+                "conclusion": "skipped",
+                "name": "Qualify Git compatibility against RustFS",
+                "number": 8,
+                "startedAt": "2026-10-05T21:01:44Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:01:44Z",
+                "conclusion": "skipped",
+                "name": "Build server",
+                "number": 9,
+                "startedAt": "2026-10-05T21:01:44Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:01:44Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 18,
+                "startedAt": "2026-10-05T21:01:44Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:01:44Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 19,
+                "startedAt": "2026-10-05T21:01:44Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37370177305/job/111965091486"
+          }
+        ],
+        "status": "completed"
+      },
+      "path": "/tmp/canopy-native-merge-endpoint-parent-push-full.log",
+      "sha256": "0ecd67d73aca631a9b1d1c664106db818cb1cdab5dc524a74fc5985868bec5b8",
+      "summaries": [
+        "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.43s",
+        "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.92s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 737 filtered out; finished in 0.00s",
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 737 filtered out; finished in 0.01s",
+        "test result: ok. 738 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 476.67s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+        "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.91s",
+        "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s",
+        "test result: FAILED. 83 passed; 27 failed; 9 ignored; 0 measured; 0 filtered out; finished in 618.68s"
+      ]
+    }
+  ],
+  "parent_ci_interpretation": "Parent 75814b4 Linux PR and push Rust jobs both completed FAILURE. Both passed 738 library cases and failed multi-server at 83 passed/27 failed/9 ignored. PR harness passed; push harness was cancelled. PR workflow log and push Rust job log plus exact-head metadata are preserved; push full-run log retrieval reported the cancelled harness log unavailable, so its actual Rust job was fetched directly. RustFS and Linux server build were skipped after Test failed. These are parent results, not qualification of this increment.",
+  "changes": [
+    "Production HTTP fast-forward merge now uses GitGateway resident-owned staging and exact registered native publication; it no longer invokes retired RepositoryCell SQL merge preparation.",
+    "The adapter checks fresh access after body ingestion, transfers the intent and producer synchronously to the resident driver before awaiting observation, binds native base and admitted work, persists the original command and dispatches through the existing fair publication lifecycle.",
+    "Each request observation gets a fresh preparation operation. The final application UUID transaction selects original results or refuses collisions; denied SDK identities are not reused with new proof or policy bytes.",
+    "Authenticated terminal success, denial and UUID replay atomically close only the exact matching admitted operation. Late closure errors roll back all domain changes, recovery phase and SDK acceptance; unauthenticated or successor operations remain protected.",
+    "Fourteen private native merge tests pass. New late-closure SQL fault coverage proves full rollback, same-command retry, original known denial and immediate typed pin retirement for both formats.",
+    "Real stock-Git public endpoint coverage creates production roots, merges and replays UUIDs, refuses changed revisions, discovers refs and clones exact feature bytes for SHA-1 and SHA-256. Existing unrelated-history, stale revision, late body-ingestion revocation and competing publication coverage passes."
+  ],
+  "qualification_limits": [
+    "New endpoint tests use genuine production startup and initial roots. Private proof/retirement fixtures still use verified stock-Git bytes with a synthetic initial certificate; neither proves full large-history capacity.",
+    "Merge-specific observer cancellation, lost acknowledgement, startup adoption, queued policy changes, pre-Bind intent reconstruction and automatic retirement after generation reaping require dedicated qualification; generic resident push lifecycle coverage is not sufficient proof for this producer.",
+    "Generated merge-commit, squash and rebase remain unavailable in this adapter. The historical direct RepositoryCell::merge_pull API still uses retired preparation and is not the production HTTP caller. No compatibility decoder is added.",
+    "No provider deletion is authorized. Complete physical ownership, retained-root inventory including permanent audits, cold/filtered fetch, backup/restore, peer recovery and final DDL remain required.",
+    "macOS lib-test linker reports an oversized __eh_frame compact-unwind warning. All-target Clippy, production server build and exact-head Linux results are independent checks.",
+    "Full CI, durable refusals, generated candidates/thread/default-branch writers, accelerators/fair maintenance, asynchronous file attribution and full-history/10k-engineer capacity gates remain open."
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 04e27163..cbbae70f 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,64 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Public native fast-forward merge endpoint (2026-10-05 checkpoint)
+
+Production HTTP merge now calls the resident `GitGateway` native driver. The
+adapter checks access again after body ingestion, transfers the request and
+producer to resident ownership before awaiting observation, binds the current
+native catalog/ref base, retrieves admitted preparation before Finishing,
+persists the original command and uses the existing fair publication/recovery
+coordinator. Each observation gets an independent preparation attempt; the
+final transaction selects the original application UUID result or refuses a
+collision. Generated strategies remain unavailable rather than receiving a
+different merge strategy. The historical direct `RepositoryCell::merge_pull`
+API remains a retired-preparation caller outside this product route.
+
+Authenticated terminal denials and UUID replays now close only their matching
+admitted operation atomically with the original recovery phase and SDK
+acceptance. The independent pin remains until typed terminal retirement. A
+late closure SQL fault rolls back complete domain state, phase and acceptance;
+the same exact command can retry and its known denial can retire immediately.
+Unauthenticated proposals and successor operations do not gain closure rights.
+This reuses the existing operation/recovery structures and codec 6 payload.
+
+The original HTTP regression failed at 503 instead of 409. The failing-first
+immediate-denial-retirement regression failed with `Error::Context`. Fourteen
+private merge tests now pass. Real stock-Git endpoint coverage creates genuine
+production roots for SHA-1 and SHA-256, merges and replays an exact UUID,
+refuses changed intent, discovers the joint ref and clones the exact new bytes.
+Existing coverage for unrelated history, stale revisions, body-ingestion access
+revocation and competing publications also passes. A first intermediate run
+had four state-oracle failures after the intentional operation deletion; the
+corrected oracle compares every other operation/domain fact and asserts the
+exact own-operation count, while rollback still compares the full state.
+
+Frozen validation passes all 739 server library cases, all-target Clippy with
+warnings denied, production server build, formatting/diff checks and all 96
+Python harness cases. Full Rust results are 864 passed /23 failed /9 ignored,
+with no added failures and four removed: both reviewed merge families,
+SHA-256 checks/reviews/merge recovery, and historical comparisons after branch
+deletion. Multi-server finishes at 87 passed /20 failed /9 ignored; three
+standalone aggregates still fail. The exact unchanged source digest over
+516 files (498 Rust) is
+`d1aa115a3c9e7ff266c3d71e50fc3d2054648af58e52d70c845ef817e2acd53a`.
+Baselines, the intermediate failures and complete validation are preserved in
+[endpoint evidence](evidence/native-merge-endpoint-ci-20261005.json).
+Parent `75814b4` Linux PR and push Rust jobs both failed: 738 library cases pass,
+then multi-server fails at 83 passed /27 failed /9 ignored. RustFS and server
+build were skipped. Those parent logs do not qualify this increment on Linux.
+
+Next: qualify this producer's observer cancellation, lost acknowledgement,
+restart adoption, queued policy/access changes, pre-Bind intent recovery and
+automatic audit retirement after generation pruning. Generic push lifecycle
+tests are not sufficient merge-specific evidence. Implement native generated
+candidate and merge/squash/rebase publication, thread/default-branch writers
+and remaining full CI failures. Physical retention/collection/final DDL,
+backup/restore, peer recovery, reachable-only cold/filtered fetch,
+accelerators/fair maintenance, asynchronous file attribution and
+full-history/10,000-engineer capacity gates remain required. The full goal is
+active and this cutover remains unqualified for release.
+
 ## Native merge audit and terminal retirement (2026-10-05 checkpoint)
 
 Operation 9 codec 6 now binds a permanent merge audit in the existing catalog

From 823092222fd043c2a0e3ce7deab8cdab40cd097c Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 14:46:37 -0700
Subject: [PATCH 43/55] fix: reserve candidates against certified native refs

---
 .../src/packs/publication/mod.rs              |   1 +
 .../src/packs/publication/registry.rs         |  15 +-
 .../src/pulls/candidates/command.rs           | 110 ++-
 .../canopy-server/src/pulls/candidates/mod.rs |  81 +-
 .../canopy-server/src/pulls/native/client.rs  |   2 +-
 .../residency/tests/serving/browser/pulls.rs  |   2 +
 .../tests/serving/browser/pulls/candidates.rs | 474 +++++++++++
 docs/contracts.md                             |  41 +-
 .../native-candidate-intent-ci-20261005.json  | 746 ++++++++++++++++++
 .../large-repository-implementation-status.md |  44 ++
 10 files changed, 1471 insertions(+), 45 deletions(-)
 create mode 100644 crates/canopy-server/src/server/residency/tests/serving/browser/pulls/candidates.rs
 create mode 100644 docs/evidence/native-candidate-intent-ci-20261005.json

diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index fe226c4b..e1848b5e 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -262,6 +262,7 @@ pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_query::<crate::checks::native::ReadCommitChecks>()?;
     registry.bind_command::<crate::pulls::native::CreateNativePull>()?;
     registry.bind_command::<crate::pulls::native::ReviewNativePull>()?;
+    registry.bind_command::<crate::pulls::candidates::command::PrepareCandidate>()?;
     registry.bind_query::<crate::pulls::native::ReadNativePulls>()?;
     registry.bind_command::<ReleaseServingPin>()?;
     registry.bind_query::<CheckServingPin>()?;
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 0ca39bbe..875d407e 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,10 +23,14 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 22] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 23] = [
     crate::operation(1),
     command::<crate::branch_rules::command::SetBranchRule>(64 << 10, 64),
     command::<PublishReviewedMerge>(NATIVE_MERGE_BYTES, 512),
+    command::<crate::pulls::candidates::command::PrepareCandidate>(
+        crate::pulls::candidates::command::INPUT_BYTES,
+        crate::pulls::candidates::command::OUTPUT_BYTES,
+    ),
     command::<AbortPreparation>(4096, 4096),
     command::<ReapPreparation>(4096, 4096),
     command::<RegisterCatalogAttestation>(4096, 4096),
@@ -94,7 +98,8 @@ mod tests {
         assert_eq!(
             ids,
             vec![
-                1, 8, 9, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49, 51, 53
+                1, 8, 9, 10, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49,
+                51, 53
             ]
         );
         assert_eq!(
@@ -106,6 +111,12 @@ mod tests {
             vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48, 50, 52]
         );
         for (id, codec, input, output) in [
+            (
+                10,
+                crate::pulls::candidates::command::PrepareCandidate::CODEC_VERSION,
+                crate::pulls::candidates::command::INPUT_BYTES,
+                crate::pulls::candidates::command::OUTPUT_BYTES,
+            ),
             (
                 9,
                 PublishReviewedMerge::CODEC_VERSION,
diff --git a/crates/canopy-server/src/pulls/candidates/command.rs b/crates/canopy-server/src/pulls/candidates/command.rs
index b25f5d1c..aa11ebdc 100644
--- a/crates/canopy-server/src/pulls/candidates/command.rs
+++ b/crates/canopy-server/src/pulls/candidates/command.rs
@@ -3,10 +3,14 @@ use crate::{
     RepositoryModule,
     access::{access_statement, decode_access},
     directory::TokenScope,
+    packs::publication::{REF_SELECTION_BYTES, RefSelection},
 };
 use cellule_runtime::{CellModule, Command, registry::CommandResult};
 
-#[derive(Deserialize, Serialize)]
+pub(crate) const INPUT_BYTES: u32 = REF_SELECTION_BYTES + (256 << 10);
+pub(crate) const OUTPUT_BYTES: u32 = 1 << 20;
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(tag = "action", deny_unknown_fields)]
 pub(crate) enum CandidateAction {
     Reserve {
@@ -22,7 +26,7 @@ pub(crate) enum CandidateAction {
     },
 }
 impl CandidateAction {
-    fn valid(&self) -> bool {
+    pub(super) fn valid(&self) -> bool {
         match self {
             Self::Reserve {
                 actor,
@@ -44,6 +48,19 @@ impl CandidateAction {
             }
         }
     }
+    pub(crate) fn actor(&self) -> &str {
+        match self {
+            Self::Reserve { actor, .. } | Self::Finish { actor, .. } => actor,
+        }
+    }
+    pub(crate) fn digest(&self) -> Result<[u8; 32], CodecError> {
+        let mut e = BoundedEncoder::new(256 << 10)?;
+        self.encode(&mut e)?;
+        let mut h = blake3::Hasher::new();
+        h.update(b"canopy.native-candidate-intent.v1\0");
+        h.update(&e.finish());
+        Ok(*h.finalize().as_bytes())
+    }
 }
 impl WireValue for CandidateAction {
     fn encode(&self, out: &mut BoundedEncoder) -> Result<(), CodecError> {
@@ -63,20 +80,56 @@ impl WireValue for CandidateAction {
         Ok(result)
     }
 }
+
+/// Certified current refs authorize only editorial reservation or a negative
+/// preparation result. A Ready result requires joint generated publication;
+/// no request DTO or serving observation can grant that write authority.
+#[derive(Clone, Debug)]
+pub(crate) struct CandidateRefRequest {
+    pub(crate) selection: RefSelection,
+    pub(crate) action: CandidateAction,
+}
+impl WireValue for CandidateRefRequest {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.selection.actor.as_deref() != Some(self.action.actor())
+            || self.selection.facts.len() > 2
+            || matches!(
+                &self.action,
+                CandidateAction::Finish {
+                    result: CandidateResult::Ready { .. },
+                    ..
+                }
+            )
+        {
+            return Err(CodecError::Invalid(
+                "invalid native candidate editorial scope",
+            ));
+        }
+        self.selection.encode(e)?;
+        self.action.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            selection: RefSelection::decode(d)?,
+            action: CandidateAction::decode(d)?,
+        };
+        value.encode(&mut BoundedEncoder::new(INPUT_BYTES)?)?;
+        Ok(value)
+    }
+}
 pub(crate) struct PrepareCandidate;
 impl Command for PrepareCandidate {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 10;
-    const CODEC_VERSION: u32 = 2;
-    type Input = CandidateAction;
+    const CODEC_VERSION: u32 = 3;
+    type Input = CandidateRefRequest;
     type Output = CandidateOutcome;
     fn execute(
         context: &mut CommandContext<'_, '_>,
-        action: CandidateAction,
+        input: CandidateRefRequest,
     ) -> cellule_runtime::Result<CommandResult<CandidateOutcome>> {
-        let actor = match &action {
-            CandidateAction::Reserve { actor, .. } | CandidateAction::Finish { actor, .. } => actor,
-        };
+        input.encode(&mut BoundedEncoder::new(INPUT_BYTES)?)?;
+        let actor = input.action.actor();
         let rejected = |value| Ok(CommandResult::Rejected(value));
         let role = decode_access(&context.sql(&SqlBatch {
             statements: vec![access_statement(actor)],
@@ -87,6 +140,16 @@ impl Command for PrepareCandidate {
         if role < TokenScope::Write {
             return rejected(CandidateOutcome::Forbidden);
         }
+        if !input.selection.authorized(
+            context.target().cell_id(),
+            Some(context.owner_fence()),
+            context.now_ms(),
+            input.action.digest()?,
+            |q| context.sql(q),
+        )? {
+            return rejected(CandidateOutcome::Conflict);
+        }
+        let action = input.action;
         let (candidate, binding) = match action {
             CandidateAction::Reserve {
                 actor,
@@ -132,17 +195,15 @@ impl Command for PrepareCandidate {
                         candidate,
                     ))));
                 }
-                if let CandidateResult::Ready { oid, tree_oid } = &result
-                    && !certified(context, &candidate, oid, tree_oid)?
-                {
-                    return rejected(CandidateOutcome::Conflict);
-                }
                 candidate.result = result;
                 (candidate, None)
             }
         };
         let Some(state) = policy_state(&context.sql(&SqlBatch {
-            statements: vec![policy_statement(&candidate.actor, candidate.number)],
+            statements: vec![super::super::native::with_refs(
+                policy_statement(&candidate.actor, candidate.number),
+                &input.selection,
+            )],
         })?)?
         else {
             return rejected(CandidateOutcome::NotFound);
@@ -169,36 +230,17 @@ impl Command for PrepareCandidate {
                 })?;
             SqlStatement {sql:"INSERT INTO merge_candidates (id,binding,pull_number,actor,request,created_ms,result,source_oid,base_oid) VALUES (?1,?2,?3,?4,?5,?6,?7,?8,?9)".into(),parameters:vec![SqlValue::Blob(id.as_bytes().to_vec()),SqlValue::Blob(binding),SqlValue::Integer(candidate.number),SqlValue::Text(candidate.actor.clone()),SqlValue::Text(request),SqlValue::Integer(candidate.created_at_ms),SqlValue::Text(result),SqlValue::Blob(oid(&candidate.request.revision.source_oid)?.to_vec()),SqlValue::Blob(oid(&candidate.request.revision.base_oid)?.to_vec())]}
         } else {
-            let ready = match &candidate.result {
-                CandidateResult::Ready { oid: commit, .. } => SqlValue::Blob(oid(commit)?.to_vec()),
-                _ => SqlValue::Null,
-            };
             SqlStatement {
-                sql: "UPDATE merge_candidates SET result = ?2, oid = ?3 WHERE id = ?1".into(),
+                sql: "UPDATE merge_candidates SET result = ?2 WHERE id = ?1".into(),
                 parameters: vec![
                     SqlValue::Blob(id.as_bytes().to_vec()),
                     SqlValue::Text(result),
-                    ready,
                 ],
             }
         };
         context.sql(&SqlBatch {
             statements: vec![statement],
         })?;
-        if let CandidateResult::Ready { oid: commit, .. } = &candidate.result {
-            // A candidate becomes fetchable in the same transaction as its ready
-            // result. The reserved namespace cannot be changed by ordinary pushes.
-            context.sql(&SqlBatch {
-                statements: vec![SqlStatement {
-                    sql: "INSERT INTO refs (name, oid, version) VALUES (?1, ?2, 1)".into(),
-                    parameters: vec![
-                        SqlValue::Text(candidate.fetch_ref()),
-                        SqlValue::Blob(oid(commit)?.to_vec()),
-                    ],
-                }],
-            })?;
-            crate::refs::advance_generation(context)?;
-        }
         Ok(CommandResult::Success(CandidateOutcome::Applied(Box::new(
             candidate,
         ))))
diff --git a/crates/canopy-server/src/pulls/candidates/mod.rs b/crates/canopy-server/src/pulls/candidates/mod.rs
index 8905c3f4..8f3c59c7 100644
--- a/crates/canopy-server/src/pulls/candidates/mod.rs
+++ b/crates/canopy-server/src/pulls/candidates/mod.rs
@@ -134,10 +134,89 @@ impl RepositoryCell {
         identity: MutationIdentity,
         action: command::CandidateAction,
     ) -> Result<Committed<CandidateOutcome>, InvocationError<CandidateOutcome>> {
+        let (_snapshot, input) = self
+            .prepare_candidate_action(action)
+            .await
+            .map_err(|source| {
+                InvocationError::NotStarted(Error::Facility {
+                    name: "native candidate observation",
+                    source: Box::new(source),
+                })
+            })?;
         self.application
-            .command::<command::PrepareCandidate>(&self.target, identity, action)
+            .command::<command::PrepareCandidate>(&self.target, identity, input)
             .await
     }
+
+    pub(crate) async fn prepare_candidate_action(
+        &self,
+        action: command::CandidateAction,
+    ) -> Result<
+        (
+            Option<crate::packs::publication::ServingSnapshot>,
+            command::CandidateRefRequest,
+        ),
+        super::native::NativePullError,
+    > {
+        validate_component(action.actor())?;
+        if !action.valid() {
+            return Err(Error::Command("invalid candidate action").into());
+        }
+        if matches!(
+            &action,
+            command::CandidateAction::Finish {
+                result: CandidateResult::Ready { .. },
+                ..
+            }
+        ) {
+            return Err(
+                Error::Command("native generated candidate publication is unavailable").into(),
+            );
+        }
+        let number = match &action {
+            command::CandidateAction::Reserve { number, .. } => Some(*number),
+            command::CandidateAction::Finish { actor, id, .. } => {
+                let id = uuid::Uuid::parse_str(id)
+                    .map_err(|_| Error::Command("invalid candidate UUID"))?;
+                let selected = self.sql.query(None, SqlBatch {statements: vec![SqlStatement {
+                    sql: format!("SELECT pull_number FROM merge_candidates WHERE id=?2 AND actor=?1 AND ({ACCESS})"),
+                    parameters: vec![ReadIdentity::Account(actor).parameter(), SqlValue::Blob(id.as_bytes().to_vec())],
+                }]}).await.map_err(|e| super::native::NativePullError::Metadata(Box::new(e)))?;
+                match selected
+                    .output
+                    .first()
+                    .and_then(|s| s.rows.first())
+                    .map(Vec::as_slice)
+                {
+                    Some([SqlValue::Integer(number)]) if *number > 0 => Some(*number),
+                    None => None,
+                    _ => return Err(Error::Command("invalid candidate number selection").into()),
+                }
+            }
+        };
+        let selected = self.sql.query(None, SqlBatch {statements: vec![SqlStatement {
+            sql: format!("SELECT source_ref,base_ref FROM pull_requests WHERE number=?2 AND ({ACCESS})"),
+            parameters: vec![ReadIdentity::Account(action.actor()).parameter(), number.map_or(SqlValue::Null, SqlValue::Integer)],
+        }]}).await.map_err(|e| super::native::NativePullError::Metadata(Box::new(e)))?;
+        let mut names = match selected
+            .output
+            .first()
+            .and_then(|s| s.rows.first())
+            .map(Vec::as_slice)
+        {
+            Some([SqlValue::Text(source), SqlValue::Text(base)]) => {
+                vec![source.clone(), base.clone()]
+            }
+            None => Vec::new(),
+            _ => return Err(Error::Command("invalid candidate ref selection").into()),
+        };
+        names.sort();
+        names.dedup();
+        let (snapshot, selection) = self
+            .pull_ref_selection(action.actor(), action.digest()?, &names)
+            .await?;
+        Ok((snapshot, command::CandidateRefRequest { selection, action }))
+    }
 }
 fn query(id: &str) -> cellule_runtime::Result<SqlBatch> {
     let id = uuid::Uuid::parse_str(id).map_err(|_| Error::Command("invalid candidate UUID"))?;
diff --git a/crates/canopy-server/src/pulls/native/client.rs b/crates/canopy-server/src/pulls/native/client.rs
index 4ce7e1a5..164abf9e 100644
--- a/crates/canopy-server/src/pulls/native/client.rs
+++ b/crates/canopy-server/src/pulls/native/client.rs
@@ -1,6 +1,6 @@
 use super::*;
 impl RepositoryCell {
-    async fn pull_ref_selection(
+    pub(crate) async fn pull_ref_selection(
         &self,
         actor: &str,
         request: [u8; 32],
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
index 3273c5eb..2c486da7 100644
--- a/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
@@ -10,6 +10,8 @@ use crate::pulls::{
 use cellule_runtime::codec::BoundedDecoder;
 use cellule_runtime::{Committed, InvocationError};
 
+mod candidates;
+
 fn data(native: &BrowseFixture) -> CreateData {
     CreateData {
         id: uuid::Uuid::new_v4().into_bytes(),
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser/pulls/candidates.rs b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls/candidates.rs
new file mode 100644
index 00000000..5f36c801
--- /dev/null
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls/candidates.rs
@@ -0,0 +1,474 @@
+//! Native candidate editorial preparation against actual resident ref facts.
+use super::*;
+use crate::pulls::{
+    candidates::{
+        CandidateOutcome, CandidateRequest, CandidateResult,
+        command::{CandidateAction, CandidateRefRequest, PrepareCandidate},
+    },
+    merge::MergeStrategy,
+};
+
+async fn intent(repository: &RepositoryCell, native: &BrowseFixture) -> Result<CandidateAction> {
+    let data = data(native);
+    let created = repository
+        .create_pull(crate::server::mutation_identity()?, "canopy", data.view())
+        .await?;
+    let PullChange::Applied(number) = created.output else {
+        return Err("candidate pull refused".into());
+    };
+    let revision = repository
+        .pull_review_policy("canopy", number)
+        .await?
+        .output
+        .and_then(|policy| policy.revision)
+        .ok_or("candidate revision missing")?;
+    Ok(CandidateAction::Reserve {
+        actor: "canopy".into(),
+        number,
+        request: CandidateRequest {
+            id: uuid::Uuid::new_v4().to_string(),
+            revision,
+            strategy: MergeStrategy::MergeCommit,
+            message: "Native candidate".into(),
+        },
+        created_ms: crate::server::mutation_identity()?.issued_at_ms,
+    })
+}
+
+async fn reserve(
+    repository: &RepositoryCell,
+    input: CandidateRefRequest,
+) -> Result<CandidateOutcome> {
+    match repository
+        .application
+        .command::<PrepareCandidate>(
+            &repository.target,
+            crate::server::mutation_identity()?,
+            input,
+        )
+        .await
+    {
+        Ok(value) => Ok(value.output),
+        Err(InvocationError::Rejected(value)) => Ok(value.output),
+        Err(error) => Err(error.into()),
+    }
+}
+async fn candidate_count(repository: &RepositoryCell) -> Result<i64> {
+    let value = repository
+        .sql
+        .query(
+            None,
+            SqlBatch {
+                statements: vec![SqlStatement {
+                    sql: "SELECT count(*) FROM merge_candidates".into(),
+                    parameters: vec![],
+                }],
+            },
+        )
+        .await?;
+    let Some([SqlValue::Integer(count)]) = value.output[0].rows.first().map(Vec::as_slice) else {
+        return Err("candidate count missing".into());
+    };
+    Ok(*count)
+}
+
+async fn joint_state(repository: &RepositoryCell) -> Result<Vec<Vec<SqlValue>>> {
+    let value=repository.sql.query(None,SqlBatch {statements:vec![SqlStatement {
+        sql:"SELECT s.generation,g.catalog,g.certificate,g.refs FROM catalog_state s JOIN catalog_generations g ON g.generation=s.generation WHERE s.singleton=1".into(),parameters:vec![],
+    }]}).await?;
+    Ok(value
+        .output
+        .into_iter()
+        .next()
+        .ok_or("candidate joint state missing")?
+        .rows)
+}
+
+async fn fault_sql(handle: &cellule_runtime::cell::actor::CellHandle, sql: &'static str) -> Result {
+    let identity = crate::server::mutation_identity()?;
+    handle
+        .execute(
+            identity,
+            cellule_runtime::Digest::from_bytes(*blake3::hash(sql.as_bytes()).as_bytes()),
+            identity.issued_at_ms,
+            sql.len(),
+            0,
+            move |tx| {
+                tx.execute_batch(sql)?;
+                Ok(cellule_runtime::cell::executor::HandlerOutcome::Success(
+                    Vec::new(),
+                ))
+            },
+        )
+        .await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_candidate_reservation_uses_certified_refs_without_legacy_ref_authority() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let action = intent(&repository, &native).await?;
+        let joint = joint_state(&repository).await?;
+        let CandidateOutcome::Applied(candidate) = repository
+            .candidate_action(crate::server::mutation_identity()?, action.clone())
+            .await?
+            .output
+        else {
+            return Err("native candidate reservation refused".into());
+        };
+        assert_eq!(candidate.result, CandidateResult::Pending);
+        let original = (*candidate).clone();
+        assert_eq!(
+            candidate.request.revision.source_oid,
+            hex::encode(native.main)
+        );
+        assert_eq!(
+            candidate.request.revision.base_oid,
+            hex::encode(native.side)
+        );
+        assert_eq!(
+            repository
+                .merge_candidate("canopy", candidate.number, &candidate.request.id)
+                .await?
+                .output,
+            Some(*candidate)
+        );
+        let legacy = repository
+            .sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![SqlStatement {
+                        sql: "SELECT count(*) FROM refs".into(),
+                        parameters: vec![],
+                    }],
+                },
+            )
+            .await?;
+        assert_eq!(legacy.output[0].rows[0], vec![SqlValue::Integer(0)]);
+        // Logical UUID replay keeps the first creation timestamp and intent.
+        let CandidateAction::Reserve {
+            mut created_ms,
+            actor,
+            number,
+            request,
+        } = action
+        else {
+            return Err("reserve intent missing".into());
+        };
+        created_ms += 100;
+        let replay = CandidateAction::Reserve {
+            created_ms,
+            actor: actor.clone(),
+            number,
+            request: request.clone(),
+        };
+        let CandidateOutcome::Applied(replayed) = repository
+            .candidate_action(crate::server::mutation_identity()?, replay)
+            .await?
+            .output
+        else {
+            return Err("candidate UUID replay refused".into());
+        };
+        assert_eq!(*replayed, original);
+        let mut collision = request.clone();
+        collision.message.push_str(" changed");
+        assert!(
+            matches!(repository.candidate_action(crate::server::mutation_identity()?, CandidateAction::Reserve {
+            actor:actor.clone(), number, request:collision, created_ms,
+        }).await, Err(InvocationError::Rejected(value)) if matches!(value.output,CandidateOutcome::Conflict))
+        );
+        assert_eq!(candidate_count(&repository).await?, 1);
+
+        // Negative preparation changes only editorial state. Its first result
+        // wins; it cannot create a fetch ref or claim generated publication.
+        let finish = CandidateAction::Finish {
+            actor: actor.clone(),
+            id: request.id.clone(),
+            result: CandidateResult::Unrelated,
+        };
+        let CandidateOutcome::Applied(finished) = repository
+            .candidate_action(crate::server::mutation_identity()?, finish)
+            .await?
+            .output
+        else {
+            return Err("negative candidate finish refused".into());
+        };
+        assert_eq!(finished.result, CandidateResult::Unrelated);
+        let CandidateOutcome::Applied(replayed) = repository
+            .candidate_action(
+                crate::server::mutation_identity()?,
+                CandidateAction::Finish {
+                    actor: actor.clone(),
+                    id: request.id.clone(),
+                    result: CandidateResult::Conflicted {
+                        paths_base64: vec![],
+                    },
+                },
+            )
+            .await?
+            .output
+        else {
+            return Err("negative result replay refused".into());
+        };
+        assert_eq!(*finished, *replayed);
+        let attempted = CandidateAction::Finish {
+            actor: actor.clone(),
+            id: request.id.clone(),
+            result: CandidateResult::Ready {
+                oid: hex::encode(native.main),
+                tree_oid: hex::encode(native.tree),
+            },
+        };
+        assert!(
+            repository
+                .prepare_candidate_action(attempted.clone())
+                .await
+                .is_err()
+        );
+        // Even an authentic current read observation bound to this exact Ready
+        // payload cannot authorize generated catalog/ref publication.
+        let snapshot = repository
+            .serving_snapshot(ReadIdentity::Account(&actor))
+            .await?;
+        let selection = snapshot
+            .ref_selection(
+                attempted.digest()?,
+                &["refs/heads/main".into(), "refs/heads/side".into()],
+            )
+            .await?;
+        assert!(
+            reserve(
+                &repository,
+                CandidateRefRequest {
+                    selection,
+                    action: attempted
+                }
+            )
+            .await
+            .is_err()
+        );
+        assert_eq!(
+            repository
+                .merge_candidate("canopy", number, &request.id)
+                .await?
+                .output,
+            Some(*finished)
+        );
+        drop(snapshot);
+        assert_eq!(candidate_count(&repository).await?, 1);
+        assert_eq!(joint_state(&repository).await?, joint);
+        server.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_candidate_receiver_binds_purpose_payload_actor_cell_and_current_generation()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let action = intent(&repository, &native).await?;
+        let (snapshot, input) = repository.prepare_candidate_action(action).await?;
+        let mut invalid = Vec::new();
+        let mut payload = input.clone();
+        let CandidateAction::Reserve { request, .. } = &mut payload.action else {
+            return Err("reserve missing".into());
+        };
+        request.message.push_str(" substituted");
+        invalid.push(payload);
+        let mut facts = input.clone();
+        facts.selection.facts[0]
+            .state
+            .as_mut()
+            .ok_or("ref absent")?
+            .version += 1;
+        invalid.push(facts);
+        let mut missing = input.clone();
+        missing.selection.proof = None;
+        invalid.push(missing);
+        let mut forged = input.clone();
+        forged.selection.proof = Some(damaged(
+            forged.selection.proof.as_ref().ok_or("proof absent")?,
+        )?);
+        invalid.push(forged);
+        let mut wrong_repository = input.clone();
+        wrong_repository.selection.repository = uuid::Uuid::new_v4().into_bytes();
+        invalid.push(wrong_repository);
+        let (pull_snapshot, pull_input) = prepare(&repository, "canopy", data(&native)).await?;
+        let mut purpose = input.clone();
+        purpose.selection = pull_input.selection;
+        invalid.push(purpose);
+        for refused in invalid {
+            assert!(matches!(
+                reserve(&repository, refused).await?,
+                CandidateOutcome::Conflict
+            ));
+            assert_eq!(candidate_count(&repository).await?, 0);
+        }
+        let mut wrong_actor = input.clone();
+        wrong_actor.selection.actor = Some("another-actor".into());
+        assert!(reserve(&repository, wrong_actor).await.is_err());
+        let foreign = create(&server.repositories, "candidate-foreign", format).await?;
+        let (other, _, _) = loaded(&server.repositories, foreign.repository_id).await?;
+        assert!(matches!(
+            reserve(&other, input.clone()).await?,
+            CandidateOutcome::Conflict
+        ));
+        assert_eq!(candidate_count(&other).await?, 0);
+        // Retaining identical roots under a new joint generation still fences
+        // an old serving observation; it must not reserve an editorial row.
+        install(&repository, 3, native.catalog, native.refs).await?;
+        assert!(matches!(
+            reserve(&repository, input).await?,
+            CandidateOutcome::Conflict
+        ));
+        assert_eq!(candidate_count(&repository).await?, 0);
+        drop((snapshot, pull_snapshot));
+        server.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_candidate_receiver_rechecks_late_access_and_editorial_revision() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let action = intent(&repository, &native).await?;
+        let (snapshot, input) = repository.prepare_candidate_action(action.clone()).await?;
+        repository
+            .edit_pull(
+                crate::server::mutation_identity()?,
+                "canopy",
+                1,
+                PullEdit {
+                    expected_version: 1,
+                    title: "Changed after preparation",
+                    body: "",
+                    state: PullState::Open,
+                    draft: false,
+                },
+            )
+            .await?;
+        assert!(matches!(
+            reserve(&repository, input).await?,
+            CandidateOutcome::Conflict
+        ));
+        assert_eq!(candidate_count(&repository).await?, 0);
+        drop(snapshot);
+        let CandidateAction::Reserve {
+            request,
+            created_ms,
+            ..
+        } = action
+        else {
+            return Err("reserve missing".into());
+        };
+        for role in [None, Some(crate::server::TokenScope::Read)] {
+            repository
+                .grant_member(
+                    crate::server::mutation_identity()?,
+                    "canopy",
+                    "candidate-writer",
+                    crate::server::TokenScope::Write,
+                )
+                .await?;
+            let mut request = request.clone();
+            request.id = uuid::Uuid::new_v4().to_string();
+            request.revision.pull_version = 2;
+            let (snapshot, input) = repository
+                .prepare_candidate_action(CandidateAction::Reserve {
+                    actor: "candidate-writer".into(),
+                    number: 1,
+                    request,
+                    created_ms,
+                })
+                .await?;
+            if let Some(role) = role {
+                repository
+                    .grant_member(
+                        crate::server::mutation_identity()?,
+                        "canopy",
+                        "candidate-writer",
+                        role,
+                    )
+                    .await?;
+            } else {
+                repository
+                    .revoke_member(
+                        crate::server::mutation_identity()?,
+                        "canopy",
+                        "candidate-writer",
+                    )
+                    .await?;
+            }
+            let result = reserve(&repository, input).await?;
+            assert!(matches!(
+                (role, result),
+                (None, CandidateOutcome::NotFound) | (Some(_), CandidateOutcome::Forbidden)
+            ));
+            assert_eq!(candidate_count(&repository).await?, 0);
+            drop(snapshot);
+        }
+        server.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_candidate_reservation_sql_failure_rolls_back_sdk_acceptance_and_retries_original_command()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let action = intent(&repository, &native).await?;
+        let (snapshot, input) = repository.prepare_candidate_action(action).await?;
+        let (_, client, _) = loaded(&server.repositories, repository.id).await?;
+        let command = client
+            .prepare_command::<PrepareCandidate>(
+                &repository.target,
+                crate::server::mutation_identity()?,
+                input,
+            )
+            .await?;
+        let joint = joint_state(&repository).await?;
+        let handle = server
+            .node
+            .runtime()
+            .resident_handle(
+                &repository.target,
+                cellule_runtime::cell::catalog::CatalogRole::Sql,
+            )
+            .await?
+            .ok_or("candidate Cell not resident")?;
+        // Fault installation belongs to the trusted test harness. The product
+        // SQL primitive correctly refuses statement separators in trigger DDL.
+        fault_sql(&handle,"CREATE TRIGGER candidate_insert_fault AFTER INSERT ON merge_candidates BEGIN SELECT RAISE(ABORT,'candidate insertion fault'); END").await?;
+        assert!(command.clone().execute().await.is_err());
+        assert_eq!(candidate_count(&repository).await?, 0);
+        assert_eq!(joint_state(&repository).await?, joint);
+        assert!(matches!(
+            client.resolve(command.evidence()).await?,
+            cellule_runtime::Resolution::Absent
+        ));
+        fault_sql(&handle, "DROP TRIGGER candidate_insert_fault").await?;
+        let applied = command.clone().execute().await?;
+        let replayed = command.execute().await?;
+        assert_eq!(applied.receipt, replayed.receipt);
+        let (CandidateOutcome::Applied(applied), CandidateOutcome::Applied(replayed)) =
+            (applied.output, replayed.output)
+        else {
+            return Err("original candidate command refused".into());
+        };
+        assert_eq!(applied, replayed);
+        assert_eq!(candidate_count(&repository).await?, 1);
+        assert_eq!(joint_state(&repository).await?, joint);
+        drop(snapshot);
+        server.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/docs/contracts.md b/docs/contracts.md
index 3aa3001c..d66227b0 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -2365,6 +2365,13 @@ remain open. No dependency or lockfile changed.
 
 ### Native merge, squash and rebase candidates
 
+In the current packed cutover, operation 10 codec 3 supports native editorial
+reservation and negative preparation completion. Generated `ready` publication
+and the resident generated producer remain incomplete. The generated-object
+workflow below is required delivery scope; retired SQLite object/ref ingestion
+does not implement it. This distinction applies even when a pending intent or
+negative result is already durable.
+
 Preparation and branch publication are separate actions. A writer POSTs
 `/api/repositories/<name>/pulls/<number>/merge-candidates` with `repository_id`,
 canonical UUID `id`, exact pull `revision`, and `strategy`. `merge_commit` and
@@ -2382,7 +2389,23 @@ its original request fields, pull `number`, `actor`, `created_at_ms`, and `resul
 | `unrelated` | none | Native Git found no common ancestor; cannot publish |
 | `rebase_unavailable` | `reason` | `merge_history`, `no_commits`, `limit` or `commit_format`; cannot publish |
 
-Operation 10, codec 2 reserves the UUID against actor, pull and complete intent.
+Operation 10, codec 3 reserves the UUID against actor, pull and complete intent.
+Its input reuses `CandidateAction` and `RefSelection`. A serving observation
+authenticates the exact action purpose, actor, selected native OIDs/versions,
+actual owner, live pin and current joint generation. The final transaction
+checks fresh write access and projects those facts into the existing pull-policy
+statement instead of reading the retired SQL ref table. The client keeps its
+serving snapshot through dispatch. Known access denials reach the typed command
+without a proof, preserving their original durable refusal.
+
+Reservation and negative completion change only existing candidate editorial
+rows. They do not move roots, create fetch refs or authorize physical deletion.
+Even an authentic serving observation bound to a `Ready` payload cannot grant
+generated write authority: this command's codec rejects that scope, and the
+client requires the forthcoming joint generated publisher. There is no codec 2
+compatibility decoder. A SQL failure rolls back both the editorial write and
+SDK acceptance, allowing the original prepared command to retry unchanged.
+
 It retains the first timestamp. Retrying completed preparation returns the
 original result, even if the pull later changes or merges; current write access
 is still required for POST. GET requires current read access. For pending
@@ -2414,10 +2437,12 @@ native worker is trusted to compute the merge tree; the Cell validates exact
 canonical commit bytes and certified graph closure before recording readiness.
 It does not independently recompute the merge algorithm.
 
-Generated objects use the same verified SQLite/chunk/external-blob ingestion as
-pushes. A ready result and `refs/canopy/merge-candidates/<UUID>` commit in one
-transaction, advancing the ref generation for cache invalidation and coherent
-pagination. The entire `refs/canopy` namespace, including its root, is reserved.
+The cutover's generated publisher must use the same physically verified native
+pack/catalog lifecycle as pushes. Its ready result, certified joint roots and
+`refs/canopy/merge-candidates/<UUID>` must commit in one transaction, advancing
+the ref generation for cache invalidation and coherent pagination. The retired
+SQLite/chunk/external object ingestion and SQL ref insertion are not a fallback.
+The entire `refs/canopy` namespace, including its root, is reserved.
 The authoritative publisher rejects direct creation, replacement and deletion
 there; native receive hooks give per-ref rejection reports. Mixed pushes may
 still publish permitted siblings, while atomic pushes reject the group. Ready
@@ -2448,8 +2473,10 @@ native peak disk/memory/CPU bounds and crash-left cleanup remain release gates.
 Candidate input/result objects and their ancestor closure are retention roots.
 No GC runs today. Abandoned pending rows, ready refs, external orphan objects and
 historic candidates need quota/retention policy before persistent public use.
-Schema 1 remains unreleased: new candidate tables, operation 10 and operation 9
-codec 4 require a fresh development prefix. No dependency or lockfile changes.
+Schema 1 remains unreleased and requires a fresh development prefix. The native
+editorial increment reuses the existing candidate request/result/table and
+ref-observation structures, with operation 10 codec 3; reviewed native merge is
+operation 9 codec 6. No dependency or lockfile changes are needed for this step.
 
 
 ## Repository browser
diff --git a/docs/evidence/native-candidate-intent-ci-20261005.json b/docs/evidence/native-candidate-intent-ci-20261005.json
new file mode 100644
index 00000000..21836cb2
--- /dev/null
+++ b/docs/evidence/native-candidate-intent-ci-20261005.json
@@ -0,0 +1,746 @@
+{
+  "recorded_at_utc": "2026-10-05T21:45:48.805014+00:00",
+  "base_head": "c8c49e8ff3e9467e2b0ca9f1610ab67245c48c58",
+  "host": "macOS, Rust 1.98.0; exact-head Linux qualification remains required",
+  "source_files": 517,
+  "rust_files": 499,
+  "source_hash_digest": "67608ddeea86178381fdc9cc3521f6c4362cd9648c0734fc8453c079a28c4926",
+  "source_manifest": "/tmp/canopy-native-candidate-intent-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "release_qualified": false,
+  "baseline": {
+    "source_digest": "7ab9a27474d208b86522094022daeb05a51aa8b036cc6b2597dda51d6a5b1495",
+    "reason": "Actual resident/native-ref candidate reservation compiles and fails because operation 10 is absent from the production registry. Legacy ref table is not populated.",
+    "path": "/tmp/canopy-native-candidate-intent-baseline.log",
+    "sha256": "2866ba8c2fb74d63915b1e7d9831d760ad41c8bf80e23fe7a71759e27dd3b801",
+    "summaries": [
+      "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 739 filtered out; finished in 0.86s"
+    ]
+  },
+  "intermediate_failed_runs": [
+    {
+      "source_digest": "85c4b6dc74c7b45647c11a97242bd99ba2506dc96942e1b0a61ee7e030d6bdd9",
+      "reason": "Three families pass; rollback fixture tries CREATE TRIGGER through the public SQL primitive, which correctly rejects statement separators. Product validation and assertions remain unchanged.",
+      "path": "/tmp/canopy-native-candidate-intent-focused-first.log",
+      "sha256": "a4a05258216e7f72655a759c2684fcf97907ea770f7251c565848e128e6e767d",
+      "summaries": [
+        "test result: FAILED. 3 passed; 1 failed; 0 ignored; 0 measured; 739 filtered out; finished in 2.20s"
+      ]
+    },
+    {
+      "source_digest": "b75150e738976a6d116cc4dd21e994e9b5b7b2207c6a76f8a61b268a0b6a848f",
+      "reason": "Three families pass; rollback fixture uses the local Cell query API, which correctly refuses writes to its read-only connection. Fault installation moved to the trusted test-only Cell mutation API; no read/SQL guard was weakened.",
+      "path": "/tmp/canopy-native-candidate-intent-second-focused-final.log",
+      "sha256": "1db47e6480227c8bbea69891a35fc08592e229d025e0e051b36ac7f52513bf7d",
+      "summaries": [
+        "test result: FAILED. 3 passed; 1 failed; 0 ignored; 0 measured; 739 filtered out; finished in 2.27s"
+      ]
+    }
+  ],
+  "utility_failure": "An initial validator-script transformation produced a Python SyntaxError before any compiler started. The script was corrected, syntax checked, and then executed; no qualification is claimed for that launch.",
+  "validation": {
+    "source_digest": "67608ddeea86178381fdc9cc3521f6c4362cd9648c0734fc8453c079a28c4926",
+    "phases": [
+      {
+        "name": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "server::residency::tests::serving::browser::pulls::candidates::",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 83.34,
+        "log": "/tmp/canopy-native-candidate-intent-final-focused-final.log",
+        "log_sha256": "0354d5f63d916c7eebcd43c8c3f211d1c9200bb0a53bbdd6d04e6d2cf611f1ab",
+        "summaries": [
+          "test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 739 filtered out; finished in 3.95s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "registry",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::registry::tests::production_registers_packed_and_policy_metadata_contracts",
+          "--locked",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 0.78,
+        "log": "/tmp/canopy-native-candidate-intent-final-registry-final.log",
+        "log_sha256": "9631879411f5511ea5c00d9a14da36fbd9b3531f6b5c452543b986cc702442d9",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 742 filtered out; finished in 0.05s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 31.7,
+        "log": "/tmp/canopy-native-candidate-intent-final-clippy-final.log",
+        "log_sha256": "476fa92a305fc1c5ef53bac68be8abc5f17ee872054cb5cd90ab6aba963b86b9",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 708.24,
+        "log": "/tmp/canopy-native-candidate-intent-final-workspace-final.log",
+        "log_sha256": "47679cd51fa28f067aaa2f0b232db8818cb934161fccb289836a66430ce01b6a",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.71s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.32s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 742 filtered out; finished in 0.00s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 742 filtered out; finished in 0.08s",
+          "test result: ok. 743 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 296.64s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.20s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+          "test result: FAILED. 87 passed; 20 failed; 9 ignored; 0 measured; 0 filtered out; finished in 351.45s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.33s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.16s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.27s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 38.06,
+        "log": "/tmp/canopy-native-candidate-intent-final-build-final.log",
+        "log_sha256": "5cc1f6ca415c48867244d685575227a3d31b7d1a48277026417833e5caed7c4f",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.23,
+        "log": "/tmp/canopy-native-candidate-intent-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 40.79,
+        "log": "/tmp/canopy-native-candidate-intent-final-harness-final.log",
+        "log_sha256": "1bb99a476c31b11299eb39ee4e728c28531110fab271887b89529a11526535fc",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.04,
+        "log": "/tmp/canopy-native-candidate-intent-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 743,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 87,
+      "failed": 20,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 868,
+    "failed": 23,
+    "ignored": 9,
+    "executed": 891,
+    "total": 900
+  },
+  "counting": "Last summary per Cargo Running/Doc-tests section; nested child summaries and focused reruns excluded. Ignored cases remain unexecuted.",
+  "workspace_failure_delta": {
+    "added": [],
+    "removed": []
+  },
+  "parent_ci": {
+    "headRefOid": "c8c49e8ff3e9467e2b0ca9f1610ab67245c48c58",
+    "mergeable": "MERGEABLE",
+    "statusCheckRollup": [
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T21:13:04Z",
+        "conclusion": "SUCCESS",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37373904793/job/111977522885",
+        "name": "harness",
+        "startedAt": "2026-10-05T21:12:20Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T21:12:55Z",
+        "conclusion": "SUCCESS",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37373898679/job/111977504016",
+        "name": "harness",
+        "startedAt": "2026-10-05T21:12:14Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T21:33:31Z",
+        "conclusion": "FAILURE",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37373904793/job/111977523019",
+        "name": "rust",
+        "startedAt": "2026-10-05T21:07:29Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T21:28:07Z",
+        "conclusion": "FAILURE",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37373898679/job/111977503964",
+        "name": "rust",
+        "startedAt": "2026-10-05T21:07:31Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      }
+    ]
+  },
+  "parent_linux_runs": [
+    {
+      "run_id": 37373904793,
+      "metadata": {
+        "conclusion": "failure",
+        "headSha": "c8c49e8ff3e9467e2b0ca9f1610ab67245c48c58",
+        "jobs": [
+          {
+            "completedAt": "2026-10-05T21:13:04Z",
+            "conclusion": "success",
+            "databaseId": 111977522885,
+            "name": "harness",
+            "startedAt": "2026-10-05T21:12:20Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T21:12:22Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T21:12:21Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:12:24Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T21:12:22Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:13:02Z",
+                "conclusion": "success",
+                "name": "Check Python qualification harness",
+                "number": 3,
+                "startedAt": "2026-10-05T21:12:24Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:13:02Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 6,
+                "startedAt": "2026-10-05T21:13:02Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:13:02Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 7,
+                "startedAt": "2026-10-05T21:13:02Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37373904793/job/111977522885"
+          },
+          {
+            "completedAt": "2026-10-05T21:33:31Z",
+            "conclusion": "failure",
+            "databaseId": 111977523019,
+            "name": "rust",
+            "startedAt": "2026-10-05T21:07:29Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T21:07:30Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T21:07:30Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:07:31Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T21:07:30Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:07:41Z",
+                "conclusion": "success",
+                "name": "Install tools",
+                "number": 3,
+                "startedAt": "2026-10-05T21:07:31Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:07:43Z",
+                "conclusion": "success",
+                "name": "Report tool versions",
+                "number": 4,
+                "startedAt": "2026-10-05T21:07:41Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:07:49Z",
+                "conclusion": "success",
+                "name": "Check formatting",
+                "number": 5,
+                "startedAt": "2026-10-05T21:07:43Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:10:09Z",
+                "conclusion": "success",
+                "name": "Check lints",
+                "number": 6,
+                "startedAt": "2026-10-05T21:07:49Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:33:29Z",
+                "conclusion": "failure",
+                "name": "Test",
+                "number": 7,
+                "startedAt": "2026-10-05T21:10:09Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:33:29Z",
+                "conclusion": "skipped",
+                "name": "Qualify Git compatibility against RustFS",
+                "number": 8,
+                "startedAt": "2026-10-05T21:33:29Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:33:29Z",
+                "conclusion": "skipped",
+                "name": "Build server",
+                "number": 9,
+                "startedAt": "2026-10-05T21:33:29Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:33:30Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 18,
+                "startedAt": "2026-10-05T21:33:29Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:33:30Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 19,
+                "startedAt": "2026-10-05T21:33:30Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37373904793/job/111977523019"
+          }
+        ],
+        "status": "completed"
+      },
+      "log": {
+        "path": "/tmp/canopy-native-candidate-intent-parent-pr-full.log",
+        "sha256": "97329983199101ae876929f444547b89ea0092958ad902f171a8140063630bb4",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.42s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.17s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 738 filtered out; finished in 0.00s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 738 filtered out; finished in 0.01s",
+          "test result: ok. 739 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 474.31s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.75s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: FAILED. 88 passed; 23 failed; 9 ignored; 0 measured; 0 filtered out; finished in 647.90s"
+        ]
+      }
+    },
+    {
+      "run_id": 37373898679,
+      "metadata": {
+        "conclusion": "failure",
+        "headSha": "c8c49e8ff3e9467e2b0ca9f1610ab67245c48c58",
+        "jobs": [
+          {
+            "completedAt": "2026-10-05T21:28:07Z",
+            "conclusion": "failure",
+            "databaseId": 111977503964,
+            "name": "rust",
+            "startedAt": "2026-10-05T21:07:31Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T21:07:32Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T21:07:31Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:07:34Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T21:07:32Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:07:41Z",
+                "conclusion": "success",
+                "name": "Install tools",
+                "number": 3,
+                "startedAt": "2026-10-05T21:07:34Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:07:43Z",
+                "conclusion": "success",
+                "name": "Report tool versions",
+                "number": 4,
+                "startedAt": "2026-10-05T21:07:41Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:07:46Z",
+                "conclusion": "success",
+                "name": "Check formatting",
+                "number": 5,
+                "startedAt": "2026-10-05T21:07:43Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:09:24Z",
+                "conclusion": "success",
+                "name": "Check lints",
+                "number": 6,
+                "startedAt": "2026-10-05T21:07:46Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:28:04Z",
+                "conclusion": "failure",
+                "name": "Test",
+                "number": 7,
+                "startedAt": "2026-10-05T21:09:24Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:28:04Z",
+                "conclusion": "skipped",
+                "name": "Qualify Git compatibility against RustFS",
+                "number": 8,
+                "startedAt": "2026-10-05T21:28:04Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:28:04Z",
+                "conclusion": "skipped",
+                "name": "Build server",
+                "number": 9,
+                "startedAt": "2026-10-05T21:28:04Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:28:04Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 18,
+                "startedAt": "2026-10-05T21:28:04Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:28:04Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 19,
+                "startedAt": "2026-10-05T21:28:04Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37373898679/job/111977503964"
+          },
+          {
+            "completedAt": "2026-10-05T21:12:55Z",
+            "conclusion": "success",
+            "databaseId": 111977504016,
+            "name": "harness",
+            "startedAt": "2026-10-05T21:12:14Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T21:12:15Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T21:12:14Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:12:16Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T21:12:15Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:12:54Z",
+                "conclusion": "success",
+                "name": "Check Python qualification harness",
+                "number": 3,
+                "startedAt": "2026-10-05T21:12:16Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:12:54Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 6,
+                "startedAt": "2026-10-05T21:12:54Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:12:54Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 7,
+                "startedAt": "2026-10-05T21:12:54Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37373898679/job/111977504016"
+          }
+        ],
+        "status": "completed"
+      },
+      "log": {
+        "path": "/tmp/canopy-native-candidate-intent-parent-push-full.log",
+        "sha256": "34c208c02f4edb957680a12ee568baf66bbc1264f859438f01f8dd7c72049a64",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 738 filtered out; finished in 0.00s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 738 filtered out; finished in 0.02s",
+          "test result: ok. 739 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 378.54s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.27s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: FAILED. 88 passed; 23 failed; 9 ignored; 0 measured; 0 filtered out; finished in 535.74s"
+        ]
+      }
+    }
+  ],
+  "parent_ci_interpretation": "Actual observed parent c8c49e8 statuses and available terminal Rust logs are retained. They do not qualify this increment; pending, in-progress and cancelled checks do not prove success. RustFS/build skipped after test failure remain unqualified.",
+  "changes": [
+    "Operation 10 codec 3 is registered with bounded native editorial input. It reuses CandidateAction, CandidateRequest, CandidateResult, existing merge_candidates rows and RefSelection; no ref/ancestry mirror, table, decoder or provider deletion is added.",
+    "The client selects pull ref names under fresh access, issues an exact-purpose ref observation and retains its serving snapshot through dispatch. Final execution checks fresh write role, actual Cell/owner, live pin, exact action/facts and current joint generation before evaluating native projected pull policy.",
+    "Only Pending reservation or first negative result may mutate editorial rows. Generated Ready payloads are refused even with an authentic read observation. The retired SQL generated-object certification/ref insertion path is removed from this command.",
+    "Logical UUID replay preserves first intent, creation timestamp and completed negative result; changed intent is a collision. Source/base/editorial versions are rechecked before a new reservation or negative completion.",
+    "Four actual-resident families exercise SHA-1 and SHA-256: reservation/negative finish/replay, authentic-read Ready refusal and unchanged joint roots; purpose/payload/fact/actor/cell/current-generation binding; late access and editorial changes; late SQL insert failure with SDK absence, unchanged roots and exact original-command receipt replay."
+  ],
+  "qualification_limits": [
+    "Fixtures contain genuine physically verified stock-Git native metadata and actual resident/registered receiver/serving observations, but install their initial joint fact using trusted synthetic certificate SQL. They do not qualify initial-root generation, public generated producer or full workload capacity.",
+    "Generated Ready publication and merge/squash/rebase remain incomplete. The existing gateway candidate producer still performs old persistence after native Git generation; no complete successful public candidate endpoint is claimed.",
+    "Candidate-specific producer cancellation, pre-Bind intent/checkpoint recovery, original registered generated command, automatic retention and cold/owner restoration require qualification with the completed resident publisher.",
+    "Default-branch and thread writers, full CI including Linux durable refusals, backup/peer recovery, selective fetch, complete physical retention/GC/final DDL, fair maintenance/accelerators, asynchronous file attribution and large-history/10k-engineer capacity remain open.",
+    "macOS lib-test linker reports oversized __eh_frame compact-unwind warning. All-target Clippy, server build and Linux validation are independent checks."
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index cbbae70f..1c6c1141 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,50 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Native candidate reservation and negative completion (2026-10-05 checkpoint)
+
+Operation 10 codec 3 is now registered for native editorial candidate intent.
+It reuses the existing request/action/result, candidate rows and certified ref
+selection. The client retains its serving snapshot through dispatch. The final
+receiver checks fresh write access, actual Cell/owner, exact action purpose and
+facts, live pin and current joint generation, then evaluates pull policy against
+native refs. UUID replay preserves the first request, timestamp and negative
+result; changed intent is a collision. Pending reservation and first negative
+completion modify only editorial metadata. Generated Ready results require a
+separate joint publication and are refused even with authentic read evidence;
+the old SQL object certification/ref insertion path is removed from this command.
+
+The failing-first actual resident reservation compiled and failed because the
+operation was absent from the production registry. Four regression families now
+pass in both Git formats: reservation/negative completion/replay and unchanged
+roots; purpose/payload/fact/actor/Cell/current-generation binding; late access and
+editorial revision changes; and SQL rollback with absent SDK acceptance followed
+by exact-command retry and receipt replay. Two intermediate rollback-fixture
+attempts hit the public SQL separator guard and read-only query guard. The fault
+now uses a trusted test-only Cell mutation; neither production guard was weakened.
+Fixtures use verified stock-Git metadata but synthetic initial certificate SQL.
+They do not qualify the public generated producer or initial-root creation.
+
+Frozen validation passes all 743 server library cases, the registry contract,
+all-target Clippy with warnings denied, production build, formatting/diff checks
+and all 96 Python harness cases. Full Rust results are 868 passed /23 failed /9
+ignored, with the exact failed-case set unchanged from the preceding checkpoint.
+The unchanged digest across 517 source files (499 Rust) is
+`67608ddeea86178381fdc9cc3521f6c4362cd9648c0734fc8453c079a28c4926`.
+[Candidate evidence](evidence/native-candidate-intent-ci-20261005.json) records
+complete results, failing-first/intermediate runs and parent Linux CI. Both
+parent c8c49e8 Linux Rust jobs failed; Python harness jobs passed. Their RustFS
+and production-build phases were skipped, and exact new-head Linux validation
+remains required.
+
+Next: complete resident generated candidate production and atomic Ready/catalog/
+fetch-ref publication, then native merge/squash/rebase, default-branch and thread
+writers. Qualify cancellation, lost acknowledgements, startup adoption and
+retention, resolve remaining full CI failures, and complete peer/backup recovery,
+selective fetch, physical collection/final DDL, acceleration/fair maintenance,
+asynchronous attribution and full-history/10,000-engineer capacity gates. The
+full goal remains active and this increment is not release qualified.
+
 ## Public native fast-forward merge endpoint (2026-10-05 checkpoint)
 
 Production HTTP merge now calls the resident `GitGateway` native driver. The

From 976b548aa64d4dfad807a514ad1ff3b8c1014f46 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 15:42:40 -0700
Subject: [PATCH 44/55] feat: verify generated candidate commits against native
 catalog metadata

---
 crates/canopy-server/src/lib.rs               |   1 +
 .../src/packs/publication/mod.rs              |   2 +
 .../src/packs/publication/native_candidate.rs | 224 ++++++
 .../packs/publication/ref_proof/ancestry.rs   | 125 +++
 .../src/packs/publication/tests.rs            |   1 +
 .../publication/tests/native_candidate.rs     | 431 ++++++++++
 .../src/packs/publication/tests/publishing.rs |   6 +-
 ...ve-candidate-verification-ci-20261005.json | 757 ++++++++++++++++++
 8 files changed, 1546 insertions(+), 1 deletion(-)
 create mode 100644 crates/canopy-server/src/packs/publication/native_candidate.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/native_candidate.rs
 create mode 100644 docs/evidence/native-candidate-verification-ci-20261005.json

diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 5d4772ef..703be03f 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -271,6 +271,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/completion.rs"));
                 source.update(include_bytes!("packs/publication/ref_proof.rs"));
                 source.update(include_bytes!("packs/publication/ref_snapshot.rs"));
+                source.update(include_bytes!("packs/publication/native_candidate.rs"));
                 source.update(include_bytes!("packs/publication/native_merge.rs"));
                 source.update(include_bytes!("packs/publication/native_merge/audit.rs"));
                 source.update(include_bytes!(
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index e1848b5e..70280d49 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -55,6 +55,8 @@ pub use initialization::{
 };
 mod ref_snapshot;
 pub use ref_snapshot::{PreparedRefSnapshot, RefSnapshotPreparationError};
+mod native_candidate;
+pub use native_candidate::NativeCandidateVerificationError;
 mod native_merge;
 pub use native_merge::audit::NativeMergeAuditError;
 pub use native_merge::{
diff --git a/crates/canopy-server/src/packs/publication/native_candidate.rs b/crates/canopy-server/src/packs/publication/native_candidate.rs
new file mode 100644
index 00000000..4d28efa8
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/native_candidate.rs
@@ -0,0 +1,224 @@
+//! Generated commit semantics are checked against the private closed catalog.
+//! This is preparation, not Ready publication or current editorial authority.
+use super::*;
+use crate::{
+    ObjectId, ObjectKind,
+    packs::{
+        catalog::CatalogReader,
+        directory::index::IndexError,
+        metadata::{MetadataError, MetadataLimits, ObjectHeader},
+    },
+    pulls::{
+        candidates::{
+            CandidateResult, MergeCandidate, commit_body,
+            rebase::{Commit, MAX_COMMIT_BYTES, MAX_COMMITS},
+            valid_request,
+        },
+        merge::MergeStrategy,
+    },
+};
+use cellule_ltx::DiskBudget;
+use std::path::Path;
+use tokio::time::timeout_at;
+
+#[derive(Debug, thiserror::Error)]
+pub enum NativeCandidateVerificationError {
+    #[error("native candidate preparation is inactive")]
+    Base(#[from] PreparationBaseError),
+    #[error("native candidate catalog failed")]
+    Catalog(#[from] IndexError),
+    #[error("native candidate metadata failed")]
+    Metadata(#[from] MetadataError),
+    #[error("native candidate object read failed")]
+    Read(#[source] Box<crate::packs::catalog::NativeReadError>),
+    #[error("native candidate ancestry failed")]
+    Ancestry(#[source] Box<RefProofError>),
+    #[error("native candidate worker failed")]
+    Task(#[from] tokio::task::JoinError),
+    #[error("native candidate intent or commit semantics differ")]
+    Invalid,
+}
+impl PreparedCatalog {
+    /// Verify exact generated merge/squash bytes or every linear rebase rewrite
+    /// through this privately verified catalog. No SQL object/ancestry mirror or
+    /// caller-provided body/closure flag is accepted. Future joint publication
+    /// must bind these facts and recheck current intent, refs, access and owner.
+    pub async fn verify_candidate_commit(
+        &self,
+        candidate: &MergeCandidate,
+        directory: &Path,
+        budget: DiskBudget,
+        limits: MetadataLimits,
+    ) -> Result<(), NativeCandidateVerificationError> {
+        let (_, deadline) = self.base.live_lease()?;
+        timeout_at(
+            deadline,
+            self.verify_candidate_commit_inner(candidate, directory, budget, limits),
+        )
+        .await
+        .map_err(|_| PreparationBaseError::Inactive)?
+    }
+    async fn verify_candidate_commit_inner(
+        &self,
+        candidate: &MergeCandidate,
+        directory: &Path,
+        budget: DiskBudget,
+        limits: MetadataLimits,
+    ) -> Result<(), NativeCandidateVerificationError> {
+        let invalid = NativeCandidateVerificationError::Invalid;
+        if candidate.actor != self.base.capability().2.actor
+            || validate_component(&candidate.actor).is_err()
+            || candidate.number <= 0
+            || candidate.created_at_ms < 0
+            || !valid_request(&candidate.request)
+        {
+            return Err(invalid);
+        }
+        let CandidateResult::Ready {
+            oid: tip,
+            tree_oid: tree,
+        } = &candidate.result
+        else {
+            return Err(invalid);
+        };
+        let parse = |s: &str| -> Result<ObjectId, NativeCandidateVerificationError> {
+            let oid = crate::pulls::merge::oid(s)
+                .map_err(|_| NativeCandidateVerificationError::Invalid)?;
+            if oid.format() != self.catalog().format || oid.is_zero() {
+                return Err(NativeCandidateVerificationError::Invalid);
+            }
+            Ok(oid)
+        };
+        let (tip, tree, source, base) = (
+            parse(tip)?,
+            parse(tree)?,
+            parse(&candidate.request.revision.source_oid)?,
+            parse(&candidate.request.revision.base_oid)?,
+        );
+        let reader = CatalogReader::open(self.base.indexes(), self.catalog()).await?;
+        let files = self.base.files();
+        let headers = reader
+            .headers(&[tip, tree, source, base], &*files, &*files)
+            .await?;
+        if headers.len() != 4
+            || headers
+                .iter()
+                .zip([
+                    ObjectKind::Commit,
+                    ObjectKind::Tree,
+                    ObjectKind::Commit,
+                    ObjectKind::Commit,
+                ])
+                .any(|(h, k)| h.is_none_or(|h| h.object.kind != k))
+        {
+            return Err(invalid);
+        }
+        if candidate.request.strategy != MergeStrategy::Rebase {
+            let body = commit_body(candidate, &hex::encode(tree));
+            verify_bytes(
+                headers[0].ok_or(NativeCandidateVerificationError::Invalid)?,
+                &body,
+            )?;
+        } else {
+            let mut source = source;
+            let mut current = tip;
+            let mut originals = Vec::with_capacity(MAX_COMMITS + 1);
+            let mut complete = false;
+            for index in 0..MAX_COMMITS {
+                self.ensure_live()?;
+                if originals.contains(&source) {
+                    return Err(NativeCandidateVerificationError::Invalid);
+                }
+                originals.push(source);
+                let original = reader
+                    .lookup(source, &*files, &*files)
+                    .await?
+                    .ok_or(NativeCandidateVerificationError::Invalid)?;
+                let rewritten = reader
+                    .lookup(current, &*files, &*files)
+                    .await?
+                    .ok_or(NativeCandidateVerificationError::Invalid)?;
+                if original.entry.header.object.kind != ObjectKind::Commit
+                    || rewritten.entry.header.object.kind != ObjectKind::Commit
+                {
+                    return Err(NativeCandidateVerificationError::Invalid);
+                }
+                let header = rewritten.entry.header;
+                let metadata = rewritten.source.metadata.clone();
+                let edges =
+                    tokio::task::spawn_blocking(move || metadata.edges_after(current, None))
+                        .await??;
+                if edges.len() != 2 {
+                    return Err(NativeCandidateVerificationError::Invalid);
+                }
+                let tree_edge = edges
+                    .iter()
+                    .find(|e| e.expected_kind == ObjectKind::Tree)
+                    .ok_or(NativeCandidateVerificationError::Invalid)?;
+                let parent_edge = edges
+                    .iter()
+                    .find(|e| e.expected_kind == ObjectKind::Commit)
+                    .ok_or(NativeCandidateVerificationError::Invalid)?;
+                if index == 0 && tree_edge.child != tree {
+                    return Err(NativeCandidateVerificationError::Invalid);
+                }
+                let owner: crate::git_objects::ReadOwner = self.base.clone();
+                let original = files
+                    .body(original, MAX_COMMIT_BYTES, owner)
+                    .await
+                    .map_err(|e| NativeCandidateVerificationError::Read(Box::new(e)))?;
+                let parsed =
+                    Commit::parse(&original).ok_or(NativeCandidateVerificationError::Invalid)?;
+                let body = parsed.rewrite(
+                    candidate,
+                    &hex::encode(tree_edge.child),
+                    &hex::encode(parent_edge.child),
+                );
+                verify_bytes(header, &body)?;
+                source = parse(parsed.parent)?;
+                current = parent_edge.child;
+                if current == base {
+                    if originals.contains(&source) {
+                        return Err(NativeCandidateVerificationError::Invalid);
+                    }
+                    originals.push(source);
+                    complete = true;
+                    break;
+                }
+            }
+            if !complete {
+                return Err(NativeCandidateVerificationError::Invalid);
+            }
+            // Walk base history once for this bounded set. Only the remaining
+            // source anchor may be reachable: accepting an earlier reachable
+            // source would replay commits that are already on the base branch.
+            let mut walk = super::ref_proof::ancestry::Walker::new(directory, budget, limits)
+                .await
+                .map_err(|e| NativeCandidateVerificationError::Ancestry(Box::new(e)))?;
+            let reached = walk
+                .ancestors_within(&reader, &files, &originals, base, &self.base)
+                .await
+                .map_err(|e| NativeCandidateVerificationError::Ancestry(Box::new(e)))?;
+            if reached.last() != Some(&true) || reached[..reached.len() - 1].iter().any(|v| *v) {
+                return Err(NativeCandidateVerificationError::Invalid);
+            }
+        }
+        self.ensure_live()?;
+        Ok(())
+    }
+}
+fn verify_bytes(header: ObjectHeader, body: &[u8]) -> Result<(), NativeCandidateVerificationError> {
+    if body.len() > MAX_COMMIT_BYTES
+        || header.object.kind != ObjectKind::Commit
+        || header.object.size != body.len() as u64
+        || blake3::hash(body).as_bytes() != &header.object.digest
+        || crate::object_id(header.object.oid.format(), ObjectKind::Commit, body)
+            != header.object.oid
+    {
+        return Err(NativeCandidateVerificationError::Invalid);
+    }
+    // Physical verification bound this OID and canonical header to actual pack
+    // bytes. Matching both the Git OID and canonical BLAKE3 body digest proves equality without another
+    // pack download/native subprocess for each rewritten/generated commit.
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/ref_proof/ancestry.rs b/crates/canopy-server/src/packs/publication/ref_proof/ancestry.rs
index 8c5adbae..843019db 100644
--- a/crates/canopy-server/src/packs/publication/ref_proof/ancestry.rs
+++ b/crates/canopy-server/src/packs/publication/ref_proof/ancestry.rs
@@ -148,6 +148,131 @@ impl Walker {
         Ok(result)
     }
 
+    /// Test a bounded set against one descendant traversal. This avoids one
+    /// full base-history walk per original commit when verifying a rebase.
+    pub(in crate::packs::publication) async fn ancestors_within(
+        &mut self,
+        reader: &CatalogReader,
+        files: &Arc<CatalogFiles>,
+        targets: &[ObjectId],
+        descendant: ObjectId,
+        base: &PreparationBaseResolver,
+    ) -> Result<Vec<bool>, RefProofError> {
+        if self.failed || self._cancel.0.load(Ordering::Acquire) {
+            return Err(RefProofError::Canceled);
+        }
+        self.failed = true;
+        let mut guard = WalkCancellation::new(Arc::clone(&self._cancel.0));
+        let catalog = reader.stored();
+        if targets.is_empty()
+            || targets.len() > PAGE_OBJECTS
+            || self.catalog.is_some_and(|c| c != catalog)
+            || descendant.format() != catalog.format
+            || targets.iter().any(|o| o.format() != catalog.format)
+        {
+            return Err(RefProofError::Invalid);
+        }
+        self.catalog = Some(catalog);
+        base.live_lease()?;
+        for ids in [targets, std::slice::from_ref(&descendant)] {
+            let headers = reader.headers(ids, &**files, &**files).await?;
+            if headers.len() != ids.len()
+                || headers
+                    .iter()
+                    .any(|h| h.is_none_or(|h| h.object.kind != ObjectKind::Commit))
+            {
+                return Err(RefProofError::Invalid);
+            }
+        }
+        loop {
+            base.live_lease()?;
+            if self.call(Scratch::clear_page).await? == 0 {
+                break;
+            }
+        }
+        self.call(move |scratch| {
+            scratch.write(|tx| {
+                tx.execute("INSERT INTO visits(oid) VALUES(?1)", [descendant.as_ref()])
+                    .map_err(MetadataError::from)?;
+                Ok(())
+            })
+        })
+        .await?;
+        let wanted: BTreeSet<_> = targets.iter().copied().collect();
+        let mut reached = BTreeSet::new();
+        'walk: loop {
+            base.live_lease()?;
+            let page = self
+                .call(|scratch| {
+                    scratch
+                        .connection
+                        .prepare_cached(
+                            "SELECT oid FROM visits WHERE expanded=0 ORDER BY oid LIMIT ?1",
+                        )
+                        .map_err(MetadataError::from)?
+                        .query_map([PAGE_OBJECTS as i64], |r| {
+                            crate::packs::metadata::oid(r.get(0)?)
+                        })
+                        .map_err(MetadataError::from)?
+                        .collect::<rusqlite::Result<Vec<_>>>()
+                        .map_err(MetadataError::from)
+                        .map_err(Into::into)
+                })
+                .await?;
+            if page.is_empty() {
+                break;
+            }
+            for oid in page {
+                base.live_lease()?;
+                if wanted.contains(&oid) {
+                    reached.insert(oid);
+                }
+                if reached.len() == wanted.len() {
+                    break 'walk;
+                }
+                let object = reader
+                    .lookup(oid, &**files, &**files)
+                    .await?
+                    .ok_or(RefProofError::Invalid)?;
+                if object.entry.header.object.kind != ObjectKind::Commit {
+                    return Err(RefProofError::Invalid);
+                }
+                let mut after = None;
+                loop {
+                    base.live_lease()?;
+                    let metadata = object.source.metadata.clone();
+                    let edges =
+                        tokio::task::spawn_blocking(move || metadata.edges_after(oid, after))
+                            .await??;
+                    if edges.is_empty() {
+                        break;
+                    }
+                    after = edges.last().map(|e| e.child);
+                    self.parents(edges).await?;
+                }
+                self.call(move |scratch| {
+                    scratch.write(|tx| {
+                        if tx
+                            .execute(
+                                "UPDATE visits SET expanded=1 WHERE oid=?1 AND expanded=0",
+                                [oid.as_ref()],
+                            )
+                            .map_err(MetadataError::from)?
+                            != 1
+                        {
+                            return Err(RefProofError::Invalid);
+                        }
+                        Ok(())
+                    })
+                })
+                .await?;
+            }
+        }
+        base.live_lease()?;
+        guard.complete = true;
+        self.failed = false;
+        Ok(targets.iter().map(|o| reached.contains(o)).collect())
+    }
     async fn walk(
         &self,
         reader: &CatalogReader,
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index d16b48cd..4c26cdc5 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -14,6 +14,7 @@ mod initialization_retirement;
 mod inputs;
 mod mandatory_registration;
 mod namespaces;
+mod native_candidate;
 mod native_capture;
 mod native_merge;
 mod policy_dispatch;
diff --git a/crates/canopy-server/src/packs/publication/tests/native_candidate.rs b/crates/canopy-server/src/packs/publication/tests/native_candidate.rs
new file mode 100644
index 00000000..f97a8c00
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/native_candidate.rs
@@ -0,0 +1,431 @@
+//! Real stock-Git pack bytes and private closed native catalogs. These isolate
+//! generated commit verification; joint Ready publication remains separate.
+use super::*;
+use super::{
+    prepare::{opened_native, physical},
+    publishing::repack,
+};
+use crate::{
+    ObjectId, ObjectKind,
+    packs::{
+        catalog::{CatalogFileLimits, CatalogFiles},
+        metadata::tests::limits,
+        verification::physical::tests::{Prepared, independence::git_input},
+    },
+    pulls::{
+        PullRevision,
+        candidates::{
+            CandidateRequest, CandidateResult, MergeCandidate, commit_body, rebase::Commit,
+        },
+        merge::MergeStrategy,
+    },
+};
+use cellule_ltx::DiskBudget;
+
+fn oid(bytes: Vec<u8>) -> Result<ObjectId> {
+    let s = String::from_utf8(bytes)?;
+    Ok(crate::pulls::merge::oid(s.trim())?)
+}
+async fn write(native: &Prepared, body: &[u8], name: &str) -> Result<ObjectId> {
+    let o = oid(git_input(
+        native.fixture.root.path(),
+        &["hash-object", "-t", "commit", "-w", "--stdin"],
+        body,
+    )
+    .await?)?;
+    assert_eq!(o, crate::object_id(o.format(), ObjectKind::Commit, body));
+    git_input(
+        native.fixture.root.path(),
+        &["update-ref", name, &hex::encode(o)],
+        b"",
+    )
+    .await?;
+    Ok(o)
+}
+fn original(tree: ObjectId, parent: ObjectId, message: &str) -> Vec<u8> {
+    format!("tree {}\nparent {}\nauthor Author <author@example.invalid> 1 +0000\ncommitter Original <original@example.invalid> 2 +0000\nencoding UTF-8\ngpgsig stale signature\n continuation\nmergetag stale tag\n continuation\n\n{message}\n",hex::encode(tree),hex::encode(parent)).into_bytes()
+}
+fn candidate(strategy: MergeStrategy, base: ObjectId, source: ObjectId) -> MergeCandidate {
+    MergeCandidate {
+        request: CandidateRequest {
+            id: uuid::Uuid::new_v4().to_string(),
+            revision: PullRevision {
+                pull_version: 1,
+                source_oid: hex::encode(source),
+                source_version: 1,
+                base_oid: hex::encode(base),
+                base_version: 1,
+            },
+            message: if strategy == MergeStrategy::Rebase {
+                String::new()
+            } else {
+                "Exact candidate message".into()
+            },
+            strategy,
+        },
+        number: 1,
+        actor: "owner".into(),
+        created_at_ms: 5000,
+        result: CandidateResult::Pending,
+    }
+}
+fn ready(c: &MergeCandidate, tip: ObjectId, tree: ObjectId) -> MergeCandidate {
+    let mut c = c.clone();
+    c.result = CandidateResult::Ready {
+        oid: hex::encode(tip),
+        tree_oid: hex::encode(tree),
+    };
+    c
+}
+fn initial(native: &Prepared) -> Result<(ObjectId, ObjectId)> {
+    let (commit, edges) = native
+        .fixture
+        .objects
+        .values()
+        .find(|(o, _)| o.kind == ObjectKind::Commit)
+        .ok_or("initial commit")?;
+    let tree = edges
+        .iter()
+        .find(|e| e.expected_kind == ObjectKind::Tree)
+        .ok_or("initial tree")?
+        .child;
+    Ok((commit.oid, tree))
+}
+
+async fn catalog(
+    f: &Fixture,
+    native: &mut Prepared,
+    base: Arc<PreparationBaseResolver>,
+) -> Result<(PreparedCatalog, tempfile::TempDir, DiskBudget)> {
+    repack(native).await?;
+    let root = tempfile::TempDir::new()?;
+    let budget = DiskBudget::new(256 << 20);
+    let files = Arc::new(
+        CatalogFiles::new(
+            f.root.path(),
+            budget.clone(),
+            native.store.clone(),
+            f.format,
+            CatalogFileLimits::default(),
+        )?
+        .with_native(
+            crate::native_resources::NativeResources::default()
+                .scope(crate::native_resources::NativeClass::Foreground),
+        ),
+    );
+    let base = Arc::new(
+        PreparationBaseResolver::from_session(base.session.clone(), base.indexes(), files).await?,
+    );
+    let mut builder = CatalogPreparation::new(root.path(), budget.clone(), base, limits()).await?;
+    let (witness, segments) = physical(native, root.path(), budget.clone()).await?;
+    builder.begin_pack(witness)?;
+    for segment in segments {
+        builder.add_segment(segment).await?;
+    }
+    builder.finish_pack().await?;
+    Ok((builder.finish().await?, root, budget))
+}
+async fn verified(
+    p: &PreparedCatalog,
+    c: &MergeCandidate,
+    root: &tempfile::TempDir,
+    budget: &DiskBudget,
+) -> Result {
+    p.verify_candidate_commit(c, root.path(), budget.clone(), limits())
+        .await?;
+    Ok(())
+}
+async fn refused(
+    p: &PreparedCatalog,
+    c: &MergeCandidate,
+    root: &tempfile::TempDir,
+    budget: &DiskBudget,
+) -> Result {
+    assert!(matches!(
+        p.verify_candidate_commit(c, root.path(), budget.clone(), limits())
+            .await,
+        Err(NativeCandidateVerificationError::Invalid)
+    ));
+    Ok(())
+}
+#[tokio::test]
+async fn generated_merge_and_squash_require_exact_verified_bytes_without_native_body_downloads()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (mut native, base, _, _) =
+            opened_native(&f, *uuid::Uuid::new_v4().as_bytes(), 2).await?;
+        let (initial, tree) = initial(&native)?;
+        let source = write(
+            &native,
+            &original(tree, initial, "source"),
+            "refs/heads/source",
+        )
+        .await?;
+        let merge = candidate(MergeStrategy::MergeCommit, initial, source);
+        let merge_oid = write(
+            &native,
+            &commit_body(&merge, &hex::encode(tree)),
+            "refs/heads/generated-merge",
+        )
+        .await?;
+        let squash = candidate(MergeStrategy::Squash, initial, source);
+        let squash_oid = write(
+            &native,
+            &commit_body(&squash, &hex::encode(tree)),
+            "refs/heads/generated-squash",
+        )
+        .await?;
+        let mut swapped = merge.clone();
+        swapped.request.revision.base_oid = hex::encode(source);
+        swapped.request.revision.source_oid = hex::encode(initial);
+        let swapped_oid = write(
+            &native,
+            &commit_body(&swapped, &hex::encode(tree)),
+            "refs/heads/swapped",
+        )
+        .await?;
+        let (p, root, budget) = catalog(&f, &mut native, base).await?;
+        let good = ready(&merge, merge_oid, tree);
+        verified(&p, &good, &root, &budget).await?;
+        verified(&p, &ready(&squash, squash_oid, tree), &root, &budget).await?;
+        for mut c in [
+            good.clone(),
+            good.clone(),
+            good.clone(),
+            good.clone(),
+            good.clone(),
+        ]
+        .into_iter()
+        .enumerate()
+        {
+            match c.0 {
+                0 => c.1.request.message.push('!'),
+                1 => c.1.created_at_ms += 1000,
+                2 => c.1.actor = "another".into(),
+                3 => c.1.result = CandidateResult::Pending,
+                _ => {
+                    c.1.result = CandidateResult::Ready {
+                        oid: hex::encode(merge_oid),
+                        tree_oid: hex::encode(source),
+                    }
+                }
+            }
+            refused(&p, &c.1, &root, &budget).await?;
+        }
+        refused(&p, &ready(&merge, swapped_oid, tree), &root, &budget).await?;
+        refused(&p, &ready(&merge, squash_oid, tree), &root, &budget).await?;
+        refused(
+            &p,
+            &ready(
+                &merge,
+                crate::object_id(format, ObjectKind::Commit, b"unpublished"),
+                tree,
+            ),
+            &root,
+            &budget,
+        )
+        .await?;
+        assert_eq!(
+            p.base
+                .files()
+                .native_stats()?
+                .ok_or("native stats")?
+                .downloaded_files,
+            0
+        );
+        let legacy=f.handle.query(0,4096,|db|Ok(db.query_row("SELECT count(*) FROM sqlite_schema WHERE type='table' AND name IN ('objects','commit_ancestry')",[],|r|r.get::<_,u64>(0))?.to_le_bytes().to_vec())).await?;
+        assert_eq!(
+            u64::from_le_bytes(legacy.try_into().map_err(|_| "legacy count")?),
+            0
+        );
+        p.base.session.fence();
+        assert!(matches!(
+            p.verify_candidate_commit(&good, root.path(), budget.clone(), limits())
+                .await,
+            Err(NativeCandidateVerificationError::Base(
+                PreparationBaseError::Inactive
+            ))
+        ));
+        drop(p);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_rebase_binds_every_original_and_rejects_skips_and_replayed_base_history() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (mut native, base, _, _) =
+            opened_native(&f, *uuid::Uuid::new_v4().as_bytes(), 2).await?;
+        let (initial, tree) = initial(&native)?;
+        let common_body = original(tree, initial, "common");
+        let common = write(&native, &common_body, "refs/heads/common").await?;
+        let base_oid = write(&native, &original(tree, common, "base"), "refs/heads/base").await?;
+        let first_body = original(tree, common, "first");
+        let first = write(&native, &first_body, "refs/heads/first").await?;
+        let last_body = original(tree, first, "last");
+        let source = write(&native, &last_body, "refs/heads/source").await?;
+        let c = candidate(MergeStrategy::Rebase, base_oid, source);
+        let rewrite = |body: &[u8], parent: ObjectId| -> Result<Vec<u8>> {
+            Ok(Commit::parse(body).ok_or("original parse")?.rewrite(
+                &c,
+                &hex::encode(tree),
+                &hex::encode(parent),
+            ))
+        };
+        let rewritten_first = write(
+            &native,
+            &rewrite(&first_body, base_oid)?,
+            "refs/heads/rebase-first",
+        )
+        .await?;
+        let rewritten_last = write(
+            &native,
+            &rewrite(&last_body, rewritten_first)?,
+            "refs/heads/rebase-last",
+        )
+        .await?;
+        let skipped = write(
+            &native,
+            &rewrite(&last_body, base_oid)?,
+            "refs/heads/skipped",
+        )
+        .await?;
+        let extra = write(
+            &native,
+            &rewrite(&common_body, base_oid)?,
+            "refs/heads/extra",
+        )
+        .await?;
+        let extra_first = write(
+            &native,
+            &rewrite(&first_body, extra)?,
+            "refs/heads/extra-first",
+        )
+        .await?;
+        let extra_last = write(
+            &native,
+            &rewrite(&last_body, extra_first)?,
+            "refs/heads/extra-last",
+        )
+        .await?;
+        let mut wrong = rewrite(&last_body, rewritten_first)?;
+        wrong.extend_from_slice(b"tampered message");
+        let wrong = write(&native, &wrong, "refs/heads/wrong").await?;
+        let (p, root, budget) = catalog(&f, &mut native, base).await?;
+        verified(&p, &ready(&c, rewritten_last, tree), &root, &budget).await?;
+        for tip in [skipped, extra_last, wrong] {
+            refused(&p, &ready(&c, tip, tree), &root, &budget).await?;
+        }
+        let stats = p.base.files().native_stats()?.ok_or("native stats")?;
+        assert_eq!(stats.downloaded_files, 1);
+        assert!(stats.cache_hits > 0);
+        let reader =
+            crate::packs::catalog::CatalogReader::open(p.base.indexes(), p.catalog()).await?;
+        let files = p.base.files();
+        let mut walker =
+            super::super::ref_proof::ancestry::Walker::new(root.path(), budget.clone(), limits())
+                .await?;
+        assert_eq!(
+            walker
+                .ancestors_within(
+                    &reader,
+                    &files,
+                    &[source, common, initial, common, base_oid],
+                    base_oid,
+                    &p.base
+                )
+                .await?,
+            vec![false, true, true, true, true]
+        );
+        assert_eq!(
+            walker
+                .ancestors_within(&reader, &files, &[source, first, common], source, &p.base)
+                .await?,
+            vec![true, true, true]
+        );
+        drop(walker);
+        drop(p);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn native_rebase_accepts_128_commits_and_refuses_129_before_publication() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let (mut native, base, _, _) =
+            opened_native(&f, *uuid::Uuid::new_v4().as_bytes(), 1).await?;
+        let (initial, tree) = initial(&native)?;
+        let count = crate::pulls::candidates::rebase::MAX_COMMITS + 1;
+        let mut input = Vec::new();
+        for rewritten in [false, true] {
+            for n in 1..=count {
+                let mark = n + if rewritten { count } else { 0 };
+                let parent = if n == 1 {
+                    hex::encode(initial)
+                } else {
+                    format!(":{}", mark - 1)
+                };
+                let (actor, email, time, reference) = if rewritten {
+                    (
+                        "owner",
+                        "owner@users.canopy.invalid",
+                        5,
+                        "refs/heads/rewritten",
+                    )
+                } else {
+                    (
+                        "Original",
+                        "original@example.invalid",
+                        2,
+                        "refs/heads/original",
+                    )
+                };
+                input.extend_from_slice(format!("commit {reference}\nmark :{mark}\nauthor Author <author@example.invalid> 1 +0000\ncommitter {actor} <{email}> {time} +0000\ndata 1\nx\nfrom {parent}\n\n").as_bytes());
+            }
+        }
+        let marks_path = native.fixture.root.path().join("candidate-marks");
+        let marks_arg = format!("--export-marks={}", marks_path.display());
+        git_input(
+            native.fixture.root.path(),
+            &["fast-import", "--quiet", &marks_arg],
+            &input,
+        )
+        .await?;
+        let marks = std::fs::read_to_string(marks_path)?;
+        let selected = |n: usize| -> Result<ObjectId> {
+            let prefix = format!(":{n} ");
+            Ok(crate::pulls::merge::oid(
+                marks
+                    .lines()
+                    .find_map(|l| l.strip_prefix(&prefix))
+                    .ok_or("mark")?,
+            )?)
+        };
+        let short = candidate(MergeStrategy::Rebase, initial, selected(count - 1)?);
+        let long = candidate(MergeStrategy::Rebase, initial, selected(count)?);
+        let short_tip = selected(count * 2 - 1)?;
+        let long_tip = selected(count * 2)?;
+        let (p, root, budget) = catalog(&f, &mut native, base).await?;
+        super::prepare::renewing(&f, &p.base, async {
+            verified(&p, &ready(&short, short_tip, tree), &root, &budget).await?;
+            refused(&p, &ready(&long, long_tip, tree), &root, &budget).await
+        })
+        .await?;
+        assert_eq!(
+            p.base
+                .files()
+                .native_stats()?
+                .ok_or("native stats")?
+                .downloaded_files,
+            1
+        );
+        drop(p);
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/publishing.rs b/crates/canopy-server/src/packs/publication/tests/publishing.rs
index f4d85720..da6ec36b 100644
--- a/crates/canopy-server/src/packs/publication/tests/publishing.rs
+++ b/crates/canopy-server/src/packs/publication/tests/publishing.rs
@@ -132,6 +132,10 @@ async fn history(
         )
         .await?,
     )?;
+    repack(native).await?;
+    Ok((tip, other))
+}
+pub(super) async fn repack(native: &mut Prepared) -> Result {
     git_input(native.fixture.root.path(), &["repack", "-ad"], b"").await?;
     let path = std::fs::read_dir(native.fixture.root.path().join("objects/pack"))?
         .find_map(|entry| {
@@ -172,7 +176,7 @@ async fn history(
     native.descriptor.index = artifact_index;
     native.descriptor.git_checksum = index.pack_checksum();
     native.descriptor.object_count = index.len();
-    Ok((tip, other))
+    Ok(())
 }
 async fn proof(graph: &Graph, updates: Vec<RefUpdate>) -> Result<RefPublicationProof> {
     Ok(Box::pin(graph.prepared.ref_proof(
diff --git a/docs/evidence/native-candidate-verification-ci-20261005.json b/docs/evidence/native-candidate-verification-ci-20261005.json
new file mode 100644
index 00000000..c9fd3774
--- /dev/null
+++ b/docs/evidence/native-candidate-verification-ci-20261005.json
@@ -0,0 +1,757 @@
+{
+  "recorded_at_utc": "2026-10-05T22:24:38.331143+00:00",
+  "base_head": "823092222fd043c2a0e3ce7deab8cdab40cd097c",
+  "host": "macOS, Rust 1.98.0; exact new-head Linux qualification required",
+  "release_qualified": false,
+  "source_files": 519,
+  "rust_files": 501,
+  "source_hash_digest": "e06fe0f8168246e9e9bf731b16d720bb97ad49c4bebb627db10ffe5a84d1eb7a",
+  "source_manifest": "/tmp/canopy-native-candidate-verification-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "public_baseline": {
+    "source_digest": "67608ddeea86178381fdc9cc3521f6c4362cd9648c0734fc8453c079a28c4926",
+    "reason": "Actual production stock-Git candidate endpoint fails at 503 instead of 200 on the parent. This private semantic increment does not claim to resolve that public failure; complete joint generated publication is next.",
+    "path": "/tmp/canopy-native-candidate-verification-public-baseline.log",
+    "sha256": "745cee89934b6426810fa32d8128b3f476d944e00be8e95508507ac2a6798c90",
+    "summaries": [
+      "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 115 filtered out; finished in 2.16s"
+    ]
+  },
+  "intermediate_failed_runs": [
+    {
+      "reason": "Compile failure: used the wrong location for the shared OID parser and treated the native fixture typed-edge inventory as raw body bytes. No tests executed and no qualification claimed.",
+      "path": "/tmp/canopy-native-candidate-verification-focused-first.log",
+      "sha256": "419e2596ef483a6a50ee347424fdd5e66e472197dd4f172df4d93f78f5af05a4",
+      "summaries": []
+    },
+    {
+      "reason": "Compile failure: shared pull parser returns bytes; switched to existing typed merge OID parser. No tests executed and no qualification claimed.",
+      "path": "/tmp/canopy-native-candidate-verification-focused-second.log",
+      "sha256": "e8ba5d7c26bc1618350a25c1dd0f93e8d7525e38558669fbc7188ffe55e82c33",
+      "summaries": []
+    },
+    {
+      "reason": "Two both-format rebase families pass, merge/squash fixture hits absent legacy objects table. The packed schema has removed objects/commit_ancestry; final assertion proves table absence rather than counting nonexistent rows. Final verifier also matches canonical BLAKE3 body digest beside Git OID.",
+      "path": "/tmp/canopy-native-candidate-verification-focused-third.log",
+      "sha256": "e802c4cca5fdbca597a6063f662e70b8fbfd71d09c2f5f3e481ab47a8232e313",
+      "summaries": [
+        "test result: FAILED. 2 passed; 1 failed; 0 ignored; 0 measured; 743 filtered out; finished in 16.05s"
+      ]
+    }
+  ],
+  "validation": {
+    "source_digest": "e06fe0f8168246e9e9bf731b16d720bb97ad49c4bebb627db10ffe5a84d1eb7a",
+    "phases": [
+      {
+        "name": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::tests::native_candidate::",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 148.68,
+        "log": "/tmp/canopy-native-candidate-verification-final-focused-final.log",
+        "log_sha256": "6e6bdd6242aaeaaea5b79883d1847e8085d938228a10f041e8a879517c2566fc",
+        "summaries": [
+          "test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 743 filtered out; finished in 12.71s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "merge",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::tests::native_merge::",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 10.35,
+        "log": "/tmp/canopy-native-candidate-verification-final-merge-final.log",
+        "log_sha256": "2a4fe6a30fa702d639f156995873143c30c71fec1bd044aaf3abd133bd47c70f",
+        "summaries": [
+          "test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 732 filtered out; finished in 5.75s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "registry",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::registry::tests::production_registers_packed_and_policy_metadata_contracts",
+          "--locked",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 1.06,
+        "log": "/tmp/canopy-native-candidate-verification-final-registry-final.log",
+        "log_sha256": "743852031baea3d9a1cbaff5b31019a53ffd48067e9011f8d7e6c712447a2077",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 745 filtered out; finished in 0.10s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 52.0,
+        "log": "/tmp/canopy-native-candidate-verification-final-clippy-final.log",
+        "log_sha256": "cf63691c426f069d6d0bb771e09d5520aca5de9892d837a2bd28980e51a68352",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 815.55,
+        "log": "/tmp/canopy-native-candidate-verification-final-workspace-final.log",
+        "log_sha256": "215a5e42f4a1fdc8f928033cc3a4c91e27813c23d6be9430e32c3e18826ce8d1",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.52s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.86s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 745 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 745 filtered out; finished in 0.08s",
+          "test result: ok. 746 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 341.05s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.71s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+          "test result: FAILED. 87 passed; 20 failed; 9 ignored; 0 measured; 0 filtered out; finished in 369.62s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.77s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.29s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 61.27,
+        "log": "/tmp/canopy-native-candidate-verification-final-build-final.log",
+        "log_sha256": "a9c739d365564f2d759cb47f51f3db6f1201f1f069f63d4ff3d40de9c66e412f",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.59,
+        "log": "/tmp/canopy-native-candidate-verification-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 43.39,
+        "log": "/tmp/canopy-native-candidate-verification-final-harness-final.log",
+        "log_sha256": "6f5949b48bd3a8896ed98da4b39bce1f6ec5b8b87825c5dca9e13c455a725c28",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.05,
+        "log": "/tmp/canopy-native-candidate-verification-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "workspace_terminal_inventory": [
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_git_format-cdf8cea2f92fe6a4)",
+      "passed": 6,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_object_storage-4a0661c5c4765140)",
+      "passed": 15,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/lib.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy_server-d080aca381ae9ba9)",
+      "passed": 746,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "unittests src/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/canopy-16a4bf977c56198e)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/directory_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/directory_cell-31a0f4eea5beeae3)",
+      "passed": 13,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/git_http.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/git_http-afa4d1d9a2db0179)",
+      "passed": 2,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/multi_server/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/multi_server-3e08ee00a07d7bde)",
+      "passed": 87,
+      "failed": 20,
+      "ignored": 9
+    },
+    {
+      "binary": "tests/owner_restart.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/owner_restart-be32ecc90c554a17)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/repository_cell/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/repository_cell-322afb5848ed5e86)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "tests/smart_http/main.rs (/Users/haipingfu/.codex/tmp/canopy-driver-native-target-zedhqen9/debug/deps/smart_http-18ac06122d3c394f)",
+      "passed": 0,
+      "failed": 1,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_git_format",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_object_storage",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    },
+    {
+      "binary": "canopy_server",
+      "passed": 0,
+      "failed": 0,
+      "ignored": 0
+    }
+  ],
+  "workspace_unique_totals": {
+    "passed": 871,
+    "failed": 23,
+    "ignored": 9,
+    "executed": 894,
+    "total": 903
+  },
+  "counting": "Last summary per Cargo Running/Doc-tests section; focused runs and nested child summaries excluded. Ignored cases remain unexecuted.",
+  "workspace_failure_delta": {
+    "added": [],
+    "removed": []
+  },
+  "parent_ci": {
+    "headRefOid": "823092222fd043c2a0e3ce7deab8cdab40cd097c",
+    "mergeable": "MERGEABLE",
+    "statusCheckRollup": [
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T21:47:34Z",
+        "conclusion": "SUCCESS",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37378141563/job/111992656152",
+        "name": "harness",
+        "startedAt": "2026-10-05T21:46:50Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T21:47:28Z",
+        "conclusion": "SUCCESS",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37378136899/job/111992639205",
+        "name": "harness",
+        "startedAt": "2026-10-05T21:46:47Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T22:12:57Z",
+        "conclusion": "FAILURE",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37378141563/job/111992655728",
+        "name": "rust",
+        "startedAt": "2026-10-05T21:46:49Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      },
+      {
+        "__typename": "CheckRun",
+        "completedAt": "2026-10-05T22:10:29Z",
+        "conclusion": "FAILURE",
+        "detailsUrl": "https://github.com/crabbuild/canopy/actions/runs/37378136899/job/111992639458",
+        "name": "rust",
+        "startedAt": "2026-10-05T21:46:49Z",
+        "status": "COMPLETED",
+        "workflowName": "Verify"
+      }
+    ]
+  },
+  "parent_linux_runs": [
+    {
+      "run_id": 37378141563,
+      "metadata": {
+        "conclusion": "failure",
+        "headSha": "823092222fd043c2a0e3ce7deab8cdab40cd097c",
+        "jobs": [
+          {
+            "completedAt": "2026-10-05T22:12:57Z",
+            "conclusion": "failure",
+            "databaseId": 111992655728,
+            "name": "rust",
+            "startedAt": "2026-10-05T21:46:49Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T21:46:51Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T21:46:50Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:46:52Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T21:46:51Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:01Z",
+                "conclusion": "success",
+                "name": "Install tools",
+                "number": 3,
+                "startedAt": "2026-10-05T21:46:52Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:05Z",
+                "conclusion": "success",
+                "name": "Report tool versions",
+                "number": 4,
+                "startedAt": "2026-10-05T21:47:01Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:13Z",
+                "conclusion": "success",
+                "name": "Check formatting",
+                "number": 5,
+                "startedAt": "2026-10-05T21:47:05Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:49:47Z",
+                "conclusion": "success",
+                "name": "Check lints",
+                "number": 6,
+                "startedAt": "2026-10-05T21:47:13Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:12:55Z",
+                "conclusion": "failure",
+                "name": "Test",
+                "number": 7,
+                "startedAt": "2026-10-05T21:49:47Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:12:55Z",
+                "conclusion": "skipped",
+                "name": "Qualify Git compatibility against RustFS",
+                "number": 8,
+                "startedAt": "2026-10-05T22:12:55Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:12:55Z",
+                "conclusion": "skipped",
+                "name": "Build server",
+                "number": 9,
+                "startedAt": "2026-10-05T22:12:55Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:12:55Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 18,
+                "startedAt": "2026-10-05T22:12:55Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:12:56Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 19,
+                "startedAt": "2026-10-05T22:12:55Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37378141563/job/111992655728"
+          },
+          {
+            "completedAt": "2026-10-05T21:47:34Z",
+            "conclusion": "success",
+            "databaseId": 111992656152,
+            "name": "harness",
+            "startedAt": "2026-10-05T21:46:50Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T21:46:52Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T21:46:51Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:46:53Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T21:46:52Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:31Z",
+                "conclusion": "success",
+                "name": "Check Python qualification harness",
+                "number": 3,
+                "startedAt": "2026-10-05T21:46:53Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:31Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 6,
+                "startedAt": "2026-10-05T21:47:31Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:31Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 7,
+                "startedAt": "2026-10-05T21:47:31Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37378141563/job/111992656152"
+          }
+        ],
+        "status": "completed"
+      },
+      "rust_log": {
+        "path": "/tmp/canopy-native-candidate-verification-parent-pr-full.log",
+        "sha256": "67cace992f4b6eff56848b2641764ec5443730fc711176d14bb80ee4415b812b",
+        "summaries": []
+      }
+    },
+    {
+      "run_id": 37378136899,
+      "metadata": {
+        "conclusion": "failure",
+        "headSha": "823092222fd043c2a0e3ce7deab8cdab40cd097c",
+        "jobs": [
+          {
+            "completedAt": "2026-10-05T21:47:28Z",
+            "conclusion": "success",
+            "databaseId": 111992639205,
+            "name": "harness",
+            "startedAt": "2026-10-05T21:46:47Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T21:46:48Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T21:46:47Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:46:49Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T21:46:48Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:26Z",
+                "conclusion": "success",
+                "name": "Check Python qualification harness",
+                "number": 3,
+                "startedAt": "2026-10-05T21:46:49Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:27Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 6,
+                "startedAt": "2026-10-05T21:47:26Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:27Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 7,
+                "startedAt": "2026-10-05T21:47:27Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37378136899/job/111992639205"
+          },
+          {
+            "completedAt": "2026-10-05T22:10:29Z",
+            "conclusion": "failure",
+            "databaseId": 111992639458,
+            "name": "rust",
+            "startedAt": "2026-10-05T21:46:49Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T21:46:50Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T21:46:50Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:46:52Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T21:46:50Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:05Z",
+                "conclusion": "success",
+                "name": "Install tools",
+                "number": 3,
+                "startedAt": "2026-10-05T21:46:52Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:05Z",
+                "conclusion": "success",
+                "name": "Report tool versions",
+                "number": 4,
+                "startedAt": "2026-10-05T21:47:05Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:47:08Z",
+                "conclusion": "success",
+                "name": "Check formatting",
+                "number": 5,
+                "startedAt": "2026-10-05T21:47:05Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T21:49:10Z",
+                "conclusion": "success",
+                "name": "Check lints",
+                "number": 6,
+                "startedAt": "2026-10-05T21:47:08Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:10:27Z",
+                "conclusion": "failure",
+                "name": "Test",
+                "number": 7,
+                "startedAt": "2026-10-05T21:49:10Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:10:27Z",
+                "conclusion": "skipped",
+                "name": "Qualify Git compatibility against RustFS",
+                "number": 8,
+                "startedAt": "2026-10-05T22:10:27Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:10:27Z",
+                "conclusion": "skipped",
+                "name": "Build server",
+                "number": 9,
+                "startedAt": "2026-10-05T22:10:27Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:10:28Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 18,
+                "startedAt": "2026-10-05T22:10:27Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:10:28Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 19,
+                "startedAt": "2026-10-05T22:10:28Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37378136899/job/111992639458"
+          }
+        ],
+        "status": "completed"
+      },
+      "rust_log": {
+        "path": "/tmp/canopy-native-candidate-verification-parent-push-full.log",
+        "sha256": "725c4a8cba2e4e77e4a2297710c8da558f1b34c9a500256fcea820a889321f0b",
+        "summaries": []
+      }
+    }
+  ],
+  "changes": [
+    "PreparedCatalog.verify_candidate_commit reuses existing candidate model, closed physically verified native catalog, canonical headers, typed edges and shared native file custody. No SQL object/ancestry/ref mirror, schema, registry change, backward decoder or physical deletion is added.",
+    "Merge/squash exact parent order, author/committer, original reserved time, message and verified tree/source/base kind are matched using canonical Git OID, size and BLAKE3 body digest. No native pack/body download is needed for these strategies.",
+    "Rebase advances source and rewritten linear chains together; it reads one bounded original body at a time and verifies exact rewritten bytes from verified header/tree/parent metadata. Original author/encoding/message are preserved and obsolete signatures stripped. At most 128 commits are accepted.",
+    "A shared bounded, admitted disk ancestry queue checks all original targets with one base-history traversal; only final source anchor may already be reachable. Skipped commits and replayed base history are refused, without rebuilding authoritative SQL ancestry.",
+    "Three physically verified stock-Git families exercise both object formats: valid merge/squash with exact intent/actor/time/parent/kind/member/fence refusal and zero native downloads; valid rebase, skipped/tampered/extra-base history refusal and one shared pack download; 128-commit acceptance and 129 refusal. Existing 14 native merge cases remain passing."
+  ],
+  "qualification_limits": [
+    "This is semantic preparation, not generated Ready publication, a write capability or current editorial authorization. The public generated endpoint still calls retired ingestion; its failure remains open.",
+    "Tests construct a private closed catalog from real physical stock-Git pack witnesses with actual preparation capability. They do not qualify public candidate preparation/fetch/merge, generated producer cancellation, exact final command/recovery, initial-root production, lost acknowledgement, startup adoption or retirement.",
+    "Shared pack cache counts prove bounded native download reuse for these fixtures, not large-history selective fetch or real object-store byte throughput. At most 128 original bodies are read, but base ancestry traversal can still cover full base history on admitted disk. Acceleration, shared/selected workspaces and workload capacity remain required.",
+    "Fresh policy/access/actual owner/pin/current generation/input checkpoint and immutable UUID/audit selection must be verified by the forthcoming joint publisher. Existing 512-byte phase result cap must be preserved using a compact acknowledgement rather than CandidateOutcome with potentially large messages/conflict paths.",
+    "Remaining full CI, generated reviewed merge/squash/rebase, default-branch/thread writers, peer/backup recovery, selective fetch, physical retention/GC/final DDL, fair maintenance/accelerators, asynchronous file attribution and 10,000-engineer capacity remain incomplete.",
+    "macOS lib-test linker retains oversized __eh_frame compact-unwind warning. All-target Clippy, production build and Linux CI are independent checks."
+  ],
+  "parent_linux_discrepancy": {
+    "newly_observed_case": "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+    "observation": "Both parent 8230922 Linux jobs fail the delete push with HTTP500 and a directly adjacent logical-publication-already-admitted driver failure. Current macOS full run passes that family. Pending creating custody/inputs and final work share JobKind::Publication; reproduce the actual collision before changing guards. Not classified as a flake or attributed to this semantic increment.",
+    "logs": [
+      "/tmp/canopy-native-candidate-verification-parent-pr-full.log",
+      "/tmp/canopy-native-candidate-verification-parent-push-full.log"
+    ]
+  },
+  "next_executable_plan": "/tmp/canopy-native-generated-publisher-plan.md"
+}

From 7c232ea0d4d384c0ac2c5cf0dc401ce454e1a00f Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 15:42:56 -0700
Subject: [PATCH 45/55] fix: preserve live staging ownership during root
 recovery discovery

---
 .../packs/publication/recovery/supervisor.rs  |  48 ++-
 .../src/packs/publication/staging_service.rs  |  16 +
 .../tests/inputs/requests/results.rs          |  98 +++++++
 .../src/server/residency/recovery.rs          |   4 +-
 docs/contracts.md                             |  31 ++
 ...sident-recovery-discovery-ci-20261005.json | 274 ++++++++++++++++++
 .../large-repository-implementation-status.md |  54 ++++
 7 files changed, 520 insertions(+), 5 deletions(-)
 create mode 100644 docs/evidence/resident-recovery-discovery-ci-20261005.json

diff --git a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
index b54027d0..ea658006 100644
--- a/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/supervisor.rs
@@ -89,7 +89,7 @@ impl RecoverySupervisor {
             coordinator,
             settings,
             authority,
-            None,
+            (None, None),
         )
     }
     /// The service supplies current repository administration and actual owner
@@ -115,7 +115,34 @@ impl RecoverySupervisor {
             coordinator,
             settings,
             authority,
-            Some(maintenance),
+            (Some(maintenance), None),
+        )
+    }
+    /// Resident discovery shares the existing staging owner. A registered
+    /// recovery head can become visible before its live producer hands off the
+    /// final command; discovery must leave that exact workflow with its owner.
+    pub(crate) fn start_resident(
+        client: CellClient,
+        target: CellTarget,
+        store: ArtifactStore,
+        resident: (PublicationCoordinator, Arc<StagingCoordinator>),
+        settings: RecoveryScanSettings,
+        authority: PreparationAuthority,
+        maintenance: MaintenanceRequest,
+    ) -> Result<Self, RootRecoveryError> {
+        let (coordinator, staging) = resident;
+        if maintenance.repository != store.repository() || !staging.matches_target(&target) {
+            return Err(RootRecoveryError::Context);
+        }
+        maintenance.encode(&mut BoundedEncoder::new(4096)?)?;
+        Self::start_inner(
+            client,
+            target,
+            store,
+            coordinator,
+            settings,
+            authority,
+            (Some(maintenance), Some(staging)),
         )
     }
     fn start_inner(
@@ -125,8 +152,9 @@ impl RecoverySupervisor {
         coordinator: PublicationCoordinator,
         settings: RecoveryScanSettings,
         authority: PreparationAuthority,
-        maintenance: Option<MaintenanceRequest>,
+        ownership: (Option<MaintenanceRequest>, Option<Arc<StagingCoordinator>>),
     ) -> Result<Self, RootRecoveryError> {
+        let (maintenance, staging) = ownership;
         settings.validate()?;
         if !authority.matches(&target)
             || !coordinator.matches_target(&target)
@@ -146,6 +174,7 @@ impl RecoverySupervisor {
                 coordinator,
                 authority,
                 maintenance,
+                staging,
             },
             sql,
             settings.clone(),
@@ -234,6 +263,7 @@ struct Scan {
     coordinator: PublicationCoordinator,
     authority: PreparationAuthority,
     maintenance: Option<MaintenanceRequest>,
+    staging: Option<Arc<StagingCoordinator>>,
 }
 impl Scan {
     async fn visit(
@@ -268,6 +298,18 @@ impl Scan {
             }
             return Ok(());
         }
+        // Registration precedes the live lifecycle's held handoff. Its exact
+        // bound owner must retain that gap; cold discovery cannot execute the
+        // same command early, steal admission, or retire the producer's pin.
+        // Check the queue first so already admitted cold work still recovers.
+        if self
+            .staging
+            .as_ref()
+            .is_some_and(|staging| staging.owns_bound(&registered.record.check))
+        {
+            stats.deferred = stats.deferred.saturating_add(1);
+            return Ok(());
+        }
         // Settled heads must not consume new command slots every scan. Known
         // intermediate results remain pinned for the retained-input producer;
         // this worker cannot invent its next page/root or claim new custody.
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index f0663a5c..a2d52753 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -660,6 +660,22 @@ impl Drop for StagingQuiescence {
     }
 }
 impl StagingCoordinator {
+    /// Discovery may defer only to this exact bound attempt, including its
+    /// actor, owner epoch, admission sequence and artifact operation. A reused
+    /// logical UUID or an unrelated historical pin is insufficient.
+    pub(in crate::packs::publication) fn owns_bound(&self, check: &LeaseCheck) -> bool {
+        let Some(ticket) = self.pending(check.token.operation) else {
+            return false;
+        };
+        let local = ticket.job.local.lock().expect("staging local");
+        local
+            .bound
+            .as_ref()
+            .is_some_and(|session| session.check == *check)
+    }
+    pub(in crate::packs::publication) fn matches_target(&self, target: &CellTarget) -> bool {
+        self.inner.target == *target
+    }
     pub fn new(
         target: CellTarget,
         limits: StagingLimits,
diff --git a/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs b/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
index e572d0a1..103091a9 100644
--- a/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
+++ b/crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs
@@ -485,3 +485,101 @@ async fn root_outcome_exact_recovery_preserves_commits_and_refuses_expired_input
     }
     Ok(())
 }
+
+#[tokio::test]
+async fn resident_discovery_defers_registered_root_until_live_producer_handoff() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let request = Request::new(format, false, false, [249; 16]).await?;
+        let native = PushCompletionRequest {
+            plan: None,
+            response: GitHttpResponse {
+                status: 503,
+                headers: Vec::new(),
+                body: b"native refusal\n".to_vec(),
+            },
+            options: Vec::new(),
+            certificate: None,
+        };
+        retain(&request, native).await?;
+        request.ticket.seal()?;
+        assert!(matches!(
+            request.ticket.wait_terminal().await,
+            StagingState::Bound(_)
+        ));
+        let session = request.ticket.bound_session()?;
+        let ready = session
+            .ready_root_outcome(
+                identity()?,
+                &request.store,
+                request.directory.path(),
+                request.disk.clone(),
+                None,
+            )
+            .await?;
+        assert!(request.coordinator.owns_bound(&session.check));
+        let mut other = session.check.clone();
+        other.token.artifact_operation[0] ^= 1;
+        assert!(!request.coordinator.owns_bound(&other));
+        other = session.check.clone();
+        other.actor = "other".into();
+        assert!(!request.coordinator.owns_bound(&other));
+        other = session.check.clone();
+        other.token.attempt += 1;
+        assert!(!request.coordinator.owns_bound(&other));
+        let evidence = ready.evidence_for_test();
+        let registered = ready.persist_recovery(&request.store, identity()?).await?;
+        let ready = ready.bind_recovery(registered, &request.store)?;
+        let f = &request.fixture;
+        let queue = PublicationCoordinator::new(
+            f.target.clone(),
+            PublicationLimits::default(),
+            f.publication_budget.clone(),
+        )?;
+        let service = RecoverySupervisor::start_resident(
+            f.client(),
+            f.target.clone(),
+            (*request.store).clone(),
+            (queue.clone(), Arc::new(request.coordinator.clone())),
+            f.scans(RecoveryScanLimits {
+                page: 1,
+                interval: Duration::from_millis(10),
+            }),
+            f.authority(),
+            super::super::super::terminal_retention::maintenance(&f.handle, f.repository).await?,
+        )?;
+        // Keep the producer paused after durable registration. Two full scan
+        // passes must not execute its original command or steal admission.
+        timeout(Duration::from_secs(10), async {
+            while service.stats().passes < 2 {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await?;
+        let stats = service.stats();
+        assert_eq!(stats.failures, 0, "{stats:?}");
+        assert_eq!(
+            stats.submitted, 0,
+            "live producer lost ownership: {stats:?}"
+        );
+        assert!(stats.deferred > 0);
+        assert_eq!(queue.stats().await.admitted, 0);
+        assert!(matches!(
+            f.client().resolve(&evidence).await?,
+            cellule_runtime::Resolution::Absent
+        ));
+        let observer = request.ticket.publish_wait(&queue, ready).await?;
+        assert!(matches!(
+            observer.wait().await,
+            PublicationState::Finished(Ok(PublicationOutcome::RootPush(_)))
+        ));
+        assert!(matches!(
+            request.ticket.wait_terminal().await,
+            StagingState::Published(_)
+        ));
+        service.shutdown().await?;
+        assert!(queue.close_and_drain().await.is_empty());
+        assert!(request.coordinator.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/server/residency/recovery.rs b/crates/canopy-server/src/server/residency/recovery.rs
index 6ba2c5f8..036e972b 100644
--- a/crates/canopy-server/src/server/residency/recovery.rs
+++ b/crates/canopy-server/src/server/residency/recovery.rs
@@ -91,11 +91,11 @@ impl RecoveryServices {
             )
             .map_err(|error| ServerError::CatalogRecovery(Box::new(error)))?,
         );
-        let roots = match RecoverySupervisor::start_retiring(
+        let roots = match RecoverySupervisor::start_resident(
             client.clone(),
             target.clone(),
             ArtifactStore::new(Arc::clone(&manager.external_store), entry.repository_id),
-            coordinator.clone(),
+            (coordinator.clone(), staging.clone()),
             settings.clone(),
             authority.clone(),
             maintenance,
diff --git a/docs/contracts.md b/docs/contracts.md
index d66227b0..289acb41 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -2000,6 +2000,16 @@ the repository, actor, pull and exact request. A fresh SDK identity is never
 substituted for an uncertain original command. Ref-only Bind selects the current
 certified joint generation; an admitted bound worker owns catalog preparation
 and ancestry verification using the gateway's scratch, disk and native resources.
+
+Resident root recovery discovery shares the existing staging coordinator.
+A newly registered recovery head can precede the producer's held publication
+handoff; discovery must not execute or retire it while that exact bound attempt
+is still owned. After looking up already admitted cold work, the scanner checks
+the full bound `LeaseCheck` against the staging owner and defers a match. Logical
+UUID equality alone is insufficient. This creates no additional admission or
+SQL mirror. The original lifecycle retains live command recovery, and abandoned
+heads without a matching bound owner continue through the cold discovery path.
+
 The producer result is retrieved before Finishing, then `ReadyNativeMerge`
 registers and binds its original command into fair publication. HTTP timeout or
 observer cancellation leaves this resident-owned workflow and exact recovery
@@ -2406,6 +2416,27 @@ client requires the forthcoming joint generated publisher. There is no codec 2
 compatibility decoder. A SQL failure rolls back both the editorial write and
 SDK acceptance, allowing the original prepared command to retry unchanged.
 
+The private prepared native catalog now provides `verify_candidate_commit`.
+It checks the reserved actor, valid intent, repository object format and selected
+commit/tree/source/base membership. Merge and squash commits must match exact
+parent order, author/committer, reserved UTC second and message bytes. Both the
+Git OID and canonical BLAKE3 body digest must match the physically verified
+header; verifying these strategies requires no native body/pack download.
+
+For rebase, at most 128 original commit bodies are read through bounded shared
+native-pack custody. Each rewritten commit is verified by canonical headers and
+exact expected bytes, preserving original author, encoding and message while
+removing stale signatures and replacing tree, parent and committer. The source
+and rewritten chains advance together. One admitted, disk-backed traversal of
+base ancestry checks the bounded original set: only the final remaining source
+anchor may already be reachable from base. Skipping a source commit or replaying
+base history is refused. Original body reads reuse the native pack cache; new
+commit bodies do not require a second download or subprocess. The shared lease
+and timeout cover preparation. This verifier adds no publication authority,
+SDK command, schema or compatibility decoder: the forthcoming resident factory
+and final transaction must bind these facts to exact intent/ref publication and
+recheck fresh policy, access, owner, generation and custody.
+
 It retains the first timestamp. Retrying completed preparation returns the
 original result, even if the pull later changes or merges; current write access
 is still required for POST. GET requires current read access. For pending
diff --git a/docs/evidence/resident-recovery-discovery-ci-20261005.json b/docs/evidence/resident-recovery-discovery-ci-20261005.json
new file mode 100644
index 00000000..b8b2c0fc
--- /dev/null
+++ b/docs/evidence/resident-recovery-discovery-ci-20261005.json
@@ -0,0 +1,274 @@
+{
+  "recorded_at_utc": "2026-10-05T22:42:15.834260+00:00",
+  "base_head": "823092222fd043c2a0e3ce7deab8cdab40cd097c",
+  "host": "macOS, Rust 1.98.0; current-head Linux qualification required",
+  "release_qualified": false,
+  "source_files": 519,
+  "rust_files": 501,
+  "source_hash_digest": "923f13824b06e38897b342cbd837e716ba5771966efbe56b50b833b927605f45",
+  "source_manifest": "/tmp/canopy-resident-recovery-race-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "validation": {
+    "source_digest": "923f13824b06e38897b342cbd837e716ba5771966efbe56b50b833b927605f45",
+    "phases": [
+      {
+        "name": "focused",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "resident_discovery_defers_registered_root_until_live_producer_handoff",
+          "--locked",
+          "--",
+          "--nocapture"
+        ],
+        "exit_code": 0,
+        "seconds": 1.39,
+        "log": "/tmp/canopy-resident-recovery-race-final-focused-final.log",
+        "log_sha256": "9f57a1c5372fee91183e774492c577ba6d0e3e4c30ce870bb6ca14c14519ccb5",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 746 filtered out; finished in 0.43s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "discovery",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::tests::recovery_discovery::",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 2.23,
+        "log": "/tmp/canopy-resident-recovery-race-final-discovery-final.log",
+        "log_sha256": "ed024e9f2276f1a8edfcfac38ec19d54509cb2f8bbebee62a27c2fb58c74bc6b",
+        "summaries": [
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 745 filtered out; finished in 1.84s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "staged",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::tests::staging_service::publication::",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 3.43,
+        "log": "/tmp/canopy-resident-recovery-race-final-staged-final.log",
+        "log_sha256": "2b39b293a537301fb9fb536ce7f6dabdbd4cc785ec232979ead16f5b75a3fef9",
+        "summaries": [
+          "test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 737 filtered out; finished in 3.04s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "registry",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "packs::publication::registry::tests::production_registers_packed_and_policy_metadata_contracts",
+          "--locked",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 0.43,
+        "log": "/tmp/canopy-resident-recovery-race-final-registry-final.log",
+        "log_sha256": "36163c43a9d9d49855aaa365245f0989c5412865912f931f86f90f430e13a8f9",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 746 filtered out; finished in 0.07s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 40.67,
+        "log": "/tmp/canopy-resident-recovery-race-final-clippy-final.log",
+        "log_sha256": "1f2390b5b69a58446bab65b3c146a59cc5d75161ce06c5ad478670688fff4523",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "library",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--lib",
+          "--locked"
+        ],
+        "exit_code": 0,
+        "seconds": 357.74,
+        "log": "/tmp/canopy-resident-recovery-race-final-library-final.log",
+        "log_sha256": "cd0b306e13443439550a017d7b060ec820225369475a98f3e2af44be7cbc8062",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 746 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 746 filtered out; finished in 0.09s",
+          "test result: ok. 747 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 356.78s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "history",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--test",
+          "multi_server",
+          "comparison::history::historical_comparisons_survive_branch_deletion_and_recheck_current_access",
+          "--locked",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 64.53,
+        "log": "/tmp/canopy-resident-recovery-race-final-history-final.log",
+        "log_sha256": "1080f3b7b8a0486c4ec412fc5a6df1c7daae8d6e7b0fcd7c2fcf696161b0e7ef",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 8.76s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 41.99,
+        "log": "/tmp/canopy-resident-recovery-race-final-build-final.log",
+        "log_sha256": "2fb5ee3e0c93f986baf18411573eb6a8eb0ab49ad1d68f8032148b56d7e7a923",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.3,
+        "log": "/tmp/canopy-resident-recovery-race-final-fmt-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 42.08,
+        "log": "/tmp/canopy-resident-recovery-race-final-harness-final.log",
+        "log_sha256": "461ca7bc24683d2d817838e6659f3190da63952e09fee985385bce03f1ee6a6e",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.04,
+        "log": "/tmp/canopy-resident-recovery-race-final-diff-final.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "complete": true,
+    "release_qualified": false,
+    "source_unchanged": true
+  },
+  "failing_first": {
+    "reason": "Actual Cell root recovery discovery submits and retires a newly registered original while its live producer is paused before held handoff; submitted=1, release_submitted=1, expected no submission. The new resident constructor carried but did not consult staging ownership in this failing-first run.",
+    "path": "/tmp/canopy-resident-recovery-race-before.log",
+    "sha256": "627868a835cbeec9efa7cc60e8cda1f02193707c0ac343db35d6b84f14544443",
+    "summaries": [
+      "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 746 filtered out; finished in 0.23s"
+    ]
+  },
+  "first_fixed": {
+    "path": "/tmp/canopy-resident-recovery-race-after.log",
+    "sha256": "be6a9c0de778b148b815d1262d18d234e8901a68aefb2c485eabe94de550ad0a",
+    "summaries": [
+      "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 746 filtered out; finished in 0.65s"
+    ]
+  },
+  "causal_fix": "Production root discovery shares the existing staging coordinator. An already admitted cold ticket is checked first; otherwise only exact bound LeaseCheck ownership defers discovery. No duplicate guard, SDK identity, recovery journal or schema is weakened.",
+  "regression_scope": [
+    "Both SHA-1 and SHA-256; producer paused after actual durable registration; two complete discovery passes leave original SDK acceptance absent and queue admissions zero; the same registered command then publishes through its live staging owner.",
+    "Equal logical UUID with another artifact operation, actor or admission sequence cannot defer discovery. Existing cold recovery, uncertain command and held-publication tests retain their original assertions."
+  ],
+  "historical_full_workspace": "docs/evidence/native-candidate-verification-ci-20261005.json",
+  "historical_full_totals": {
+    "passed": 871,
+    "failed": 23,
+    "ignored": 9
+  },
+  "qualification_limits": [
+    "Focused current-source gates are not a full green workspace claim. The previous complete macOS inventory and its source digest remain historical evidence, not a run of this source.",
+    "Parent Linux PR/push jobs both fail the branch-deletion family with HTTP500/logical publication already admitted. Exact current-head Linux jobs and full release gates still required.",
+    "Generated candidate Ready/catalog/fetch-ref publication, generated reviewed merge, default-branch/thread writers, peer/backup recovery, selective fetch, complete retention/GC/final DDL, acceleration/fair maintenance, attribution and large-team load proof remain open.",
+    "No test was ignored or assertion weakened, and no Verify workflow was changed. Existing macOS oversized compact-unwind linker warning remains recorded."
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 1c6c1141..86a8cd57 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,60 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Resident recovery discovery race (2026-10-05 checkpoint)
+
+The two Linux Verify jobs on `8230922` add a branch-deletion failure with HTTP
+500 and `logical publication already admitted`. Restart discovery can observe a
+new recovery registration before the live producer reserves final publication.
+It can execute that original command and retire its pin during this gap.
+A deterministic failing-first actual Cell regression reproduces premature
+submission and retirement while the producer is paused after registration.
+
+Production residency now supplies the existing staging coordinator to root
+recovery discovery. After checking already admitted cold work, discovery defers
+only when that coordinator still owns the exact bound `LeaseCheck`: actor,
+request digest, operation, owner incarnation/epoch, admission sequence and artifact
+operation. This leaves the original producer in charge of handoff. The queue's
+original duplicate guard and cold exact-command recovery remain in place.
+Historical pins and reused logical UUIDs cannot satisfy the exact owner test.
+There is no additional command, SQL table or retry identity.
+
+The regression passes in SHA-1 and SHA-256 and verifies absent SDK acceptance,
+zero queue admissions and no scanner submission before producer handoff, then
+successful publication through the same registered command. Frozen current-source
+validation passes all 747 server library cases, the branch-deletion integration
+case, both recovery-discovery tests, all 10 staging-publication cases, registry,
+all-target Clippy, formatting, production build and all 96 Python harness tests.
+[Discovery evidence](evidence/resident-recovery-discovery-ci-20261005.json)
+records actual terminal logs and source digest
+`923f13824b06e38897b342cbd837e716ba5771966efbe56b50b833b927605f45`.
+The previous full diagnostic inventory is historical, not a run of this source.
+Exact new-head Linux qualification remains required. Full CI remains open; generated
+publication, metadata writers, selective-fetch and restoration failures are
+separate required work, not flakes or skipped tests.
+
+## Native generated commit semantic verification (2026-10-05 checkpoint)
+
+A private preparation verifier reuses the candidate model and physically verified
+catalog headers/edges. Merge and squash check the exact canonical Git OID, size
+and BLAKE3 body digest without native body downloads. Rebase checks up to 128
+original commits, exact rewritten parent order and bytes, author/message/encoding
+preservation and removal of stale signatures. One admitted disk ancestry walk
+rejects skipped source commits and replayed base history. The fixture accepts
+128 and refuses 129 commits in both Git formats, with shared pack-cache reuse.
+The verifier does not publish a Ready candidate or authorize a SQL write.
+
+Frozen semantic verification passed three new both-format families, 14 existing
+native merge cases, all 746 library cases, registry, Clippy, formatting, production
+build and all 96 Python harness tests. The full diagnostic inventory was 871
+passed, 23 failed and nine ignored; the failed-case set was unchanged from the
+preceding macOS checkpoint. Its historical source digest is
+`e06fe0f8168246e9e9bf731b16d720bb97ad49c4bebb627db10ffe5a84d1eb7a`.
+[Semantic evidence](evidence/native-candidate-verification-ci-20261005.json)
+retains the public candidate baseline (HTTP 503), intermediate failed runs,
+terminal log hashes and actual Linux failures. Generated joint publication,
+startup adoption, selective workspaces and workload capacity remain required.
+
 ## Native candidate reservation and negative completion (2026-10-05 checkpoint)
 
 Operation 10 codec 3 is now registered for native editorial candidate intent.

From 1ebb2786a3f15622d59a9b0d6420c1e7d0517e1b Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 16:57:43 -0700
Subject: [PATCH 46/55] fix: publish symbolic HEAD with native ref snapshots
 atomically

---
 crates/canopy-server/src/default_branch.rs    |  59 +-
 crates/canopy-server/src/git_gateway/head.rs  | 164 ++++
 crates/canopy-server/src/git_gateway/mod.rs   |   1 +
 crates/canopy-server/src/lib.rs               |   6 +
 .../src/packs/publication/coordinator.rs      |   2 +
 .../publication/coordinator/native_head.rs    |  71 ++
 .../src/packs/publication/coordinator/work.rs |   5 +
 .../src/packs/publication/mod.rs              |  12 +-
 .../src/packs/publication/native_head.rs      | 199 +++++
 .../packs/publication/native_head/publish.rs  | 264 ++++++
 .../src/packs/publication/native_merge.rs     |  30 +-
 .../packs/publication/native_merge/audit.rs   |  20 +-
 .../src/packs/publication/recovery/archive.rs |  60 ++
 .../src/packs/publication/recovery/codec.rs   |   4 +
 .../src/packs/publication/recovery/mod.rs     |  79 +-
 .../src/packs/publication/recovery/phase.rs   |   7 +-
 .../src/packs/publication/recovery/ready.rs   |   4 +
 .../src/packs/publication/registry.rs         |   6 +-
 .../publication/root_completion/publish.rs    |   4 +
 .../src/packs/publication/schema.sql          |  16 +
 .../src/packs/publication/tests.rs            |   1 +
 .../packs/publication/tests/native_head.rs    | 353 ++++++++
 .../packs/publication/tests/native_merge.rs   |  19 +-
 .../publication/tests/root_completion.rs      |  34 +
 .../src/repository_http/default_branch.rs     |  53 +-
 crates/canopy-server/src/server/discovery.rs  |   9 +-
 docs/contracts.md                             |  76 +-
 docs/evidence/native-head-ci-20261005.json    | 760 ++++++++++++++++++
 .../large-repository-implementation-status.md |  52 +-
 29 files changed, 2246 insertions(+), 124 deletions(-)
 create mode 100644 crates/canopy-server/src/git_gateway/head.rs
 create mode 100644 crates/canopy-server/src/packs/publication/coordinator/native_head.rs
 create mode 100644 crates/canopy-server/src/packs/publication/native_head.rs
 create mode 100644 crates/canopy-server/src/packs/publication/native_head/publish.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/native_head.rs
 create mode 100644 docs/evidence/native-head-ci-20261005.json

diff --git a/crates/canopy-server/src/default_branch.rs b/crates/canopy-server/src/default_branch.rs
index d3d1a731..6ed4a026 100644
--- a/crates/canopy-server/src/default_branch.rs
+++ b/crates/canopy-server/src/default_branch.rs
@@ -6,7 +6,7 @@ use cellule_runtime::{
     primitives::sql::SqlValue,
 };
 
-use crate::{RepositoryCell, directory::validate_component, refs::valid_ref_name};
+use crate::{ReadIdentity, RepositoryCell, directory::validate_component, refs::valid_ref_name};
 
 /// Repository symbolic HEAD and the ref generation required to change it.
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -39,13 +39,42 @@ impl RepositoryCell {
         })
     }
 
-    /// Changes HEAD only for the owner at the expected ref generation.
-    ///
-    /// The target must be a live branch, or there must be no live branches.
-    /// False means authorization, generation or target existence failed.
+    /// Reads the constant-size summary with current access in the same query.
+    /// Native publishers update this row atomically with the immutable snapshot;
+    /// metadata reads acquire no serving pin and publish no Cell root.
+    pub async fn default_branch_for(
+        &self,
+        actor: ReadIdentity<'_>,
+        minimum: Option<Receipt>,
+    ) -> Result<Observed<Option<DefaultBranch>>, InvocationError<Vec<SqlResultSet>>> {
+        actor.validate().map_err(InvocationError::NotStarted)?;
+        let result = self.sql.query(minimum, SqlBatch {
+            statements: vec![SqlStatement {
+                sql: format!("SELECT generation, default_branch FROM ref_generation WHERE singleton=1 AND ({}) AND EXISTS (SELECT 1 FROM catalog_state s JOIN catalog_generations g ON g.generation=s.generation WHERE s.singleton=1 AND g.refs IS NOT NULL)", crate::access::READ_ACCESS),
+                parameters: vec![actor.parameter()],
+            }],
+        }).await?;
+        let output = result
+            .output
+            .first()
+            .ok_or_else(|| {
+                InvocationError::NotStarted(Error::Command("missing HEAD query result"))
+            })?
+            .rows
+            .first()
+            .map(|row| decode_head(row))
+            .transpose()
+            .map_err(InvocationError::NotStarted)?;
+        Ok(Observed {
+            output,
+            receipt: result.receipt,
+        })
+    }
+
+    /// Retired SQL writer: HEAD changes require resident native publication.
     pub async fn set_default_branch(
         &self,
-        identity: MutationIdentity,
+        _identity: MutationIdentity,
         actor: &str,
         expected_generation: i64,
         reference: &str,
@@ -56,21 +85,9 @@ impl RepositoryCell {
                 "invalid default branch update",
             )));
         }
-        // HEAD and the pagination fence change in the same owner-authorized
-        // statement. A concurrent push or HEAD ABA makes a stale update fail.
-        let result = self.sql.batch(identity, SqlBatch {
-            statements: vec![SqlStatement {
-                sql: "UPDATE ref_generation SET default_branch = ?1, generation = generation + 1 WHERE singleton = 1 AND generation = ?2 AND EXISTS (SELECT 1 FROM repository_identity WHERE owner = ?3) AND (EXISTS (SELECT 1 FROM refs WHERE name = ?1 AND oid IS NOT NULL) OR NOT EXISTS (SELECT 1 FROM refs WHERE name GLOB 'refs/heads/*' AND oid IS NOT NULL))".into(),
-                parameters: vec![SqlValue::Text(reference.into()), SqlValue::Integer(expected_generation), SqlValue::Text(actor.into())],
-            }],
-        }).await?;
-        Ok(Committed {
-            output: result
-                .output
-                .first()
-                .is_some_and(|set| set.rows_affected == 1),
-            receipt: result.receipt,
-        })
+        Err(InvocationError::NotStarted(Error::Command(
+            "default branch changes require resident native publication",
+        )))
     }
 }
 
diff --git a/crates/canopy-server/src/git_gateway/head.rs b/crates/canopy-server/src/git_gateway/head.rs
new file mode 100644
index 00000000..30af755d
--- /dev/null
+++ b/crates/canopy-server/src/git_gateway/head.rs
@@ -0,0 +1,164 @@
+//! Symbolic HEAD changes use the same resident-owned staging and exact publication
+//! lifecycle as pushes. HTTP observers own no producer or recovery command.
+use super::push::native::{active, bound, final_publication};
+use super::*;
+use crate::{
+    packs::publication::{HeadRequest, PublicationReply},
+    packs::{
+        catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes},
+        metadata::MetadataLimits,
+        publication::{
+            BeginRequest, CatalogPreparation, DEFAULT_LEASE_MS, PublicationCoordinator,
+            PublicationError, PublicationOutcome, StagingCoordinator, StagingError, StagingState,
+            StagingTicket,
+        },
+    },
+};
+use cellule_runtime::{
+    InvocationError,
+    codec::{BoundedEncoder, WireValue},
+};
+
+fn work(error: impl StdError + Send + Sync + 'static) -> StagingError {
+    StagingError::Input(Box::new(error))
+}
+fn failed(error: impl StdError + Send + Sync + 'static) -> GatewayError {
+    GatewayError::Cell(Box::new(error))
+}
+
+impl GitGateway {
+    /// Every request owns one exact attempt through resident staging.
+    /// The final transaction rechecks ownership and the joint generation.
+    pub async fn set_default_branch(
+        &self,
+        identity: MutationIdentity,
+        actor: &str,
+        request: HeadRequest,
+    ) -> Result<PublicationReply, GatewayError> {
+        if crate::directory::validate_component(actor).is_err() {
+            return Err(failed(cellule_runtime::Error::Command(
+                "invalid HEAD actor",
+            )));
+        }
+        let mut encoded =
+            BoundedEncoder::new(crate::packs::publication::NATIVE_HEAD_BYTES).map_err(failed)?;
+        request.encode(&mut encoded).map_err(failed)?;
+        let mut digest = blake3::Hasher::new();
+        digest.update(b"canopy.symbolic-head-workflow.v1\0");
+        digest.update(&self.repository.repository_id());
+        digest.update(actor.as_bytes());
+        digest.update(&[0]);
+        digest.update(&encoded.finish());
+        let staging = self.repository.staging_coordinator().map_err(failed)?;
+        let ready = staging
+            .ready_request(
+                BeginRequest {
+                    repository: self.repository.repository_id(),
+                    operation: uuid::Uuid::new_v4().into_bytes(),
+                    request_digest: *digest.finalize().as_bytes(),
+                    actor: actor.into(),
+                    lease_ms: DEFAULT_LEASE_MS,
+                },
+                new_identity()?,
+            )
+            .await
+            .map_err(failed)?;
+        let ticket = staging.submit(ready).map_err(|(error, _)| failed(error))?;
+        let gateway = self.clone();
+        let owner = staging.clone();
+        ticket
+            .drive(move |ticket, publication| async move {
+                Box::pin(gateway.drive_head(owner, ticket, publication, identity, request)).await
+            })
+            .map_err(failed)?;
+        match ticket.wait_completion().await {
+            StagingState::Published(Ok(PublicationOutcome::Head(value))) => Ok(value.output),
+            StagingState::Published(Err(error)) => match error.as_ref() {
+                PublicationError::Head(InvocationError::Rejected(value)) => Ok(value.output),
+                _ => Err(failed(error)),
+            },
+            StagingState::Uncertain(error) | StagingState::Fenced(error) => Err(failed(error)),
+            _ => Err(failed(StagingError::NotReady)),
+        }
+    }
+
+    async fn drive_head(
+        &self,
+        staging: Arc<StagingCoordinator>,
+        ticket: StagingTicket,
+        publication: PublicationCoordinator,
+        identity: MutationIdentity,
+        request: HeadRequest,
+    ) -> Result<(), StagingError> {
+        active(&staging, &ticket).await?;
+        // Ref-only work has no incoming physical inputs. Bind selects the
+        // current certified joint generation after all staged work drains.
+        ticket.seal()?;
+        bound(&staging, &ticket).await?;
+        let format = self.repository.object_format();
+        let indexes = Arc::new(CatalogIndexes::new(self.artifacts.clone(), format));
+        let files = Arc::new(
+            CatalogFiles::new(
+                &self.scratch_root,
+                self.disk_budget.clone(),
+                self.artifacts.clone(),
+                format,
+                CatalogFileLimits::default(),
+            )
+            .map_err(work)?
+            .with_native(self.native.clone()),
+        );
+        let base = Arc::new(ticket.open_base(indexes, files).await?);
+        let gateway = self.clone();
+        let ready = ticket
+            .spawn_bound(move |_, context| async move {
+                let prepared = Arc::new(
+                    CatalogPreparation::new_staged(
+                        &context,
+                        &gateway.scratch_root,
+                        gateway.disk_budget.clone(),
+                        base,
+                        MetadataLimits::default(),
+                    )
+                    .await
+                    .map_err(work)?
+                    .finish()
+                    .await
+                    .map_err(work)?,
+                );
+                prepared
+                    .ready_native_head(identity, request)
+                    .await
+                    .map_err(work)
+            })?
+            .wait()
+            .await
+            .map_err(work)?;
+        let registered = ready
+            .persist_recovery(&self.artifacts, new_identity().map_err(work)?)
+            .await
+            .map_err(work)?;
+        let ready = ready
+            .bind_recovery(registered, &self.artifacts)
+            .map_err(work)?;
+        // Retrieve the producer result before Finishing so it cannot wait for
+        // its own worker drain. The lifecycle captures the exact ready owner.
+        let observer = ticket
+            .publish_wait(&publication, ready)
+            .await
+            .map_err(work)?;
+        match final_publication(&staging, &ticket, &observer).await {
+            Ok(PublicationOutcome::Head(_)) => Ok(()),
+            Err(StagingError::Publication(error))
+                if matches!(
+                    error.as_ref(),
+                    PublicationError::Head(InvocationError::Rejected(_))
+                ) =>
+            {
+                Ok(())
+            }
+            Err(error) => Err(error),
+            _ => Err(StagingError::Context),
+        }
+    }
+}
diff --git a/crates/canopy-server/src/git_gateway/mod.rs b/crates/canopy-server/src/git_gateway/mod.rs
index 527f8c7c..3f4d1c51 100644
--- a/crates/canopy-server/src/git_gateway/mod.rs
+++ b/crates/canopy-server/src/git_gateway/mod.rs
@@ -34,6 +34,7 @@ mod branch_policy;
 mod candidates;
 mod discovery;
 mod fetch;
+mod head;
 mod merge;
 pub mod preflight;
 mod push;
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 703be03f..a7edd2d0 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -209,6 +209,7 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("native_git/process/fence.rs"));
                 source.update(include_bytes!("git_gateway/mod.rs"));
                 source.update(include_bytes!("git_gateway/merge.rs"));
+                source.update(include_bytes!("git_gateway/head.rs"));
                 source.update(include_bytes!("git_gateway/candidates/mod.rs"));
                 source.update(include_bytes!("git_gateway/fetch.rs"));
                 source.update(include_bytes!("git_gateway/discovery.rs"));
@@ -273,6 +274,11 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/ref_snapshot.rs"));
                 source.update(include_bytes!("packs/publication/native_candidate.rs"));
                 source.update(include_bytes!("packs/publication/native_merge.rs"));
+                source.update(include_bytes!("packs/publication/native_head.rs"));
+                source.update(include_bytes!("packs/publication/native_head/publish.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/coordinator/native_head.rs"
+                ));
                 source.update(include_bytes!("packs/publication/native_merge/audit.rs"));
                 source.update(include_bytes!(
                     "packs/publication/coordinator/native_merge.rs"
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index 666554d2..fd650ac7 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -23,6 +23,8 @@ use tokio::{
 const COMMAND_RESERVATION: u64 = 8 << 20;
 const INLINE_BYTES: u32 = 4 << 20;
 mod initialization;
+mod native_head;
+pub use native_head::ReadyNativeHead;
 mod native_merge;
 pub use native_merge::ReadyNativeMerge;
 mod inputs;
diff --git a/crates/canopy-server/src/packs/publication/coordinator/native_head.rs b/crates/canopy-server/src/packs/publication/coordinator/native_head.rs
new file mode 100644
index 00000000..26b97587
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/coordinator/native_head.rs
@@ -0,0 +1,71 @@
+//! Symbolic HEAD changes share the original private owner and exact registered dispatch.
+use super::*;
+use canopy_object_storage::artifact::ArtifactStore;
+
+#[must_use]
+pub struct ReadyNativeHead {
+    owner: Arc<PreparedCatalog>,
+    command: PreparedCommand<PublishNativeHead>,
+}
+impl PreparedCatalog {
+    pub async fn ready_native_head(
+        self: &Arc<Self>,
+        identity: MutationIdentity,
+        request: HeadRequest,
+    ) -> Result<ReadyNativeHead, NativeHeadPreparationError> {
+        let proof = self.native_head_proof(request).await?;
+        self.ensure_live()?;
+        let (client, target, _) = self.base.capability();
+        let command = client
+            .prepare_command::<PublishNativeHead>(target, identity, proof)
+            .await
+            .map_err(|e| NativeHeadPreparationError::Command(Box::new(e)))?;
+        self.ensure_live()?;
+        Ok(ReadyNativeHead {
+            owner: self.clone(),
+            command,
+        })
+    }
+}
+impl ReadyNativeHead {
+    pub async fn persist_recovery(
+        &self,
+        store: &ArtifactStore,
+        identity: MutationIdentity,
+    ) -> Result<RegisteredRootRecovery, RootRecoveryError> {
+        super::super::recovery::persist(
+            &self.owner.base.session,
+            &self.command,
+            super::super::recovery::Kind::Head,
+            store,
+            identity,
+            0,
+        )
+        .await
+    }
+    pub fn bind_recovery(
+        self,
+        registered: RegisteredRootRecovery,
+        store: &ArtifactStore,
+    ) -> Result<ReadyBoundRecovery, Box<RecoveryBindingFailure<Self>>> {
+        if !registered.matches_original(
+            super::super::recovery::Kind::Head,
+            self.command.evidence(),
+            None,
+            &self.owner.base.session,
+            store,
+        ) {
+            return Err(Box::new(RecoveryBindingFailure {
+                original: self,
+                registered,
+            }));
+        }
+        Ok(ReadyBoundRecovery::new(
+            PushPreparation::Catalog(self.owner),
+            None,
+            false,
+            registered,
+            store,
+        ))
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index e6ac2c30..79f060ef 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -335,6 +335,7 @@ impl ReadyPublication {
 
 #[derive(Clone, Debug)]
 pub enum PublicationOutcome {
+    Head(Committed<PublicationReply>),
     Merge(Committed<crate::pulls::merge::MergeOutcome>),
     ServingRelease(Committed<ServingReleaseReply>),
     ServingCommand(Committed<ServingReply>),
@@ -351,6 +352,8 @@ pub enum PublicationOutcome {
 }
 #[derive(Debug, thiserror::Error)]
 pub enum PublicationError {
+    #[error("symbolic HEAD publication: {0}")]
+    Head(#[source] InvocationError<PublicationReply>),
     #[error("native reviewed merge publication: {0}")]
     Merge(#[source] InvocationError<crate::pulls::merge::MergeOutcome>),
     #[error("serving pin release: {0}")]
@@ -405,6 +408,7 @@ impl PublicationError {
             Self::ServingCommand(error) => kind(error),
             Self::Initialization(error) => kind(error),
             Self::Merge(error) => kind(error),
+            Self::Head(error) => kind(error),
             Self::Push(error) => kind(error),
             Self::RootPush(error) => kind(error),
             Self::PolicyPage(error) => kind(error),
@@ -429,6 +433,7 @@ impl PublicationError {
             Self::ServingCommand(error) => unknown(error),
             Self::Initialization(error) => unknown(error),
             Self::Merge(error) => unknown(error),
+            Self::Head(error) => unknown(error),
             Self::Push(error) => unknown(error),
             Self::RootPush(error) => unknown(error),
             Self::PolicyPage(error) => unknown(error),
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 70280d49..967344f4 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -55,6 +55,10 @@ pub use initialization::{
 };
 mod ref_snapshot;
 pub use ref_snapshot::{PreparedRefSnapshot, RefSnapshotPreparationError};
+mod native_head;
+pub use native_head::{
+    HeadRequest, NATIVE_HEAD_BYTES, NativeHeadPreparationError, NativeHeadProof, PublishNativeHead,
+};
 mod native_candidate;
 pub use native_candidate::NativeCandidateVerificationError;
 mod native_merge;
@@ -88,9 +92,10 @@ pub use coordinator::{
     PublicationClass, PublicationCoordinator, PublicationError, PublicationLimits,
     PublicationOutcome, PublicationScheduleError, PublicationState, PublicationStats,
     PublicationTicket, ReadyBoundRecovery, ReadyCatalogCompaction, ReadyCatalogPush,
-    ReadyInitialization, ReadyNativeInputs, ReadyNativeMerge, ReadyPreparation, ReadyPublication,
-    ReadyRefPolicyPage, ReadyRootPush, RecoveryBindingFailure, RefPolicyReadyError,
-    RefPolicyRefusalFailure, RegisteredNativeInputs, RootPushReadyError, ServingDrainAdmission,
+    ReadyInitialization, ReadyNativeHead, ReadyNativeInputs, ReadyNativeMerge, ReadyPreparation,
+    ReadyPublication, ReadyRefPolicyPage, ReadyRootPush, RecoveryBindingFailure,
+    RefPolicyReadyError, RefPolicyRefusalFailure, RegisteredNativeInputs, RootPushReadyError,
+    ServingDrainAdmission,
 };
 pub use scan::{RecoveryScanBudget, RecoveryScanSettings};
 mod commands;
@@ -259,6 +264,7 @@ pub struct MaintenanceRequest {
 /// are deliberately excluded; qualification binds its historical fixtures itself.
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_command::<PublishReviewedMerge>()?;
+    registry.bind_command::<PublishNativeHead>()?;
     registry.bind_command::<crate::branch_rules::command::SetBranchRule>()?;
     registry.bind_command::<crate::checks::native::StartCommitCheck>()?;
     registry.bind_query::<crate::checks::native::ReadCommitChecks>()?;
diff --git a/crates/canopy-server/src/packs/publication/native_head.rs b/crates/canopy-server/src/packs/publication/native_head.rs
new file mode 100644
index 00000000..c0a3cced
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/native_head.rs
@@ -0,0 +1,199 @@
+//! Symbolic HEAD changes share the certified ref tree and joint publication CAS.
+//! Only the held preparation can certify branch existence or an unborn target.
+use super::*;
+use crate::packs::ref_state::{RefNameKey, RefStateIndex, RefStateSnapshot};
+use cellule_runtime::InvocationError;
+use std::sync::Arc;
+use tokio::time::timeout_at;
+
+pub(in crate::packs::publication) mod publish;
+pub use publish::PublishNativeHead;
+pub const NATIVE_HEAD_BYTES: u32 = 128 << 10;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct HeadRequest {
+    pub reference: String,
+    pub expected_generation: i64,
+}
+impl WireValue for HeadRequest {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.reference.len() > crate::packs::ref_state::MAX_NAME_BYTES
+            || !crate::default_branch::valid_default_branch(&self.reference)
+            || !(0..i64::MAX).contains(&self.expected_generation)
+        {
+            return Err(CodecError::Invalid("invalid symbolic HEAD request"));
+        }
+        e.write_text(&self.reference)?;
+        e.write_i64(self.expected_generation)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            reference: d.read_text()?.into(),
+            expected_generation: d.read_i64()?,
+        };
+        value.encode(&mut BoundedEncoder::new(NATIVE_HEAD_BYTES)?)?;
+        Ok(value)
+    }
+}
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct NativeHeadProof {
+    pub certificate: CatalogCertificate,
+    pub request: HeadRequest,
+    /// None is a certified refusal, never an empty-ref fallback.
+    pub refs: Option<RefStateSnapshotRoot>,
+}
+impl NativeHeadProof {
+    fn binding(&self) -> Result<[u8; 32], CodecError> {
+        Self::payload_binding(&self.request, &self.refs)
+    }
+    fn payload_binding(
+        request: &HeadRequest,
+        refs: &Option<RefStateSnapshotRoot>,
+    ) -> Result<[u8; 32], CodecError> {
+        let mut e = BoundedEncoder::new(NATIVE_HEAD_BYTES)?;
+        request.encode(&mut e)?;
+        refs.encode(&mut e)?;
+        let mut h = blake3::Hasher::new();
+        h.update(b"canopy.symbolic-head-publication.v1\0");
+        h.update(&e.finish());
+        Ok(*h.finalize().as_bytes())
+    }
+    fn shape(&self) -> Result<(), CodecError> {
+        let data = self.certificate.data()?;
+        self.request
+            .encode(&mut BoundedEncoder::new(NATIVE_HEAD_BYTES)?)?;
+        if data.compaction
+            || data.base.refs.is_none()
+            || data.object_count != 0
+            || data.edge_count != 0
+            || data.input_count != 0
+            || data.input_checkpoint_digest.is_some()
+            || data.completion_digest.is_some()
+            || data.refs_digest != Some(self.binding()?)
+            || self
+                .refs
+                .is_some_and(|r| r.operation() != data.token.artifact_operation)
+        {
+            return Err(CodecError::Invalid("invalid symbolic HEAD proof"));
+        }
+        Ok(())
+    }
+}
+impl WireValue for NativeHeadProof {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.shape()?;
+        self.certificate.encode(e)?;
+        self.request.encode(e)?;
+        self.refs.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            certificate: CatalogCertificate::decode(d)?,
+            request: HeadRequest::decode(d)?,
+            refs: Option::decode(d)?,
+        };
+        value.shape()?;
+        Ok(value)
+    }
+}
+#[derive(Debug, thiserror::Error)]
+pub enum NativeHeadPreparationError {
+    #[error("symbolic HEAD preparation is inactive")]
+    Base(#[from] PreparationBaseError),
+    #[error("symbolic HEAD snapshot failed")]
+    Snapshot(#[from] crate::packs::ref_state::RefSnapshotError),
+    #[error("symbolic HEAD ref lookup failed")]
+    Refs(#[from] crate::packs::ref_state::RefStateError),
+    #[error("symbolic HEAD range lookup failed")]
+    Index(#[from] crate::packs::directory::index::IndexError),
+    #[error("symbolic HEAD encoding failed")]
+    Codec(#[from] CodecError),
+    #[error("symbolic HEAD certificate failed")]
+    Certificate(#[from] CatalogAttestationError),
+    #[error("symbolic HEAD command preparation failed")]
+    Command(#[source] Box<InvocationError<PublicationReply>>),
+    #[error("symbolic HEAD preparation context differs")]
+    Context,
+}
+impl PreparedCatalog {
+    pub async fn native_head_proof(
+        &self,
+        request: HeadRequest,
+    ) -> Result<NativeHeadProof, NativeHeadPreparationError> {
+        request.encode(&mut BoundedEncoder::new(NATIVE_HEAD_BYTES)?)?;
+        let (_, deadline) = self.base.live_lease()?;
+        timeout_at(deadline, async {
+            if self.object_count() != 0
+                || self.edge_count() != 0
+                || self.input_count() != 0
+                || self.input_checkpoint_digest.is_some()
+            {
+                return Err(NativeHeadPreparationError::Context);
+            }
+            let base = self.base();
+            let store = self.base.indexes().store();
+            let old = base
+                .refs
+                .ok_or(NativeHeadPreparationError::Context)?
+                .read(&store)
+                .await?;
+            if old.repository != self.token().repository
+                || old.format != self.catalog().format
+                || old.generation > base.generation
+                || old.generation >= i64::MAX as u64
+            {
+                return Err(NativeHeadPreparationError::Context);
+            }
+            let mut refs = None;
+            if old.generation == request.expected_generation as u64 {
+                let index = RefStateIndex::new(Arc::clone(&store), old.format);
+                let target = index.read(old.root.clone(), &request.reference).await?;
+                let live_target = target.is_some_and(|r| r.oid.is_some());
+                // The live cursor skips entire tombstoned subtrees. One seek and
+                // one live record suffice; no scan proportional to repo history.
+                let mut branches = index.cursor(
+                    old.root.clone(),
+                    Some(RefNameKey::new("refs/heads/")?),
+                    true,
+                )?;
+                let has_branches = branches
+                    .next()
+                    .await?
+                    .is_some_and(|r| r.name().starts_with("refs/heads/"));
+                if live_target || !has_branches {
+                    self.ensure_live()?;
+                    refs = Some(
+                        RefStateSnapshotRoot::upload(
+                            &store,
+                            self.token().artifact_operation,
+                            RefStateSnapshot {
+                                repository: old.repository,
+                                format: old.format,
+                                generation: old.generation + 1,
+                                default_branch: request.reference.clone(),
+                                root: old.root,
+                            },
+                        )
+                        .await?,
+                    );
+                }
+            }
+            let certificate = self
+                .issue_certificate(
+                    Some(NativeHeadProof::payload_binding(&request, &refs)?),
+                    None,
+                )
+                .await?;
+            let proof = NativeHeadProof {
+                certificate,
+                request,
+                refs,
+            };
+            proof.shape()?;
+            self.ensure_live()?;
+            Ok(proof)
+        })
+        .await
+        .map_err(|_| PreparationBaseError::Inactive)?
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/native_head/publish.rs b/crates/canopy-server/src/packs/publication/native_head/publish.rs
new file mode 100644
index 00000000..d6059c07
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/native_head/publish.rs
@@ -0,0 +1,264 @@
+use super::*;
+use crate::packs::publication::{
+    commands::{authorized, check_pin, fact, load, matched},
+    publish::{authenticate, changed, checkpoint, retention_matches},
+    sql::*,
+};
+
+pub(in crate::packs::publication) const SAVED: &str =
+    "SELECT actor,request_digest,request,result,fact FROM catalog_head_updates WHERE id=?1";
+fn denied(reason: PreparationDenial) -> CommandResult<PublicationReply> {
+    CommandResult::Rejected(PublicationReply::Denied(reason))
+}
+pub(in crate::packs::publication) fn selected(
+    sets: &[SqlResultSet],
+    check: &LeaseCheck,
+    reply: PublicationReply,
+) -> cellule_runtime::Result<Option<(HeadRequest, GenerationFact)>> {
+    let Some(
+        [
+            SqlValue::Text(actor),
+            digest,
+            SqlValue::Blob(request),
+            SqlValue::Blob(result),
+            SqlValue::Blob(fact),
+        ],
+    ) = rows(sets)?.first().map(Vec::as_slice)
+    else {
+        if rows(sets)?.is_empty() {
+            return Ok(None);
+        }
+        return Err(Error::Command("invalid symbolic HEAD outcome"));
+    };
+    if *actor != check.actor || fixed::<32>(digest)? != check.token.request_digest {
+        return Ok(None);
+    }
+    let mut d = BoundedDecoder::new(result, 512)?;
+    let saved = PublicationReply::decode(&mut d)?;
+    d.finish()?;
+    if saved != reply {
+        return Ok(None);
+    }
+    let PublicationReply::Published(published) = reply else {
+        return Ok(None);
+    };
+    let mut d = BoundedDecoder::new(request, NATIVE_HEAD_BYTES)?;
+    let request = HeadRequest::decode(&mut d)?;
+    d.finish()?;
+    let mut d = BoundedDecoder::new(fact, 512)?;
+    let fact = GenerationFact::decode(&mut d)?;
+    d.finish()?;
+    if fact
+        .catalog
+        .is_none_or(|c| c.repository != check.token.repository)
+        || fact.refs.is_none()
+        || fact.generation != published.generation
+        || fact.certificate != Some(published.certificate_digest)
+        || published.ref_generation != request.expected_generation as u64 + 1
+    {
+        return Err(Error::Command("symbolic HEAD outcome roots differ"));
+    }
+    Ok(Some((request, fact)))
+}
+
+pub struct PublishNativeHead;
+impl Command for PublishNativeHead {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 54;
+    const CODEC_VERSION: u32 = 1;
+    type Input = NativeHeadProof;
+    type Output = PublicationReply;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        let data = input.certificate.data()?;
+        let check = LeaseCheck {
+            token: data.token,
+            actor: data.actor,
+        };
+        recovery::execute(context, &check, recovery::Kind::Head, |context| {
+            publish(context, input)
+        })
+    }
+}
+fn publish(
+    context: &mut CommandContext<'_, '_>,
+    proof: NativeHeadProof,
+) -> cellule_runtime::Result<CommandResult<PublicationReply>> {
+    proof.shape()?;
+    let Some((data, key)) =
+        authenticate(context, &proof.certificate, Some(proof.binding()?), None)?
+    else {
+        return Ok(denied(PreparationDenial::Unauthorized));
+    };
+    let check = LeaseCheck {
+        token: data.token,
+        actor: data.actor.clone(),
+    };
+    let result = publish_authenticated(context, proof, data, key)?;
+    // Authenticated denial is terminal only for this original bound attempt.
+    if check.token.owner == context.owner_fence()
+        && let Some(row) = load(context, check.token)?
+        && matched(&row, &check)
+    {
+        check_pin(context, &row)?;
+        changed(context.sql(&statement(
+            "DELETE FROM catalog_operations WHERE id=?1",
+            vec![blob(check.token.operation)],
+        ))?)?;
+    }
+    Ok(result)
+}
+fn publish_authenticated(
+    context: &mut CommandContext<'_, '_>,
+    proof: NativeHeadProof,
+    data: super::super::certificate::CertificateData,
+    key: [u8; 32],
+) -> cellule_runtime::Result<CommandResult<PublicationReply>> {
+    if authorized(
+        context,
+        data.token.repository,
+        &data.actor,
+        TokenScope::Admin,
+    )? != Some(data.catalog.format)
+    {
+        return Ok(denied(PreparationDenial::Unauthorized));
+    }
+    let owner = context.sql(&statement(
+        "SELECT 1 FROM repository_identity WHERE singleton=1 AND owner=?1",
+        vec![SqlValue::Text(data.actor.clone())],
+    ))?;
+    if rows(&owner)?.is_empty() {
+        return Ok(denied(PreparationDenial::Unauthorized));
+    }
+    let prior = context.sql(&statement(SAVED, vec![blob(data.token.operation)]))?;
+    if let Some([_, _, SqlValue::Blob(request), SqlValue::Blob(result), _]) =
+        rows(&prior)?.first().map(Vec::as_slice)
+    {
+        let mut e = BoundedEncoder::new(NATIVE_HEAD_BYTES)?;
+        proof.request.encode(&mut e)?;
+        if *request != e.finish() {
+            return Ok(denied(PreparationDenial::Conflict));
+        }
+        let mut d = BoundedDecoder::new(result, 512)?;
+        let reply = PublicationReply::decode(&mut d)?;
+        d.finish()?;
+        if selected(
+            &prior,
+            &LeaseCheck {
+                token: data.token,
+                actor: data.actor,
+            },
+            reply,
+        )?
+        .is_none()
+        {
+            return Ok(denied(PreparationDenial::Conflict));
+        }
+        return Ok(CommandResult::Success(reply));
+    }
+    if data.token.owner != context.owner_fence() {
+        return Ok(denied(PreparationDenial::Stale));
+    }
+    let Some(row) = load(context, data.token)? else {
+        return Ok(denied(PreparationDenial::Missing));
+    };
+    if !matched(
+        &row,
+        &LeaseCheck {
+            token: data.token,
+            actor: data.actor.clone(),
+        },
+    ) {
+        return Ok(denied(PreparationDenial::Stale));
+    }
+    if row.expires <= now(context.now_ms())? {
+        return Ok(denied(PreparationDenial::Expired));
+    }
+    check_pin(context, &row)?;
+    if !retention_matches(context, &data, row.generation, data.catalog.format)?
+        || fact(context, data.token.repository, data.catalog.format, None)? != data.base
+    {
+        return Ok(denied(PreparationDenial::Conflict));
+    }
+    let Some(refs) = proof.refs else {
+        return Ok(denied(PreparationDenial::Conflict));
+    };
+    let count = context.sql(&statement(
+        "SELECT count(*) FROM (SELECT generation FROM catalog_generations LIMIT ?1)",
+        vec![number(MAX_RETAINED_GENERATIONS)?],
+    ))?;
+    let Some([count]) = rows(&count)?.first().map(Vec::as_slice) else {
+        return Err(Error::Command("missing symbolic HEAD generation count"));
+    };
+    if unsigned(count)? >= MAX_RETAINED_GENERATIONS {
+        return Ok(denied(PreparationDenial::Capacity));
+    }
+    let Some(missing) = checkpoint(context, &data, &key)? else {
+        return Ok(denied(PreparationDenial::Conflict));
+    };
+    let bytes = proof.certificate.bytes()?;
+    let digest = *blake3::hash(&bytes).as_bytes();
+    let generation = data
+        .base
+        .generation
+        .checked_add(1)
+        .filter(|g| *g <= i64::MAX as u64)
+        .ok_or(Error::Command("symbolic HEAD generation exhausted"))?;
+    let reply = PublicationReply::Published(PublishedRefs {
+        generation,
+        ref_generation: proof.request.expected_generation as u64 + 1,
+        certificate_digest: digest,
+    });
+    let fact = GenerationFact {
+        generation,
+        catalog: Some(data.catalog),
+        refs: Some(refs),
+        certificate: Some(digest),
+    };
+    let mut catalog = BoundedEncoder::new(256)?;
+    data.catalog.encode(&mut catalog)?;
+    // Store the descriptor itself, rather than Option framing, in joint roots.
+    let mut refs_root = BoundedEncoder::new(128)?;
+    fact.refs
+        .ok_or(Error::Command("symbolic HEAD root missing"))?
+        .encode(&mut refs_root)?;
+    let mut request = BoundedEncoder::new(NATIVE_HEAD_BYTES)?;
+    proof.request.encode(&mut request)?;
+    let mut result = BoundedEncoder::new(512)?;
+    reply.encode(&mut result)?;
+    let mut result_fact = BoundedEncoder::new(512)?;
+    fact.encode(&mut result_fact)?;
+    if row.expires <= now(context.now_ms())? {
+        return Ok(denied(PreparationDenial::Expired));
+    }
+    // No refusal after the first write. SDK acceptance commits the joint roots,
+    // original outcome, checkpoint, attempt closure and journal together.
+    if missing {
+        changed(context.sql(&statement("UPDATE catalog_operations SET attestation=?1,attestation_digest=?2 WHERE id=?3 AND attestation IS NULL", vec![blob(&bytes),blob(digest),blob(data.token.operation)]))?)?;
+        changed(context.sql(&statement("UPDATE catalog_leases SET attestation=?1,attestation_digest=?2 WHERE incarnation=?3 AND admission_sequence=?4 AND attestation IS NULL", vec![blob(&bytes),blob(digest),blob(data.token.owner.incarnation.as_bytes()),number(data.token.attempt)?]))?)?;
+    }
+    changed(context.sql(&statement(
+        "INSERT INTO catalog_generations(generation,catalog,certificate,refs) VALUES(?1,?2,?3,?4)",
+        vec![
+            number(generation)?,
+            blob(catalog.finish()),
+            blob(digest),
+            blob(refs_root.finish()),
+        ],
+    ))?)?;
+    changed(context.sql(&statement(
+        "UPDATE catalog_state SET generation=?1 WHERE singleton=1 AND generation=?2",
+        vec![number(generation)?, number(data.base.generation)?],
+    ))?)?;
+    changed(context.sql(&statement(
+        "UPDATE ref_generation SET generation=?1,default_branch=?2 WHERE singleton=1",
+        vec![
+            number(proof.request.expected_generation as u64 + 1)?,
+            SqlValue::Text(proof.request.reference),
+        ],
+    ))?)?;
+    changed(context.sql(&statement("INSERT INTO catalog_head_updates(id,actor,request_digest,request,result,fact) VALUES(?1,?2,?3,?4,?5,?6)", vec![blob(data.token.operation),SqlValue::Text(data.actor),blob(data.token.request_digest),blob(request.finish()),blob(result.finish()),blob(result_fact.finish())]))?)?;
+    Ok(CommandResult::Success(reply))
+}
diff --git a/crates/canopy-server/src/packs/publication/native_merge.rs b/crates/canopy-server/src/packs/publication/native_merge.rs
index 927013f6..079f2b8d 100644
--- a/crates/canopy-server/src/packs/publication/native_merge.rs
+++ b/crates/canopy-server/src/packs/publication/native_merge.rs
@@ -33,6 +33,7 @@ struct Transition {
     plan: PushPlan,
     ancestry: Vec<u8>,
     refs: Option<RefStateSnapshotRoot>,
+    ref_generation: Option<u64>,
     audit: Option<crate::packs::input_artifact::StoredInputRoot>,
 }
 
@@ -121,6 +122,9 @@ impl NativeMergeProof {
                     .is_some_and(|r| r.operation() != data.token.artifact_operation)
                 || t.audit
                     .is_some_and(|r| r.operation != data.token.artifact_operation)
+                || t.ref_generation.is_some() != t.refs.is_some()
+                || t.ref_generation
+                    .is_some_and(|g| g == 0 || g > i64::MAX as u64)
                 || t.audit.is_some() != t.refs.is_some()
                 || t.refs.is_some() != super::ref_proof::proven(&t.ancestry, 0)
             {
@@ -148,6 +152,7 @@ impl NativeMergeProof {
             h.update(&super::ref_proof::binding(&t.plan, &t.ancestry)?);
             let mut e = BoundedEncoder::new(256)?;
             t.refs.encode(&mut e)?;
+            t.ref_generation.encode(&mut e)?;
             t.audit.encode(&mut e)?;
             h.update(&e.finish());
         }
@@ -165,6 +170,7 @@ impl WireValue for NativeMergeProof {
             t.plan.encode(e)?;
             e.write_bytes(&t.ancestry)?;
             t.refs.encode(e)?;
+            t.ref_generation.encode(e)?;
             t.audit.encode(e)?;
         }
         Ok(())
@@ -179,6 +185,7 @@ impl WireValue for NativeMergeProof {
                     plan: PushPlan::decode(d)?,
                     ancestry: d.read_bytes()?.to_vec(),
                     refs: Option::<RefStateSnapshotRoot>::decode(d)?,
+                    ref_generation: Option::<u64>::decode(d)?,
                     audit: Option::<crate::packs::input_artifact::StoredInputRoot>::decode(d)?,
                 })
             } else {
@@ -283,16 +290,20 @@ impl PreparedCatalog {
                         } else {
                             None
                         };
-                        let audit = match proposed {
-                            Some(refs) => Some(
-                                audit::prepare(self, &input, &plan.updates[0].name, refs).await?,
-                            ),
-                            None => None,
+                        let (audit, ref_generation) = match proposed {
+                            Some(refs) => {
+                                let (audit, generation) =
+                                    audit::prepare(self, &input, &plan.updates[0].name, refs)
+                                        .await?;
+                                (Some(audit), Some(generation))
+                            }
+                            None => (None, None),
                         };
                         transition = Some(Transition {
                             plan,
                             ancestry,
                             refs: proposed,
+                            ref_generation,
                             audit,
                         });
                     }
@@ -318,7 +329,7 @@ pub struct PublishReviewedMerge;
 impl Command for PublishReviewedMerge {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 9;
-    const CODEC_VERSION: u32 = 6;
+    const CODEC_VERSION: u32 = 7;
     type Input = NativeMergeProof;
     type Output = MergeOutcome;
     fn execute(
@@ -444,6 +455,9 @@ fn publish_authenticated(
     let Some(refs) = transition.refs else {
         return Ok(denied(MergeOutcome::Conflict));
     };
+    let Some(ref_generation) = transition.ref_generation else {
+        return Ok(denied(MergeOutcome::Conflict));
+    };
     let Some(audit) = transition.audit else {
         return Ok(denied(MergeOutcome::Conflict));
     };
@@ -525,6 +539,10 @@ fn publish_authenticated(
         "UPDATE catalog_state SET generation=?1 WHERE singleton=1 AND generation=?2",
         vec![number(generation)?, number(data.base.generation)?],
     ))?)?;
+    changed(context.sql(&statement(
+        "UPDATE ref_generation SET generation=?1 WHERE singleton=1",
+        vec![number(ref_generation)?],
+    ))?)?;
     changed(context.sql(&statement("UPDATE pull_requests SET state='merged',version=version+1,updated_ms=max(updated_ms,?2) WHERE number=?1 AND state='open' AND version=?3 AND version<9223372036854775807", vec![SqlValue::Integer(input.number),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version)]))?)?;
     changed(context.sql(&statement("INSERT INTO pull_merges(id,binding,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version,publication) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9,?10,?11)", vec![blob(id.as_bytes()),blob(binding),SqlValue::Integer(input.number),blob(source),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version),blob(crate::pulls::merge::oid(&input.request.revision.source_oid)?),SqlValue::Integer(input.request.revision.source_version),blob(base),SqlValue::Integer(input.request.revision.base_version),blob(encoded_audit)]))?)?;
     changed(context.sql(&statement(
diff --git a/crates/canopy-server/src/packs/publication/native_merge/audit.rs b/crates/canopy-server/src/packs/publication/native_merge/audit.rs
index 8e8c48f2..1784ab6d 100644
--- a/crates/canopy-server/src/packs/publication/native_merge/audit.rs
+++ b/crates/canopy-server/src/packs/publication/native_merge/audit.rs
@@ -102,7 +102,7 @@ pub(super) async fn prepare(
     input: &MergeInput,
     base_ref: &str,
     refs: RefStateSnapshotRoot,
-) -> Result<StoredInputRoot, NativeMergePreparationError> {
+) -> Result<(StoredInputRoot, u64), NativeMergePreparationError> {
     let store = prepared.base.indexes().store();
     let record = Audit {
         input: input.clone(),
@@ -111,13 +111,17 @@ pub(super) async fn prepare(
         refs,
         ref_generation: refs.read(&store).await?.generation,
     };
-    Ok(StoredInputRoot::upload(
-        &store,
-        prepared.token().artifact_operation,
-        &record,
-        INPUT_ROOT_BYTES,
-    )
-    .await?)
+    let generation = record.ref_generation;
+    Ok((
+        StoredInputRoot::upload(
+            &store,
+            prepared.token().artifact_operation,
+            &record,
+            INPUT_ROOT_BYTES,
+        )
+        .await?,
+        generation,
+    ))
 }
 
 pub(in crate::packs::publication) fn statement(outcome: &MergeOutcome) -> SqlStatement {
diff --git a/crates/canopy-server/src/packs/publication/recovery/archive.rs b/crates/canopy-server/src/packs/publication/recovery/archive.rs
index 8e8d9fb4..c7eff079 100644
--- a/crates/canopy-server/src/packs/publication/recovery/archive.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/archive.rs
@@ -124,6 +124,7 @@ pub(super) enum Terminal {
     Push(Box<CompletedRootPush>),
     Initialization(InitializationReply),
     Merge(crate::pulls::merge::MergeOutcome),
+    Head(PublicationReply),
 }
 impl Terminal {
     fn selected_statement(&self, operation: [u8; 16]) -> SqlStatement {
@@ -131,6 +132,7 @@ impl Terminal {
             sql: match self {
                 Self::Push(_) => super::super::root_completion::read::SAVED,
                 Self::Initialization(_) => super::super::initialization::publish::SAVED,
+                Self::Head(_) => super::super::native_head::publish::SAVED,
                 Self::Merge(outcome) => {
                     return super::super::native_merge::audit::statement(outcome);
                 }
@@ -154,6 +156,11 @@ impl Terminal {
             // A known negative is the original phase knowledge. A later attempt
             // may initialize this logical operation, without rewriting that denial.
             Self::Initialization(InitializationReply::Denied(_)) => true,
+            Self::Head(reply) => {
+                matches!(reply, PublicationReply::Denied(_))
+                    || super::super::native_head::publish::selected(result, check, *reply)?
+                        .is_some()
+            }
             Self::Merge(outcome) => {
                 !matches!(outcome, crate::pulls::merge::MergeOutcome::Applied { .. })
                     || super::super::native_merge::audit::selected(result, outcome, &check.actor)?
@@ -169,6 +176,52 @@ impl Terminal {
         hash: &mut blake3::Hasher,
     ) -> Result<(), RootRecoveryError> {
         match self {
+            Self::Head(reply) => {
+                hash.update(&encoded(reply, 512)?);
+                if let PublicationReply::Published(published) = reply {
+                    let (request, fact) =
+                        super::super::native_head::publish::selected(selected, check, *reply)?
+                            .ok_or(RootRecoveryError::Context)?;
+                    let catalog = fact.catalog.ok_or(RootRecoveryError::Context)?;
+                    let snapshot =
+                        crate::packs::catalog::CatalogSnapshot::download(store, catalog).await?;
+                    crate::packs::directory::snapshot::DirectorySnapshot::download(
+                        store,
+                        snapshot.directory,
+                    )
+                    .await?;
+                    let refs = fact.refs.ok_or(RootRecoveryError::Context)?;
+                    let state = refs
+                        .read(store)
+                        .await
+                        .map_err(super::super::RefSnapshotPreparationError::from)?;
+                    if state.repository != check.token.repository
+                        || state.format != catalog.format
+                        || state.generation != published.ref_generation
+                        || state.default_branch != request.reference
+                    {
+                        return Err(RootRecoveryError::Context);
+                    }
+                    descriptor(
+                        hash,
+                        catalog.operation,
+                        ArtifactKind::CatalogNode,
+                        catalog.artifact,
+                    )?;
+                    descriptor(
+                        hash,
+                        snapshot.directory.operation,
+                        ArtifactKind::CatalogNode,
+                        snapshot.directory.artifact,
+                    )?;
+                    descriptor(
+                        hash,
+                        refs.operation(),
+                        ArtifactKind::InputRoot,
+                        refs.artifact(),
+                    )?;
+                }
+            }
             Self::Merge(outcome) => {
                 hash.update(&encoded(outcome, 512)?);
                 if let Some(root) =
@@ -221,6 +274,13 @@ impl phase::Journal {
         self.may_advance(record)?;
         // A merge has its own typed permanent audit selection. Known denials
         // retain their original phase even if a later UUID attempt succeeds.
+        if record.kind == Kind::Head {
+            return self
+                .primary
+                .as_ref()
+                .map(|v| v.decode_reply::<PublicationReply>().map(Terminal::Head))
+                .transpose();
+        }
         if record.kind == Kind::Merge {
             return self
                 .primary
diff --git a/crates/canopy-server/src/packs/publication/recovery/codec.rs b/crates/canopy-server/src/packs/publication/recovery/codec.rs
index 69476b24..52501329 100644
--- a/crates/canopy-server/src/packs/publication/recovery/codec.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/codec.rs
@@ -29,6 +29,7 @@ impl WireValue for Record {
             Kind::Policy => 2,
             Kind::Initialization => 3,
             Kind::Merge => 4,
+            Kind::Head => 5,
         })?;
         self.primary.encode(e)?;
         e.write_bool(self.refusal.is_some())?;
@@ -56,6 +57,7 @@ impl WireValue for Record {
                 2 => Kind::Policy,
                 3 => Kind::Initialization,
                 4 => Kind::Merge,
+                5 => Kind::Head,
                 _ => return Err(CodecError::Invalid("root recovery command")),
             },
             primary: Stamp::decode(d)?,
@@ -92,6 +94,7 @@ impl WireValue for Bundle {
             Kind::Policy => 2,
             Kind::Initialization => 3,
             Kind::Merge => 4,
+            Kind::Head => 5,
         })?;
         self.primary.encode(e)?;
         e.write_bool(self.refusal.is_some())?;
@@ -111,6 +114,7 @@ impl WireValue for Bundle {
                 2 => Kind::Policy,
                 3 => Kind::Initialization,
                 4 => Kind::Merge,
+                5 => Kind::Head,
                 _ => return Err(CodecError::Invalid("unknown recovery kind")),
             },
             primary: SavedCommand::decode(d)?,
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index ea7282ac..937c453e 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -39,6 +39,10 @@ const DOMAIN: &[u8] = b"canopy.publication-command-recovery.v4\0";
 
 #[derive(Debug, thiserror::Error)]
 pub enum RootRecoveryError {
+    #[error("symbolic HEAD retirement metadata failed")]
+    HeadMetadata(#[from] crate::packs::directory::index::IndexError),
+    #[error("symbolic HEAD retirement snapshot failed")]
+    HeadSnapshot(#[from] RefSnapshotPreparationError),
     #[error("selected native merge audit failed")]
     MergeAudit(#[source] Box<NativeMergeAuditError>),
     #[error("closed initialization graph failed")]
@@ -87,10 +91,13 @@ pub(super) enum Kind {
     Policy,
     Initialization,
     Merge,
+    Head,
 }
 impl Kind {
     fn body_limit(self) -> u32 {
-        if self == Self::Merge {
+        if self == Self::Head {
+            NATIVE_HEAD_BYTES
+        } else if self == Self::Merge {
             NATIVE_MERGE_BYTES
         } else if self == Self::Initialization {
             INITIALIZATION_BYTES
@@ -344,7 +351,7 @@ impl RegisteredRootRecovery {
                 )
                 .await
             }
-            Kind::Policy | Kind::Initialization | Kind::Merge => {
+            Kind::Policy | Kind::Initialization | Kind::Merge | Kind::Head => {
                 Err(AttemptError::Invocation(InvocationError::NotStarted(
                     Error::Command("recovery kind requires typed phase dispatch"),
                 )))
@@ -388,6 +395,19 @@ impl RegisteredRootRecovery {
                 .await
                 .map(PublicationOutcome::Initialization);
         }
+        if self.record.kind == Kind::Head {
+            let result = self
+                .dispatch_command::<PublishNativeHead>(client, store, authority, false, original)
+                .await
+                .map_err(|e| e.publication(self.evidence(), PublicationError::Head))?;
+            return if matches!(result.output, PublicationReply::Published(_)) {
+                Ok(PublicationOutcome::Head(result))
+            } else {
+                Err(PublicationError::Head(InvocationError::Rejected(Box::new(
+                    result,
+                ))))
+            };
+        }
         if self.record.kind == Kind::Merge {
             let result = self
                 .dispatch_command::<PublishReviewedMerge>(client, store, authority, false, original)
@@ -575,33 +595,38 @@ impl RegisteredRootRecovery {
         // Write query here would hide an expired/revoked attempt before that
         // original command could record its definitive denial. Bound live
         // initialization still retains and checks its original local guard.
-        let session =
-            if refusal_only || self.record.kind == Kind::Initialization || original.is_some() {
-                None
-            } else {
-                match PreparationSession::open(
-                    client.clone(),
-                    self.evidence().target().clone(),
-                    self.record.check.clone(),
-                    None,
-                    authority.clone(),
-                )
-                .await
-                {
-                    Ok(session) => Some(session),
-                    Err(error) => {
-                        if let Some(known) = self.known::<C>(client, store, refusal).await? {
-                            return Ok(known);
-                        }
-                        return Err(AttemptError::Invocation(InvocationError::NotStarted(
-                            Error::Facility {
-                                name: "publication recovery custody",
-                                source: Box::new(error),
-                            },
-                        )));
+        // Frozen HEAD metadata also needs no native work or new preparation.
+        // Its original final receiver must record expired/revoked denials,
+        // while checking actual owner, original pin and current joint roots.
+        let session = if refusal_only
+            || matches!(self.record.kind, Kind::Initialization | Kind::Head)
+            || original.is_some()
+        {
+            None
+        } else {
+            match PreparationSession::open(
+                client.clone(),
+                self.evidence().target().clone(),
+                self.record.check.clone(),
+                None,
+                authority.clone(),
+            )
+            .await
+            {
+                Ok(session) => Some(session),
+                Err(error) => {
+                    if let Some(known) = self.known::<C>(client, store, refusal).await? {
+                        return Ok(known);
                     }
+                    return Err(AttemptError::Invocation(InvocationError::NotStarted(
+                        Error::Facility {
+                            name: "publication recovery custody",
+                            source: Box::new(error),
+                        },
+                    )));
                 }
-            };
+            }
+        };
         // A command can settle while body I/O or custody acquisition is in flight.
         if let Some(known) = self.known::<C>(client, store, refusal).await? {
             return Ok(known);
diff --git a/crates/canopy-server/src/packs/publication/recovery/phase.rs b/crates/canopy-server/src/packs/publication/recovery/phase.rs
index 08a365b8..e0b112d1 100644
--- a/crates/canopy-server/src/packs/publication/recovery/phase.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/phase.rs
@@ -89,6 +89,11 @@ impl Journal {
                     primary.decode_reply::<InitializationReply>()?,
                     InitializationReply::Denied(_)
                 )
+            } else if record.kind == Kind::Head {
+                matches!(
+                    primary.decode_reply::<PublicationReply>()?,
+                    PublicationReply::Denied(_)
+                )
             } else if record.kind == Kind::Merge {
                 !matches!(
                     primary.decode_reply::<crate::pulls::merge::MergeOutcome>()?,
@@ -155,7 +160,7 @@ impl Journal {
                 primary.decode_reply::<InitializationReply>()?,
                 InitializationReply::Denied(_)
             )
-        } else if record.kind == Kind::Merge {
+        } else if matches!(record.kind, Kind::Merge | Kind::Head) {
             false
         } else if record.kind == Kind::Policy {
             matches!(primary.decode_reply::<RefPolicyReply>()?, RefPolicyReply::Registered(value) if value.valid)
diff --git a/crates/canopy-server/src/packs/publication/recovery/ready.rs b/crates/canopy-server/src/packs/publication/recovery/ready.rs
index d4eea5e6..7c60abd9 100644
--- a/crates/canopy-server/src/packs/publication/recovery/ready.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/ready.rs
@@ -105,6 +105,10 @@ impl ReadyRootRecovery {
             PublicationError::Initialization(InvocationError::Pending(Box::new(
                 self.recovery.evidence().clone(),
             )))
+        } else if self.recovery.record.kind == Kind::Head {
+            PublicationError::Head(InvocationError::Pending(Box::new(
+                self.recovery.evidence().clone(),
+            )))
         } else if self.recovery.record.kind == Kind::Merge {
             PublicationError::Merge(InvocationError::Pending(Box::new(
                 self.recovery.evidence().clone(),
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 875d407e..9e18b4e0 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,7 +23,7 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 23] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 24] = [
     crate::operation(1),
     command::<crate::branch_rules::command::SetBranchRule>(64 << 10, 64),
     command::<PublishReviewedMerge>(NATIVE_MERGE_BYTES, 512),
@@ -50,6 +50,7 @@ pub(crate) const COMMANDS: [OperationDescriptor; 23] = [
     command::<crate::checks::native::StartCommitCheck>(4096, 16),
     command::<crate::pulls::native::CreateNativePull>(crate::pulls::native::INPUT_BYTES, 16),
     command::<crate::pulls::native::ReviewNativePull>(crate::pulls::native::INPUT_BYTES, 16),
+    command::<PublishNativeHead>(NATIVE_HEAD_BYTES, 512),
 ];
 pub(crate) const QUERIES: [OperationDescriptor; 13] = [
     crate::operation(2),
@@ -99,7 +100,7 @@ mod tests {
             ids,
             vec![
                 1, 8, 9, 10, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49,
-                51, 53
+                51, 53, 54
             ]
         );
         assert_eq!(
@@ -111,6 +112,7 @@ mod tests {
             vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48, 50, 52]
         );
         for (id, codec, input, output) in [
+            (54, PublishNativeHead::CODEC_VERSION, NATIVE_HEAD_BYTES, 512),
             (
                 10,
                 crate::pulls::candidates::command::PrepareCandidate::CODEC_VERSION,
diff --git a/crates/canopy-server/src/packs/publication/root_completion/publish.rs b/crates/canopy-server/src/packs/publication/root_completion/publish.rs
index 614a7f50..002ffda4 100644
--- a/crates/canopy-server/src/packs/publication/root_completion/publish.rs
+++ b/crates/canopy-server/src/packs/publication/root_completion/publish.rs
@@ -187,6 +187,10 @@ impl CompleteRootPush {
                 "UPDATE catalog_state SET generation=?1 WHERE singleton=1 AND generation=?2",
                 vec![number(value.generation)?, number(data.base.generation)?],
             ))?)?;
+            changed(context.sql(&statement(
+                "UPDATE ref_generation SET generation=?1 WHERE singleton=1",
+                vec![number(value.ref_generation)?],
+            ))?)?;
         }
         Ok(CommandResult::Success(terminal.save(context)?))
     }
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index c154ed52..f366cbe4 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -595,3 +595,19 @@ BEGIN SELECT RAISE(ABORT, 'custody command must be retained'); END;
 CREATE TRIGGER catalog_custody_stop_immutable BEFORE UPDATE OF stopped ON catalog_custody_commands
 WHEN OLD.stopped IS NOT NULL AND NEW.stopped IS NOT OLD.stopped
 BEGIN SELECT RAISE(ABORT, 'custody retirement is immutable'); END;
+
+-- Symbolic HEAD outcomes retain the original joint roots for exact retirement.
+CREATE TABLE catalog_head_updates (
+    id BLOB PRIMARY KEY CHECK(length(id)=16),
+    actor TEXT NOT NULL,
+    request_digest BLOB NOT NULL CHECK(length(request_digest)=32),
+    request BLOB NOT NULL CHECK(length(request)<=131072),
+    result BLOB NOT NULL CHECK(length(result)<=512),
+    fact BLOB NOT NULL CHECK(length(fact)<=512)
+) STRICT;
+CREATE TRIGGER catalog_head_updates_immutable BEFORE UPDATE ON catalog_head_updates BEGIN
+    SELECT RAISE(ABORT, 'symbolic HEAD outcome is immutable');
+END;
+CREATE TRIGGER catalog_head_updates_retained BEFORE DELETE ON catalog_head_updates BEGIN
+    SELECT RAISE(ABORT, 'symbolic HEAD outcome is retained');
+END;
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index 4c26cdc5..d9fd2ab6 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -16,6 +16,7 @@ mod mandatory_registration;
 mod namespaces;
 mod native_candidate;
 mod native_capture;
+mod native_head;
 mod native_merge;
 mod policy_dispatch;
 mod policy_refusal;
diff --git a/crates/canopy-server/src/packs/publication/tests/native_head.rs b/crates/canopy-server/src/packs/publication/tests/native_head.rs
new file mode 100644
index 00000000..042bdeb5
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/native_head.rs
@@ -0,0 +1,353 @@
+//! Same native catalog fixtures as merges, with real SDK phase and retirement.
+use super::*;
+use super::{
+    native_merge::{initial, preparation},
+    prepare::cleaned,
+    publishing::edit,
+};
+use crate::packs::ref_state::RefStateIndex;
+use canopy_object_storage::artifact::{ArtifactKey, ArtifactKind};
+use cellule_runtime::{PreparedCommand, Resolution};
+use object_store::ObjectStoreExt;
+
+fn request(reference: &str, generation: i64) -> HeadRequest {
+    HeadRequest {
+        reference: reference.into(),
+        expected_generation: generation,
+    }
+}
+async fn command(
+    f: &Fixture,
+    prepared: &PreparedCatalog,
+    request: HeadRequest,
+) -> Result<(PreparedCommand<PublishNativeHead>, RegisteredRootRecovery)> {
+    let command = f
+        .client()
+        .prepare_command::<PublishNativeHead>(
+            &f.target,
+            identity()?,
+            prepared.native_head_proof(request).await?,
+        )
+        .await?;
+    let saved = super::super::recovery::persist(
+        &prepared.base.session,
+        &command,
+        super::super::recovery::Kind::Head,
+        &prepared.base.indexes().store(),
+        identity()?,
+        0,
+    )
+    .await?;
+    Ok((command, saved))
+}
+async fn state(f: &Fixture) -> Result<Vec<u8>> {
+    let roots = super::publishing::state(&f.handle).await?;
+    let phases = f.handle.query(0,65536, |db| {
+        let mut s = db.prepare("SELECT recovery_phase,recovery_phase_revision FROM catalog_leases ORDER BY admission_sequence")?;
+        let phases = s.query_map([], |r| Ok((r.get::<_,Option<Vec<u8>>>(0)?,r.get::<_,u64>(1)?)))?.collect::<rusqlite::Result<Vec<_>>>()?;
+        let heads: u64 = db.query_row("SELECT count(*) FROM catalog_head_updates",[],|r|r.get(0))?;
+        serde_json::to_vec(&(phases,heads)).map_err(|_|Error::Command("HEAD test state"))
+    }).await?;
+    Ok([roots, phases].concat())
+}
+async fn recover(
+    f: &Fixture,
+    saved: &RegisteredRootRecovery,
+    store: &canopy_object_storage::artifact::ArtifactStore,
+) -> Result<cellule_runtime::Committed<PublicationReply>> {
+    match saved
+        .dispatch_any(
+            &f.client(),
+            store,
+            &f.authority(),
+            &std::sync::atomic::AtomicBool::new(false),
+        )
+        .await
+    {
+        Ok(PublicationOutcome::Head(value)) => Ok(value),
+        Err(PublicationError::Head(InvocationError::Rejected(value))) => Ok(*value),
+        other => Err(format!("wrong HEAD recovery purpose: {other:?}").into()),
+    }
+}
+#[tokio::test]
+async fn native_head_reuses_ref_tree_and_preserves_original_receipt_after_typed_retirement()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, _) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let check = prepared.base.capability().2.clone();
+        let old = prepared
+            .base()
+            .refs
+            .ok_or("missing ref snapshot")?
+            .read(&graph.store)
+            .await?;
+        let (command, saved) = command(&f, &prepared, request("refs/heads/feature", 1)).await?;
+        let original = command.clone().execute().await?;
+        let PublicationReply::Published(published) = original.output else {
+            return Err("HEAD refused".into());
+        };
+        assert_eq!((published.generation, published.ref_generation), (2, 2));
+        let audit = f
+            .handle
+            .query(0, 1024, |db| {
+                assert_eq!(
+                    db.query_row("SELECT generation FROM ref_generation", [], |r| r
+                        .get::<_, u64>(0))?,
+                    2
+                );
+                assert_eq!(
+                    db.query_row("SELECT default_branch FROM ref_generation", [], |r| r
+                        .get::<_, String>(0))?,
+                    "refs/heads/feature"
+                );
+                assert_eq!(
+                    db.query_row("SELECT count(*) FROM refs", [], |r| r.get::<_, u64>(0))?,
+                    0
+                );
+                Ok(
+                    db.query_row("SELECT fact FROM catalog_head_updates", [], |r| {
+                        r.get::<_, Vec<u8>>(0)
+                    })?,
+                )
+            })
+            .await?;
+        let mut d = BoundedDecoder::new(&audit, 512)?;
+        let fact = GenerationFact::decode(&mut d)?;
+        d.finish()?;
+        let refs = fact.refs.ok_or("missing HEAD outcome refs")?;
+        let updated = refs.read(&graph.store).await?;
+        assert_eq!(
+            (
+                updated.root.clone(),
+                updated.generation,
+                updated.default_branch.as_str()
+            ),
+            (old.root, 2, "refs/heads/feature")
+        );
+        let index = RefStateIndex::new(graph.store.clone(), format);
+        assert_eq!(
+            index
+                .read(updated.root, "refs/heads/feature")
+                .await?
+                .ok_or("missing feature")?
+                .version,
+            1
+        );
+        assert_eq!(command.execute().await?.receipt, original.receipt);
+        let admin = super::terminal_retention::maintenance(&f.handle, f.repository).await?;
+        // Corrupt/missing selected metadata must retain the original independent pin.
+        let path = graph.store.path(
+            ArtifactKey {
+                operation: refs.operation(),
+                binding_digest: refs.artifact().digest,
+                kind: ArtifactKind::InputRoot,
+            },
+            refs.artifact().digest,
+        )?;
+        let bytes = graph.provider.get(&path).await?.bytes().await?;
+        graph.provider.delete(&path).await?;
+        assert!(
+            saved
+                .ready_terminal_release(f.client(), &graph.store, admin.clone(), identity()?)
+                .await
+                .is_err()
+        );
+        assert_eq!(
+            recover(&f, &saved, &graph.store).await?.receipt,
+            original.receipt
+        );
+        graph.provider.put(&path, bytes.into()).await?;
+        assert_eq!(
+            saved
+                .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
+                .await?
+                .complete()
+                .await?
+                .output,
+            TerminalReleaseReply::Released
+        );
+        for (key, descriptor) in saved.command_bodies_for_test() {
+            graph
+                .provider
+                .delete(&graph.store.path(key, descriptor.digest)?)
+                .await?;
+        }
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        // Permanent outcome selectors cannot be altered or deleted.
+        let id = check.token.operation;
+        f.handle
+            .query(0, 128, move |db| {
+                assert!(
+                    db.execute(
+                        "UPDATE catalog_head_updates SET actor='replacement' WHERE id=?1",
+                        [id.as_slice()]
+                    )
+                    .is_err()
+                );
+                assert!(
+                    db.execute(
+                        "DELETE FROM catalog_head_updates WHERE id=?1",
+                        [id.as_slice()]
+                    )
+                    .is_err()
+                );
+                Ok(Vec::new())
+            })
+            .await?;
+        let (runtime, handle, client) = super::durable_recovery::restore_owner(&f, &check).await?;
+        assert!(handle.owner_fence().epoch > check.token.owner.epoch);
+        let restored = RegisteredRootRecovery::load(&client, &f.target, &graph.store, &check)
+            .await?
+            .ok_or("HEAD archive missing")?;
+        let PublicationOutcome::Head(replay) = restored
+            .dispatch_any(
+                &client,
+                &graph.store,
+                &f.authority(),
+                &std::sync::atomic::AtomicBool::new(false),
+            )
+            .await?
+        else {
+            return Err("wrong restored HEAD purpose".into());
+        };
+        assert_eq!(
+            (replay.output, replay.receipt),
+            (original.output, original.receipt)
+        );
+        runtime.shutdown().await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_head_denials_recheck_current_authority_generation_and_native_branch_existence()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        for mode in 0..5 {
+            let (f, graph, _) = initial(format, false).await?;
+            let (prepared, root, budget) = preparation(&f, &graph).await?;
+            let req = match mode {
+                0 => request("refs/heads/absent", 1),
+                1 => request("refs/heads/feature", 0),
+                _ => request("refs/heads/feature", 1),
+            };
+            let (command, saved) = command(&f, &prepared, req).await?;
+            let reason = match mode {
+                2 => {
+                    edit(&f, "UPDATE repository_identity SET owner='replacement'").await?;
+                    PreparationDenial::Unauthorized
+                }
+                3 => {
+                    edit(&f,"INSERT INTO catalog_generations SELECT 2,catalog,certificate,refs FROM catalog_generations WHERE generation=1; UPDATE catalog_state SET generation=2").await?;
+                    PreparationDenial::Conflict
+                }
+                4 => {
+                    edit(&f,"UPDATE catalog_operations SET expires_at_ms=0; UPDATE catalog_leases SET expires_at_ms=0").await?;
+                    PreparationDenial::Expired
+                }
+                _ => PreparationDenial::Conflict,
+            };
+            let roots_before = f
+                .handle
+                .query(0, 128, |db| {
+                    serde_json::to_vec(&(
+                        db.query_row("SELECT generation FROM catalog_state", [], |r| {
+                            r.get::<_, u64>(0)
+                        })?,
+                        db.query_row("SELECT count(*) FROM catalog_head_updates", [], |r| {
+                            r.get::<_, u64>(0)
+                        })?,
+                    ))
+                    .map_err(|_| Error::Command("HEAD test roots"))
+                })
+                .await?;
+            let original = if matches!(mode, 2 | 4) {
+                // Authoritative SDK absence after restart must settle the same
+                // frozen denial, without a fresh Write observation hiding it.
+                drop(command);
+                recover(&f, &saved, &graph.store).await?
+            } else {
+                command.execute().await?
+            };
+            assert_eq!(original.output, PublicationReply::Denied(reason));
+            let after = f.handle.query(0,128,|db| {
+                assert_eq!(db.query_row("SELECT count(*) FROM catalog_operations WHERE actor='owner' AND generation IS NOT NULL",[],|r|r.get::<_,u64>(0))?,1);
+                serde_json::to_vec(&(db.query_row("SELECT generation FROM catalog_state",[],|r|r.get::<_,u64>(0))?,db.query_row("SELECT count(*) FROM catalog_head_updates",[],|r|r.get::<_,u64>(0))?)).map_err(|_|Error::Command("HEAD test roots"))
+            }).await?;
+            assert_eq!(after, roots_before);
+            assert_eq!(
+                recover(&f, &saved, &graph.store).await?.receipt,
+                original.receipt
+            );
+            drop(prepared);
+            cleaned(root.path(), &budget).await?;
+            drop(graph.prepared);
+            cleaned(graph.root.path(), &graph.budget).await?;
+            f.runtime.shutdown().await?;
+        }
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn native_head_registration_and_late_sql_failure_keep_original_command_and_atomic_roots()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, _) = initial(format, false).await?;
+        let (prepared, root, budget) = preparation(&f, &graph).await?;
+        let mut proof = prepared
+            .native_head_proof(request("refs/heads/feature", 1))
+            .await?;
+        let mut e = BoundedEncoder::new(NATIVE_HEAD_BYTES)?;
+        proof.encode(&mut e)?;
+        let bytes = e.finish();
+        let mut d = BoundedDecoder::new(&bytes, NATIVE_HEAD_BYTES)?;
+        assert_eq!(NativeHeadProof::decode(&mut d)?, proof);
+        d.finish()?;
+        // A request/root mutation cannot borrow an authentic catalog's authority.
+        proof.request.reference = "refs/heads/main".into();
+        assert!(
+            proof
+                .encode(&mut BoundedEncoder::new(NATIVE_HEAD_BYTES)?)
+                .is_err()
+        );
+        let unregistered = f
+            .client()
+            .prepare_command::<PublishNativeHead>(
+                &f.target,
+                identity()?,
+                prepared
+                    .native_head_proof(request("refs/heads/feature", 1))
+                    .await?,
+            )
+            .await?;
+        let before = state(&f).await?;
+        assert!(matches!(
+            unregistered.execute().await,
+            Err(InvocationError::NotStarted(_))
+        ));
+        assert_eq!(state(&f).await?, before);
+        let (command, _) = command(&f, &prepared, request("refs/heads/feature", 1)).await?;
+        edit(&f,"CREATE TRIGGER abort_head BEFORE INSERT ON catalog_head_updates BEGIN SELECT RAISE(ABORT,'late HEAD failure'); END").await?;
+        let before = state(&f).await?;
+        assert!(command.clone().execute().await.is_err());
+        assert_eq!(state(&f).await?, before);
+        assert!(matches!(
+            f.client().resolve(command.evidence()).await?,
+            Resolution::Absent
+        ));
+        edit(&f, "DROP TRIGGER abort_head").await?;
+        assert!(matches!(
+            command.execute().await?.output,
+            PublicationReply::Published(_)
+        ));
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/native_merge.rs b/crates/canopy-server/src/packs/publication/tests/native_merge.rs
index d0af4554..da0719e5 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_merge.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_merge.rs
@@ -17,7 +17,10 @@ use crate::{
 use cellule_ltx::DiskBudget;
 use cellule_runtime::{PreparedCommand, Resolution};
 
-async fn initial(format: ObjectFormat, unrelated: bool) -> Result<(Fixture, Graph, MergeRequest)> {
+pub(super) async fn initial(
+    format: ObjectFormat,
+    unrelated: bool,
+) -> Result<(Fixture, Graph, MergeRequest)> {
     let f = Fixture::new(format).await?;
     let graph = assembled(&f, [245; 16], 16).await?;
     let source = if unrelated { graph.other } else { graph.tip };
@@ -74,7 +77,7 @@ async fn initial(format: ObjectFormat, unrelated: bool) -> Result<(Fixture, Grap
     };
     Ok((f, graph, request))
 }
-async fn preparation(
+pub(super) async fn preparation(
     f: &Fixture,
     graph: &Graph,
 ) -> Result<(Arc<PreparedCatalog>, tempfile::TempDir, DiskBudget)> {
@@ -161,7 +164,7 @@ async fn merged_roots(f: &Fixture, graph: &Graph) -> Result {
         let result=db.query_row("SELECT s.generation,g.refs,(SELECT count(*) FROM refs),(SELECT generation FROM ref_generation),(SELECT state FROM pull_requests WHERE number=1),(SELECT count(*) FROM pull_merges) FROM catalog_state s JOIN catalog_generations g ON g.generation=s.generation",[],|r|Ok((r.get::<_,u64>(0)?,r.get::<_,Vec<u8>>(1)?,r.get::<_,u64>(2)?,r.get::<_,u64>(3)?,r.get::<_,String>(4)?,r.get::<_,u64>(5)?)))?;
         serde_json::to_vec(&result).map_err(|_|Error::Command("merge fixture roots"))
     }).await?;
-    let (generation, refs, legacy, legacy_generation, pull, merges): (
+    let (generation, refs, legacy, summary_generation, pull, merges): (
         u64,
         Vec<u8>,
         u64,
@@ -170,8 +173,14 @@ async fn merged_roots(f: &Fixture, graph: &Graph) -> Result {
         u64,
     ) = serde_json::from_slice(&bytes)?;
     assert_eq!(
-        (generation, legacy, legacy_generation, pull.as_str(), merges),
-        (2, 0, 0, "merged", 1)
+        (
+            generation,
+            legacy,
+            summary_generation,
+            pull.as_str(),
+            merges
+        ),
+        (2, 0, 2, "merged", 1)
     );
     let mut d = BoundedDecoder::new(&refs, 128)?;
     let root = RefStateSnapshotRoot::decode(&mut d)?;
diff --git a/crates/canopy-server/src/packs/publication/tests/root_completion.rs b/crates/canopy-server/src/packs/publication/tests/root_completion.rs
index 36f05fa2..fa6d42d9 100644
--- a/crates/canopy-server/src/packs/publication/tests/root_completion.rs
+++ b/crates/canopy-server/src/packs/publication/tests/root_completion.rs
@@ -317,6 +317,22 @@ pub(super) async fn qualify(
             edit(fixture, "INSERT INTO pushes(id,actor,request_digest) VALUES(zeroblob(16),'original',zeroblob(32)); INSERT INTO push_certificates VALUES(X'1111111111111111111111111111111111111111111111111111111111111111',zeroblob(16),'original','original','original key',1234,0)").await?;
         }
     }
+    let prior_summary = fixture
+        .handle
+        .query(0, 1024, |db| {
+            let value: u64 = db.query_row(
+                "SELECT generation FROM ref_generation WHERE singleton=1",
+                [],
+                |r| r.get(0),
+            )?;
+            Ok(value.to_le_bytes().to_vec())
+        })
+        .await?;
+    let prior_summary = u64::from_le_bytes(
+        prior_summary
+            .try_into()
+            .map_err(|_| "invalid prior summary")?,
+    );
     let mutation = identity()?;
     let command = fixture
         .client()
@@ -394,6 +410,24 @@ pub(super) async fn qualify(
         assert_eq!(value.generation, 3);
         assert_eq!(value.ref_generation, 1);
     }
+    let summary = fixture
+        .handle
+        .query(0, 1024, |db| {
+            let value: u64 = db.query_row(
+                "SELECT generation FROM ref_generation WHERE singleton=1",
+                [],
+                |r| r.get(0),
+            )?;
+            Ok(value.to_le_bytes().to_vec())
+        })
+        .await?;
+    assert_eq!(
+        u64::from_le_bytes(summary.try_into().map_err(|_| "invalid summary")?),
+        output
+            .completion
+            .publication
+            .map_or(prior_summary, |value| value.ref_generation)
+    );
     let roots = fixture.handle.query(0, 1024, |db| {
         let value: (u64, Vec<u8>, Vec<u8>) = db.query_row("SELECT generation,catalog,refs FROM catalog_generations WHERE generation=(SELECT generation FROM catalog_state)", [], |row| Ok((row.get(0)?,row.get(1)?,row.get(2)?)))?;
         Ok(serde_json::to_vec(&value).unwrap())
diff --git a/crates/canopy-server/src/repository_http/default_branch.rs b/crates/canopy-server/src/repository_http/default_branch.rs
index f1402aad..44dac3bf 100644
--- a/crates/canopy-server/src/repository_http/default_branch.rs
+++ b/crates/canopy-server/src/repository_http/default_branch.rs
@@ -18,21 +18,22 @@ pub(super) async fn read(
         Ok(authorized) => authorized,
         Err(response) => return response,
     };
-    let head = async {
-        let snapshot = route.repository.serving_snapshot(actor.identity()).await?;
-        snapshot
-            .resolve_ref(None)
-            .await
-            .map_err(crate::packs::publication::ServingOwnerError::from)
-    }
-    .await;
+    let head = route
+        .repository
+        .default_branch_for(actor.identity(), None)
+        .await;
     match head {
-        Ok(head) if (state.manager.ready)() => response(
-            route.repository.repository_id(),
-            &head.reference,
-            head.generation,
-        ),
-        Ok(_) => plain(StatusCode::SERVICE_UNAVAILABLE, "Canopy node is not ready"),
+        Ok(_) if !(state.manager.ready)() => {
+            plain(StatusCode::SERVICE_UNAVAILABLE, "Canopy node is not ready")
+        }
+        Ok(head) => match head.output {
+            Some(head) => response(
+                route.repository.repository_id(),
+                &head.reference,
+                head.generation,
+            ),
+            None => plain(StatusCode::NOT_FOUND, "Repository not found"),
+        },
         Err(error) => {
             tracing::error!(error = %error, "default branch read failed");
             plain(
@@ -90,21 +91,27 @@ pub(super) async fn update(
         }
     };
     match route
-        .repository
+        .gateway
         .set_default_branch(
             identity,
             &principal.account,
-            input.expected_generation,
-            &input.reference,
+            crate::packs::publication::HeadRequest {
+                expected_generation: input.expected_generation,
+                reference: input.reference.clone(),
+            },
         )
         .await
     {
-        Ok(result) if result.output && (state.manager.ready)() => response(
-            route.repository.repository_id(),
-            &input.reference,
-            input.expected_generation + 1,
-        ),
-        Ok(result) if !result.output => plain(
+        Ok(crate::packs::publication::PublicationReply::Published(_))
+            if (state.manager.ready)() =>
+        {
+            response(
+                route.repository.repository_id(),
+                &input.reference,
+                input.expected_generation + 1,
+            )
+        }
+        Ok(crate::packs::publication::PublicationReply::Denied(_)) => plain(
             StatusCode::CONFLICT,
             "Ref generation changed or target branch does not exist",
         ),
diff --git a/crates/canopy-server/src/server/discovery.rs b/crates/canopy-server/src/server/discovery.rs
index 1e9c8621..677188eb 100644
--- a/crates/canopy-server/src/server/discovery.rs
+++ b/crates/canopy-server/src/server/discovery.rs
@@ -63,7 +63,14 @@ impl RepositoryManager {
             let Some(role) = route.repository.access_level(actor, None).await?.output else {
                 return Ok(None);
             };
-            let head = route.repository.default_branch(None).await?.output;
+            let Some(head) = route
+                .repository
+                .default_branch_for(actor, None)
+                .await?
+                .output
+            else {
+                return Ok(None);
+            };
             let visibility = route.repository.visibility().await?.output;
             Ok(Some(RepositoryDetails {
                 entry,
diff --git a/docs/contracts.md b/docs/contracts.md
index 289acb41..73b14c18 100644
--- a/docs/contracts.md
+++ b/docs/contracts.md
@@ -103,7 +103,7 @@ These limits bound individual requests and publication work. They do not cap tot
 | LFS request deadline | Batch: 120 seconds; object PUT: 120-second input idle timeout with no whole-transfer deadline; timeout returns 408 | Git HTTP router / LFS service |
 | Git request admission | No receive-pack byte quota; 64 MiB for other requests; 120-second input idle deadline | anonymous request spool |
 | Ref mutation | check actor's write role, compare expected optional OID and monotonic version; retain deletion records and apply all updates in one Cell transaction | `FinalizePush` |
-| Symbolic HEAD | `ref_generation.default_branch`, initially `refs/heads/main`; owner-authorized compare-and-set with ref generation | `RepositoryCell::set_default_branch` |
+| Symbolic HEAD | Accepted immutable `RefStateSnapshot.default_branch`, initially `refs/heads/main`; owner-authorized joint-root compare-and-set | `PublishNativeHead`, operation 54, codec 1 |
 | HTTP push identity | repository-local UUID bound to account and BLAKE3 request digest; different IDs identify independent operations | `pushes` |
 | HTTP push outcome | status, headers and BLAKE3-verified body in SQLite chunks; publish response pointer, rejection decision and ordered push notes atomically with accepted refs | `CompletePush`, codec 5 |
 | Graph certificates | at most 128 candidates; SQLite verification targets 64 MiB, with larger objects verified individually; typed dependencies must already be certified | `CertifyObjects`, operation 6, codec 1 |
@@ -155,26 +155,50 @@ implemented yet.
 
 ### Ref snapshots and default branch
 
-The `ref_generation` singleton advances once in the same transaction as each
-accepted ref plan or default-branch update, including selecting the same branch.
-Typed finalization and HTTP completion share the ref-plan update; rejected plans,
-failed HEAD preconditions, completed-request replay and object/ACL writes do not
-advance it. Ref queries return at most 256 rows with HEAD and generation in one SQLite
-statement, including an empty terminal page. A continuation must supply the
-first page's generation. Changes invalidate the scan even when tips return to
-their previous OIDs or names are deleted and recreated. The gateway discards
-partial scans and tries at most three scans, then returns HTTP 503.
-Successful scans therefore describe one coherent ref state. That state can
-become older while its disposable cache is hydrated; admitted readers retain
-the selected generation, and immutable objects remain readable without GC.
-
-HEAD must name a valid `refs/heads/` reference under Canopy's UTF-8,
-255-byte ref policy. Changing it requires the owner, an expected ref generation,
-and either a live target branch or no live branches. Owner authorization, target
-existence and generation comparison occur in one Cell SQL update. Concurrent
-ref changes and HEAD ABA invalidate the precondition. The SDK's mutation identity
-replays its recorded result; the HTTP API uses an explicit generation and requires
-a fresh GET after an ambiguous reply. It does not silently retry updates.
+The accepted immutable ref snapshot's generation advances once for every
+accepted ref plan or HEAD update, including selecting the same branch. Ref
+records retain independent monotonic versions and deletion history. HEAD-only
+changes reuse the existing ref tree without changing those records. Ref pages
+select the same certified joint catalog/ref generation; continuations must use
+the unchanged ref generation. A push or HEAD ABA invalidates that precondition.
+
+HEAD must name a valid UTF-8 `refs/heads/` reference within the ref metadata's
+65,535-byte name limit. The HTTP body has a separate 8 KiB limit. Changing HEAD
+requires the current repository owner, an admin-scoped token, the expected ref
+generation, and either a live target branch or no live branches. The private
+preparation reads the held immutable tree. Checking for any live branch uses a
+seek and one live cursor result, skipping whole tombstoned subtrees.
+
+Operation 54 carries a purpose-bound catalog certificate, original request and
+conditional new snapshot. The final Cell transaction rechecks current owner,
+ACL, actual fence, exact original pin, expiry, retention floor and current joint
+roots, then publishes roots, immutable `catalog_head_updates` outcome, checkpoint,
+attempt closure and the original recovery phase together. No network observer
+owns the command. The resident staging/publication lifecycle retains its original
+prepared command and owner through cancellation and uncertain acknowledgements.
+Results fit the existing 512-byte recovery phase limit. A known SDK receipt or
+journal is resolved before body downloads or new custody. A cold absent HEAD
+command performs no new native work; its final receiver can record the original
+expiry or revocation denial without first requiring fresh Write authorization.
+
+Typed retirement checks the immutable selected outcome and bounded catalog,
+directory and ref snapshot headers before transferring the original journal to
+shared recovery receipts and releasing the transient pin. A missing selected
+snapshot retains the pin. The permanent original outcome cannot be updated or
+deleted. This authorizes no provider deletion; physical collection and quota
+qualification remain separate work.
+
+The HTTP API uses an explicit generation and requires a fresh GET after an
+ambiguous reply. It does not silently retry an update. Repository discovery,
+and default-branch GET read the existing constant-size `ref_generation` summary
+with current read access in the same query. Every successful native push,
+reviewed merge and HEAD publication updates its generation atomically with the
+accepted immutable ref snapshot. Push and merge preserve HEAD; operation 54
+changes both fields. The private merge proof binds the generation read from its
+prepared immutable snapshot (operation 9 codec 7). Ref-free completions and
+refusals leave the summary unchanged. Stock Git reads the accepted immutable
+snapshot. Metadata reads perform no artifact I/O, acquire no serving pin and
+publish no Cell root. The detached SQL HEAD setter fails closed.
 
 `GET /api/repositories/<name>/default-branch` requires repository read access,
 including anonymous public access. It returns `repository_id`, `reference` and `generation`.
@@ -1732,7 +1756,7 @@ with a 30-second receive deadline. The Cell command rechecks owner authority.
 The historical SQL publisher used `refs::apply_refs` for typed
 `FinalizePush`, HTTP `CompletePush`, and `MergePull`. Native publication instead
 uses privately certified immutable ref roots and reuses current branch/check
-predicates; native reviewed merge operation 9, codec 6 is described below. Before any ref writes, each enabled rule
+predicates; native reviewed merge operation 9, codec 7 is described below. Before any ref writes, each enabled rule
 checks deletion policy, ancestry and every required check. For a non-deletion,
 the selected attempt is the greatest creation number matching the proposed
 commit, context and current context version. It must have state `success` and
@@ -1945,7 +1969,7 @@ recovery journal. The native receiver and resident fast-forward adapter describe
 Typed terminal release is described below. The historical SQL merge description
 below is not qualification of generated native merge strategies.
 
-`PublishReviewedMerge` reuses operation 9 with codec 6 and a 256 KiB input / 512
+`PublishReviewedMerge` reuses operation 9 with codec 7 and a 256 KiB input / 512
 byte output contract. It replaces the registered contract rather than decoding
 legacy codec 4. Its private factory requires a ref-only `PreparedCatalog`: no
 incoming pack or native push-result checkpoint is accepted. It reads at most two
@@ -2323,7 +2347,7 @@ conflict. There is no synthesized commit, implicit rebase or strategy fallback.
 
 Historical SQL merge contract (operation 9, codec 4; no longer registered in
 the native production registry): the old command performed the following
-transaction. The native operation 9, codec 6 contract above replaces its storage
+transaction. The native operation 9, codec 7 contract above replaces its storage
 authority. Public/resident adapter conversion remains open; this historical
 section is not evidence that the current merge endpoint works.
 
@@ -2507,7 +2531,7 @@ historic candidates need quota/retention policy before persistent public use.
 Schema 1 remains unreleased and requires a fresh development prefix. The native
 editorial increment reuses the existing candidate request/result/table and
 ref-observation structures, with operation 10 codec 3; reviewed native merge is
-operation 9 codec 6. No dependency or lockfile changes are needed for this step.
+operation 9 codec 7. No dependency or lockfile changes are needed for this step.
 
 
 ## Repository browser
@@ -2526,7 +2550,7 @@ A different UUID returns 409; malformed input returns 422. The response is
 | `{"kind":"history","commit":"<OID>"}` | `history` | Up to 32 commits following only the first parent |
 
 `resolved` contains `reference`, nullable `oid`/`version`, and `generation`.
-Default HEAD and its ref tip come from one SQL observation. A missing/deleted
+Default HEAD and its ref tip come from the same accepted immutable ref snapshot. A missing/deleted
 reference returns null OID. Subsequent tree/file/history queries use the returned
 lowercase SHA-1 object ID, preserving that snapshot through ref changes.
 Annotated tags are peeled to commits, with at most 16 object visits. Tags to
diff --git a/docs/evidence/native-head-ci-20261005.json b/docs/evidence/native-head-ci-20261005.json
new file mode 100644
index 00000000..a6e37b1a
--- /dev/null
+++ b/docs/evidence/native-head-ci-20261005.json
@@ -0,0 +1,760 @@
+{
+  "recorded_at_utc": "2026-10-05T23:57:21.753158+00:00",
+  "base_head": "7c232ea0d4d384c0ac2c5cf0dc401ce454e1a00f",
+  "host": "macOS, Rust 1.98.0; exact new-head Linux qualification required",
+  "release_qualified": false,
+  "source_files": 524,
+  "rust_files": 506,
+  "source_hash_digest": "d7b56a0f6e789648dda2a9ebe3dfeb30ad5d747a855bdecd400ca9d05069e8ea",
+  "source_manifest": "/tmp/canopy-head-summary-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "validation": {
+    "source_digest": "d7b56a0f6e789648dda2a9ebe3dfeb30ad5d747a855bdecd400ca9d05069e8ea",
+    "complete": true,
+    "phases": [
+      {
+        "name": "head",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "native_head"
+        ],
+        "exit_code": 0,
+        "seconds": 134.59,
+        "log": "/tmp/canopy-head-summary-head.log",
+        "log_sha256": "e0e3a3bd4c022f22bf5aeca9688d960d47adc7a983876a82ab0f44fa7aefd35d",
+        "summaries": [
+          "test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 747 filtered out; finished in 6.08s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "merge",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "native_merge"
+        ],
+        "exit_code": 0,
+        "seconds": 6.97,
+        "log": "/tmp/canopy-head-summary-merge.log",
+        "log_sha256": "4d34eed2c82a7d19921d9052d649c3c7d2cd442bf97399de7b74000b8a2336ad",
+        "summaries": [
+          "test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 736 filtered out; finished in 5.80s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "public",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--test",
+          "multi_server",
+          "default_branch::default_branch_controls_discovery_and_clone_after_fresh_owner_restore",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 88.02,
+        "log": "/tmp/canopy-head-summary-public.log",
+        "log_sha256": "756652712b533832935ef2281d52d5d0d7dab8f09309a6f180729aa9f203880a",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 7.59s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "cold",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--test",
+          "multi_server",
+          "peers::cold_activation::"
+        ],
+        "exit_code": 0,
+        "seconds": 4.04,
+        "log": "/tmp/canopy-head-summary-cold.log",
+        "log_sha256": "5f928564e8c881d28aa4e4bc969e5ad90260342cc1938c7d9949827e1af11e3a",
+        "summaries": [
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 114 filtered out; finished in 2.54s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "bootstrap",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--test",
+          "multi_server",
+          "workspace::new_repositories_bootstrap_the_production_packed_catalog_before_becoming_ready",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 3.85,
+        "log": "/tmp/canopy-head-summary-bootstrap.log",
+        "log_sha256": "94df72fea51923e65570f0d31adae86829f292a60f4345556a00ff922c46ea6b",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 3.37s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "oversize",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--test",
+          "multi_server",
+          "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 3.46,
+        "log": "/tmp/canopy-head-summary-oversize.log",
+        "log_sha256": "23884c775d6f7881e59108944a126d597d41de4ec683833504f5c14485bcaa74",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 3.01s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "discovery",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--test",
+          "multi_server",
+          "discovery::repository_discovery_filters_current_acl_and_pages_past_revoked_grants_after_restore",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 17.48,
+        "log": "/tmp/canopy-head-summary-discovery.log",
+        "log_sha256": "df9a69863e3a37d28bc2cd69527e8cc693409e2496e2ef61bc728a75bade3dc5",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 16.82s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 49.73,
+        "log": "/tmp/canopy-head-summary-clippy.log",
+        "log_sha256": "4bb7f80a2815bf59e3f974d5dfb1de1bf100921e2447b23d3711499424ca8f98",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 752.49,
+        "log": "/tmp/canopy-head-summary-workspace.log",
+        "log_sha256": "19f36a54bae4605e03eaae1589326930e1a9e489a53a5f86ab908bb5dd898311",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.24s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.33s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 749 filtered out; finished in 0.02s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 749 filtered out; finished in 0.08s",
+          "test result: ok. 750 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 368.86s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.86s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s",
+          "test result: FAILED. 88 passed; 19 failed; 9 ignored; 0 measured; 0 filtered out; finished in 356.93s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.17s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.27s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 37.81,
+        "log": "/tmp/canopy-head-summary-build.log",
+        "log_sha256": "11cf025f5bfca56d93bd55b71e03567bca9d33b71f423acf7a41267601acb381",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.24,
+        "log": "/tmp/canopy-head-summary-fmt.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 40.72,
+        "log": "/tmp/canopy-head-summary-harness.log",
+        "log_sha256": "a7ed82283e322c3e506901e2d379125e1be1f3822667d0f370332df1766b8fcd",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.05,
+        "log": "/tmp/canopy-head-summary-diff.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "source_unchanged": true,
+    "release_qualified": false
+  },
+  "failing_first": {
+    "clean_parent_public_default_branch": {
+      "log": "/tmp/canopy-native-head-public-before.log",
+      "log_sha256": "ba806d827d81625e54d412e81a3fd7f88b474850093d75f983faf55a462000b6",
+      "exit_code": 101
+    },
+    "intermediate_reader_root_mutation": {
+      "source_digest": "339f988252be032ec41515870febc1b6be3e523e4fc273eee4fd0d959cf41491",
+      "workspace": {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 680.59,
+        "log": "/tmp/canopy-native-head-final-workspace-final.log",
+        "log_sha256": "9137bc5e321ad9f8f7346088998ab91224de47be89b44fd9a490f02e9b5cbc70",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.67s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.24s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 749 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 749 filtered out; finished in 0.09s",
+          "test result: ok. 750 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 291.00s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.54s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s",
+          "test result: FAILED. 84 passed; 23 failed; 9 ignored; 0 measured; 0 filtered out; finished in 367.95s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.45s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.24s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+          "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+          "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::cold_activation::competing_cold_gateway_waits_for_the_winners_serving_handle",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::cold_activation::simultaneous_cold_gateways_follow_the_winning_live_owner",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "workspace::new_repositories_bootstrap_the_production_packed_catalog_before_becoming_ready",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      "new_regressions": [
+        "peers::cold_activation::competing_cold_gateway_waits_for_the_winners_serving_handle",
+        "peers::cold_activation::simultaneous_cold_gateways_follow_the_winning_live_owner",
+        "workspace::new_repositories_bootstrap_the_production_packed_catalog_before_becoming_ready"
+      ],
+      "current_assertions_unchanged": true
+    }
+  },
+  "parent_linux": {
+    "pr": {
+      "status": {
+        "conclusion": "failure",
+        "headSha": "7c232ea0d4d384c0ac2c5cf0dc401ce454e1a00f",
+        "jobs": [
+          {
+            "completedAt": "2026-10-05T23:03:59Z",
+            "conclusion": "failure",
+            "databaseId": 112013399366,
+            "name": "rust",
+            "startedAt": "2026-10-05T22:43:06Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T22:43:08Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T22:43:07Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:09Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T22:43:08Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:17Z",
+                "conclusion": "success",
+                "name": "Install tools",
+                "number": 3,
+                "startedAt": "2026-10-05T22:43:09Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:18Z",
+                "conclusion": "success",
+                "name": "Report tool versions",
+                "number": 4,
+                "startedAt": "2026-10-05T22:43:17Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:21Z",
+                "conclusion": "success",
+                "name": "Check formatting",
+                "number": 5,
+                "startedAt": "2026-10-05T22:43:18Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:45:07Z",
+                "conclusion": "success",
+                "name": "Check lints",
+                "number": 6,
+                "startedAt": "2026-10-05T22:43:21Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:03:56Z",
+                "conclusion": "failure",
+                "name": "Test",
+                "number": 7,
+                "startedAt": "2026-10-05T22:45:07Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:03:56Z",
+                "conclusion": "skipped",
+                "name": "Qualify Git compatibility against RustFS",
+                "number": 8,
+                "startedAt": "2026-10-05T23:03:56Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:03:56Z",
+                "conclusion": "skipped",
+                "name": "Build server",
+                "number": 9,
+                "startedAt": "2026-10-05T23:03:56Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:03:57Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 18,
+                "startedAt": "2026-10-05T23:03:56Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:03:57Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 19,
+                "startedAt": "2026-10-05T23:03:57Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37384217476/job/112013399366"
+          },
+          {
+            "completedAt": "2026-10-05T22:43:48Z",
+            "conclusion": "success",
+            "databaseId": 112013399624,
+            "name": "harness",
+            "startedAt": "2026-10-05T22:43:06Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T22:43:08Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T22:43:07Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:09Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T22:43:08Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:46Z",
+                "conclusion": "success",
+                "name": "Check Python qualification harness",
+                "number": 3,
+                "startedAt": "2026-10-05T22:43:09Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:46Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 6,
+                "startedAt": "2026-10-05T22:43:46Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:46Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 7,
+                "startedAt": "2026-10-05T22:43:46Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37384217476/job/112013399624"
+          }
+        ],
+        "status": "completed"
+      },
+      "log": "/tmp/canopy-native-head-parent-pr-full.log",
+      "log_sha256": "76a03be5961d7cbda6d6a8078f3a1fa58ad2d6483b81222b1c6e2647878b7668"
+    },
+    "push": {
+      "status": {
+        "conclusion": "failure",
+        "headSha": "7c232ea0d4d384c0ac2c5cf0dc401ce454e1a00f",
+        "jobs": [
+          {
+            "completedAt": "2026-10-05T23:09:18Z",
+            "conclusion": "failure",
+            "databaseId": 112013378631,
+            "name": "rust",
+            "startedAt": "2026-10-05T22:43:02Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T22:43:03Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T22:43:03Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:05Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T22:43:03Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:11Z",
+                "conclusion": "success",
+                "name": "Install tools",
+                "number": 3,
+                "startedAt": "2026-10-05T22:43:05Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:12Z",
+                "conclusion": "success",
+                "name": "Report tool versions",
+                "number": 4,
+                "startedAt": "2026-10-05T22:43:11Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:16Z",
+                "conclusion": "success",
+                "name": "Check formatting",
+                "number": 5,
+                "startedAt": "2026-10-05T22:43:12Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:45:32Z",
+                "conclusion": "success",
+                "name": "Check lints",
+                "number": 6,
+                "startedAt": "2026-10-05T22:43:16Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:09:16Z",
+                "conclusion": "failure",
+                "name": "Test",
+                "number": 7,
+                "startedAt": "2026-10-05T22:45:32Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:09:16Z",
+                "conclusion": "skipped",
+                "name": "Qualify Git compatibility against RustFS",
+                "number": 8,
+                "startedAt": "2026-10-05T23:09:16Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:09:16Z",
+                "conclusion": "skipped",
+                "name": "Build server",
+                "number": 9,
+                "startedAt": "2026-10-05T23:09:16Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:09:17Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 18,
+                "startedAt": "2026-10-05T23:09:16Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T23:09:17Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 19,
+                "startedAt": "2026-10-05T23:09:17Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37384211402/job/112013378631"
+          },
+          {
+            "completedAt": "2026-10-05T22:43:46Z",
+            "conclusion": "success",
+            "databaseId": 112013378871,
+            "name": "harness",
+            "startedAt": "2026-10-05T22:43:03Z",
+            "status": "completed",
+            "steps": [
+              {
+                "completedAt": "2026-10-05T22:43:05Z",
+                "conclusion": "success",
+                "name": "Set up job",
+                "number": 1,
+                "startedAt": "2026-10-05T22:43:04Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:06Z",
+                "conclusion": "success",
+                "name": "Run actions/checkout@v4",
+                "number": 2,
+                "startedAt": "2026-10-05T22:43:05Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:44Z",
+                "conclusion": "success",
+                "name": "Check Python qualification harness",
+                "number": 3,
+                "startedAt": "2026-10-05T22:43:06Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:44Z",
+                "conclusion": "success",
+                "name": "Post Run actions/checkout@v4",
+                "number": 6,
+                "startedAt": "2026-10-05T22:43:44Z",
+                "status": "completed"
+              },
+              {
+                "completedAt": "2026-10-05T22:43:44Z",
+                "conclusion": "success",
+                "name": "Complete job",
+                "number": 7,
+                "startedAt": "2026-10-05T22:43:44Z",
+                "status": "completed"
+              }
+            ],
+            "url": "https://github.com/crabbuild/canopy/actions/runs/37384211402/job/112013378871"
+          }
+        ],
+        "status": "completed"
+      },
+      "log": "/tmp/canopy-native-head-parent-push-full.log",
+      "log_sha256": "f26b54c4c98260645dd196a9929491fa66b0fa6965a8790e9c31057b61d15597"
+    }
+  },
+  "remaining_failed_cases": [
+    "candidates::conflicts_and_unrelated_histories_never_publish_and_stale_candidates_cannot_merge",
+    "candidates::candidate_native_graph_and_paths_preserve_git_semantics",
+    "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+    "candidates::native_candidates_are_fetchable_checked_and_recover_before_atomic_merge",
+    "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+    "leased_server_recovers_two_repositories_with_git_and_lfs",
+    "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+    "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+    "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+    "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+    "rebase::rebase_conflicts_limits_and_stale_publication_keep_branches_unchanged",
+    "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+    "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+    "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+    "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+    "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+    "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+    "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+    "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+    "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+    "repository_cell_publishes_objects_and_refs_atomically",
+    "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+  ],
+  "fixed_from_intermediate_inventory": [
+    "comparison::comparison_rejects_oversized_change_sets_without_partial_results",
+    "peers::cold_activation::competing_cold_gateway_waits_for_the_winners_serving_handle",
+    "peers::cold_activation::simultaneous_cold_gateways_follow_the_winning_live_owner",
+    "workspace::new_repositories_bootstrap_the_production_packed_catalog_before_becoming_ready"
+  ],
+  "new_failed_from_intermediate_inventory": [],
+  "limits": [
+    "Full CI remains incomplete if any workspace target fails. No workflow, test, ignored-case status or root-mutation assertion was weakened.",
+    "No provider deletion, final retained-root inventory or large-team capacity qualification.",
+    "SDK revision, protected original index and historical progress archive remain unchanged."
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 86a8cd57..3877502a 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -17,6 +17,56 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Native symbolic HEAD publication (2026-10-05 checkpoint)
+
+The stock-Git default-branch regression failed before this change: the API
+reported success but an unborn Unicode clone still selected `refs/heads/main`.
+The public writer had changed legacy SQL HEAD while native Git read the accepted
+immutable snapshot. The HTTP writer now uses resident staging and operation 54
+codec 1. Discovery and HEAD GET read the existing constant-size summary with
+current ACL in the same observation. Native pushes, reviewed merges and HEAD
+updates maintain that summary atomically with their immutable ref snapshots;
+the merge proof binds the prepared snapshot generation in operation 9 codec 7.
+Metadata reads acquire no pin and publish no root. The detached SQL setter fails
+closed.
+
+The private factory retains the existing ref tree and creates a new snapshot
+header. It checks the target through an exact tree lookup; one live cursor seek
+checks whether any branch exists, skipping deleted subtrees. The final owner
+transaction checks current ACL, actual fence, original pin, expiry, retention
+and joint-root CAS, then commits roots, immutable original outcome, checkpoint,
+attempt closure and its compact recovery journal atomically. The new permanent
+outcome selector reuses `GenerationFact` and the existing 512-byte phase limit.
+Typed retirement verifies selected snapshot headers and preserves the original
+SDK receipt before releasing the transient pin; it grants no provider deletion.
+
+Three actual Cell regression families pass in both Git formats. They cover
+unchanged tree/ref versions, request-purpose binding, absent registration, late
+SQL rollback with absent SDK acceptance, current owner/expiry/generation/target
+denials, cold absent recovery after revocation or expiry, missing metadata
+retaining a pin, immutable outcome rows, and receipt recovery on a fresh owner
+after deleting command bodies. The original public stock-Git case, repository
+metadata/ACL/restore case, branch-deletion case, registry and all-target Clippy
+also pass. The complete current-source validation results are recorded in
+[evidence](evidence/native-head-ci-20261005.json).
+
+The corrected source's full workspace diagnostic passes all 750 server library
+cases. Multi-server finishes with 88 passed, 19 failed and nine ignored; the
+three detached owner-restart, repository-cell and smart-HTTP targets each fail.
+Clippy, production build, formatting and all 96 Python harness cases pass.
+Both cold-gateway root-equality cases, pristine-bootstrap custody-count case and
+oversized-comparison case now pass in the full run with unchanged assertions.
+The intermediate serving-pin reader failed those cases and was corrected before
+commit. This is a completed diagnostic inventory, not a green CI result.
+
+Both Linux Verify runs on parent `7c232ea` completed with 747 passing library
+cases and the branch-deletion regression passing; their multi-server inventories
+were 88 passed, 23 failed and nine ignored. They confirm the previous recovery
+race fix but are not qualification of this HEAD source. Full CI and the capacity
+goal remain open. Generated candidates/merges, line threads, detached legacy
+Cell fixtures/writers, selective fetch, peer/backup restore, retention/collection,
+final DDL, acceleration and workload qualification remain required.
+
 ## Resident recovery discovery race (2026-10-05 checkpoint)
 
 The two Linux Verify jobs on `8230922` add a branch-deletion failure with HTTP
@@ -108,7 +158,7 @@ and production-build phases were skipped, and exact new-head Linux validation
 remains required.
 
 Next: complete resident generated candidate production and atomic Ready/catalog/
-fetch-ref publication, then native merge/squash/rebase, default-branch and thread
+fetch-ref publication, then native merge/squash/rebase and thread
 writers. Qualify cancellation, lost acknowledgements, startup adoption and
 retention, resolve remaining full CI failures, and complete peer/backup recovery,
 selective fetch, physical collection/final DDL, acceleration/fair maintenance,

From 68dad78c6bf125c95fdb13d289553e7a8ac9d485 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 18:10:00 -0700
Subject: [PATCH 47/55] fix: publish generated candidates and reviewed merges
 through native catalogs

---
 .../src/git_cache/maintenance.rs              |   2 +
 crates/canopy-server/src/git_cache/mod.rs     |   5 +-
 .../src/git_gateway/candidates/mod.rs         |  80 ++--
 .../src/git_gateway/candidates/produce.rs     | 406 ++++++++++++++++++
 .../src/git_gateway/candidates/rebase.rs      |  18 +-
 crates/canopy-server/src/git_gateway/merge.rs |   7 +-
 crates/canopy-server/src/git_gateway/mod.rs   | 202 +--------
 .../src/git_gateway/push/native.rs            |   2 +-
 crates/canopy-server/src/git_http/capture.rs  | 145 +++++--
 crates/canopy-server/src/git_objects/mod.rs   |  74 +---
 crates/canopy-server/src/lib.rs               |  16 +
 crates/canopy-server/src/pack_store.rs        |  99 +----
 .../candidate_publication/audit.rs            | 307 +++++++++++++
 .../publication/candidate_publication/mod.rs  | 323 ++++++++++++++
 .../candidate_publication/publish.rs          | 223 ++++++++++
 .../src/packs/publication/coordinator.rs      |   2 +
 .../coordinator/native_candidate.rs           |  76 ++++
 .../src/packs/publication/coordinator/work.rs |   5 +
 .../src/packs/publication/mod.rs              |   8 +
 .../src/packs/publication/native_merge.rs     | 163 ++++++-
 .../packs/publication/native_merge/audit.rs   |  83 +++-
 .../src/packs/publication/recovery/archive.rs |  30 ++
 .../src/packs/publication/recovery/codec.rs   |   4 +
 .../src/packs/publication/recovery/mod.rs     |  35 +-
 .../src/packs/publication/recovery/phase.rs   |   6 +-
 .../src/packs/publication/recovery/ready.rs   |   4 +
 .../src/packs/publication/registry.rs         |  11 +-
 .../src/packs/publication/schema.sql          |  19 +-
 .../publication/staging_service/driver.rs     |  29 ++
 .../src/packs/publication/tests.rs            |   1 +
 .../tests/candidate_publication.rs            | 316 ++++++++++++++
 .../publication/tests/native_candidate.rs     |  14 +-
 .../publication/tests/staging_service.rs      |  71 +++
 .../src/packs/ref_state/transition.rs         |  42 ++
 .../canopy-server/src/pulls/candidates/mod.rs |  16 +-
 crates/canopy-server/src/pulls/merge/mod.rs   |  13 +-
 .../native-generated-candidate-publication.md | 103 +++++
 ...ive-generated-publication-ci-20261005.json | 319 ++++++++++++++
 .../large-repository-implementation-status.md |  42 +-
 39 files changed, 2833 insertions(+), 488 deletions(-)
 create mode 100644 crates/canopy-server/src/git_gateway/candidates/produce.rs
 create mode 100644 crates/canopy-server/src/packs/publication/candidate_publication/audit.rs
 create mode 100644 crates/canopy-server/src/packs/publication/candidate_publication/mod.rs
 create mode 100644 crates/canopy-server/src/packs/publication/candidate_publication/publish.rs
 create mode 100644 crates/canopy-server/src/packs/publication/coordinator/native_candidate.rs
 create mode 100644 crates/canopy-server/src/packs/publication/tests/candidate_publication.rs
 create mode 100644 docs/design/native-generated-candidate-publication.md
 create mode 100644 docs/evidence/native-generated-publication-ci-20261005.json

diff --git a/crates/canopy-server/src/git_cache/maintenance.rs b/crates/canopy-server/src/git_cache/maintenance.rs
index 4193a43a..4b2e3683 100644
--- a/crates/canopy-server/src/git_cache/maintenance.rs
+++ b/crates/canopy-server/src/git_cache/maintenance.rs
@@ -14,6 +14,7 @@ fn worker_error(error: GitHttpError) -> CacheError {
 
 // Follow physical pack order to retain delta-base locality while verifying large
 // histories. Hash order forces needless repeated decompression of distant bases.
+#[cfg(test)]
 fn index_order(path: &Path, format: crate::ObjectFormat) -> io::Result<Vec<crate::ObjectId>> {
     let data = fs::read(path)?;
     let validated = crate::git_format::pack_index::PackIndex::open(path, format)?;
@@ -82,6 +83,7 @@ impl GitCache {
             .expect("durable inventory poisoned")
             .insert(sha);
     }
+    #[cfg(test)]
     pub(crate) async fn pack_sources(
         self: &Arc<Self>,
     ) -> Result<Vec<(crate::ObjectId, PathBuf, PathBuf, Vec<crate::ObjectId>)>, CacheError> {
diff --git a/crates/canopy-server/src/git_cache/mod.rs b/crates/canopy-server/src/git_cache/mod.rs
index 77009cf5..51018bd4 100644
--- a/crates/canopy-server/src/git_cache/mod.rs
+++ b/crates/canopy-server/src/git_cache/mod.rs
@@ -193,7 +193,7 @@ impl GitCache {
         Ok(self.reservation()?.bytes())
     }
 
-    fn writer(self: &Arc<Self>, relative: &Path) -> io::Result<CacheWriter> {
+    pub(crate) fn writer(self: &Arc<Self>, relative: &Path) -> io::Result<CacheWriter> {
         let path = self.git_dir().join(relative);
         if let Some(parent) = path.parent() {
             fs::create_dir_all(parent)?;
@@ -458,6 +458,7 @@ impl GitCache {
     }
 
     /// Measures native Git's completed writes before the gateway can publish refs.
+    #[cfg(test)]
     pub(crate) async fn reconcile(self: &Arc<Self>) -> Result<(), CacheError> {
         self.reconcile_owned(Arc::new(())).await
     }
@@ -562,7 +563,7 @@ impl Drop for GitCache {
     }
 }
 
-struct CacheWriter {
+pub(crate) struct CacheWriter {
     file: File,
     cache: Arc<GitCache>,
 }
diff --git a/crates/canopy-server/src/git_gateway/candidates/mod.rs b/crates/canopy-server/src/git_gateway/candidates/mod.rs
index 91b65ade..7fd91e2c 100644
--- a/crates/canopy-server/src/git_gateway/candidates/mod.rs
+++ b/crates/canopy-server/src/git_gateway/candidates/mod.rs
@@ -14,7 +14,9 @@ use cellule_runtime::InvocationError;
 use std::process::{ExitStatus, Stdio};
 use tokio::io::AsyncWriteExt;
 
+mod produce;
 mod rebase;
+pub(crate) use produce::ProducedCandidate;
 
 impl GitGateway {
     pub(crate) async fn prepare_candidate(
@@ -23,9 +25,6 @@ impl GitGateway {
         number: i64,
         request: CandidateRequest,
     ) -> Result<CandidateOutcome, GatewayError> {
-        // Serialize native mutations with pushes; each candidate still gets a
-        // disposable cache. The Cell command rechecks refs and authority later.
-        let _push = self.push.lock().await;
         let identity = new_identity()?;
         let reserved = self
             .candidate_command(CandidateAction::Reserve {
@@ -41,45 +40,7 @@ impl GitGateway {
         if candidate.result != CandidateResult::Pending {
             return Ok(CandidateOutcome::Applied(candidate));
         }
-        let policy = self
-            .repository
-            .pull_review_policy(actor, number)
-            .await
-            .map_err(|error| GatewayError::Cell(Box::new(error)))?
-            .output;
-        if policy.is_none_or(|policy| {
-            !policy.ready || policy.revision.as_ref() != Some(&candidate.request.revision)
-        }) {
-            return Ok(CandidateOutcome::Conflict);
-        }
-        let cached = self.build_cache(actor, &[]).await?;
-        let result = prepare_native(&self.repository, &cached.backend, &candidate).await?;
-        if !valid_result(&result) {
-            return Err(GitHttpError::TooLarge.into());
-        }
-        cached.backend.cache.reconcile().await?;
-        if let CandidateResult::Ready { oid, .. } = &result {
-            let plan = PushPlan {
-                actor: actor.into(),
-                updates: vec![RefUpdate {
-                    name: candidate.fetch_ref(),
-                    expected: None,
-                    new_oid: Some(parse_oid(oid)?),
-                }],
-            };
-            self.persist_objects(&cached.backend, &cached.refs, &plan)
-                .await?;
-            self.repository
-                .prepare_graph(&plan)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-        }
-        self.candidate_command(CandidateAction::Finish {
-            actor: actor.into(),
-            id: candidate.request.id,
-            result,
-        })
-        .await
+        self.publish_candidate(*candidate).await
     }
 
     async fn candidate_command(
@@ -99,12 +60,13 @@ impl GitGateway {
 }
 
 async fn prepare_native(
-    repository: &RepositoryCell,
+    context: &crate::packs::publication::StagingContext,
     backend: &GitHttpBackend,
     candidate: &MergeCandidate,
 ) -> Result<CandidateResult, GatewayError> {
     let revision = &candidate.request.revision;
     let related = run(
+        context,
         backend,
         &["merge-base", &revision.base_oid, &revision.source_oid],
         b"",
@@ -118,12 +80,18 @@ async fn prepare_native(
     }
     if candidate.request.strategy == MergeStrategy::Rebase {
         let common = output_oid(&related.stdout)?;
-        return rebase::prepare(repository, backend, candidate, &common).await;
+        return rebase::prepare(context, backend, candidate, &common).await;
     }
     // Native merge-tree consolidates multiple merge bases itself. Never select
     // one merge base or infer a clean result from an empty conflict-path list.
-    let (tree_oid, conflict) =
-        merge_tree(backend, &revision.base_oid, &revision.source_oid, None).await?;
+    let (tree_oid, conflict) = merge_tree(
+        context,
+        backend,
+        &revision.base_oid,
+        &revision.source_oid,
+        None,
+    )
+    .await?;
     if let Some(conflict) = conflict {
         return Ok(conflict);
     }
@@ -146,7 +114,7 @@ async fn prepare_native(
     if !message.ends_with('\n') {
         message.push('\n');
     }
-    let commit = run(backend, &args, message.as_bytes(), &environment).await?;
+    let commit = run(context, backend, &args, message.as_bytes(), &environment).await?;
     if !commit.status.success() {
         return Err(commit.error());
     }
@@ -166,6 +134,7 @@ fn output_oid(bytes: &[u8]) -> Result<String, GatewayError> {
 }
 
 async fn merge_tree(
+    context: &crate::packs::publication::StagingContext,
     backend: &GitHttpBackend,
     base: &str,
     source: &str,
@@ -184,7 +153,7 @@ async fn merge_tree(
         args.push(&explicit);
     }
     args.extend([base, source]);
-    let merged = run(backend, &args, b"", &[]).await?;
+    let merged = run(context, backend, &args, b"", &[]).await?;
     if !matches!(merged.status.code(), Some(0 | 1)) {
         return Err(merged.error());
     }
@@ -235,10 +204,21 @@ impl Output {
     }
 }
 pub(super) async fn run(
+    context: &crate::packs::publication::StagingContext,
+    backend: &GitHttpBackend,
+    args: &[&str],
+    input: &[u8],
+    environment: &[(&str, &str)],
+) -> Result<Output, GatewayError> {
+    run_owned(backend, args, input, environment, context.physical_owner()).await
+}
+
+pub(super) async fn run_owned(
     backend: &GitHttpBackend,
     args: &[&str],
     input: &[u8],
     environment: &[(&str, &str)],
+    owner: crate::git_objects::ReadOwner,
 ) -> Result<Output, GatewayError> {
     let mut command = crate::native_git::command(&backend.git_dir())?;
     command
@@ -251,7 +231,7 @@ pub(super) async fn run(
         .stderr(Stdio::piped());
     let mut process = GitProcess::spawn(
         command,
-        Arc::clone(&backend.cache),
+        (Arc::clone(&backend.cache), owner),
         backend
             .cache
             .native
@@ -281,7 +261,7 @@ pub(super) async fn run(
             drop(stdin);
             Ok::<_, GitHttpError>(())
         },
-        read_bounded(stdout, 128 * 1024),
+        read_bounded(stdout, 300 * 1024),
         read_bounded(stderr, 64 * 1024)
     )?;
     let status = process.wait().await?;
diff --git a/crates/canopy-server/src/git_gateway/candidates/produce.rs b/crates/canopy-server/src/git_gateway/candidates/produce.rs
new file mode 100644
index 00000000..b2d85902
--- /dev/null
+++ b/crates/canopy-server/src/git_gateway/candidates/produce.rs
@@ -0,0 +1,406 @@
+//! A resident producer owns native Git, exact generated inputs and final dispatch.
+use super::*;
+use crate::git_gateway::push::native::{active, bound, checkpoint, final_publication};
+use crate::packs::{
+    catalog::{CatalogFileLimits, CatalogFiles, CatalogIndexes},
+    metadata::MetadataLimits,
+    publication::{
+        BeginRequest, CandidatePublicationReply, CatalogPreparation, DEFAULT_LEASE_MS,
+        PublicationCoordinator, PublicationError, PublicationOutcome, StagingCoordinator,
+        StagingError, StagingState, StagingTicket,
+    },
+    sources::NativePackDescriptor,
+    verification::{NativeMetadataLimits, PhysicalLimits, PhysicalVerifier},
+};
+use std::io::Write;
+
+/// Only the native producer can construct this witness. A client Ready DTO
+/// cannot obtain authority to install a server-owned candidate ref.
+pub(crate) struct ProducedCandidate {
+    candidate: MergeCandidate,
+    operation: [u8; 16],
+}
+impl ProducedCandidate {
+    #[cfg(test)]
+    pub(crate) fn verified_fixture(candidate: MergeCandidate, operation: [u8; 16]) -> Self {
+        Self {
+            candidate,
+            operation,
+        }
+    }
+    pub(crate) fn candidate(&self) -> &MergeCandidate {
+        &self.candidate
+    }
+    pub(crate) fn operation(&self) -> [u8; 16] {
+        self.operation
+    }
+}
+fn work(error: impl StdError + Send + Sync + 'static) -> StagingError {
+    StagingError::Input(Box::new(error))
+}
+fn failed(error: impl StdError + Send + Sync + 'static) -> GatewayError {
+    GatewayError::Cell(Box::new(error))
+}
+
+impl GitGateway {
+    pub(super) async fn publish_candidate(
+        &self,
+        candidate: MergeCandidate,
+    ) -> Result<CandidateOutcome, GatewayError> {
+        let bytes = serde_json::to_vec(&candidate).map_err(failed)?;
+        let mut digest = blake3::Hasher::new();
+        digest.update(b"canopy.generated-candidate-workflow.v1\0");
+        digest.update(&self.repository.repository_id());
+        digest.update(&bytes);
+        let staging = self.repository.staging_coordinator().map_err(failed)?;
+        let request = BeginRequest {
+            repository: self.repository.repository_id(),
+            operation: uuid::Uuid::new_v4().into_bytes(),
+            request_digest: *digest.finalize().as_bytes(),
+            actor: candidate.actor.clone(),
+            lease_ms: DEFAULT_LEASE_MS,
+        };
+        // Serialize admission only: observers of the same frozen candidate
+        // join its original owner and never race independent generated work.
+        let admission = self.push.lock().await;
+        let ticket = if let Some(ticket) =
+            staging.join_generated_candidate(&request).map_err(failed)?
+        {
+            ticket
+        } else {
+            let ready = staging
+                .ready_request(request, new_identity()?)
+                .await
+                .map_err(failed)?;
+            let ticket = staging.submit(ready).map_err(|(error, _)| failed(error))?;
+            let gateway = self.clone();
+            let owner = staging.clone();
+            let produced = candidate.clone();
+            ticket
+                .drive(move |ticket, publication| async move {
+                    Box::pin(gateway.drive_candidate(owner, ticket, publication, produced)).await
+                })
+                .map_err(failed)?;
+            ticket
+        };
+        drop(admission);
+        let number = candidate.number;
+        let actor = candidate.actor.clone();
+        let id = candidate.request.id.clone();
+        let reply = match ticket.wait_completion().await {
+            StagingState::Published(Ok(PublicationOutcome::Candidate(value))) => value.output,
+            StagingState::Published(Err(error)) => match error.as_ref() {
+                PublicationError::Candidate(InvocationError::Rejected(value)) => {
+                    value.output.clone()
+                }
+                _ => return Err(failed(error)),
+            },
+            StagingState::Uncertain(error) | StagingState::Fenced(error) => {
+                return Err(failed(error));
+            }
+            _ => return Err(failed(StagingError::NotReady)),
+        };
+        match reply {
+            CandidatePublicationReply::Applied {
+                id: selected,
+                digest,
+                publication,
+            } => {
+                if uuid::Uuid::from_bytes(selected).to_string() != id {
+                    return Err(failed(StagingError::Context));
+                }
+                let Some(candidate) = self
+                    .repository
+                    .merge_candidate(actor.as_str(), number, &id)
+                    .await
+                    .map_err(failed)?
+                    .output
+                else {
+                    return Ok(CandidateOutcome::NotFound);
+                };
+                let bytes = serde_json::to_vec(&candidate).map_err(failed)?;
+                if *blake3::hash(&bytes).as_bytes() != digest
+                    || matches!(candidate.result, CandidateResult::Ready { .. })
+                        != publication.is_some()
+                {
+                    return Err(failed(StagingError::Context));
+                }
+                Ok(CandidateOutcome::Applied(Box::new(candidate)))
+            }
+            CandidatePublicationReply::NotFound => Ok(CandidateOutcome::NotFound),
+            CandidatePublicationReply::Forbidden => Ok(CandidateOutcome::Forbidden),
+            CandidatePublicationReply::Conflict => Ok(CandidateOutcome::Conflict),
+            CandidatePublicationReply::Denied(_) => Ok(CandidateOutcome::Conflict),
+        }
+    }
+
+    async fn drive_candidate(
+        &self,
+        staging: Arc<StagingCoordinator>,
+        ticket: StagingTicket,
+        publication: PublicationCoordinator,
+        mut candidate: MergeCandidate,
+    ) -> Result<(), StagingError> {
+        active(&staging, &ticket).await?;
+        let gateway = self.clone();
+        let (produced, packs, certificate) = ticket
+            .spawn(move |context| async move {
+                let cached = gateway
+                    .build_cache(&candidate.actor, &[])
+                    .await
+                    .map_err(work)?;
+                candidate.result = prepare_native(&context, &cached.backend, &candidate)
+                    .await
+                    .map_err(work)?;
+                if !valid_result(&candidate.result) {
+                    return Err(work(GitHttpError::TooLarge));
+                }
+                let packs = if matches!(candidate.result, CandidateResult::Ready { .. }) {
+                    generated_pack(&context, &cached.backend, &gateway.artifacts)
+                        .await
+                        .map_err(work)?
+                } else {
+                    vec![]
+                };
+                let certificate = context
+                    .seal_native_inputs(gateway.artifacts.clone(), packs.iter().copied())
+                    .await
+                    .map_err(work)?;
+                let operation = context.token()?.operation;
+                Ok((
+                    ProducedCandidate {
+                        candidate,
+                        operation,
+                    },
+                    packs,
+                    certificate,
+                ))
+            })?
+            .wait()
+            .await
+            .map_err(work)?;
+        checkpoint(&staging, &ticket, certificate).await?;
+        let mut metadata = Vec::with_capacity(packs.len());
+        for pack in packs {
+            let gateway = self.clone();
+            metadata.push(
+                ticket
+                    .spawn(move |context| async move {
+                        PhysicalVerifier::download_staged(
+                            &context,
+                            &gateway.scratch_root,
+                            gateway.disk_budget.clone(),
+                            &gateway.artifacts,
+                            pack,
+                            PhysicalLimits::default(),
+                            gateway.native.clone(),
+                        )
+                        .await
+                        .map_err(work)?
+                        .stage_metadata(NativeMetadataLimits::default())
+                        .await
+                        .map_err(work)
+                    })?
+                    .wait()
+                    .await
+                    .map_err(work)?,
+            );
+        }
+        ticket.seal()?;
+        bound(&staging, &ticket).await?;
+        let format = self.repository.object_format();
+        let indexes = Arc::new(CatalogIndexes::new(self.artifacts.clone(), format));
+        let files = Arc::new(
+            CatalogFiles::new(
+                &self.scratch_root,
+                self.disk_budget.clone(),
+                self.artifacts.clone(),
+                format,
+                CatalogFileLimits::default(),
+            )
+            .map_err(work)?
+            .with_native(self.native.clone()),
+        );
+        let base = Arc::new(ticket.open_base(indexes, files).await?);
+        let gateway = self.clone();
+        let ready = ticket
+            .spawn_bound(move |_, context| async move {
+                let mut builder = CatalogPreparation::new_staged(
+                    &context,
+                    &gateway.scratch_root,
+                    gateway.disk_budget.clone(),
+                    base,
+                    MetadataLimits::default(),
+                )
+                .await
+                .map_err(work)?;
+                for staged in metadata {
+                    builder.add_staged_pack(staged).await.map_err(work)?;
+                }
+                let prepared = Arc::new(builder.finish().await.map_err(work)?);
+                prepared
+                    .ready_native_candidate(
+                        new_identity().map_err(work)?,
+                        &produced,
+                        &gateway.scratch_root,
+                        gateway.disk_budget.clone(),
+                        MetadataLimits::default(),
+                    )
+                    .await
+                    .map_err(work)
+            })?
+            .wait()
+            .await
+            .map_err(work)?;
+        let registered = ready
+            .persist_recovery(&self.artifacts, new_identity().map_err(work)?)
+            .await
+            .map_err(work)?;
+        let ready = ready
+            .bind_recovery(registered, &self.artifacts)
+            .map_err(work)?;
+        let observer = ticket
+            .publish_wait(&publication, ready)
+            .await
+            .map_err(work)?;
+        match final_publication(&staging, &ticket, &observer).await {
+            Ok(PublicationOutcome::Candidate(_)) => Ok(()),
+            Err(StagingError::Publication(error))
+                if matches!(
+                    error.as_ref(),
+                    PublicationError::Candidate(InvocationError::Rejected(_))
+                ) =>
+            {
+                Ok(())
+            }
+            Err(error) => Err(error),
+            _ => Err(StagingError::Context),
+        }
+    }
+}
+
+/// Pack only newly written loose objects. The base is composed of immutable
+/// catalog packs, so this work and input size follow generated changes rather
+/// than every historical object. Git resolves any deltas against these inputs
+/// and emits a non-thin pack. The spool is disk-admitted and memory stays bounded.
+async fn generated_pack(
+    context: &crate::packs::publication::StagingContext,
+    backend: &GitHttpBackend,
+    store: &canopy_object_storage::artifact::ArtifactStore,
+) -> Result<Vec<NativePackDescriptor>, GatewayError> {
+    let cache = backend.cache.clone();
+    let owner = context.physical_owner();
+    let format = context.format();
+    let operation = context.token().map_err(failed)?.artifact_operation;
+    let relative = PathBuf::from(format!("canopy-generated-{}.oids", hex::encode(operation)));
+    let spool = relative.clone();
+    let claim = cache
+        .native
+        .try_admit(crate::native_resources::NativeWork::Read)?;
+    let count = tokio::task::spawn_blocking(move || {
+        let _owner = owner;
+        let _claim = claim;
+        let fence =
+            crate::native_git::lock_file(&cache.git_dir().join(crate::native_git::WORKER_LOCK))?;
+        fence.try_lock().map_err(std::io::Error::from)?;
+        let mut writer = cache.writer(&spool)?;
+        let mut count = 0u64;
+        for directory in std::fs::read_dir(cache.git_dir().join("objects"))? {
+            let directory = directory?;
+            let prefix = directory.file_name();
+            let prefix = prefix
+                .to_str()
+                .ok_or_else(|| std::io::Error::other("non-UTF8 loose object directory"))?;
+            if matches!(prefix, "pack" | "info") {
+                continue;
+            }
+            if prefix.len() != 2
+                || !prefix
+                    .bytes()
+                    .all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase())
+                || !directory.file_type()?.is_dir()
+            {
+                return Err(std::io::Error::other(
+                    "invalid generated loose object directory",
+                ));
+            }
+            for entry in std::fs::read_dir(directory.path())? {
+                let entry = entry?;
+                let name = entry.file_name();
+                let name = name
+                    .to_str()
+                    .ok_or_else(|| std::io::Error::other("invalid loose object name"))?;
+                let oid = format!("{prefix}{name}");
+                if !entry.file_type()?.is_file()
+                    || oid.len() != format.bytes() * 2
+                    || crate::ObjectId::from_hex(&oid).is_err()
+                {
+                    return Err(std::io::Error::other("invalid generated loose object"));
+                }
+                count += 1;
+                // A fixed ceiling bounds request-private enumeration; disk
+                // reservation independently enforces the service's byte limit.
+                if count > 1_000_000 {
+                    return Err(std::io::Error::other("generated object limit"));
+                }
+                writeln!(writer, "{oid}")?;
+            }
+        }
+        writer.flush()?;
+        drop(writer);
+        fence.unlock()?;
+        Ok::<_, std::io::Error>(count)
+    })
+    .await
+    .map_err(failed)??;
+    if count == 0 {
+        return Ok(vec![]);
+    }
+    context.ensure_live().map_err(failed)?;
+    let prefix = backend
+        .git_dir()
+        .join("objects/pack")
+        .join(format!("canopy-generated-{}", hex::encode(operation)));
+    let mut command = crate::native_git::command(&backend.git_dir())?;
+    command
+        .arg("--git-dir")
+        .arg(backend.git_dir())
+        .args(["pack-objects", "--no-reuse-object", "--no-reuse-delta"])
+        .arg(prefix)
+        .stdin(std::fs::File::open(backend.git_dir().join(relative))?)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    let mut process = GitProcess::spawn(
+        command,
+        (backend.cache.clone(), context.physical_owner()),
+        backend
+            .cache
+            .native
+            .try_admit(crate::native_resources::NativeWork::Pack)?,
+    )?;
+    let stdout = process
+        .child
+        .stdout
+        .take()
+        .ok_or(GitHttpError::Interrupted)?;
+    let stderr = process
+        .child
+        .stderr
+        .take()
+        .ok_or(GitHttpError::Interrupted)?;
+    let (stdout, stderr) =
+        tokio::try_join!(read_bounded(stdout, 128), read_bounded(stderr, 64 << 10))?;
+    let status = process.wait().await?;
+    if !status.success() {
+        return Err(GitHttpError::GitExit {
+            status,
+            stderr: String::from_utf8_lossy(&stderr).into_owned(),
+        }
+        .into());
+    }
+    let checksum = output_oid(&stdout)?;
+    backend
+        .stage_generated_pack(context, store, PhysicalLimits::default(), &checksum)
+        .await
+        .map_err(failed)
+}
diff --git a/crates/canopy-server/src/git_gateway/candidates/rebase.rs b/crates/canopy-server/src/git_gateway/candidates/rebase.rs
index f6d70565..2443acb3 100644
--- a/crates/canopy-server/src/git_gateway/candidates/rebase.rs
+++ b/crates/canopy-server/src/git_gateway/candidates/rebase.rs
@@ -5,7 +5,7 @@ use crate::pulls::candidates::{
 };
 
 pub(super) async fn prepare(
-    repository: &RepositoryCell,
+    context: &crate::packs::publication::StagingContext,
     backend: &GitHttpBackend,
     candidate: &MergeCandidate,
     common: &str,
@@ -15,6 +15,7 @@ pub(super) async fn prepare(
     let range = format!("{}..{}", revision.base_oid, revision.source_oid);
     let limit = format!("--max-count={}", MAX_COMMITS + 1);
     let listed = run(
+        context,
         backend,
         &["rev-list", "--reverse", "--topo-order", &limit, &range],
         b"",
@@ -36,7 +37,7 @@ pub(super) async fn prepare(
     let mut parent = common;
     for commit in &commits {
         parse_oid(commit)?;
-        let size = run(backend, &["cat-file", "-s", commit], b"", &[]).await?;
+        let size = run(context, backend, &["cat-file", "-s", commit], b"", &[]).await?;
         if !size.status.success() {
             return Err(size.error());
         }
@@ -47,7 +48,7 @@ pub(super) async fn prepare(
         if size > MAX_COMMIT_BYTES {
             return unavailable(RebaseUnavailable::Limit);
         }
-        let original = run(backend, &["cat-file", "commit", commit], b"", &[]).await?;
+        let original = run(context, backend, &["cat-file", "commit", commit], b"", &[]).await?;
         if !original.status.success() {
             return Err(original.error());
         }
@@ -55,6 +56,7 @@ pub(super) async fn prepare(
             // Detect topology from Git rather than treating arbitrary malformed
             // headers as a merge. Neither case is silently flattened or dropped.
             let parents = run(
+                context,
                 backend,
                 &["rev-list", "--parents", "-n", "1", commit],
                 b"",
@@ -84,17 +86,16 @@ pub(super) async fn prepare(
     if parent != revision.source_oid {
         return Err(GatewayError::MalformedCache);
     }
-    repository
-        .prepare_ancestry(parse_oid(common)?, parse_oid(&revision.base_oid)?)
-        .await
-        .map_err(|error| GatewayError::Cell(Box::new(error)))?;
+    // Native merge-base established this boundary. The private catalog
+    // verifier checks the generated chain and its base closure before publication.
     let mut current = revision.base_oid.clone();
     let mut tree_oid = String::new();
     for (source, bytes) in commits.into_iter().zip(originals) {
         let original = Commit::parse(&bytes).ok_or(GatewayError::MalformedCache)?;
         // Replaying one change uses its original parent as the explicit base;
         // recomputing a merge base would replay the entire branch instead.
-        let (tree, conflict) = merge_tree(backend, &current, source, Some(original.parent)).await?;
+        let (tree, conflict) =
+            merge_tree(context, backend, &current, source, Some(original.parent)).await?;
         if let Some(conflict) = conflict {
             return Ok(conflict);
         }
@@ -103,6 +104,7 @@ pub(super) async fn prepare(
             return unavailable(RebaseUnavailable::Limit);
         }
         let written = run(
+            context,
             backend,
             &["hash-object", "-t", "commit", "-w", "--stdin"],
             &body,
diff --git a/crates/canopy-server/src/git_gateway/merge.rs b/crates/canopy-server/src/git_gateway/merge.rs
index fe35560b..8b642680 100644
--- a/crates/canopy-server/src/git_gateway/merge.rs
+++ b/crates/canopy-server/src/git_gateway/merge.rs
@@ -12,7 +12,7 @@ use crate::{
             StagingTicket,
         },
     },
-    pulls::merge::{MergeOutcome, MergeRequest, MergeStrategy, command::MergeInput, valid_request},
+    pulls::merge::{MergeOutcome, MergeRequest, command::MergeInput, valid_request},
 };
 use cellule_runtime::{
     InvocationError,
@@ -58,11 +58,6 @@ impl GitGateway {
             Some(role) if role < TokenScope::Write => return Ok(MergeOutcome::Forbidden),
             _ => {}
         }
-        if request.strategy != MergeStrategy::FastForward {
-            return Err(failed(cellule_runtime::Error::Command(
-                "native generated merge preparation is unavailable",
-            )));
-        }
         let input = MergeInput {
             actor: actor.into(),
             number,
diff --git a/crates/canopy-server/src/git_gateway/mod.rs b/crates/canopy-server/src/git_gateway/mod.rs
index 3f4d1c51..4a9ecf47 100644
--- a/crates/canopy-server/src/git_gateway/mod.rs
+++ b/crates/canopy-server/src/git_gateway/mod.rs
@@ -1,9 +1,10 @@
 //! Durable bridge from Git smart HTTP to one repository's SQLite Cell.
 
+use crate::ObjectKind;
 use crate::ReadIdentity;
 
 use std::{
-    collections::{BTreeMap, BTreeSet, HashSet},
+    collections::{BTreeMap, BTreeSet},
     error::Error as StdError,
     path::{Path, PathBuf},
     sync::Arc,
@@ -18,20 +19,18 @@ use object_store::ObjectStore;
 use tokio::sync::{Mutex, OnceCell};
 
 use crate::{
-    INLINE_OBJECT_LIMIT, ObjectBatch, ObjectKind, ObjectStorage, PushPlan, RefExpectation,
-    RefUpdate, RepositoryCell, StoredObject,
-    blob::{LargeBlobError, LargeBlobStore},
+    PushPlan, RefExpectation, RefUpdate, RepositoryCell,
+    blob::LargeBlobError,
     directory::TokenScope,
     git_cache::CacheError,
     git_http::{GitHttpBackend, GitHttpError, GitHttpRequest, GitHttpResponse},
     git_input::{GitInput, InputError, MAX_FETCH_REQUEST_BYTES},
-    git_objects::GitObjects,
     lfs::LfsService,
     push::PushError,
 };
 
 mod branch_policy;
-mod candidates;
+pub(crate) mod candidates;
 mod discovery;
 mod fetch;
 mod head;
@@ -89,8 +88,7 @@ pub struct GitGateway {
     repository: Arc<RepositoryCell>,
     signer_directory: Option<Arc<crate::directory::DirectoryCell>>,
     certificate_seed: Arc<OnceCell<[u8; 32]>>,
-    large_blobs: Arc<LargeBlobStore>,
-    pack_reader: Arc<crate::pack_store::PackReader>,
+    _pack_reader: Arc<crate::pack_store::PackReader>,
     lfs: Arc<LfsService>,
     artifacts: Arc<canopy_object_storage::artifact::ArtifactStore>,
     scratch_root: PathBuf,
@@ -108,10 +106,6 @@ impl GitGateway {
         native: crate::native_resources::NativeResources,
     ) -> Self {
         let native = native.scope(crate::native_resources::NativeClass::Foreground);
-        let large_blobs = Arc::new(LargeBlobStore::new(
-            Arc::clone(&blob_store),
-            repository.repository_id(),
-        ));
         let artifacts = Arc::new(canopy_object_storage::artifact::ArtifactStore::new(
             Arc::clone(&blob_store),
             repository.repository_id(),
@@ -139,8 +133,7 @@ impl GitGateway {
             repository,
             signer_directory: None,
             certificate_seed: Arc::new(OnceCell::new()),
-            large_blobs,
-            pack_reader,
+            _pack_reader: pack_reader,
             lfs,
             artifacts,
             scratch_root,
@@ -351,184 +344,6 @@ impl GitGateway {
             .with_nonce(self.certificate_nonce().await?);
         Ok(CachedRepository { backend, refs })
     }
-
-    async fn persist_objects(
-        &self,
-        backend: &GitHttpBackend,
-        before: &BTreeMap<String, RefExpectation>,
-        plan: &PushPlan,
-    ) -> Result<(), GatewayError> {
-        let included: Vec<_> = plan
-            .updates
-            .iter()
-            .filter_map(|update| update.new_oid)
-            .collect();
-        if included.is_empty() {
-            return Ok(());
-        }
-        // Published refs already have durable graph closure. Excluding them avoids
-        // re-reading old history; the final Cell transaction still verifies every new tip.
-        let excluded = before.values().filter_map(|state| state.oid).collect();
-        let started = std::time::Instant::now();
-        let mut sources = backend.cache.pack_sources().await?;
-        let mut archive = None;
-        let mut packed_ids = None;
-        if sources.len() == 1 {
-            let (hash, pack, index, ids) = sources.pop().ok_or(GatewayError::MalformedCache)?;
-            let record = crate::pack_store::PackRecord {
-                hash,
-                pack: self.pack_reader.upload(pack).await?,
-                index: self.pack_reader.upload(index).await?,
-                approved: false,
-            };
-            self.repository
-                .register_pack(new_identity()?, &record)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-            archive = Some(record);
-            packed_ids = Some(ids);
-        }
-        let mut objects = if let Some(ids) = packed_ids {
-            GitObjects::packed(&backend.git_dir(), ids, &backend.cache.native)?
-        } else {
-            GitObjects::start(
-                &backend.git_dir(),
-                included,
-                excluded,
-                &backend.cache.native,
-            )?
-        };
-
-        let mut batch = ObjectBatch::default();
-        let mut verified = HashSet::new();
-        let mut logged = std::time::Instant::now();
-        loop {
-            let mut candidates = Vec::with_capacity(crate::object_batch::MAX_BATCH_OBJECTS);
-            for _ in 0..crate::object_batch::MAX_BATCH_OBJECTS {
-                let Some(oid) = objects.next().await? else {
-                    break;
-                };
-                candidates.push(oid);
-            }
-            if candidates.is_empty() {
-                break;
-            }
-            let present = self
-                .repository
-                .canonical_headers(&candidates)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-            for oid in candidates {
-                if let Some((kind, size, digest)) = present.get(&oid) {
-                    if archive.is_some() {
-                        objects
-                            .read(oid)
-                            .await?
-                            .verify(*kind, *size, *digest)
-                            .await?;
-                        verified.insert(oid);
-                    }
-                    continue;
-                }
-                let mut input = objects.read(oid).await?;
-                let object = if input.kind == ObjectKind::Blob && archive.is_some() {
-                    let size = input.size;
-                    let digest = input.fingerprint().await?;
-                    StoredObject {
-                        oid,
-                        kind: ObjectKind::Blob,
-                        storage: ObjectStorage::Packed {
-                            size,
-                            blake3: digest,
-                            pack: archive
-                                .as_ref()
-                                .ok_or(GatewayError::MalformedCache)?
-                                .pack
-                                .sha256,
-                        },
-                    }
-                } else if input.kind == ObjectKind::Blob && input.size > INLINE_OBJECT_LIMIT as u64
-                {
-                    let uploaded = self
-                        .large_blobs
-                        .put(oid, input.size, &mut input.reader)
-                        .await?;
-                    input.finish().await?;
-                    StoredObject {
-                        oid,
-                        kind: ObjectKind::Blob,
-                        storage: ObjectStorage::External {
-                            size: uploaded.size,
-                            blake3: uploaded.blake3,
-                            sha256: uploaded.sha256,
-                        },
-                    }
-                } else {
-                    let (kind, body) = input.body().await?;
-                    if body.len() > INLINE_OBJECT_LIMIT {
-                        self.repository
-                            .stage_object(new_identity()?, kind, &body)
-                            .await
-                            .map_err(|error| GatewayError::Cell(Box::new(error)))?
-                    } else if let Some(record) =
-                        archive.as_ref().filter(|_| kind == ObjectKind::Blob)
-                    {
-                        StoredObject {
-                            oid,
-                            kind,
-                            storage: ObjectStorage::Packed {
-                                size: body.len() as u64,
-                                blake3: *blake3::hash(&body).as_bytes(),
-                                pack: record.pack.sha256,
-                            },
-                        }
-                    } else {
-                        StoredObject {
-                            oid,
-                            kind,
-                            storage: ObjectStorage::Inline(body),
-                        }
-                    }
-                };
-                if let Err(object) = batch.try_push(object) {
-                    self.repository
-                        .put_objects(new_identity()?, std::mem::take(&mut batch))
-                        .await
-                        .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-                    batch
-                        .try_push(object)
-                        .map_err(|_| GatewayError::MalformedCache)?;
-                }
-                verified.insert(oid);
-            }
-            if logged.elapsed().as_secs() >= 10 {
-                tracing::info!(
-                    objects = verified.len(),
-                    elapsed_seconds = started.elapsed().as_secs_f64(),
-                    "persisting Git objects"
-                );
-                logged = std::time::Instant::now();
-            }
-        }
-        objects.finish().await?;
-        if !batch.is_empty() {
-            self.repository
-                .put_objects(new_identity()?, batch)
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-        }
-        if let Some(record) = &archive {
-            self.repository
-                .approve_pack(new_identity()?, record.pack.sha256, verified.len())
-                .await
-                .map_err(|error| GatewayError::Cell(Box::new(error)))?;
-        }
-        tracing::info!(
-            elapsed_seconds = started.elapsed().as_secs_f64(),
-            "persisted Git objects"
-        );
-        Ok(())
-    }
 }
 
 fn with_push_id<B>(mut response: GitHttpResponse<B>, id: [u8; 16]) -> GitHttpResponse<B> {
@@ -583,11 +398,12 @@ async fn git_refs(
     for page in ref_pages(names, 32, 64 << 10) {
         let mut input = page.join("\n").into_bytes();
         input.push(b'\n');
-        let output = candidates::run(
+        let output = candidates::run_owned(
             backend,
             &["cat-file", "--batch-check=%(objectname)"],
             &input,
             &[],
+            Arc::new(()),
         )
         .await?;
         if !output.status.success() {
diff --git a/crates/canopy-server/src/git_gateway/push/native.rs b/crates/canopy-server/src/git_gateway/push/native.rs
index 974dae16..68460e0c 100644
--- a/crates/canopy-server/src/git_gateway/push/native.rs
+++ b/crates/canopy-server/src/git_gateway/push/native.rs
@@ -503,7 +503,7 @@ pub(in crate::git_gateway) async fn bound(
         }
     }
 }
-async fn checkpoint(
+pub(in crate::git_gateway) async fn checkpoint(
     staging: &StagingCoordinator,
     ticket: &StagingTicket,
     proof: NativeInputCertificate,
diff --git a/crates/canopy-server/src/git_http/capture.rs b/crates/canopy-server/src/git_http/capture.rs
index 97e3388a..656457b5 100644
--- a/crates/canopy-server/src/git_http/capture.rs
+++ b/crates/canopy-server/src/git_http/capture.rs
@@ -219,37 +219,128 @@ impl GitHttpBackend {
         })
         .await??;
         context.ensure_live()?;
-        let mut inputs = Vec::with_capacity(pairs.len());
-        for Pair {
-            mut native,
-            pack,
-            index,
-        } in pairs
+        upload_pairs(context, store, pairs).await
+    }
+
+    /// Only the producer's exact newly generated pair is captured. Existing
+    /// immutable base packs and loose intermediates are never re-ingested.
+    pub(crate) async fn stage_generated_pack(
+        &self,
+        context: &StagingContext,
+        store: &ArtifactStore,
+        limits: PhysicalLimits,
+        checksum: &str,
+    ) -> Result<Vec<NativePackDescriptor>, NativeCaptureError> {
+        let token = context.token()?;
+        let format = context.format();
+        if token.repository != store.repository()
+            || format != self.cache.object_format
+            || checksum.len() != format.bytes() * 2
+            || !checksum
+                .bytes()
+                .all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase())
         {
-            context.ensure_live()?;
-            native.pack = upload_file(
-                pack,
-                store,
-                native.key(ArtifactKind::Pack)?,
-                native.pack.size,
-                native.pack.digest,
-            )
-            .await?;
-            context.ensure_live()?;
-            native.index = upload_file(
-                index,
-                store,
-                native.key(ArtifactKind::Index)?,
-                native.index.size,
-                native.index.digest,
-            )
-            .await?;
-            context.ensure_live()?;
-            inputs.push(native);
+            return Err(NativeCaptureError::Context);
         }
+        let _selection = self.cache.selection.lock().await;
+        self.cache.reconcile_owned(context.physical_owner()).await?;
+        let cache = self.cache.clone();
+        let owner = context.physical_owner();
+        let checksum = checksum.to_owned();
+        let claim = cache
+            .native
+            .try_admit(crate::native_resources::NativeWork::Read)?;
+        let pair = tokio::task::spawn_blocking(move || {
+            let _claim = claim;
+            let fence = crate::native_git::lock_file(
+                &cache.git_dir().join(crate::native_git::WORKER_LOCK),
+            )?;
+            fence.try_lock().map_err(std::io::Error::from)?;
+            let pin = Arc::new(CapturePin {
+                _fence: fence,
+                cache,
+                _owner: owner,
+            });
+            let path = pin.cache.git_dir().join("objects/pack").join(format!(
+                "canopy-generated-{}-{}.pack",
+                hex::encode(token.artifact_operation),
+                checksum
+            ));
+            let index_path = path.with_extension("idx");
+            if !std::fs::symlink_metadata(&path)?.is_file()
+                || !std::fs::symlink_metadata(&index_path)?.is_file()
+            {
+                return Err(NativeCaptureError::Context);
+            }
+            if std::fs::metadata(&path)?.len() > limits.max_pack_bytes
+                || std::fs::metadata(&index_path)?.len() > limits.max_index_bytes
+            {
+                return Err(NativeCaptureError::Limit);
+            }
+            let native = NativePackDescriptor::inspect_files(
+                token.repository,
+                token.artifact_operation,
+                format,
+                &path,
+                &index_path,
+            )?;
+            if hex::encode(native.git_checksum) != checksum
+                || NativePackDescriptor::is_empty_pair(format, &path, &index_path)?
+            {
+                return Err(NativeCaptureError::Context);
+            }
+            Ok::<_, NativeCaptureError>(Pair {
+                native,
+                pack: Arc::new(InputFile {
+                    path,
+                    _pin: pin.clone(),
+                }),
+                index: Arc::new(InputFile {
+                    path: index_path,
+                    _pin: pin,
+                }),
+            })
+        })
+        .await??;
+        upload_pairs(context, store, vec![pair]).await
+    }
+}
+
+async fn upload_pairs(
+    context: &StagingContext,
+    store: &ArtifactStore,
+    pairs: Vec<Pair>,
+) -> Result<Vec<NativePackDescriptor>, NativeCaptureError> {
+    let mut inputs = Vec::with_capacity(pairs.len());
+    for Pair {
+        mut native,
+        pack,
+        index,
+    } in pairs
+    {
+        context.ensure_live()?;
+        native.pack = upload_file(
+            pack,
+            store,
+            native.key(ArtifactKind::Pack)?,
+            native.pack.size,
+            native.pack.digest,
+        )
+        .await?;
+        context.ensure_live()?;
+        native.index = upload_file(
+            index,
+            store,
+            native.key(ArtifactKind::Index)?,
+            native.index.size,
+            native.index.digest,
+        )
+        .await?;
         context.ensure_live()?;
-        Ok(inputs)
+        inputs.push(native);
     }
+    context.ensure_live()?;
+    Ok(inputs)
 }
 
 #[cfg(test)]
diff --git a/crates/canopy-server/src/git_objects/mod.rs b/crates/canopy-server/src/git_objects/mod.rs
index fe593e9f..ae8d4fff 100644
--- a/crates/canopy-server/src/git_objects/mod.rs
+++ b/crates/canopy-server/src/git_objects/mod.rs
@@ -9,7 +9,9 @@ use tokio::{
 };
 use tokio_util::task::AbortOnDropHandle;
 
-use crate::{INLINE_OBJECT_LIMIT, ObjectKind, object_id};
+#[cfg(test)]
+use crate::INLINE_OBJECT_LIMIT;
+use crate::{ObjectKind, object_id};
 
 const IO_TIMEOUT: Duration = Duration::from_secs(120);
 const HEADER_LIMIT: usize = 128;
@@ -43,6 +45,7 @@ struct Process {
 }
 
 impl Process {
+    #[cfg(test)]
     fn start(
         git_dir: &Path,
         args: &[&str],
@@ -118,12 +121,14 @@ impl Process {
     }
 }
 
+#[cfg(test)]
 pub(crate) struct GitObjectWalk {
     process: Process,
     revisions: AbortOnDropHandle<Result<(), io::Error>>,
     missing_only: bool,
 }
 
+#[cfg(test)]
 impl GitObjectWalk {
     #[cfg(test)]
     pub(crate) fn missing(
@@ -170,6 +175,7 @@ impl GitObjectWalk {
         })
     }
 
+    #[cfg(test)]
     pub(crate) async fn next(&mut self) -> Result<Option<crate::ObjectId>, ObjectReadError> {
         timeout(IO_TIMEOUT, async {
             while let Some(line) = header(&mut self.process.output).await? {
@@ -199,7 +205,9 @@ impl GitObjectWalk {
 }
 
 pub(crate) struct GitObjects {
+    #[cfg(test)]
     walk: Option<GitObjectWalk>,
+    #[cfg(test)]
     inventory: Option<std::vec::IntoIter<crate::ObjectId>>,
     batch: Process,
     requests: ChildStdin,
@@ -217,6 +225,7 @@ pub trait EdgeSink: Send {
 }
 
 impl GitObjects {
+    #[cfg(test)]
     pub(crate) fn start(
         git_dir: &Path,
         included: Vec<crate::ObjectId>,
@@ -227,6 +236,7 @@ impl GitObjects {
         let (batch, requests) = Process::start(git_dir, &["cat-file", "--batch"], native)?;
         Ok(Self {
             walk: Some(walk),
+            #[cfg(test)]
             inventory: None,
             batch,
             requests,
@@ -234,6 +244,7 @@ impl GitObjects {
         })
     }
 
+    #[cfg(test)]
     pub(crate) fn packed(
         git_dir: &Path,
         ids: Vec<crate::ObjectId>,
@@ -246,6 +257,7 @@ impl GitObjects {
 
     /// Persistent native reader with caller-owned bounded index iteration.
     /// Verification uses an isolated admitted object directory without alternates.
+    #[cfg(test)]
     pub(crate) fn batch(
         git_dir: &Path,
         native: &crate::native_resources::NativeScope,
@@ -263,7 +275,9 @@ impl GitObjects {
         let (batch, requests) =
             Process::start_owned(git_dir, &["cat-file", "--batch"], native, owner)?;
         Ok(Self {
+            #[cfg(test)]
             walk: None,
+            #[cfg(test)]
             inventory: None,
             batch,
             requests,
@@ -324,6 +338,7 @@ impl GitObjects {
         Ok(canonical)
     }
 
+    #[cfg(test)]
     pub(crate) async fn next(&mut self) -> Result<Option<crate::ObjectId>, ObjectReadError> {
         if self.inspection_failed {
             return Err(ObjectReadError::Malformed);
@@ -338,6 +353,7 @@ impl GitObjects {
             .await
     }
 
+    #[cfg(test)]
     pub(crate) async fn read(
         &mut self,
         oid: crate::ObjectId,
@@ -360,6 +376,7 @@ impl GitObjects {
             return Err(ObjectReadError::Malformed);
         }
         timeout(IO_TIMEOUT, async move {
+            #[cfg(test)]
             if let Some(walk) = self.walk {
                 walk.finish().await?;
             }
@@ -454,60 +471,6 @@ impl<R: AsyncRead + Unpin> GitObject<'_, R> {
         }
         Ok(result)
     }
-    /// Verify a packed body with constant memory, including oversized blobs.
-    pub(crate) async fn fingerprint(mut self) -> Result<[u8; 32], ObjectReadError> {
-        let expected = self.oid;
-        let mut canonical =
-            crate::git_format::ObjectHasher::new(expected.format(), self.kind, self.size);
-        let mut hash = blake3::Hasher::new();
-        let mut buffer = vec![0; 64 << 10];
-        loop {
-            let count = timeout(IO_TIMEOUT, self.reader.read(&mut buffer))
-                .await
-                .map_err(|_| ObjectReadError::Timeout)??;
-            if count == 0 {
-                break;
-            }
-            canonical.update(&buffer[..count]);
-            hash.update(&buffer[..count]);
-        }
-        self.finish().await?;
-        if canonical.finalize() != expected {
-            return Err(ObjectReadError::Malformed);
-        }
-        Ok(*hash.finalize().as_bytes())
-    }
-
-    pub(crate) async fn verify(
-        mut self,
-        kind: ObjectKind,
-        size: u64,
-        digest: [u8; 32],
-    ) -> Result<(), ObjectReadError> {
-        if self.kind != kind || self.size != size {
-            return Err(ObjectReadError::Malformed);
-        }
-        let expected = self.oid;
-        let mut canonical = crate::git_format::ObjectHasher::new(expected.format(), kind, size);
-        let mut hash = blake3::Hasher::new();
-        let mut buffer = vec![0; 64 << 10];
-        loop {
-            let count = timeout(IO_TIMEOUT, self.reader.read(&mut buffer))
-                .await
-                .map_err(|_| ObjectReadError::Timeout)??;
-            if count == 0 {
-                break;
-            }
-            canonical.update(&buffer[..count]);
-            hash.update(&buffer[..count]);
-        }
-        self.finish().await?;
-        if canonical.finalize() != expected || hash.finalize().as_bytes() != &digest {
-            return Err(ObjectReadError::Malformed);
-        }
-        Ok(())
-    }
-
     async fn body_verified(
         mut self,
         expected: crate::packs::metadata::CanonicalObject,
@@ -541,6 +504,7 @@ impl<R: AsyncRead + Unpin> GitObject<'_, R> {
         .await?
     }
 
+    #[cfg(test)]
     pub(crate) async fn body(mut self) -> Result<(ObjectKind, Vec<u8>), ObjectReadError> {
         let limit = if self.kind == ObjectKind::Blob {
             INLINE_OBJECT_LIMIT
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index a7edd2d0..6f074196 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -275,6 +275,19 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("packs/publication/native_candidate.rs"));
                 source.update(include_bytes!("packs/publication/native_merge.rs"));
                 source.update(include_bytes!("packs/publication/native_head.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/candidate_publication/mod.rs"
+                ));
+                source.update(include_bytes!(
+                    "packs/publication/candidate_publication/publish.rs"
+                ));
+                source.update(include_bytes!(
+                    "packs/publication/candidate_publication/audit.rs"
+                ));
+                source.update(include_bytes!(
+                    "packs/publication/coordinator/native_candidate.rs"
+                ));
+                source.update(include_bytes!("git_gateway/candidates/produce.rs"));
                 source.update(include_bytes!("packs/publication/native_head/publish.rs"));
                 source.update(include_bytes!(
                     "packs/publication/coordinator/native_head.rs"
@@ -299,6 +312,9 @@ impl CellModule for RepositoryModule {
                     "packs/publication/initialization/publish.rs"
                 ));
                 source.update(include_bytes!("packs/publication/staging_service.rs"));
+                source.update(include_bytes!(
+                    "packs/publication/staging_service/driver.rs"
+                ));
                 source.update(include_bytes!("packs/publication/staging_receipt.rs"));
                 source.update(include_bytes!("packs/publication/admission_receipt.rs"));
                 source.update(include_bytes!("packs/publication/custody/mod.rs"));
diff --git a/crates/canopy-server/src/pack_store.rs b/crates/canopy-server/src/pack_store.rs
index 368e303b..1cab3aa1 100644
--- a/crates/canopy-server/src/pack_store.rs
+++ b/crates/canopy-server/src/pack_store.rs
@@ -8,11 +8,11 @@ use crate::{
 };
 use cellule_ltx::DiskBudget;
 use cellule_runtime::{
-    Error, InvocationError, MutationIdentity,
+    Error, InvocationError,
     primitives::sql::{SqlBatch, SqlResultSet, SqlStatement, SqlValue},
 };
 use object_store::ObjectStore;
-use std::{collections::BTreeMap, path::PathBuf, sync::Arc};
+use std::{path::PathBuf, sync::Arc};
 use tokio::sync::Mutex;
 
 #[derive(Clone)]
@@ -178,6 +178,7 @@ impl PackReader {
         }
         Ok(body)
     }
+    #[cfg(test)]
     pub(crate) async fn upload(&self, path: PathBuf) -> Result<LargeBlobReference, GatewayError> {
         let hash_path = path.clone();
         let (oid, size) = tokio::task::spawn_blocking(move || {
@@ -333,98 +334,4 @@ impl RepositoryCell {
                 .ok_or_else(invalid)?,
         )
     }
-    pub(crate) async fn register_pack(
-        &self,
-        identity: MutationIdentity,
-        record: &PackRecord,
-    ) -> Result<(), ReadError> {
-        let values = vec![
-            SqlValue::Blob(record.pack.sha256.to_vec()),
-            SqlValue::Blob(record.hash.to_vec()),
-            SqlValue::Blob(record.pack.oid.to_vec()),
-            SqlValue::Integer(record.pack.size.try_into().map_err(|_| invalid())?),
-            SqlValue::Blob(record.pack.blake3.to_vec()),
-            SqlValue::Blob(record.index.oid.to_vec()),
-            SqlValue::Integer(record.index.size.try_into().map_err(|_| invalid())?),
-            SqlValue::Blob(record.index.blake3.to_vec()),
-            SqlValue::Blob(record.index.sha256.to_vec()),
-        ];
-        let result = self.sql.batch(identity, SqlBatch { statements: vec![
-            SqlStatement { sql: "INSERT INTO git_packs (sha256, pack_hash, pack_oid, pack_size, pack_digest, index_oid, index_size, index_digest, index_sha256) VALUES (?1,?2,?3,?4,?5,?6,?7,?8,?9) ON CONFLICT DO NOTHING".into(), parameters: values },
-        ] }).await?;
-        drop(result);
-        let stored = self.pack_record(record.pack.sha256).await?;
-        if stored.hash != record.hash
-            || stored.pack.oid != record.pack.oid
-            || stored.pack.size != record.pack.size
-            || stored.pack.blake3 != record.pack.blake3
-            || stored.index.oid != record.index.oid
-            || stored.index.size != record.index.size
-            || stored.index.blake3 != record.index.blake3
-            || stored.index.sha256 != record.index.sha256
-        {
-            return Err(invalid());
-        }
-        Ok(())
-    }
-    pub(crate) async fn approve_pack(
-        &self,
-        identity: MutationIdentity,
-        sha: [u8; 32],
-        verified_count: usize,
-    ) -> Result<(), ReadError> {
-        self.sql
-            .batch(
-                identity,
-                SqlBatch {
-                    statements: vec![SqlStatement {
-                        // Every unique index member has a matching canonical SQL row.
-                        // Equal cardinality proves this pack covers the entire immutable
-                        // object table at this transaction, without scanning it on recovery.
-                        sql: "UPDATE git_packs SET approved = 1, covered_through = CASE WHEN ?2 = (SELECT COUNT(oid) FROM objects) THEN (SELECT COALESCE(MAX(sequence), 0) FROM objects) ELSE covered_through END WHERE sha256 = ?1".into(),
-                        parameters: vec![SqlValue::Blob(sha.to_vec()), SqlValue::Integer(verified_count.try_into().map_err(|_| invalid())?)],
-                    }],
-                },
-            )
-            .await?;
-        Ok(())
-    }
-    pub(crate) async fn canonical_headers(
-        &self,
-        ids: &[ObjectId],
-    ) -> Result<BTreeMap<ObjectId, (ObjectKind, u64, [u8; 32])>, ReadError> {
-        if ids.is_empty() || ids.len() > crate::object_batch::MAX_BATCH_OBJECTS {
-            return Err(invalid());
-        }
-        let placeholders = vec!["?"; ids.len()].join(",");
-        let result = self.sql.query(None, SqlBatch { statements: vec![SqlStatement { sql: format!("SELECT oid, kind, size, digest FROM objects WHERE oid IN ({placeholders})"), parameters: ids.iter().map(|oid| SqlValue::Blob(oid.to_vec())).collect() }] }).await?;
-        let mut headers = BTreeMap::new();
-        for row in &result.output.first().ok_or_else(invalid)?.rows {
-            let [
-                SqlValue::Blob(oid),
-                SqlValue::Text(kind),
-                SqlValue::Integer(size),
-                SqlValue::Blob(digest),
-            ] = row.as_slice()
-            else {
-                return Err(invalid());
-            };
-            let kind = match kind.as_str() {
-                "blob" => ObjectKind::Blob,
-                "tree" => ObjectKind::Tree,
-                "commit" => ObjectKind::Commit,
-                "tag" => ObjectKind::Tag,
-                _ => return Err(invalid()),
-            };
-            headers.insert(
-                oid.as_slice().try_into().map_err(|_| invalid())?,
-                (
-                    kind,
-                    (*size).try_into().map_err(|_| invalid())?,
-                    digest.as_slice().try_into().map_err(|_| invalid())?,
-                ),
-            );
-        }
-        Ok(headers)
-    }
 }
diff --git a/crates/canopy-server/src/packs/publication/candidate_publication/audit.rs b/crates/canopy-server/src/packs/publication/candidate_publication/audit.rs
new file mode 100644
index 00000000..e83fe6c4
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/candidate_publication/audit.rs
@@ -0,0 +1,307 @@
+//! Permanent selected Ready roots; negative results need only the frozen editorial row.
+use super::super::sql::*;
+use super::*;
+use crate::packs::{
+    catalog::CatalogSnapshot,
+    directory::index::IndexError,
+    input_artifact::{INPUT_ROOT_BYTES, StoredInputRoot},
+    ref_state::{RefSnapshotError, RefStateError, RefStateIndex},
+};
+use canopy_object_storage::artifact::{ArtifactKind, ArtifactStore};
+const DOMAIN: &[u8] = b"canopy.generated-candidate-audit.v1\0";
+pub(in crate::packs::publication) const SAVED: &str = "SELECT binding,pull_number,actor,request,created_ms,result,native_publication FROM merge_candidates WHERE id=?1";
+#[derive(Debug, thiserror::Error)]
+pub enum NativeCandidateAuditError {
+    #[error("candidate audit codec failed")]
+    Codec(#[from] CodecError),
+    #[error("candidate audit root failed")]
+    Root(#[from] crate::packs::InputRootError),
+    #[error("candidate audit catalog failed")]
+    Catalog(#[from] IndexError),
+    #[error("candidate audit refs failed")]
+    Refs(#[from] RefStateError),
+    #[error("candidate audit snapshot failed")]
+    Snapshot(#[from] RefSnapshotError),
+    #[error("candidate audit context differs")]
+    Context,
+}
+#[derive(Clone, Debug)]
+pub(in crate::packs::publication) struct Selected {
+    pub reply: CandidatePublicationReply,
+    pub root: Option<StoredInputRoot>,
+}
+impl WireValue for Selected {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.reply.encode(e)?;
+        self.root.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        Ok(Self {
+            reply: CandidatePublicationReply::decode(d)?,
+            root: Option::decode(d)?,
+        })
+    }
+}
+pub(in crate::packs::publication) struct Audit {
+    pub candidate: MergeCandidate,
+    pub catalog: StoredCatalog,
+    refs: RefStateSnapshotRoot,
+    generation: u64,
+    ref_generation: u64,
+}
+impl WireValue for Audit {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if !matches!(self.candidate.result, CandidateResult::Ready { .. })
+            || self.generation == 0
+            || self.ref_generation == 0
+            || self.ref_generation > self.generation
+        {
+            return Err(CodecError::Invalid("candidate audit scope"));
+        }
+        e.write_bytes(DOMAIN)?;
+        e.write_bytes(&candidate_bytes(&self.candidate)?)?;
+        self.catalog.encode(e)?;
+        self.refs.encode(e)?;
+        e.write_u64(self.generation)?;
+        e.write_u64(self.ref_generation)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if d.read_bytes()? != DOMAIN {
+            return Err(CodecError::Invalid("candidate audit purpose"));
+        }
+        let value = Self {
+            candidate: serde_json::from_slice(d.read_bytes()?)
+                .map_err(|_| CodecError::Invalid("candidate audit value"))?,
+            catalog: StoredCatalog::decode(d)?,
+            refs: RefStateSnapshotRoot::decode(d)?,
+            generation: d.read_u64()?,
+            ref_generation: d.read_u64()?,
+        };
+        value.encode(&mut BoundedEncoder::new(INPUT_ROOT_BYTES)?)?;
+        Ok(value)
+    }
+}
+pub(super) async fn prepare(
+    prepared: &PreparedCatalog,
+    candidate: &MergeCandidate,
+    refs: RefStateSnapshotRoot,
+    ref_generation: u64,
+) -> Result<StoredInputRoot, NativeCandidatePublicationError> {
+    let value = Audit {
+        candidate: candidate.clone(),
+        catalog: prepared.catalog(),
+        refs,
+        generation: prepared.base().generation + 1,
+        ref_generation,
+    };
+    Ok(StoredInputRoot::upload(
+        &prepared.base.indexes().store(),
+        prepared.token().artifact_operation,
+        &value,
+        INPUT_ROOT_BYTES,
+    )
+    .await?)
+}
+type CandidateRow = (Vec<u8>, MergeCandidate, Option<Selected>);
+
+pub(super) fn row(sets: &[SqlResultSet]) -> Result<Option<CandidateRow>, Error> {
+    let Some(row) = rows(sets)?.first() else {
+        return Ok(None);
+    };
+    if row.len() != 7 {
+        return Err(Error::Command("invalid candidate audit row"));
+    }
+    let (binding, candidate) = crate::pulls::candidates::decode(&[SqlResultSet {
+        columns: vec![],
+        rows: vec![row[..6].to_vec()],
+        rows_affected: 0,
+    }])?
+    .ok_or(Error::Command("candidate audit row absent"))?;
+    let selected = match &row[6] {
+        SqlValue::Null => None,
+        SqlValue::Blob(bytes) => {
+            let mut d = BoundedDecoder::new(bytes, 512)?;
+            let value = Selected::decode(&mut d)?;
+            d.finish()?;
+            Some(value)
+        }
+        _ => return Err(Error::Command("invalid candidate publication")),
+    };
+    Ok(Some((binding, candidate, selected)))
+}
+pub(in crate::packs::publication) fn statement(reply: &CandidatePublicationReply) -> SqlStatement {
+    let id = match reply {
+        CandidatePublicationReply::Applied { id, .. } => blob(id),
+        _ => SqlValue::Null,
+    };
+    SqlStatement {
+        sql: SAVED.into(),
+        parameters: vec![id],
+    }
+}
+pub(in crate::packs::publication) fn selected(
+    sets: &[SqlResultSet],
+    reply: &CandidatePublicationReply,
+    actor: &str,
+) -> Result<Option<Selected>, Error> {
+    let CandidatePublicationReply::Applied {
+        id,
+        digest,
+        publication,
+    } = reply
+    else {
+        return Ok(None);
+    };
+    let Some((_, candidate, stored)) = row(sets)? else {
+        return Ok(None);
+    };
+    if candidate.actor != actor
+        || candidate.request.id != uuid::Uuid::from_bytes(*id).to_string()
+        || result_digest(&candidate)? != *digest
+    {
+        return Ok(None);
+    }
+    let ready = matches!(candidate.result, CandidateResult::Ready { .. });
+    if ready != publication.is_some() {
+        return Err(Error::Command("candidate publication result differs"));
+    }
+    match stored {
+        Some(value) if value.reply == *reply && ready == value.root.is_some() => Ok(Some(value)),
+        None if !ready => Ok(Some(Selected {
+            reply: reply.clone(),
+            root: None,
+        })),
+        _ => Ok(None),
+    }
+}
+pub(in crate::packs::publication) async fn closed_graph(
+    store: &ArtifactStore,
+    sets: &[SqlResultSet],
+    reply: &CandidatePublicationReply,
+    check: &LeaseCheck,
+    hash: &mut blake3::Hasher,
+) -> Result<(), RootRecoveryError> {
+    if !reply.applied() {
+        return Ok(());
+    }
+    let selected = selected(sets, reply, &check.actor)?.ok_or(RootRecoveryError::Context)?;
+    let Some(root) = selected.root else {
+        return Ok(());
+    };
+    let audit: Audit = root
+        .read(store, INPUT_ROOT_BYTES)
+        .await
+        .map_err(NativeCandidateAuditError::from)?;
+    let CandidatePublicationReply::Applied {
+        id,
+        digest,
+        publication: Some(published),
+    } = reply
+    else {
+        return Err(RootRecoveryError::Context);
+    };
+    if audit.candidate.actor != check.actor
+        || audit.candidate.request.id != uuid::Uuid::from_bytes(*id).to_string()
+        || result_digest(&audit.candidate)? != *digest
+        || audit.catalog.repository != check.token.repository
+        || audit.refs.operation() != root.operation
+        || audit.generation != published.generation
+        || audit.ref_generation != published.ref_generation
+    {
+        return Err(RootRecoveryError::Context);
+    }
+    let snapshot = CatalogSnapshot::download(store, audit.catalog)
+        .await
+        .map_err(NativeCandidateAuditError::from)?;
+    crate::packs::directory::snapshot::DirectorySnapshot::download(store, snapshot.directory)
+        .await
+        .map_err(NativeCandidateAuditError::from)?;
+    let refs = audit
+        .refs
+        .read(store)
+        .await
+        .map_err(NativeCandidateAuditError::from)?;
+    if refs.repository != check.token.repository
+        || refs.format != audit.catalog.format
+        || refs.generation != audit.ref_generation
+    {
+        return Err(RootRecoveryError::Context);
+    }
+    let CandidateResult::Ready { oid, .. } = &audit.candidate.result else {
+        return Err(RootRecoveryError::Context);
+    };
+    let expected = crate::RefExpectation {
+        oid: Some(crate::pulls::merge::oid(oid)?),
+        version: 1,
+    };
+    let found = RefStateIndex::new(std::sync::Arc::new(store.clone()), refs.format)
+        .read(refs.root, &audit.candidate.fetch_ref())
+        .await
+        .map_err(NativeCandidateAuditError::from)?;
+    if found != Some(expected) {
+        return Err(RootRecoveryError::Context);
+    }
+    let descriptor = super::super::recovery::archive::descriptor;
+    descriptor(hash, root.operation, ArtifactKind::InputRoot, root.artifact)?;
+    descriptor(
+        hash,
+        audit.catalog.operation,
+        ArtifactKind::CatalogNode,
+        audit.catalog.artifact,
+    )?;
+    descriptor(
+        hash,
+        snapshot.directory.operation,
+        ArtifactKind::CatalogNode,
+        snapshot.directory.artifact,
+    )?;
+    descriptor(
+        hash,
+        audit.refs.operation(),
+        ArtifactKind::InputRoot,
+        audit.refs.artifact(),
+    )?;
+    Ok(())
+}
+
+/// Select only a completed native result matching the requested pull revision
+/// and strategy. SQL bytes alone do not establish commit semantics: the private
+/// merge factory separately verifies this candidate in its accepted catalog.
+pub(in crate::packs::publication) fn ready_for_merge(
+    sets: &[SqlResultSet],
+    input: &crate::pulls::merge::command::MergeInput,
+) -> Result<Option<(MergeCandidate, StoredInputRoot)>, Error> {
+    let Some((binding, candidate, stored)) = row(sets)? else {
+        return Ok(None);
+    };
+    if candidate.number != input.number
+        || candidate.request.revision != input.request.revision
+        || candidate.request.strategy != input.request.strategy
+        || input.request.candidate_id.as_deref() != Some(&candidate.request.id)
+        || !matches!(candidate.result, CandidateResult::Ready { .. })
+        || binding != crate::pulls::candidates::intent_binding(&candidate)?
+    {
+        return Ok(None);
+    }
+    let Some(stored) = stored else {
+        return Ok(None);
+    };
+    if selected(sets, &stored.reply, &candidate.actor)?.is_none() {
+        return Ok(None);
+    }
+    Ok(stored.root.map(|root| (candidate, root)))
+}
+pub(in crate::packs::publication) async fn verify_ready(
+    store: &ArtifactStore,
+    candidate: &MergeCandidate,
+    root: StoredInputRoot,
+) -> Result<(), NativeCandidateAuditError> {
+    let audit: Audit = root.read(store, INPUT_ROOT_BYTES).await?;
+    if audit.candidate != *candidate
+        || audit.catalog.repository != store.repository()
+        || audit.refs.operation() != root.operation
+    {
+        return Err(NativeCandidateAuditError::Context);
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/candidate_publication/mod.rs b/crates/canopy-server/src/packs/publication/candidate_publication/mod.rs
new file mode 100644
index 00000000..4d9274df
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/candidate_publication/mod.rs
@@ -0,0 +1,323 @@
+//! Generated candidate publication reuses the editorial intent and exact root journal.
+//! Ready never obtains authority from a client result, ref descriptor or SQL OID.
+use super::*;
+use crate::pulls::candidates::{CandidateResult, MergeCandidate, valid_request, valid_result};
+use cellule_ltx::DiskBudget;
+use cellule_runtime::{InvocationError, primitives::sql::SqlCell};
+use std::path::Path;
+use tokio::time::timeout_at;
+
+pub(super) mod audit;
+mod publish;
+pub use publish::PublishNativeCandidate;
+pub const NATIVE_CANDIDATE_BYTES: u32 = 512 << 10;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CandidatePublicationReply {
+    Applied {
+        id: [u8; 16],
+        digest: [u8; 32],
+        publication: Option<PublishedRefs>,
+    },
+    NotFound,
+    Forbidden,
+    Conflict,
+    Denied(PreparationDenial),
+}
+impl CandidatePublicationReply {
+    pub(crate) fn applied(&self) -> bool {
+        matches!(self, Self::Applied { .. })
+    }
+}
+impl WireValue for CandidatePublicationReply {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        match self {
+            Self::Applied {
+                id,
+                digest,
+                publication,
+            } => {
+                crate::validate_repository_id(*id)
+                    .map_err(|_| CodecError::Invalid("candidate UUID"))?;
+                e.write_u8(0)?;
+                e.write_bytes(id)?;
+                e.write_bytes(digest)?;
+                publication.encode(e)
+            }
+            Self::NotFound => e.write_u8(1),
+            Self::Forbidden => e.write_u8(2),
+            Self::Conflict => e.write_u8(3),
+            Self::Denied(reason) => {
+                e.write_u8(4)?;
+                PreparationReply::Denied(*reason).encode(e)
+            }
+        }
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = match d.read_u8()? {
+            0 => Self::Applied {
+                id: crate::packs::directory::index::codec::fixed(d)?,
+                digest: crate::packs::directory::index::codec::fixed(d)?,
+                publication: Option::decode(d)?,
+            },
+            1 => Self::NotFound,
+            2 => Self::Forbidden,
+            3 => Self::Conflict,
+            4 => match PreparationReply::decode(d)? {
+                PreparationReply::Denied(reason) => Self::Denied(reason),
+                _ => return Err(CodecError::Invalid("candidate denial")),
+            },
+            _ => return Err(CodecError::Invalid("candidate acknowledgement")),
+        };
+        value.encode(&mut BoundedEncoder::new(512)?)?;
+        Ok(value)
+    }
+}
+pub(super) fn candidate_bytes(candidate: &MergeCandidate) -> Result<Vec<u8>, CodecError> {
+    if candidate.number <= 0
+        || candidate.created_at_ms < 0
+        || validate_component(&candidate.actor).is_err()
+        || !valid_request(&candidate.request)
+        || !valid_result(&candidate.result)
+    {
+        return Err(CodecError::Invalid("generated candidate result"));
+    }
+    let bytes =
+        serde_json::to_vec(candidate).map_err(|_| CodecError::Invalid("candidate encoding"))?;
+    if bytes.len() > 300 << 10 {
+        return Err(CodecError::Invalid("candidate result limit"));
+    }
+    Ok(bytes)
+}
+pub(super) fn result_digest(candidate: &MergeCandidate) -> Result<[u8; 32], CodecError> {
+    Ok(*blake3::hash(&candidate_bytes(candidate)?).as_bytes())
+}
+#[derive(Clone, Debug)]
+pub struct NativeCandidateProof {
+    certificate: CatalogCertificate,
+    candidate: MergeCandidate,
+    selection: RefSelection,
+    refs: Option<RefStateSnapshotRoot>,
+    ref_generation: Option<u64>,
+    audit: Option<crate::packs::input_artifact::StoredInputRoot>,
+}
+impl NativeCandidateProof {
+    fn binding(&self) -> Result<[u8; 32], CodecError> {
+        Self::payload_binding(
+            &self.candidate,
+            &self.selection,
+            self.refs,
+            self.ref_generation,
+            self.audit,
+        )
+    }
+    fn payload_binding(
+        candidate: &MergeCandidate,
+        selection: &RefSelection,
+        refs: Option<RefStateSnapshotRoot>,
+        generation: Option<u64>,
+        audit: Option<crate::packs::input_artifact::StoredInputRoot>,
+    ) -> Result<[u8; 32], CodecError> {
+        let mut e = BoundedEncoder::new(NATIVE_CANDIDATE_BYTES)?;
+        e.write_bytes(&candidate_bytes(candidate)?)?;
+        selection.encode(&mut e)?;
+        refs.encode(&mut e)?;
+        generation.encode(&mut e)?;
+        audit.encode(&mut e)?;
+        let mut h = blake3::Hasher::new();
+        h.update(b"canopy.generated-candidate-publication.v1\0");
+        h.update(&e.finish());
+        Ok(*h.finalize().as_bytes())
+    }
+    fn shape(&self) -> Result<(), CodecError> {
+        let data = self.certificate.data()?;
+        candidate_bytes(&self.candidate)?;
+        let ready = matches!(self.candidate.result, CandidateResult::Ready { .. });
+        if data.compaction
+            || data.base.refs.is_none()
+            || data.actor != self.candidate.actor
+            || data.completion_digest.is_some()
+            || data.refs_digest != Some(self.binding()?)
+            || self.selection.repository != data.token.repository
+            || self.selection.actor.as_deref() != Some(&data.actor)
+            || self.selection.proof.is_some()
+            || self.selection.facts.len() > 2
+            || ready != self.refs.is_some()
+            || ready != self.ref_generation.is_some()
+            || ready != self.audit.is_some()
+            || self
+                .refs
+                .is_some_and(|r| r.operation() != data.token.artifact_operation)
+            || self
+                .audit
+                .is_some_and(|r| r.operation != data.token.artifact_operation)
+            || self
+                .ref_generation
+                .is_some_and(|g| g == 0 || g > i64::MAX as u64)
+            || !ready && (data.input_count != 0 || data.object_count != 0 || data.edge_count != 0)
+        {
+            return Err(CodecError::Invalid("candidate proof scope"));
+        }
+        Ok(())
+    }
+}
+impl WireValue for NativeCandidateProof {
+    fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
+        self.shape()?;
+        self.certificate.encode(e)?;
+        e.write_bytes(&candidate_bytes(&self.candidate)?)?;
+        self.selection.encode(e)?;
+        self.refs.encode(e)?;
+        self.ref_generation.encode(e)?;
+        self.audit.encode(e)
+    }
+    fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            certificate: CatalogCertificate::decode(d)?,
+            candidate: serde_json::from_slice(d.read_bytes()?)
+                .map_err(|_| CodecError::Invalid("candidate result"))?,
+            selection: RefSelection::decode(d)?,
+            refs: Option::decode(d)?,
+            ref_generation: Option::decode(d)?,
+            audit: Option::decode(d)?,
+        };
+        value.shape()?;
+        Ok(value)
+    }
+}
+#[derive(Debug, thiserror::Error)]
+pub enum NativeCandidatePublicationError {
+    #[error("candidate preparation is inactive")]
+    Base(#[from] PreparationBaseError),
+    #[error("candidate context differs")]
+    Context,
+    #[error("candidate encoding failed")]
+    Codec(#[from] CodecError),
+    #[error("candidate native verification failed")]
+    Verification(#[from] NativeCandidateVerificationError),
+    #[error("candidate SQL capability failed")]
+    Capability(#[from] Error),
+    #[error("candidate ref snapshot failed")]
+    Snapshot(#[from] crate::packs::ref_state::RefSnapshotError),
+    #[error("candidate ref tree failed")]
+    Refs(#[from] crate::packs::ref_state::RefStateError),
+    #[error("candidate audit failed")]
+    Root(#[from] crate::packs::InputRootError),
+    #[error("candidate certificate failed")]
+    Certificate(#[from] CatalogAttestationError),
+    #[error("candidate metadata query failed")]
+    Query(#[source] Box<InvocationError<Vec<SqlResultSet>>>),
+    #[error("candidate command preparation failed")]
+    Command(#[source] Box<InvocationError<CandidatePublicationReply>>),
+}
+impl PreparedCatalog {
+    pub(crate) async fn native_candidate_proof(
+        &self,
+        produced: &crate::git_gateway::candidates::ProducedCandidate,
+        directory: &Path,
+        budget: DiskBudget,
+        limits: crate::packs::metadata::MetadataLimits,
+    ) -> Result<NativeCandidateProof, NativeCandidatePublicationError> {
+        let (_, deadline) = self.base.live_lease()?;
+        timeout_at(deadline, async {
+            let candidate = produced.candidate().clone();
+            if candidate.actor != self.base.capability().2.actor
+                || produced.operation() != self.token().operation
+            {
+                return Err(NativeCandidatePublicationError::Context);
+            }
+            candidate_bytes(&candidate)?;
+            let (client, target, _) = self.base.capability();
+            let sql = SqlCell::<RepositoryModule>::new(client.clone(), target.clone())?;
+            let selected = sql
+                .query(
+                    None,
+                    sql::statement(
+                        "SELECT source_ref,base_ref FROM pull_requests WHERE number=?1",
+                        vec![SqlValue::Integer(candidate.number)],
+                    ),
+                )
+                .await
+                .map_err(|e| NativeCandidatePublicationError::Query(Box::new(e)))?;
+            let store = self.base.indexes().store();
+            let old = self
+                .base()
+                .refs
+                .ok_or(NativeCandidatePublicationError::Context)?
+                .read(&store)
+                .await?;
+            if old.repository != self.token().repository
+                || old.format != self.catalog().format
+                || old.generation > self.base().generation
+                || old.generation >= i64::MAX as u64
+            {
+                return Err(NativeCandidatePublicationError::Context);
+            }
+            let index = crate::packs::ref_state::RefStateIndex::new(store.clone(), old.format);
+            let mut selection = RefSelection {
+                repository: self.token().repository,
+                actor: Some(candidate.actor.clone()),
+                facts: vec![],
+                proof: None,
+            };
+            if let Some([SqlValue::Text(source), SqlValue::Text(base)]) =
+                sql::rows(&selected.output)?.first().map(Vec::as_slice)
+            {
+                let mut names = vec![source.clone(), base.clone()];
+                names.sort();
+                names.dedup();
+                for name in names {
+                    selection.facts.push(ref_observation::RefFact {
+                        state: index.read(old.root.clone(), &name).await?,
+                        name,
+                    });
+                }
+            }
+            let (refs, ref_generation, audit) =
+                if matches!(candidate.result, CandidateResult::Ready { .. }) {
+                    self.verify_candidate_commit(&candidate, directory, budget, limits)
+                        .await?;
+                    let transition = index
+                        .prepare_candidate(old.root, self.token().artifact_operation, &candidate)
+                        .await?;
+                    let generation = old.generation + 1;
+                    let refs = crate::packs::ref_state::RefStateSnapshotRoot::upload(
+                        &store,
+                        self.token().artifact_operation,
+                        crate::packs::ref_state::RefStateSnapshot {
+                            repository: old.repository,
+                            format: old.format,
+                            generation,
+                            default_branch: old.default_branch,
+                            root: Some(transition.root()),
+                        },
+                    )
+                    .await?;
+                    let audit = audit::prepare(self, &candidate, refs, generation).await?;
+                    (Some(refs), Some(generation), Some(audit))
+                } else {
+                    (None, None, None)
+                };
+            let binding = NativeCandidateProof::payload_binding(
+                &candidate,
+                &selection,
+                refs,
+                ref_generation,
+                audit,
+            )?;
+            let proof = NativeCandidateProof {
+                certificate: self.issue_certificate(Some(binding), None).await?,
+                candidate,
+                selection,
+                refs,
+                ref_generation,
+                audit,
+            };
+            proof.shape()?;
+            self.ensure_live()?;
+            Ok(proof)
+        })
+        .await
+        .map_err(|_| PreparationBaseError::Inactive)?
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/candidate_publication/publish.rs b/crates/canopy-server/src/packs/publication/candidate_publication/publish.rs
new file mode 100644
index 00000000..709c7024
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/candidate_publication/publish.rs
@@ -0,0 +1,223 @@
+//! Original authenticated attempt, joint-root CAS and first result share SDK acceptance.
+use super::super::{
+    commands::{authorized, check_pin, fact, load, matched},
+    publish::{authenticate, changed, checkpoint, retention_matches},
+    sql::*,
+};
+use super::*;
+pub struct PublishNativeCandidate;
+impl Command for PublishNativeCandidate {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 55;
+    const CODEC_VERSION: u32 = 1;
+    type Input = NativeCandidateProof;
+    type Output = CandidatePublicationReply;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        let data = input.certificate.data()?;
+        let check = LeaseCheck {
+            token: data.token,
+            actor: data.actor,
+        };
+        recovery::execute(context, &check, recovery::Kind::Candidate, |context| {
+            publish(context, input)
+        })
+    }
+}
+fn reject(value: CandidatePublicationReply) -> CommandResult<CandidatePublicationReply> {
+    CommandResult::Rejected(value)
+}
+fn denied(reason: PreparationDenial) -> CommandResult<CandidatePublicationReply> {
+    reject(CandidatePublicationReply::Denied(reason))
+}
+fn publish(
+    context: &mut CommandContext<'_, '_>,
+    proof: NativeCandidateProof,
+) -> cellule_runtime::Result<CommandResult<CandidatePublicationReply>> {
+    proof.shape()?;
+    let Some((data, key)) =
+        authenticate(context, &proof.certificate, Some(proof.binding()?), None)?
+    else {
+        return Ok(denied(PreparationDenial::Unauthorized));
+    };
+    let check = LeaseCheck {
+        token: data.token,
+        actor: data.actor.clone(),
+    };
+    let result = authenticated(context, proof, data, key)?;
+    if check.token.owner == context.owner_fence()
+        && let Some(row) = load(context, check.token)?
+        && matched(&row, &check)
+    {
+        check_pin(context, &row)?;
+        changed(context.sql(&statement(
+            "DELETE FROM catalog_operations WHERE id=?1",
+            vec![blob(check.token.operation)],
+        ))?)?;
+    }
+    Ok(result)
+}
+fn authenticated(
+    context: &mut CommandContext<'_, '_>,
+    proof: NativeCandidateProof,
+    data: super::super::certificate::CertificateData,
+    key: [u8; 32],
+) -> cellule_runtime::Result<CommandResult<CandidatePublicationReply>> {
+    if authorized(
+        context,
+        data.token.repository,
+        &data.actor,
+        TokenScope::Write,
+    )? != Some(data.catalog.format)
+    {
+        return Ok(reject(CandidatePublicationReply::Forbidden));
+    }
+    let id = uuid::Uuid::parse_str(&proof.candidate.request.id)
+        .map_err(|_| Error::Command("candidate UUID"))?;
+    let prior = context.sql(&statement(audit::SAVED, vec![blob(id.as_bytes())]))?;
+    let Some((binding, old, stored)) = audit::row(&prior)? else {
+        return Ok(reject(CandidatePublicationReply::NotFound));
+    };
+    let expected_binding = crate::pulls::candidates::intent_binding(&proof.candidate)?;
+    if binding != expected_binding
+        || old.request != proof.candidate.request
+        || old.actor != data.actor
+        || old.number != proof.candidate.number
+        || old.created_at_ms != proof.candidate.created_at_ms
+    {
+        return Ok(reject(CandidatePublicationReply::Conflict));
+    }
+    if old.result != CandidateResult::Pending {
+        let reply = match stored {
+            Some(value) => value.reply,
+            None if !matches!(old.result, CandidateResult::Ready { .. }) => {
+                CandidatePublicationReply::Applied {
+                    id: *id.as_bytes(),
+                    digest: result_digest(&old)?,
+                    publication: None,
+                }
+            }
+            None => return Err(Error::Command("Ready candidate has no native audit")),
+        };
+        if audit::selected(&prior, &reply, &data.actor)?.is_none() {
+            return Err(Error::Command("candidate prior result differs"));
+        }
+        return Ok(CommandResult::Success(reply));
+    }
+    if data.token.owner != context.owner_fence() {
+        return Ok(denied(PreparationDenial::Stale));
+    }
+    let Some(row) = load(context, data.token)? else {
+        return Ok(denied(PreparationDenial::Missing));
+    };
+    if !matched(
+        &row,
+        &LeaseCheck {
+            token: data.token,
+            actor: data.actor.clone(),
+        },
+    ) {
+        return Ok(denied(PreparationDenial::Stale));
+    }
+    if row.expires <= now(context.now_ms())? {
+        return Ok(denied(PreparationDenial::Expired));
+    }
+    check_pin(context, &row)?;
+    if !retention_matches(context, &data, row.generation, data.catalog.format)?
+        || fact(context, data.token.repository, data.catalog.format, None)? != data.base
+    {
+        return Ok(reject(CandidatePublicationReply::Conflict));
+    }
+    let policy = context.sql(&SqlBatch {
+        statements: vec![crate::pulls::native::with_refs(
+            crate::pulls::merge::policy_statement(&data.actor, old.number),
+            &proof.selection,
+        )],
+    })?;
+    match crate::pulls::merge::candidate_ready(&policy, &old.request.revision)? {
+        None => return Ok(reject(CandidatePublicationReply::NotFound)),
+        Some(false) => return Ok(reject(CandidatePublicationReply::Conflict)),
+        Some(true) => {}
+    }
+    let ready = proof.refs.is_some();
+    if ready {
+        let count = context.sql(&statement(
+            "SELECT count(*) FROM (SELECT generation FROM catalog_generations LIMIT ?1)",
+            vec![number(MAX_RETAINED_GENERATIONS)?],
+        ))?;
+        let Some([count]) = rows(&count)?.first().map(Vec::as_slice) else {
+            return Err(Error::Command("candidate generation count"));
+        };
+        if unsigned(count)? >= MAX_RETAINED_GENERATIONS {
+            return Ok(denied(PreparationDenial::Capacity));
+        }
+    }
+    let Some(missing) = checkpoint(context, &data, &key)? else {
+        return Ok(reject(CandidatePublicationReply::Conflict));
+    };
+    let bytes = proof.certificate.bytes()?;
+    let digest = *blake3::hash(&bytes).as_bytes();
+    let publication = if ready {
+        Some(PublishedRefs {
+            generation: data
+                .base
+                .generation
+                .checked_add(1)
+                .filter(|g| *g <= i64::MAX as u64)
+                .ok_or(Error::Command("candidate generation exhausted"))?,
+            ref_generation: proof
+                .ref_generation
+                .ok_or(Error::Command("candidate ref generation"))?,
+            certificate_digest: digest,
+        })
+    } else {
+        None
+    };
+    let reply = CandidatePublicationReply::Applied {
+        id: *id.as_bytes(),
+        digest: result_digest(&proof.candidate)?,
+        publication,
+    };
+    let mut selected = BoundedEncoder::new(512)?;
+    audit::Selected {
+        reply: reply.clone(),
+        root: proof.audit,
+    }
+    .encode(&mut selected)?;
+    let result = serde_json::to_string(&proof.candidate.result)
+        .map_err(|_| Error::Command("candidate result encoding"))?;
+    let oid = match &proof.candidate.result {
+        CandidateResult::Ready { oid, .. } => blob(crate::pulls::merge::oid(oid)?),
+        _ => SqlValue::Null,
+    };
+    let mut catalog = BoundedEncoder::new(256)?;
+    data.catalog.encode(&mut catalog)?;
+    let mut refs = BoundedEncoder::new(128)?;
+    if let Some(root) = proof.refs {
+        root.encode(&mut refs)?;
+    }
+    if row.expires <= now(context.now_ms())? {
+        return Ok(denied(PreparationDenial::Expired));
+    }
+    // No later refusal. A late SQL error rolls back roots, summary, first result,
+    // checkpoint, own attempt closure, journal and SDK acceptance together.
+    if missing {
+        changed(context.sql(&statement("UPDATE catalog_operations SET attestation=?1,attestation_digest=?2 WHERE id=?3 AND attestation IS NULL",vec![blob(&bytes),blob(digest),blob(data.token.operation)]))?)?;
+        changed(context.sql(&statement("UPDATE catalog_leases SET attestation=?1,attestation_digest=?2 WHERE incarnation=?3 AND admission_sequence=?4 AND attestation IS NULL",vec![blob(&bytes),blob(digest),blob(data.token.owner.incarnation.as_bytes()),number(data.token.attempt)?]))?)?;
+    }
+    if let Some(value) = publication {
+        changed(context.sql(&statement("INSERT INTO catalog_generations(generation,catalog,certificate,refs) VALUES(?1,?2,?3,?4)",vec![number(value.generation)?,blob(catalog.finish()),blob(digest),blob(refs.finish())]))?)?;
+        changed(context.sql(&statement(
+            "UPDATE catalog_state SET generation=?1 WHERE singleton=1 AND generation=?2",
+            vec![number(value.generation)?, number(data.base.generation)?],
+        ))?)?;
+        changed(context.sql(&statement(
+            "UPDATE ref_generation SET generation=?1 WHERE singleton=1",
+            vec![number(value.ref_generation)?],
+        ))?)?;
+    }
+    changed(context.sql(&statement("UPDATE merge_candidates SET result=?2,oid=?3,native_publication=?4 WHERE id=?1 AND json_extract(result,'$.state')='pending'",vec![blob(id.as_bytes()),SqlValue::Text(result),oid,blob(selected.finish())]))?)?;
+    Ok(CommandResult::Success(reply))
+}
diff --git a/crates/canopy-server/src/packs/publication/coordinator.rs b/crates/canopy-server/src/packs/publication/coordinator.rs
index fd650ac7..9a2cdf71 100644
--- a/crates/canopy-server/src/packs/publication/coordinator.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator.rs
@@ -1309,3 +1309,5 @@ mod fairness {
         assert_eq!(queue.pop(true, 3), Some(101));
     }
 }
+
+mod native_candidate;
diff --git a/crates/canopy-server/src/packs/publication/coordinator/native_candidate.rs b/crates/canopy-server/src/packs/publication/coordinator/native_candidate.rs
new file mode 100644
index 00000000..fae8d7c5
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/coordinator/native_candidate.rs
@@ -0,0 +1,76 @@
+//! Generated candidates share the original private owner and exact registered dispatch.
+use super::*;
+use canopy_object_storage::artifact::ArtifactStore;
+
+#[must_use]
+pub struct ReadyNativeCandidate {
+    owner: Arc<PreparedCatalog>,
+    command: PreparedCommand<PublishNativeCandidate>,
+}
+impl PreparedCatalog {
+    pub(crate) async fn ready_native_candidate(
+        self: &Arc<Self>,
+        identity: MutationIdentity,
+        produced: &crate::git_gateway::candidates::ProducedCandidate,
+        directory: &std::path::Path,
+        budget: cellule_ltx::DiskBudget,
+        limits: crate::packs::metadata::MetadataLimits,
+    ) -> Result<ReadyNativeCandidate, NativeCandidatePublicationError> {
+        let proof = self
+            .native_candidate_proof(produced, directory, budget, limits)
+            .await?;
+        self.ensure_live()?;
+        let (client, target, _) = self.base.capability();
+        let command = client
+            .prepare_command::<PublishNativeCandidate>(target, identity, proof)
+            .await
+            .map_err(|e| NativeCandidatePublicationError::Command(Box::new(e)))?;
+        self.ensure_live()?;
+        Ok(ReadyNativeCandidate {
+            owner: self.clone(),
+            command,
+        })
+    }
+}
+impl ReadyNativeCandidate {
+    pub async fn persist_recovery(
+        &self,
+        store: &ArtifactStore,
+        identity: MutationIdentity,
+    ) -> Result<RegisteredRootRecovery, RootRecoveryError> {
+        super::super::recovery::persist(
+            &self.owner.base.session,
+            &self.command,
+            super::super::recovery::Kind::Candidate,
+            store,
+            identity,
+            0,
+        )
+        .await
+    }
+    pub fn bind_recovery(
+        self,
+        registered: RegisteredRootRecovery,
+        store: &ArtifactStore,
+    ) -> Result<ReadyBoundRecovery, Box<RecoveryBindingFailure<Self>>> {
+        if !registered.matches_original(
+            super::super::recovery::Kind::Candidate,
+            self.command.evidence(),
+            None,
+            &self.owner.base.session,
+            store,
+        ) {
+            return Err(Box::new(RecoveryBindingFailure {
+                original: self,
+                registered,
+            }));
+        }
+        Ok(ReadyBoundRecovery::new(
+            PushPreparation::Catalog(self.owner),
+            None,
+            false,
+            registered,
+            store,
+        ))
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/coordinator/work.rs b/crates/canopy-server/src/packs/publication/coordinator/work.rs
index 79f060ef..13809c93 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/work.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/work.rs
@@ -335,6 +335,7 @@ impl ReadyPublication {
 
 #[derive(Clone, Debug)]
 pub enum PublicationOutcome {
+    Candidate(Committed<CandidatePublicationReply>),
     Head(Committed<PublicationReply>),
     Merge(Committed<crate::pulls::merge::MergeOutcome>),
     ServingRelease(Committed<ServingReleaseReply>),
@@ -352,6 +353,8 @@ pub enum PublicationOutcome {
 }
 #[derive(Debug, thiserror::Error)]
 pub enum PublicationError {
+    #[error("native candidate publication: {0}")]
+    Candidate(#[source] InvocationError<CandidatePublicationReply>),
     #[error("symbolic HEAD publication: {0}")]
     Head(#[source] InvocationError<PublicationReply>),
     #[error("native reviewed merge publication: {0}")]
@@ -408,6 +411,7 @@ impl PublicationError {
             Self::ServingCommand(error) => kind(error),
             Self::Initialization(error) => kind(error),
             Self::Merge(error) => kind(error),
+            Self::Candidate(error) => kind(error),
             Self::Head(error) => kind(error),
             Self::Push(error) => kind(error),
             Self::RootPush(error) => kind(error),
@@ -433,6 +437,7 @@ impl PublicationError {
             Self::ServingCommand(error) => unknown(error),
             Self::Initialization(error) => unknown(error),
             Self::Merge(error) => unknown(error),
+            Self::Candidate(error) => unknown(error),
             Self::Head(error) => unknown(error),
             Self::Push(error) => unknown(error),
             Self::RootPush(error) => unknown(error),
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 967344f4..db733fc3 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -265,6 +265,7 @@ pub struct MaintenanceRequest {
 pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_command::<PublishReviewedMerge>()?;
     registry.bind_command::<PublishNativeHead>()?;
+    registry.bind_command::<PublishNativeCandidate>()?;
     registry.bind_command::<crate::branch_rules::command::SetBranchRule>()?;
     registry.bind_command::<crate::checks::native::StartCommitCheck>()?;
     registry.bind_query::<crate::checks::native::ReadCommitChecks>()?;
@@ -301,3 +302,10 @@ pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
 }
 #[cfg(test)]
 mod tests;
+
+mod candidate_publication;
+pub use candidate_publication::audit::NativeCandidateAuditError;
+pub use candidate_publication::{
+    CandidatePublicationReply, NATIVE_CANDIDATE_BYTES, NativeCandidateProof,
+    NativeCandidatePublicationError, PublishNativeCandidate,
+};
diff --git a/crates/canopy-server/src/packs/publication/native_merge.rs b/crates/canopy-server/src/packs/publication/native_merge.rs
index 079f2b8d..9f54e5e6 100644
--- a/crates/canopy-server/src/packs/publication/native_merge.rs
+++ b/crates/canopy-server/src/packs/publication/native_merge.rs
@@ -35,6 +35,7 @@ struct Transition {
     refs: Option<RefStateSnapshotRoot>,
     ref_generation: Option<u64>,
     audit: Option<crate::packs::input_artifact::StoredInputRoot>,
+    candidate: Option<crate::packs::input_artifact::StoredInputRoot>,
 }
 
 /// Exact request, native ref facts and conditional snapshot. Only a privately
@@ -50,6 +51,10 @@ pub struct NativeMergeProof {
 
 #[derive(Debug, thiserror::Error)]
 pub enum NativeMergePreparationError {
+    #[error("native generated candidate verification failed")]
+    Candidate(#[from] NativeCandidateVerificationError),
+    #[error("native candidate audit failed")]
+    CandidateAudit(#[from] NativeCandidateAuditError),
     #[error("native merge audit root failed")]
     Root(#[from] crate::packs::InputRootError),
     #[error("native merge preparation is inactive")]
@@ -88,8 +93,7 @@ impl NativeMergeProof {
             || self.selection.repository != data.token.repository
             || self.selection.actor.as_deref() != Some(&self.input.actor)
             || self.selection.proof.is_some()
-            || self.selection.facts.len() > 2
-            || self.input.request.strategy != MergeStrategy::FastForward
+            || self.selection.facts.len() > 3
         {
             return Err(CodecError::Invalid("invalid native merge scope"));
         }
@@ -110,7 +114,8 @@ impl NativeMergeProof {
             super::ref_proof::shape(&t.plan, data.catalog.format)
                 .map_err(|_| CodecError::Invalid("native merge plan"))?;
             super::ref_proof::binding(&t.plan, &t.ancestry)?;
-            if t.plan.actor != self.input.actor
+            if t.candidate.is_some() != (self.input.request.strategy != MergeStrategy::FastForward)
+                || t.plan.actor != self.input.actor
                 || t.plan.updates.len() != 1
                 || t.plan.updates[0].new_oid.is_none()
                 || t.plan.updates[0]
@@ -150,10 +155,11 @@ impl NativeMergeProof {
         h.update(&[u8::from(transition.is_some())]);
         if let Some(t) = transition {
             h.update(&super::ref_proof::binding(&t.plan, &t.ancestry)?);
-            let mut e = BoundedEncoder::new(256)?;
+            let mut e = BoundedEncoder::new(512)?;
             t.refs.encode(&mut e)?;
             t.ref_generation.encode(&mut e)?;
             t.audit.encode(&mut e)?;
+            t.candidate.encode(&mut e)?;
             h.update(&e.finish());
         }
         Ok(*h.finalize().as_bytes())
@@ -172,6 +178,7 @@ impl WireValue for NativeMergeProof {
             t.refs.encode(e)?;
             t.ref_generation.encode(e)?;
             t.audit.encode(e)?;
+            t.candidate.encode(e)?;
         }
         Ok(())
     }
@@ -187,6 +194,7 @@ impl WireValue for NativeMergeProof {
                     refs: Option::<RefStateSnapshotRoot>::decode(d)?,
                     ref_generation: Option::<u64>::decode(d)?,
                     audit: Option::<crate::packs::input_artifact::StoredInputRoot>::decode(d)?,
+                    candidate: Option::<crate::packs::input_artifact::StoredInputRoot>::decode(d)?,
                 })
             } else {
                 None
@@ -212,7 +220,6 @@ impl PreparedCatalog {
                 if self.input_count() != 0
                     || self.input_checkpoint_digest.is_some()
                     || input.actor != self.base.capability().2.actor
-                    || input.request.strategy != MergeStrategy::FastForward
                 {
                     return Err(NativeMergePreparationError::Context);
                 }
@@ -240,7 +247,7 @@ impl PreparedCatalog {
                 {
                     return Err(NativeMergePreparationError::Context);
                 }
-                let refs = RefStateIndex::new(store, snapshot.format);
+                let refs = RefStateIndex::new(store.clone(), snapshot.format);
                 let mut selection = RefSelection {
                     repository: self.token().repository,
                     actor: Some(input.actor.clone()),
@@ -257,7 +264,7 @@ impl PreparedCatalog {
                 let mut transition = None;
                 if let Some((source, base)) = names {
                     let source_state = refs.read(snapshot.root.clone(), &source).await?;
-                    let base_state = refs.read(snapshot.root, &base).await?;
+                    let base_state = refs.read(snapshot.root.clone(), &base).await?;
                     selection.facts.push(RefFact {
                         name: source.clone(),
                         state: source_state.clone(),
@@ -268,9 +275,74 @@ impl PreparedCatalog {
                             state: base_state.clone(),
                         });
                     }
+                    let mut candidate_root = None;
+                    let target_oid = if input.request.strategy == MergeStrategy::FastForward {
+                        source_state.and_then(|s| s.oid)
+                    } else {
+                        let candidate_id = uuid::Uuid::parse_str(
+                            input
+                                .request
+                                .candidate_id
+                                .as_deref()
+                                .ok_or(NativeMergePreparationError::Context)?,
+                        )
+                        .map_err(|_| NativeMergePreparationError::Context)?;
+                        let saved = sql
+                            .query(
+                                None,
+                                statement(
+                                    super::candidate_publication::audit::SAVED,
+                                    vec![blob(candidate_id.as_bytes())],
+                                ),
+                            )
+                            .await
+                            .map_err(|e| NativeMergePreparationError::Query(Box::new(e)))?;
+                        if let Some((candidate, root)) =
+                            super::candidate_publication::audit::ready_for_merge(
+                                &saved.output,
+                                &input,
+                            )?
+                        {
+                            super::candidate_publication::audit::verify_ready(
+                                &store, &candidate, root,
+                            )
+                            .await?;
+                            self.verify_candidate_commit(
+                                &candidate,
+                                directory,
+                                budget.clone(),
+                                limits,
+                            )
+                            .await?;
+                            let name = candidate.fetch_ref();
+                            let state = refs.read(snapshot.root.clone(), &name).await?;
+                            let crate::pulls::candidates::CandidateResult::Ready { oid, .. } =
+                                &candidate.result
+                            else {
+                                return Err(NativeMergePreparationError::Context);
+                            };
+                            let oid = crate::pulls::merge::oid(oid)?;
+                            selection.facts.push(RefFact {
+                                name,
+                                state: state.clone(),
+                            });
+                            if state
+                                == Some(crate::RefExpectation {
+                                    oid: Some(oid),
+                                    version: 1,
+                                })
+                            {
+                                candidate_root = Some(root);
+                                Some(oid)
+                            } else {
+                                None
+                            }
+                        } else {
+                            None
+                        }
+                    };
                     selection.facts.sort_by(|a, b| a.name.cmp(&b.name));
-                    if let (Some(source_oid), Some(base_state)) =
-                        (source_state.and_then(|s| s.oid), base_state)
+                    if let (Some(source_oid), Some(base_state)) = (target_oid, base_state)
                         && base_state.oid.is_some()
                         && base_state.oid != Some(source_oid)
                     {
@@ -292,9 +364,17 @@ impl PreparedCatalog {
                         };
                         let (audit, ref_generation) = match proposed {
                             Some(refs) => {
-                                let (audit, generation) =
-                                    audit::prepare(self, &input, &plan.updates[0].name, refs)
-                                        .await?;
+                                let (audit, generation) = audit::prepare(
+                                    self,
+                                    &input,
+                                    &plan.updates[0].name,
+                                    refs,
+                                    plan.updates[0]
+                                        .new_oid
+                                        .ok_or(NativeMergePreparationError::Context)?,
+                                    candidate_root,
+                                )
+                                .await?;
                                 (Some(audit), Some(generation))
                             }
                             None => (None, None),
@@ -305,6 +385,7 @@ impl PreparedCatalog {
                             refs: proposed,
                             ref_generation,
                             audit,
+                            candidate: candidate_root,
                         });
                     }
                 }
@@ -329,7 +410,7 @@ pub struct PublishReviewedMerge;
 impl Command for PublishReviewedMerge {
     const MODULE: &'static str = RepositoryModule::NAME;
     const ID: u32 = 9;
-    const CODEC_VERSION: u32 = 7;
+    const CODEC_VERSION: u32 = 8;
     type Input = NativeMergeProof;
     type Output = MergeOutcome;
     fn execute(
@@ -437,11 +518,57 @@ fn publish_authenticated(
     {
         return Ok(denied(MergeOutcome::Conflict));
     }
-    let reviewed =
-        match crate::pulls::merge::reviewed_native_update(context, &input, &proof.selection)? {
-            Ok(value) => value,
-            Err(outcome) => return Ok(denied(outcome)),
+    let generated = if input.request.strategy != MergeStrategy::FastForward {
+        let Some(transition) = proof.transition.as_ref() else {
+            return Ok(denied(MergeOutcome::Conflict));
+        };
+        let candidate_id = uuid::Uuid::parse_str(
+            input
+                .request
+                .candidate_id
+                .as_deref()
+                .ok_or(Error::Command("missing merge candidate"))?,
+        )
+        .map_err(|_| Error::Command("merge candidate UUID"))?;
+        let saved = context.sql(&statement(
+            super::candidate_publication::audit::SAVED,
+            vec![blob(candidate_id.as_bytes())],
+        ))?;
+        let Some((candidate, root)) =
+            super::candidate_publication::audit::ready_for_merge(&saved, &input)?
+        else {
+            return Ok(denied(MergeOutcome::Conflict));
         };
+        if transition.candidate != Some(root) {
+            return Ok(denied(MergeOutcome::Conflict));
+        }
+        let crate::pulls::candidates::CandidateResult::Ready { oid, .. } = &candidate.result else {
+            return Ok(denied(MergeOutcome::Conflict));
+        };
+        let oid = crate::pulls::merge::oid(oid)?;
+        if !proof.selection.facts.iter().any(|fact| {
+            fact.name == candidate.fetch_ref()
+                && fact.state
+                    == Some(crate::RefExpectation {
+                        oid: Some(oid),
+                        version: 1,
+                    })
+        }) {
+            return Ok(denied(MergeOutcome::Conflict));
+        }
+        Some(oid)
+    } else {
+        None
+    };
+    let reviewed = match crate::pulls::merge::reviewed_native_update(
+        context,
+        &input,
+        &proof.selection,
+        generated,
+    )? {
+        Ok(value) => value,
+        Err(outcome) => return Ok(denied(outcome)),
+    };
     let Some(transition) = proof.transition else {
         return Ok(denied(MergeOutcome::Conflict));
     };
@@ -544,7 +671,7 @@ fn publish_authenticated(
         vec![number(ref_generation)?],
     ))?)?;
     changed(context.sql(&statement("UPDATE pull_requests SET state='merged',version=version+1,updated_ms=max(updated_ms,?2) WHERE number=?1 AND state='open' AND version=?3 AND version<9223372036854775807", vec![SqlValue::Integer(input.number),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version)]))?)?;
-    changed(context.sql(&statement("INSERT INTO pull_merges(id,binding,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version,publication) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9,?10,?11)", vec![blob(id.as_bytes()),blob(binding),SqlValue::Integer(input.number),blob(source),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version),blob(crate::pulls::merge::oid(&input.request.revision.source_oid)?),SqlValue::Integer(input.request.revision.source_version),blob(base),SqlValue::Integer(input.request.revision.base_version),blob(encoded_audit)]))?)?;
+    changed(context.sql(&statement("INSERT INTO pull_merges(id,binding,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version,publication,strategy,candidate_id) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9,?10,?11,?12,?13)", vec![blob(id.as_bytes()),blob(binding),SqlValue::Integer(input.number),blob(source),SqlValue::Integer(input.issued_at_ms),SqlValue::Integer(input.request.revision.pull_version),blob(crate::pulls::merge::oid(&input.request.revision.source_oid)?),SqlValue::Integer(input.request.revision.source_version),blob(base),SqlValue::Integer(input.request.revision.base_version),blob(encoded_audit), SqlValue::Text(match input.request.strategy {MergeStrategy::FastForward=>"fast_forward",MergeStrategy::MergeCommit=>"merge_commit",MergeStrategy::Squash=>"squash",MergeStrategy::Rebase=>"rebase"}.into()), input.request.candidate_id.as_ref().map(|id|uuid::Uuid::parse_str(id).map(|id|blob(id.as_bytes())).map_err(|_|Error::Command("candidate UUID"))).transpose()?.unwrap_or(SqlValue::Null)]))?)?;
     changed(context.sql(&statement(
         "DELETE FROM catalog_operations WHERE id=?1",
         vec![blob(data.token.operation)],
diff --git a/crates/canopy-server/src/packs/publication/native_merge/audit.rs b/crates/canopy-server/src/packs/publication/native_merge/audit.rs
index 1784ab6d..8380b94a 100644
--- a/crates/canopy-server/src/packs/publication/native_merge/audit.rs
+++ b/crates/canopy-server/src/packs/publication/native_merge/audit.rs
@@ -10,8 +10,8 @@ use crate::packs::{
 use canopy_object_storage::artifact::{ArtifactKind, ArtifactStore};
 use std::sync::Arc;
 
-const DOMAIN: &[u8] = b"canopy.native-reviewed-merge-audit.v1\0";
-pub(super) const SAVED: &str = "SELECT binding,id,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version,publication FROM pull_merges WHERE id=?1";
+const DOMAIN: &[u8] = b"canopy.native-reviewed-merge-audit.v2\0";
+pub(super) const SAVED: &str = "SELECT binding,id,pull_number,oid,merged_ms,pull_version,source_oid,source_version,base_oid,base_version,publication,strategy,candidate_id FROM pull_merges WHERE id=?1";
 
 #[derive(Debug, thiserror::Error)]
 pub enum NativeMergeAuditError {
@@ -34,11 +34,16 @@ struct Audit {
     catalog: StoredCatalog,
     refs: RefStateSnapshotRoot,
     ref_generation: u64,
+    target: crate::ObjectId,
+    candidate: Option<StoredInputRoot>,
 }
 impl Audit {
     fn shape(&self) -> Result<(), CodecError> {
         self.input.encode(&mut BoundedEncoder::new(4096)?)?;
-        if self.input.request.strategy != MergeStrategy::FastForward
+        if self.candidate.is_some() != (self.input.request.strategy != MergeStrategy::FastForward)
+            || self.target.format() != self.catalog.format
+            || (self.input.request.strategy == MergeStrategy::FastForward
+                && hex::encode(self.target) != self.input.request.revision.source_oid)
             || !self.base_ref.starts_with("refs/heads/")
             || self.base_ref.len() > crate::packs::ref_state::MAX_NAME_BYTES
             || !crate::refs::valid_ref_name(&self.base_ref)
@@ -64,7 +69,7 @@ impl Audit {
             merge: MergeRecord {
                 id: self.input.request.id.clone(),
                 number: self.input.number,
-                oid: self.input.request.revision.source_oid.clone(),
+                oid: hex::encode(self.target),
                 merged_at_ms: self.input.issued_at_ms,
                 revision: self.input.request.revision.clone(),
             },
@@ -79,7 +84,9 @@ impl WireValue for Audit {
         e.write_text(&self.base_ref)?;
         self.catalog.encode(e)?;
         self.refs.encode(e)?;
-        e.write_u64(self.ref_generation)
+        e.write_u64(self.ref_generation)?;
+        e.write_bytes(self.target.as_ref())?;
+        self.candidate.encode(e)
     }
     fn decode(d: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
         if d.read_bytes()? != DOMAIN {
@@ -91,6 +98,9 @@ impl WireValue for Audit {
             catalog: StoredCatalog::decode(d)?,
             refs: RefStateSnapshotRoot::decode(d)?,
             ref_generation: d.read_u64()?,
+            target: crate::ObjectId::try_from(d.read_bytes()?)
+                .map_err(|_| CodecError::Invalid("merge target OID"))?,
+            candidate: Option::<StoredInputRoot>::decode(d)?,
         };
         value.shape()?;
         Ok(value)
@@ -102,6 +112,8 @@ pub(super) async fn prepare(
     input: &MergeInput,
     base_ref: &str,
     refs: RefStateSnapshotRoot,
+    target: crate::ObjectId,
+    candidate: Option<StoredInputRoot>,
 ) -> Result<(StoredInputRoot, u64), NativeMergePreparationError> {
     let store = prepared.base.indexes().store();
     let record = Audit {
@@ -110,6 +122,8 @@ pub(super) async fn prepare(
         catalog: prepared.catalog(),
         refs,
         ref_generation: refs.read(&store).await?.generation,
+        target,
+        candidate,
     };
     let generation = record.ref_generation;
     Ok((
@@ -149,7 +163,7 @@ pub(in crate::packs::publication) fn selected(
     let Some(row) = rows(result)?.first() else {
         return Ok(None);
     };
-    if row.len() != 11 {
+    if row.len() != 13 {
         return Err(Error::Command("invalid selected merge audit"));
     }
     let (SqlValue::Blob(binding), SqlValue::Blob(publication)) = (&row[0], &row[10]) else {
@@ -162,8 +176,25 @@ pub(in crate::packs::publication) fn selected(
         request: crate::pulls::merge::MergeRequest {
             id: merge.id.clone(),
             revision: merge.revision.clone(),
-            strategy: MergeStrategy::FastForward,
-            candidate_id: None,
+            strategy: match &row[11] {
+                SqlValue::Text(value) => match value.as_str() {
+                    "fast_forward" => MergeStrategy::FastForward,
+                    "merge_commit" => MergeStrategy::MergeCommit,
+                    "squash" => MergeStrategy::Squash,
+                    "rebase" => MergeStrategy::Rebase,
+                    _ => return Err(Error::Command("merge strategy")),
+                },
+                _ => return Err(Error::Command("merge strategy type")),
+            },
+            candidate_id: match &row[12] {
+                SqlValue::Null => None,
+                SqlValue::Blob(value) => Some(
+                    uuid::Uuid::from_slice(value)
+                        .map_err(|_| Error::Command("merge candidate UUID"))?
+                        .to_string(),
+                ),
+                _ => return Err(Error::Command("merge candidate type")),
+            },
         },
     };
     if *binding != request_binding(&expected) || crate::pulls::merge::record(&row[1..10])? != *merge
@@ -209,15 +240,34 @@ async fn verify(
         .await?;
     if state
         != Some(crate::RefExpectation {
-            oid: Some(
-                crate::pulls::merge::oid(&audit.input.request.revision.source_oid)
-                    .map_err(|_| NativeMergeAuditError::Context)?,
-            ),
+            oid: Some(audit.target),
             version: audit.input.request.revision.base_version + 1,
         })
     {
         return Err(NativeMergeAuditError::Context);
     }
+    if let Some(candidate) = audit.candidate {
+        let selected = uuid::Uuid::parse_str(
+            audit
+                .input
+                .request
+                .candidate_id
+                .as_deref()
+                .ok_or(NativeMergeAuditError::Context)?,
+        )
+        .map_err(|_| NativeMergeAuditError::Context)?;
+        let ready: super::super::candidate_publication::audit::Audit =
+            candidate.read(store, INPUT_ROOT_BYTES).await?;
+        if ready.candidate.request.id != selected.to_string()
+            || ready.candidate.number != audit.input.number
+            || ready.candidate.request.strategy != audit.input.request.strategy
+            || ready.candidate.request.revision != audit.input.request.revision
+            || !matches!(&ready.candidate.result,crate::pulls::candidates::CandidateResult::Ready{oid,..} if *oid==hex::encode(audit.target))
+            || ready.catalog.repository != store.repository()
+        {
+            return Err(NativeMergeAuditError::Context);
+        }
+    }
     Ok((audit, snapshot))
 }
 pub(in crate::packs::publication) async fn closed_graph(
@@ -229,6 +279,15 @@ pub(in crate::packs::publication) async fn closed_graph(
 ) -> Result<(), RootRecoveryError> {
     let (audit, snapshot) = verify(store, root, outcome, check).await?;
     let descriptor = super::super::recovery::archive::descriptor;
+    if let Some(candidate) = audit.candidate {
+        descriptor(
+            hash,
+            candidate.operation,
+            ArtifactKind::InputRoot,
+            candidate.artifact,
+        )?;
+    }
+
     descriptor(hash, root.operation, ArtifactKind::InputRoot, root.artifact)?;
     descriptor(
         hash,
diff --git a/crates/canopy-server/src/packs/publication/recovery/archive.rs b/crates/canopy-server/src/packs/publication/recovery/archive.rs
index c7eff079..cbc84d32 100644
--- a/crates/canopy-server/src/packs/publication/recovery/archive.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/archive.rs
@@ -121,6 +121,7 @@ impl WireValue for TerminalReleaseReply {
 }
 
 pub(super) enum Terminal {
+    Candidate(CandidatePublicationReply),
     Push(Box<CompletedRootPush>),
     Initialization(InitializationReply),
     Merge(crate::pulls::merge::MergeOutcome),
@@ -132,6 +133,9 @@ impl Terminal {
             sql: match self {
                 Self::Push(_) => super::super::root_completion::read::SAVED,
                 Self::Initialization(_) => super::super::initialization::publish::SAVED,
+                Self::Candidate(reply) => {
+                    return super::super::candidate_publication::audit::statement(reply);
+                }
                 Self::Head(_) => super::super::native_head::publish::SAVED,
                 Self::Merge(outcome) => {
                     return super::super::native_merge::audit::statement(outcome);
@@ -156,6 +160,15 @@ impl Terminal {
             // A known negative is the original phase knowledge. A later attempt
             // may initialize this logical operation, without rewriting that denial.
             Self::Initialization(InitializationReply::Denied(_)) => true,
+            Self::Candidate(reply) => {
+                !reply.applied()
+                    || super::super::candidate_publication::audit::selected(
+                        result,
+                        reply,
+                        &check.actor,
+                    )?
+                    .is_some()
+            }
             Self::Head(reply) => {
                 matches!(reply, PublicationReply::Denied(_))
                     || super::super::native_head::publish::selected(result, check, *reply)?
@@ -176,6 +189,13 @@ impl Terminal {
         hash: &mut blake3::Hasher,
     ) -> Result<(), RootRecoveryError> {
         match self {
+            Self::Candidate(reply) => {
+                hash.update(&encoded(reply, 512)?);
+                super::super::candidate_publication::audit::closed_graph(
+                    store, selected, reply, check, hash,
+                )
+                .await?;
+            }
             Self::Head(reply) => {
                 hash.update(&encoded(reply, 512)?);
                 if let PublicationReply::Published(published) = reply {
@@ -274,6 +294,16 @@ impl phase::Journal {
         self.may_advance(record)?;
         // A merge has its own typed permanent audit selection. Known denials
         // retain their original phase even if a later UUID attempt succeeds.
+        if record.kind == Kind::Candidate {
+            return self
+                .primary
+                .as_ref()
+                .map(|v| {
+                    v.decode_reply::<CandidatePublicationReply>()
+                        .map(Terminal::Candidate)
+                })
+                .transpose();
+        }
         if record.kind == Kind::Head {
             return self
                 .primary
diff --git a/crates/canopy-server/src/packs/publication/recovery/codec.rs b/crates/canopy-server/src/packs/publication/recovery/codec.rs
index 52501329..96d8728f 100644
--- a/crates/canopy-server/src/packs/publication/recovery/codec.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/codec.rs
@@ -30,6 +30,7 @@ impl WireValue for Record {
             Kind::Initialization => 3,
             Kind::Merge => 4,
             Kind::Head => 5,
+            Kind::Candidate => 6,
         })?;
         self.primary.encode(e)?;
         e.write_bool(self.refusal.is_some())?;
@@ -58,6 +59,7 @@ impl WireValue for Record {
                 3 => Kind::Initialization,
                 4 => Kind::Merge,
                 5 => Kind::Head,
+                6 => Kind::Candidate,
                 _ => return Err(CodecError::Invalid("root recovery command")),
             },
             primary: Stamp::decode(d)?,
@@ -95,6 +97,7 @@ impl WireValue for Bundle {
             Kind::Initialization => 3,
             Kind::Merge => 4,
             Kind::Head => 5,
+            Kind::Candidate => 6,
         })?;
         self.primary.encode(e)?;
         e.write_bool(self.refusal.is_some())?;
@@ -115,6 +118,7 @@ impl WireValue for Bundle {
                 3 => Kind::Initialization,
                 4 => Kind::Merge,
                 5 => Kind::Head,
+                6 => Kind::Candidate,
                 _ => return Err(CodecError::Invalid("unknown recovery kind")),
             },
             primary: SavedCommand::decode(d)?,
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index 937c453e..f77bfeda 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -39,6 +39,8 @@ const DOMAIN: &[u8] = b"canopy.publication-command-recovery.v4\0";
 
 #[derive(Debug, thiserror::Error)]
 pub enum RootRecoveryError {
+    #[error("selected candidate audit failed")]
+    CandidateAudit(#[source] Box<NativeCandidateAuditError>),
     #[error("symbolic HEAD retirement metadata failed")]
     HeadMetadata(#[from] crate::packs::directory::index::IndexError),
     #[error("symbolic HEAD retirement snapshot failed")]
@@ -92,10 +94,13 @@ pub(super) enum Kind {
     Initialization,
     Merge,
     Head,
+    Candidate,
 }
 impl Kind {
     fn body_limit(self) -> u32 {
-        if self == Self::Head {
+        if self == Self::Candidate {
+            NATIVE_CANDIDATE_BYTES
+        } else if self == Self::Head {
             NATIVE_HEAD_BYTES
         } else if self == Self::Merge {
             NATIVE_MERGE_BYTES
@@ -351,7 +356,7 @@ impl RegisteredRootRecovery {
                 )
                 .await
             }
-            Kind::Policy | Kind::Initialization | Kind::Merge | Kind::Head => {
+            Kind::Policy | Kind::Initialization | Kind::Merge | Kind::Head | Kind::Candidate => {
                 Err(AttemptError::Invocation(InvocationError::NotStarted(
                     Error::Command("recovery kind requires typed phase dispatch"),
                 )))
@@ -395,6 +400,21 @@ impl RegisteredRootRecovery {
                 .await
                 .map(PublicationOutcome::Initialization);
         }
+        if self.record.kind == Kind::Candidate {
+            let result = self
+                .dispatch_command::<PublishNativeCandidate>(
+                    client, store, authority, false, original,
+                )
+                .await
+                .map_err(|e| e.publication(self.evidence(), PublicationError::Candidate))?;
+            return if result.output.applied() {
+                Ok(PublicationOutcome::Candidate(result))
+            } else {
+                Err(PublicationError::Candidate(InvocationError::Rejected(
+                    Box::new(result),
+                )))
+            };
+        }
         if self.record.kind == Kind::Head {
             let result = self
                 .dispatch_command::<PublishNativeHead>(client, store, authority, false, original)
@@ -599,7 +619,10 @@ impl RegisteredRootRecovery {
         // Its original final receiver must record expired/revoked denials,
         // while checking actual owner, original pin and current joint roots.
         let session = if refusal_only
-            || matches!(self.record.kind, Kind::Initialization | Kind::Head)
+            || matches!(
+                self.record.kind,
+                Kind::Initialization | Kind::Head | Kind::Candidate
+            )
             || original.is_some()
         {
             None
@@ -889,3 +912,9 @@ pub(super) async fn persist_full<C: Command>(
     }
     Ok(registered)
 }
+
+impl From<NativeCandidateAuditError> for RootRecoveryError {
+    fn from(error: NativeCandidateAuditError) -> Self {
+        Self::CandidateAudit(Box::new(error))
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/recovery/phase.rs b/crates/canopy-server/src/packs/publication/recovery/phase.rs
index e0b112d1..8c0c2c80 100644
--- a/crates/canopy-server/src/packs/publication/recovery/phase.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/phase.rs
@@ -89,6 +89,10 @@ impl Journal {
                     primary.decode_reply::<InitializationReply>()?,
                     InitializationReply::Denied(_)
                 )
+            } else if record.kind == Kind::Candidate {
+                !primary
+                    .decode_reply::<CandidatePublicationReply>()?
+                    .applied()
             } else if record.kind == Kind::Head {
                 matches!(
                     primary.decode_reply::<PublicationReply>()?,
@@ -160,7 +164,7 @@ impl Journal {
                 primary.decode_reply::<InitializationReply>()?,
                 InitializationReply::Denied(_)
             )
-        } else if matches!(record.kind, Kind::Merge | Kind::Head) {
+        } else if matches!(record.kind, Kind::Merge | Kind::Head | Kind::Candidate) {
             false
         } else if record.kind == Kind::Policy {
             matches!(primary.decode_reply::<RefPolicyReply>()?, RefPolicyReply::Registered(value) if value.valid)
diff --git a/crates/canopy-server/src/packs/publication/recovery/ready.rs b/crates/canopy-server/src/packs/publication/recovery/ready.rs
index 7c60abd9..49e60b46 100644
--- a/crates/canopy-server/src/packs/publication/recovery/ready.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/ready.rs
@@ -105,6 +105,10 @@ impl ReadyRootRecovery {
             PublicationError::Initialization(InvocationError::Pending(Box::new(
                 self.recovery.evidence().clone(),
             )))
+        } else if self.recovery.record.kind == Kind::Candidate {
+            PublicationError::Candidate(InvocationError::Pending(Box::new(
+                self.recovery.evidence().clone(),
+            )))
         } else if self.recovery.record.kind == Kind::Head {
             PublicationError::Head(InvocationError::Pending(Box::new(
                 self.recovery.evidence().clone(),
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 9e18b4e0..91fafa52 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,7 +23,7 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 24] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 25] = [
     crate::operation(1),
     command::<crate::branch_rules::command::SetBranchRule>(64 << 10, 64),
     command::<PublishReviewedMerge>(NATIVE_MERGE_BYTES, 512),
@@ -51,6 +51,7 @@ pub(crate) const COMMANDS: [OperationDescriptor; 24] = [
     command::<crate::pulls::native::CreateNativePull>(crate::pulls::native::INPUT_BYTES, 16),
     command::<crate::pulls::native::ReviewNativePull>(crate::pulls::native::INPUT_BYTES, 16),
     command::<PublishNativeHead>(NATIVE_HEAD_BYTES, 512),
+    command::<PublishNativeCandidate>(NATIVE_CANDIDATE_BYTES, 512),
 ];
 pub(crate) const QUERIES: [OperationDescriptor; 13] = [
     crate::operation(2),
@@ -100,7 +101,7 @@ mod tests {
             ids,
             vec![
                 1, 8, 9, 10, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49,
-                51, 53, 54
+                51, 53, 54, 55
             ]
         );
         assert_eq!(
@@ -112,6 +113,12 @@ mod tests {
             vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48, 50, 52]
         );
         for (id, codec, input, output) in [
+            (
+                55,
+                PublishNativeCandidate::CODEC_VERSION,
+                NATIVE_CANDIDATE_BYTES,
+                512,
+            ),
             (54, PublishNativeHead::CODEC_VERSION, NATIVE_HEAD_BYTES, 512),
             (
                 10,
diff --git a/crates/canopy-server/src/packs/publication/schema.sql b/crates/canopy-server/src/packs/publication/schema.sql
index f366cbe4..c10abbc8 100644
--- a/crates/canopy-server/src/packs/publication/schema.sql
+++ b/crates/canopy-server/src/packs/publication/schema.sql
@@ -283,7 +283,10 @@ CREATE TABLE pull_merges (
     source_version INTEGER NOT NULL CHECK(source_version > 0),
     base_oid BLOB NOT NULL CHECK(length(base_oid) IN (20, 32)),
     base_version INTEGER NOT NULL CHECK(base_version > 0),
-    publication BLOB NOT NULL CHECK(length(publication) BETWEEN 1 AND 128)
+    publication BLOB NOT NULL CHECK(length(publication) BETWEEN 1 AND 128),
+    strategy TEXT NOT NULL DEFAULT 'fast_forward' CHECK(strategy IN ('fast_forward','merge_commit','squash','rebase')),
+    candidate_id BLOB REFERENCES merge_candidates(id) CHECK(candidate_id IS NULL OR length(candidate_id)=16),
+    CHECK((strategy='fast_forward' AND candidate_id IS NULL) OR (strategy!='fast_forward' AND candidate_id IS NOT NULL))
 ) WITHOUT ROWID;
 CREATE TRIGGER pull_merge_immutable BEFORE UPDATE ON pull_merges
 BEGIN SELECT RAISE(ABORT,'merge result immutable'); END;
@@ -303,8 +306,20 @@ CREATE TABLE merge_candidates (
     result TEXT NOT NULL CHECK(length(CAST(result AS BLOB)) <= 262144),
     source_oid BLOB NOT NULL CHECK(length(source_oid) IN (20, 32)),
     base_oid BLOB NOT NULL CHECK(length(base_oid) IN (20, 32)),
-    oid BLOB CHECK(oid IS NULL OR length(oid) IN (20, 32))
+    oid BLOB CHECK(oid IS NULL OR length(oid) IN (20, 32)),
+    native_publication BLOB CHECK(native_publication IS NULL OR (typeof(native_publication)='blob' AND length(native_publication) BETWEEN 1 AND 512))
 ) WITHOUT ROWID;
+CREATE TRIGGER candidate_intent_immutable BEFORE UPDATE ON merge_candidates
+WHEN NEW.id IS NOT OLD.id OR NEW.binding IS NOT OLD.binding OR NEW.pull_number IS NOT OLD.pull_number OR NEW.actor IS NOT OLD.actor OR NEW.request IS NOT OLD.request OR NEW.created_ms IS NOT OLD.created_ms OR NEW.source_oid IS NOT OLD.source_oid OR NEW.base_oid IS NOT OLD.base_oid
+BEGIN SELECT RAISE(ABORT,'candidate intent immutable'); END;
+CREATE TRIGGER candidate_completed_immutable BEFORE UPDATE ON merge_candidates
+WHEN json_extract(OLD.result,'$.state') IS NOT 'pending' AND (NEW.result IS NOT OLD.result OR NEW.oid IS NOT OLD.oid OR NEW.native_publication IS NOT OLD.native_publication)
+BEGIN SELECT RAISE(ABORT,'candidate result immutable'); END;
+CREATE TRIGGER candidate_intent_not_replaced BEFORE INSERT ON merge_candidates
+WHEN EXISTS(SELECT 1 FROM merge_candidates WHERE id=NEW.id)
+BEGIN SELECT RAISE(ABORT,'candidate intent retained'); END;
+CREATE TRIGGER candidate_intent_retained BEFORE DELETE ON merge_candidates
+BEGIN SELECT RAISE(ABORT,'candidate intent retained'); END;
 
 CREATE TABLE pull_threads (
     number INTEGER PRIMARY KEY AUTOINCREMENT,
diff --git a/crates/canopy-server/src/packs/publication/staging_service/driver.rs b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
index 8ae4eb90..8711f75f 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/driver.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
@@ -118,6 +118,35 @@ impl StagingCoordinator {
         ReadyStaging::new(client.clone(), self.inner.target.clone(), request, identity).await
     }
 
+    /// Candidate observers join by the digest of the existing frozen editorial
+    /// intent. Search only the bounded admitted jobs, without a second UUID
+    /// cache. Uncertain work keeps its original ticket/commands; once a known
+    /// attempt fully drains, a new operation can retry the same pending intent.
+    pub(crate) fn join_generated_candidate(
+        &self,
+        request: &BeginRequest,
+    ) -> Result<Option<StagingTicket>, StagingError> {
+        if crate::repository_target(
+            self.inner.target.tenant(),
+            self.inner.target.application(),
+            request.repository,
+        )
+        .map_err(|_| StagingError::Context)?
+            != self.inner.target
+        {
+            return Err(StagingError::Foreign);
+        }
+        let admitted = self.inner.admission.lock().expect("staging admission");
+        Ok(admitted
+            .jobs
+            .values()
+            .find(|job| job.actor == request.actor && job.request_digest == request.request_digest)
+            .map(|job| StagingTicket {
+                inner: self.inner.clone(),
+                job: job.clone(),
+            }))
+    }
+
     /// Joining an operation ID requires the original authenticated context,
     /// including while Begin has not yet produced a token.
     pub fn join_request(
diff --git a/crates/canopy-server/src/packs/publication/tests.rs b/crates/canopy-server/src/packs/publication/tests.rs
index d9fd2ab6..5aeca18b 100644
--- a/crates/canopy-server/src/packs/publication/tests.rs
+++ b/crates/canopy-server/src/packs/publication/tests.rs
@@ -1,5 +1,6 @@
 use super::*;
 mod attestation;
+mod candidate_publication;
 mod compaction;
 mod completion;
 mod coordinator;
diff --git a/crates/canopy-server/src/packs/publication/tests/candidate_publication.rs b/crates/canopy-server/src/packs/publication/tests/candidate_publication.rs
new file mode 100644
index 00000000..77134e4e
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/tests/candidate_publication.rs
@@ -0,0 +1,316 @@
+//! Real Git generated bytes, owner-fenced SQL rollback and exact SDK recovery.
+use super::*;
+use super::{
+    native_candidate::{candidate, catalog, initial, ready, write},
+    native_merge,
+    prepare::{cleaned, opened},
+    publishing::edit,
+};
+use crate::{
+    git_gateway::candidates::ProducedCandidate,
+    packs::verification::physical::tests::prepared_for_store,
+    pulls::{
+        candidates::{CandidateResult, MergeCandidate, commit_body},
+        merge::MergeStrategy,
+    },
+};
+use canopy_object_storage::artifact::{ArtifactKey, ArtifactKind};
+use cellule_runtime::{PreparedCommand, Resolution};
+use object_store::ObjectStoreExt;
+
+async fn reserve(f: &Fixture, candidate: &MergeCandidate) -> Result {
+    let candidate = candidate.clone();
+    f.handle.execute(identity()?,Digest::from_bytes([218;32]),sql::now(0)?,4096,0,move|tx| {
+        let id=uuid::Uuid::parse_str(&candidate.request.id).map_err(|_|Error::Command("candidate fixture UUID"))?;
+        let binding=crate::pulls::candidates::intent_binding(&candidate)?;
+        let request=serde_json::to_string(&candidate.request).map_err(|_|Error::Command("candidate fixture request"))?;
+        let result=serde_json::to_string(&CandidateResult::Pending).map_err(|_|Error::Command("candidate fixture result"))?;
+        tx.execute("INSERT INTO merge_candidates(id,binding,pull_number,actor,request,created_ms,result,source_oid,base_oid) VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9)",rusqlite::params![id.as_bytes().as_slice(),binding,candidate.number,candidate.actor,request,candidate.created_at_ms,result,crate::pulls::merge::oid(&candidate.request.revision.source_oid)?.as_ref(),crate::pulls::merge::oid(&candidate.request.revision.base_oid)?.as_ref()])?;
+        Ok(cellule_runtime::cell::executor::HandlerOutcome::Success(vec![]))
+    }).await?;
+    Ok(())
+}
+async fn state(f: &Fixture) -> Result<Vec<u8>> {
+    let roots = super::publishing::state(&f.handle).await?;
+    let editorial=f.handle.query(0,65536,|db| {
+        let candidate:(String,Option<Vec<u8>>,Option<Vec<u8>>)=db.query_row("SELECT result,oid,native_publication FROM merge_candidates",[],|r|Ok((r.get(0)?,r.get(1)?,r.get(2)?)))?;
+        let mut query=db.prepare("SELECT recovery_phase,recovery_phase_revision FROM catalog_leases ORDER BY admission_sequence")?;
+        let phases=query.query_map([],|r|Ok((r.get::<_,Option<Vec<u8>>>(0)?,r.get::<_,u64>(1)?)))?.collect::<rusqlite::Result<Vec<_>>>()?;
+        serde_json::to_vec(&(candidate,phases)).map_err(|_|Error::Command("candidate fixture state"))
+    }).await?;
+    Ok([roots, editorial].concat())
+}
+async fn command(
+    f: &Fixture,
+    prepared: &PreparedCatalog,
+    candidate: MergeCandidate,
+    root: &std::path::Path,
+    budget: cellule_ltx::DiskBudget,
+) -> Result<(
+    PreparedCommand<PublishNativeCandidate>,
+    RegisteredRootRecovery,
+)> {
+    let produced = ProducedCandidate::verified_fixture(candidate, prepared.token().operation);
+    let proof = prepared
+        .native_candidate_proof(
+            &produced,
+            root,
+            budget,
+            crate::packs::metadata::tests::limits(),
+        )
+        .await?;
+    let command = f
+        .client()
+        .prepare_command::<PublishNativeCandidate>(&f.target, identity()?, proof)
+        .await?;
+    let registered = super::super::recovery::persist(
+        &prepared.base.session,
+        &command,
+        super::super::recovery::Kind::Candidate,
+        &prepared.base.indexes().store(),
+        identity()?,
+        0,
+    )
+    .await?;
+    Ok((command, registered))
+}
+#[tokio::test]
+async fn native_candidate_ready_is_atomic_retained_and_recovers_original_receipt_after_body_retirement()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, merge) = native_merge::initial(format, false).await?;
+        let (base, _, _) =
+            opened(&f, *uuid::Uuid::new_v4().as_bytes(), graph.store.clone()).await?;
+        let mut native = prepared_for_store(
+            format,
+            4,
+            base.context().operation,
+            graph.provider.clone(),
+            graph.store.clone(),
+        )
+        .await?;
+        // Install the real accepted base pack into this isolated fixture so
+        // stock Git can traverse the generated commit's original parents.
+        let reader =
+            crate::packs::catalog::CatalogReader::open(base.indexes(), graph.prepared.catalog())
+                .await?;
+        let files = base.files();
+        let pack = reader
+            .lookup(graph.tip, &*files, &*files)
+            .await?
+            .ok_or("base source")?
+            .source
+            .record
+            .native();
+        let mut body = graph
+            .store
+            .read(pack.key(ArtifactKind::Pack)?, pack.pack)
+            .await?;
+        let mut bytes = Vec::new();
+        while let Some(chunk) = body.next().await? {
+            bytes.extend_from_slice(&chunk);
+        }
+        crate::packs::verification::physical::tests::independence::git_input(
+            native.fixture.root.path(),
+            &["index-pack", "--stdin"],
+            &bytes,
+        )
+        .await?;
+        let (first, tree) = initial(&native)?;
+        assert_eq!(first, graph.initial);
+        let mut pending = candidate(MergeStrategy::MergeCommit, graph.initial, graph.tip);
+        pending.request.revision = merge.revision;
+        reserve(&f, &pending).await?;
+        let generated = write(
+            &native,
+            &commit_body(&pending, &hex::encode(tree)),
+            "refs/heads/generated",
+        )
+        .await?;
+        let completed = ready(&pending, generated, tree);
+        let (prepared, root, budget) = catalog(&f, &mut native, base).await?;
+        let check = prepared.base.capability().2.clone();
+        let (command, saved) =
+            command(&f, &prepared, completed, root.path(), budget.clone()).await?;
+        edit(&f,"CREATE TRIGGER abort_candidate BEFORE UPDATE OF result ON merge_candidates BEGIN SELECT RAISE(ABORT,'late candidate failure'); END;").await?;
+        let before = state(&f).await?;
+        assert!(command.clone().execute().await.is_err());
+        assert_eq!(state(&f).await?, before);
+        assert!(matches!(
+            f.client().resolve(command.evidence()).await?,
+            Resolution::Absent
+        ));
+        edit(&f, "DROP TRIGGER abort_candidate").await?;
+        let original = command.clone().execute().await?;
+        assert!(matches!(
+            original.output,
+            CandidatePublicationReply::Applied {
+                publication: Some(PublishedRefs {
+                    generation: 2,
+                    ref_generation: 2,
+                    ..
+                }),
+                ..
+            }
+        ));
+        assert_eq!(command.execute().await?.receipt, original.receipt);
+        let selected = f
+            .handle
+            .query(0, 1024, |db| {
+                assert_eq!(
+                    db.query_row("SELECT generation FROM ref_generation", [], |r| r
+                        .get::<_, i64>(0))?,
+                    2
+                );
+                assert_eq!(
+                    db.query_row("SELECT count(*) FROM refs", [], |r| r.get::<_, i64>(0))?,
+                    0
+                );
+                assert!(
+                    db.execute("UPDATE merge_candidates SET created_ms=created_ms+1", [])
+                        .is_err()
+                );
+                assert!(
+                    db.execute("UPDATE merge_candidates SET result='{}'", [])
+                        .is_err()
+                );
+                assert!(db.execute("DELETE FROM merge_candidates", []).is_err());
+                db.query_row("SELECT native_publication FROM merge_candidates", [], |r| {
+                    r.get::<_, Vec<u8>>(0)
+                })
+                .map_err(Into::into)
+            })
+            .await?;
+        let mut decoder = BoundedDecoder::new(&selected, 512)?;
+        let selected = super::super::candidate_publication::audit::Selected::decode(&mut decoder)?;
+        decoder.finish()?;
+        let audit = selected.root.ok_or("candidate audit absent")?;
+        let path = graph.store.path(
+            ArtifactKey {
+                operation: audit.operation,
+                binding_digest: audit.artifact.digest,
+                kind: ArtifactKind::InputRoot,
+            },
+            audit.artifact.digest,
+        )?;
+        let bytes = graph.provider.get(&path).await?.bytes().await?;
+        graph.provider.delete(&path).await?;
+        let admin = super::terminal_retention::maintenance(&f.handle, f.repository).await?;
+        assert!(
+            saved
+                .ready_terminal_release(f.client(), &graph.store, admin.clone(), identity()?)
+                .await
+                .is_err()
+        );
+        graph.provider.put(&path, bytes.into()).await?;
+        assert_eq!(
+            saved
+                .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
+                .await?
+                .complete()
+                .await?
+                .output,
+            TerminalReleaseReply::Released
+        );
+        for (key, descriptor) in saved.command_bodies_for_test() {
+            graph
+                .provider
+                .delete(&graph.store.path(key, descriptor.digest)?)
+                .await?;
+        }
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        let (runtime, handle, client) = super::durable_recovery::restore_owner(&f, &check).await?;
+        assert!(handle.owner_fence().epoch > check.token.owner.epoch);
+        let restored = RegisteredRootRecovery::load(&client, &f.target, &graph.store, &check)
+            .await?
+            .ok_or("candidate recovery archive absent")?;
+        let PublicationOutcome::Candidate(replay) = restored
+            .dispatch_any(
+                &client,
+                &graph.store,
+                &f.authority(),
+                &std::sync::atomic::AtomicBool::new(false),
+            )
+            .await?
+        else {
+            return Err("wrong candidate recovery purpose".into());
+        };
+        assert_eq!(
+            (replay.output, replay.receipt),
+            (original.output, original.receipt)
+        );
+        runtime.shutdown().await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn large_negative_candidate_uses_compact_ack_without_publishing_roots() -> Result {
+    use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (f, graph, merge) = native_merge::initial(format, false).await?;
+        let (prepared, root, budget) = native_merge::preparation(&f, &graph).await?;
+        let mut pending = candidate(MergeStrategy::MergeCommit, graph.initial, graph.tip);
+        pending.request.revision = merge.revision;
+        reserve(&f, &pending).await?;
+        let mut completed = pending;
+        completed.result = CandidateResult::Conflicted {
+            paths_base64: vec![URL_SAFE_NO_PAD.encode(vec![b'x'; 256]); 700],
+        };
+        assert!(crate::pulls::candidates::valid_result(&completed.result));
+        assert!(serde_json::to_vec(&completed.result)?.len() > 200 << 10);
+        let (command, saved) =
+            command(&f, &prepared, completed, root.path(), budget.clone()).await?;
+        let before = f
+            .handle
+            .query(0, 1024, |db| {
+                Ok(db
+                    .query_row("SELECT generation FROM catalog_state", [], |r| {
+                        r.get::<_, u64>(0)
+                    })?
+                    .to_le_bytes()
+                    .to_vec())
+            })
+            .await?;
+        let original = command.execute().await?;
+        assert!(matches!(
+            original.output,
+            CandidatePublicationReply::Applied {
+                publication: None,
+                ..
+            }
+        ));
+        let mut encoded = BoundedEncoder::new(512)?;
+        original.output.encode(&mut encoded)?;
+        assert!(encoded.finish().len() < 128);
+        assert_eq!(
+            f.handle
+                .query(0, 1024, |db| Ok(db
+                    .query_row("SELECT generation FROM catalog_state", [], |r| r
+                        .get::<_, u64>(0))?
+                    .to_le_bytes()
+                    .to_vec()))
+                .await?,
+            before
+        );
+        let admin = super::terminal_retention::maintenance(&f.handle, f.repository).await?;
+        assert_eq!(
+            saved
+                .ready_terminal_release(f.client(), &graph.store, admin, identity()?)
+                .await?
+                .complete()
+                .await?
+                .output,
+            TerminalReleaseReply::Released
+        );
+        drop(prepared);
+        cleaned(root.path(), &budget).await?;
+        drop(graph.prepared);
+        cleaned(graph.root.path(), &graph.budget).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/native_candidate.rs b/crates/canopy-server/src/packs/publication/tests/native_candidate.rs
index f97a8c00..e56332dc 100644
--- a/crates/canopy-server/src/packs/publication/tests/native_candidate.rs
+++ b/crates/canopy-server/src/packs/publication/tests/native_candidate.rs
@@ -26,7 +26,7 @@ fn oid(bytes: Vec<u8>) -> Result<ObjectId> {
     let s = String::from_utf8(bytes)?;
     Ok(crate::pulls::merge::oid(s.trim())?)
 }
-async fn write(native: &Prepared, body: &[u8], name: &str) -> Result<ObjectId> {
+pub(super) async fn write(native: &Prepared, body: &[u8], name: &str) -> Result<ObjectId> {
     let o = oid(git_input(
         native.fixture.root.path(),
         &["hash-object", "-t", "commit", "-w", "--stdin"],
@@ -45,7 +45,11 @@ async fn write(native: &Prepared, body: &[u8], name: &str) -> Result<ObjectId> {
 fn original(tree: ObjectId, parent: ObjectId, message: &str) -> Vec<u8> {
     format!("tree {}\nparent {}\nauthor Author <author@example.invalid> 1 +0000\ncommitter Original <original@example.invalid> 2 +0000\nencoding UTF-8\ngpgsig stale signature\n continuation\nmergetag stale tag\n continuation\n\n{message}\n",hex::encode(tree),hex::encode(parent)).into_bytes()
 }
-fn candidate(strategy: MergeStrategy, base: ObjectId, source: ObjectId) -> MergeCandidate {
+pub(super) fn candidate(
+    strategy: MergeStrategy,
+    base: ObjectId,
+    source: ObjectId,
+) -> MergeCandidate {
     MergeCandidate {
         request: CandidateRequest {
             id: uuid::Uuid::new_v4().to_string(),
@@ -69,7 +73,7 @@ fn candidate(strategy: MergeStrategy, base: ObjectId, source: ObjectId) -> Merge
         result: CandidateResult::Pending,
     }
 }
-fn ready(c: &MergeCandidate, tip: ObjectId, tree: ObjectId) -> MergeCandidate {
+pub(super) fn ready(c: &MergeCandidate, tip: ObjectId, tree: ObjectId) -> MergeCandidate {
     let mut c = c.clone();
     c.result = CandidateResult::Ready {
         oid: hex::encode(tip),
@@ -77,7 +81,7 @@ fn ready(c: &MergeCandidate, tip: ObjectId, tree: ObjectId) -> MergeCandidate {
     };
     c
 }
-fn initial(native: &Prepared) -> Result<(ObjectId, ObjectId)> {
+pub(super) fn initial(native: &Prepared) -> Result<(ObjectId, ObjectId)> {
     let (commit, edges) = native
         .fixture
         .objects
@@ -92,7 +96,7 @@ fn initial(native: &Prepared) -> Result<(ObjectId, ObjectId)> {
     Ok((commit.oid, tree))
 }
 
-async fn catalog(
+pub(super) async fn catalog(
     f: &Fixture,
     native: &mut Prepared,
     base: Arc<PreparationBaseResolver>,
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index 8d1b0f14..d3d65075 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -852,3 +852,74 @@ async fn staged_service_revocation_drops_completed_owned_results_before_releasin
     fixture.runtime.shutdown().await?;
     Ok(())
 }
+
+#[tokio::test]
+async fn generated_candidate_intent_joins_uncertain_original_and_retries_only_after_known_drain()
+-> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        let first_request = f.begin([191; 16]);
+        c.fault_for_test(4);
+        let first = submit(&f, &c, first_request.operation, "owner").await?;
+        assert!(matches!(
+            terminal(&first).await?,
+            StagingState::Uncertain(_)
+        ));
+        let original = first
+            .custody_evidence_for_test()
+            .ok_or("original custody absent")?;
+        assert!(matches!(
+            f.client().resolve(&original.0).await?,
+            cellule_runtime::Resolution::Absent
+        ));
+        let mut retry = first_request.clone();
+        retry.operation = [192; 16];
+        let joined = c
+            .join_generated_candidate(&retry)?
+            .ok_or("original uncertain candidate not joined")?;
+        assert_eq!(joined.custody_evidence_for_test(), Some(original.clone()));
+        assert_eq!(c.stats().admitted, 1);
+        let mut wrong = retry.clone();
+        wrong.actor = "writer".into();
+        assert!(c.join_generated_candidate(&wrong)?.is_none());
+        wrong = retry.clone();
+        wrong.request_digest = [195; 32];
+        assert!(c.join_generated_candidate(&wrong)?.is_none());
+        wrong = retry.clone();
+        wrong.repository = [196; 16];
+        assert!(c.join_generated_candidate(&wrong).is_err());
+        c.recover(&first)?;
+        let old = active(&first).await?;
+        // Once acceptance is known, transient pending diagnostics are released.
+        // The durable custody head and SDK still select the exact original.
+        let saved = RegisteredCustody::load_latest(&f.client(), &f.target, first_request.operation)
+            .await?
+            .ok_or("original custody head missing")?;
+        assert_eq!(saved.evidence(), &original.0);
+        assert!(matches!(
+            f.client().resolve(&original.0).await?,
+            cellule_runtime::Resolution::Committed(_)
+        ));
+        assert!(matches!(joined.state(),StagingState::Active(lease) if lease.token==old.token));
+        first.stop();
+        assert!(matches!(terminal(&first).await?, StagingState::Stopped));
+        timeout(Duration::from_secs(10), async {
+            while c.pending(first_request.operation).is_some() {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await?;
+        assert!(c.join_generated_candidate(&retry)?.is_none());
+        let ready =
+            ReadyStaging::new(f.client(), f.target.clone(), retry.clone(), identity()?).await?;
+        let fresh = c.submit(ready).map_err(|(error, _)| error)?;
+        let new = active(&fresh).await?;
+        assert_eq!(new.token.operation, retry.operation);
+        assert_ne!(new.token.attempt, old.token.attempt);
+        assert_ne!(new.token.artifact_operation, old.token.artifact_operation);
+        assert!(c.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/ref_state/transition.rs b/crates/canopy-server/src/packs/ref_state/transition.rs
index bace6e8e..6574d5bb 100644
--- a/crates/canopy-server/src/packs/ref_state/transition.rs
+++ b/crates/canopy-server/src/packs/ref_state/transition.rs
@@ -33,6 +33,48 @@ impl RefStateIndex {
     ) -> Result<RefTransition, RefStateError> {
         super::super::publication::codec::artifact_valid(operation)?;
         super::super::publication::ref_proof::shape(plan, self.format())?;
+        self.prepare_checked(base, operation, plan).await
+    }
+
+    /// Private reserved-ref creation. This tree output grants no write authority;
+    /// the generated publisher must authenticate the verified candidate scope.
+    pub(crate) async fn prepare_candidate(
+        &self,
+        base: Option<RefStateRoot>,
+        operation: [u8; 16],
+        candidate: &crate::pulls::candidates::MergeCandidate,
+    ) -> Result<RefTransition, RefStateError> {
+        use crate::pulls::candidates::{CandidateResult, valid_request};
+        let CandidateResult::Ready { oid, .. } = &candidate.result else {
+            return Err(RefStateError::Changed);
+        };
+        if !valid_request(&candidate.request)
+            || crate::directory::validate_component(&candidate.actor).is_err()
+        {
+            return Err(RefStateError::Changed);
+        }
+        let oid = crate::pulls::merge::oid(oid).map_err(|_| RefStateError::Changed)?;
+        if oid.format() != self.format() || oid.is_zero() {
+            return Err(RefStateError::Changed);
+        }
+        super::super::publication::codec::artifact_valid(operation)?;
+        let plan = PushPlan {
+            actor: candidate.actor.clone(),
+            updates: vec![crate::RefUpdate {
+                name: candidate.fetch_ref(),
+                expected: None,
+                new_oid: Some(oid),
+            }],
+        };
+        self.prepare_checked(base, operation, &plan).await
+    }
+
+    async fn prepare_checked(
+        &self,
+        base: Option<RefStateRoot>,
+        operation: [u8; 16],
+        plan: &PushPlan,
+    ) -> Result<RefTransition, RefStateError> {
         if let Some(root) = &base {
             self.tree.validate_root(root.clone()).await?;
         }
diff --git a/crates/canopy-server/src/pulls/candidates/mod.rs b/crates/canopy-server/src/pulls/candidates/mod.rs
index 8f3c59c7..a43167d3 100644
--- a/crates/canopy-server/src/pulls/candidates/mod.rs
+++ b/crates/canopy-server/src/pulls/candidates/mod.rs
@@ -218,11 +218,13 @@ impl RepositoryCell {
         Ok((snapshot, command::CandidateRefRequest { selection, action }))
     }
 }
-fn query(id: &str) -> cellule_runtime::Result<SqlBatch> {
+pub(crate) fn query(id: &str) -> cellule_runtime::Result<SqlBatch> {
     let id = uuid::Uuid::parse_str(id).map_err(|_| Error::Command("invalid candidate UUID"))?;
     Ok(SqlBatch {statements:vec![SqlStatement {sql:"SELECT binding, pull_number, actor, request, created_ms, result FROM merge_candidates WHERE id = ?1".into(),parameters:vec![SqlValue::Blob(id.as_bytes().to_vec())]}]})
 }
-fn decode(sets: &[SqlResultSet]) -> cellule_runtime::Result<Option<(Vec<u8>, MergeCandidate)>> {
+pub(crate) fn decode(
+    sets: &[SqlResultSet],
+) -> cellule_runtime::Result<Option<(Vec<u8>, MergeCandidate)>> {
     let set = sets
         .first()
         .ok_or(Error::Command("missing candidate result"))?;
@@ -326,3 +328,13 @@ fn certified(
         matches!(rows.first().and_then(|set|set.rows.first()).map(Vec::as_slice),Some([SqlValue::Blob(stored)]) if *stored == body),
     )
 }
+
+pub(crate) fn intent_binding(candidate: &MergeCandidate) -> cellule_runtime::Result<Vec<u8>> {
+    let request = serde_json::to_string(&candidate.request)
+        .map_err(|_| Error::Command("candidate intent encoding"))?;
+    Ok(super::mutations::binding(&[
+        &candidate.actor,
+        &candidate.number.to_string(),
+        &request,
+    ]))
+}
diff --git a/crates/canopy-server/src/pulls/merge/mod.rs b/crates/canopy-server/src/pulls/merge/mod.rs
index 68a35cef..daf982a9 100644
--- a/crates/canopy-server/src/pulls/merge/mod.rs
+++ b/crates/canopy-server/src/pulls/merge/mod.rs
@@ -99,6 +99,7 @@ pub(crate) fn reviewed_native_update(
     context: &cellule_runtime::registry::CommandContext<'_, '_>,
     input: &command::MergeInput,
     selection: &crate::packs::publication::RefSelection,
+    generated: Option<crate::ObjectId>,
 ) -> cellule_runtime::Result<Result<ReviewedMerge, MergeOutcome>> {
     let statement =
         super::native::with_refs(policy_statement(&input.actor, input.number), selection);
@@ -121,7 +122,7 @@ pub(crate) fn reviewed_native_update(
                 oid: Some(oid(&input.request.revision.base_oid)?),
                 version: input.request.revision.base_version,
             }),
-            new_oid: Some(oid(&input.request.revision.source_oid)?),
+            new_oid: Some(generated.unwrap_or(oid(&input.request.revision.source_oid)?)),
         },
     }))
 }
@@ -267,7 +268,7 @@ pub(crate) fn oid(text: &str) -> cellule_runtime::Result<crate::ObjectId> {
         .and_then(|value| value.try_into().ok())
         .ok_or(Error::Command("invalid merge object ID"))
 }
-pub(super) fn policy_statement<'a>(
+pub(crate) fn policy_statement<'a>(
     actor: impl Into<ReadIdentity<'a>>,
     number: i64,
 ) -> SqlStatement {
@@ -339,3 +340,11 @@ pub(super) fn policy_state(sets: &[SqlResultSet]) -> cellule_runtime::Result<Opt
         },
     }))
 }
+
+pub(crate) fn candidate_ready(
+    sets: &[SqlResultSet],
+    revision: &super::PullRevision,
+) -> cellule_runtime::Result<Option<bool>> {
+    Ok(policy_state(sets)?
+        .map(|state| state.policy.ready && state.policy.revision.as_ref() == Some(revision)))
+}
diff --git a/docs/design/native-generated-candidate-publication.md b/docs/design/native-generated-candidate-publication.md
new file mode 100644
index 00000000..8a071d9e
--- /dev/null
+++ b/docs/design/native-generated-candidate-publication.md
@@ -0,0 +1,103 @@
+# Native generated candidate publication
+
+This hard-cutover path reuses the existing candidate, merge, catalog, ref snapshot,
+input checkpoint and exact-command recovery structures. It creates no SQL Git
+object/ancestry mirror and no second persistent candidate UUID table.
+
+## Frozen intent and resident admission
+
+Operation 10 reserves the existing `merge_candidates` row with the first actor,
+pull number, full source/base revision, strategy, message and creating timestamp.
+The intent is immutable. Completed results are immutable and duplicate inserts
+and deletes are refused by the native schema. A completed UUID returns its
+original result under current authorization.
+
+A pending intent enters resident staging with a domain-separated digest of its
+canonical candidate value and repository. Admission briefly holds the existing
+gateway admission mutex. It searches only the staging service's bounded admitted
+job map for the same actor and digest. Concurrent observers share the original
+controller, including uncertain original custody or publication commands. A new
+operation and creating namespace can be admitted after a known attempt has fully
+drained. No observer owns the native process or final recovery command.
+
+Git `merge-base`, `merge-tree`, `commit-tree` and the bounded rebase producer run
+with the staging physical owner retained by their native process owner. Rebase
+continues to support at most 128 linear commits, preserving original author,
+message and encoding while removing stale signatures. The private catalog
+verifier independently checks the original boundary and exact rewritten chain.
+Only this native producer constructs `ProducedCandidate`; a client Ready DTO
+cannot construct the production witness.
+
+## Generated inputs
+
+The accepted native base consists of immutable catalog packs. The producer
+streams newly written loose OIDs into a disk-admitted spool with constant
+iteration memory and a one-million-object request ceiling. `pack-objects` reads
+that explicit spool, disables object/delta reuse and emits a non-thin pair.
+Existing base packs are not recaptured as new input.
+
+Capture reconciles disk usage, fences the private cache and inspects only that
+exact generated pack/index pair in the admitted creating namespace. The fence,
+cache and physical owner remain pinned through authenticated hash/upload work.
+The existing native input checkpoint retains the exact pair inventory.
+Independent physical verification downloads it without alternates, checks the
+physical partition and canonical identities, then stages bounded metadata.
+Catalog preparation checks typed closure against the certified bound base.
+The candidate verifier checks the exact generated commit semantics before the
+private publication factory can issue a MAC. A generated commit already present
+in the certified base can require no new pair.
+
+## Atomic publication and compact recovery
+
+Operation 55, codec 1, authenticates the candidate-purpose binding of the frozen
+result, exact held-base native ref observations, proposed snapshot, its certified
+ref generation, and typed permanent audit. Ready creates the one server-owned
+candidate fetch ref with an absent expectation; the ordinary push factory still
+rejects server-owned ref updates.
+
+The final owner transaction selects the immutable intent and any first completed
+result, then checks current write authority, actual owner fence, exact operation
+and independent pin, lease expiry, retention, current joint roots and full pull
+revision. Ready additionally checks generation capacity. It atomically commits
+the catalog/ref roots, existing constant-size ref summary (preserving HEAD),
+candidate result/OID/audit, attestation checkpoint, original recovery phase and
+SDK acceptance. Late SQL failure rolls all of those back. Negative results retain
+the frozen editorial result without advancing roots.
+
+`CandidatePublicationReply` carries the UUID, canonical result digest and optional
+`PublishedRefs`; it fits the existing 512-byte recovery contract even when a
+conflict result approaches the existing 256-KiB limit. The larger result remains
+in the immutable candidate row. Ready additionally stores a typed input-root
+audit referencing the accepted catalog and ref snapshot. Recovery kind 6 routes
+the exact originally registered operation 55 command. Typed retirement selects
+the permanent row before traversing its audit and preserves the original SDK
+receipt before releasing the transient pin. Missing audit metadata prevents
+retirement. This path performs no provider deletion.
+
+## Reviewed generated merges
+
+Operation 9, codec 8, supports fast-forward and generated strategies. The private
+factory selects the immutable Ready candidate matching the requested UUID,
+strategy, pull number and complete revision. It verifies that candidate's native
+audit and commit semantics in the accepted catalog, observes the exact reserved
+ref and prepares the ordinary base-branch update to the generated target. Native
+ancestry evidence proves the target descends from the requested base.
+
+The final transaction reselects the candidate result and audit, checks the held
+reserved ref, and rechecks current authorization, pull revision, approvals,
+changes requested, required checks on the generated target, branch policy,
+owner/pin/expiry/retention and joint-root CAS. The reviewed capability authorizes
+only that exact update. Existing `pull_merges` now retains strategy and candidate
+UUID; its immutable audit retains the actual target and candidate audit root.
+Replay reconstructs the original binding from those fields rather than assuming
+fast-forward. Merge results retain their existing wire shape and original receipt.
+
+## Qualification boundaries
+
+The evidence record distinguishes focused tests, the full workspace diagnostic
+and exact-head Linux CI. This work does not qualify full-history cold-base cost,
+10,000-engineer throughput, automatic reconstruction of generated work before
+final command registration, remote-provider interruption/adoption, continuous
+retention/collection, backup export of the complete typed graph, or native
+acceleration. Those remain required delivery gates. Passing the generated
+workflow does not make the full cutover release qualified.
diff --git a/docs/evidence/native-generated-publication-ci-20261005.json b/docs/evidence/native-generated-publication-ci-20261005.json
new file mode 100644
index 00000000..a9917e8b
--- /dev/null
+++ b/docs/evidence/native-generated-publication-ci-20261005.json
@@ -0,0 +1,319 @@
+{
+  "recorded_at_utc": "2026-10-06T01:09:35.971053+00:00",
+  "base_head": "1ebb2786a3f15622d59a9b0d6420c1e7d0517e1b",
+  "host": "macOS, Rust 1.98.0; exact new-head Linux qualification required",
+  "release_qualified": false,
+  "source_files": 530,
+  "rust_files": 512,
+  "source_hash_digest": "d17d143258c8fab52eac31f699e42cd54259be4af8ec48d5b7c2d43c5caabb8f",
+  "source_manifest": "/tmp/canopy-generated-final-source.json",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML path to its file SHA256",
+  "source_unchanged_during_validation": true,
+  "validation": {
+    "source_digest": "d17d143258c8fab52eac31f699e42cd54259be4af8ec48d5b7c2d43c5caabb8f",
+    "complete": true,
+    "phases": [
+      {
+        "name": "retry",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "generated_candidate_intent_joins_uncertain_original_and_retries_only_after_known_drain"
+        ],
+        "exit_code": 0,
+        "seconds": 102.49,
+        "log": "/tmp/canopy-generated-final-retry.log",
+        "log_sha256": "b378b5a93e34d18298ee8e47c0a1c53e430d21458110f96e96810366e5ee46fc",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 752 filtered out; finished in 0.24s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "transactions",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "packs::publication::tests::candidate_publication::"
+        ],
+        "exit_code": 0,
+        "seconds": 2.17,
+        "log": "/tmp/canopy-generated-final-transactions.log",
+        "log_sha256": "b809ea8f3975213a973df8535e78a0bcea6b70b235458fa72d93f88d5ddb26e7",
+        "summaries": [
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 751 filtered out; finished in 1.42s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "merge",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "native_merge"
+        ],
+        "exit_code": 0,
+        "seconds": 7.56,
+        "log": "/tmp/canopy-generated-final-merge.log",
+        "log_sha256": "728e3b19d0f616ba7af2f07690e16ebcd7254a6851811ca9a3425aba5ad51b40",
+        "summaries": [
+          "test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 739 filtered out; finished in 7.22s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "head",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "native_head"
+        ],
+        "exit_code": 0,
+        "seconds": 5.56,
+        "log": "/tmp/canopy-generated-final-head.log",
+        "log_sha256": "10423fb77d9fc8ddb61e71a28289b9db777045a42a19cca7d1fbb93b84649959",
+        "summaries": [
+          "test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 750 filtered out; finished in 5.20s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "candidates",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--test",
+          "multi_server",
+          "candidates::"
+        ],
+        "exit_code": 0,
+        "seconds": 104.03,
+        "log": "/tmp/canopy-generated-final-candidates.log",
+        "log_sha256": "59ef6ae7977bff2631f7df3113d9a9959283453d69922e5dfc01ac74ebcbbdcf",
+        "summaries": [
+          "test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 113 filtered out; finished in 26.74s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "rebase",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--test",
+          "multi_server",
+          "rebase::"
+        ],
+        "exit_code": 0,
+        "seconds": 18.21,
+        "log": "/tmp/canopy-generated-final-rebase.log",
+        "log_sha256": "520654d5b43656b0a93a69d87a6a677b66a62f6a80ade9b5e82504d51d166323",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 16.83s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "sha256",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--test",
+          "multi_server",
+          "sha256::sha256_native_merge_candidates_survive_restore_and_publish",
+          "--",
+          "--exact"
+        ],
+        "exit_code": 0,
+        "seconds": 9.4,
+        "log": "/tmp/canopy-generated-final-sha256.log",
+        "log_sha256": "49ad196cf211f56c42d786e4f38ed83d20efeeace75ffde990ab2819cca37b9b",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 8.50s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 44.11,
+        "log": "/tmp/canopy-generated-final-clippy.log",
+        "log_sha256": "8016738f3743ff7a6344dd03d636804e776627d3c4c34cc31ac7fa0e056d1c2d",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 797.82,
+        "log": "/tmp/canopy-generated-final-workspace.log",
+        "log_sha256": "b8e6d143a85892184d5f99ba559ebb427134d453a145e2864eeb7183f61ea549",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.40s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.05s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 752 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 752 filtered out; finished in 0.09s",
+          "test result: ok. 753 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 360.54s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.43s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.16s",
+          "test result: FAILED. 93 passed; 14 failed; 9 ignored; 0 measured; 0 filtered out; finished in 398.62s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.50s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.39s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.65s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "comparison::threads::line_threads_bind_verified_hunks_and_survive_ref_loss_with_authorized_retries",
+          "leased_server_recovers_two_repositories_with_git_and_lfs",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "peers::moving_repositories_preserve_history_and_serialize_cross_gateway_pushes",
+          "peers::two_live_nodes_route_git_to_distinct_cell_owners_and_recover_the_directory",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "visibility::public_reads_and_private_revocation_survive_cell_recovery",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 64.78,
+        "log": "/tmp/canopy-generated-final-build.log",
+        "log_sha256": "0900ec22ab155c16e1caea5a43d4c5f9d9cd5d0898632803a9736b4a4740f671",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.59,
+        "log": "/tmp/canopy-generated-final-fmt.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "harness",
+        "command": [
+          "python3",
+          "-B",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "scripts",
+          "-p",
+          "test_*.py"
+        ],
+        "exit_code": 0,
+        "seconds": 43.9,
+        "log": "/tmp/canopy-generated-final-harness.log",
+        "log_sha256": "651f2b86f1312d3534d475dea692087fad2ce3d2d223302def85f1913d1a501a",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.15,
+        "log": "/tmp/canopy-generated-final-diff.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "source_unchanged": true,
+    "release_qualified": false
+  },
+  "historical_linux": {
+    "head": "1ebb2786a3f15622d59a9b0d6420c1e7d0517e1b",
+    "run": "https://github.com/crabbuild/canopy/actions/runs/37391496693",
+    "result": "FAILURE; multi-server 89 passed, 22 failed, 9 ignored",
+    "log_sha256": "58862df442dc9b52bc73ce6818b54f2afea78bb45e56e3e18128d8b796afaedd",
+    "qualification_of_current_source": false
+  },
+  "qualification_note": "Current-source full workspace remains failed. Nested child-process library summaries are not additional independent passing cases. No tests or assertions were disabled; no large-team throughput or remote-provider qualification is claimed."
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 3877502a..3a8ee575 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -7,15 +7,51 @@ Packed cutover [PR #34](https://github.com/crabbuild/canopy/pull/34) was merged
 The native metadata follow-up is based on that main revision. The original SQL
 hydration failures have been resolved by converting real read/cache callers.
 The directory recovery fixture now uses repository-local permission metadata
-to verify separate Cells and replay after restoration. Full CI remains open because generated writers and other product callers still
-invoke retired ingestion/ref metadata. The production HTTP/SSH native writer is
+to verify separate Cells and replay after restoration. Full CI remains open because remaining product callers and fixtures still
+invoke retired ingestion/ref metadata. Generated candidate and reviewed-merge
+publication now use certified native roots. The production HTTP/SSH native writer is
 now wired through the resident lifecycle, with the remaining correctness and
 qualification gates described below. This cutover is not release qualified.
 Older checkpoint notes describe historical states.
 
 Implementation is isolated in the PR worktree. The original checkout contains an unrelated, extensive staged workspace merge; its workspace, benchmark and runtime work has been preserved. Canopy is split into Git-format, object-storage and server crates. Main now contains all completed PR #20–#30 changes through [PR #31](https://github.com/crabbuild/canopy/pull/31), merged at `db80fd836db94fff894030f02d736fe92840748c`. The PR #31 checkpoint audit verifies each directly merged PR's exact merge tree and main ancestry; that checkpoint's entire tree is identical to completed PR #30 (`5bf48677857e3d1dd769aa7f1d73eb5db00db30f`). PRs #28–#30 originally merged into stack branches and reached main through #31. Both #31 Verify runs, [37132349361](https://github.com/crabbuild/canopy/actions/runs/37132349361) and [37132329706](https://github.com/crabbuild/canopy/actions/runs/37132329706), pass harness and Rust. The merged main revision also passes [Verify 37132672371](https://github.com/crabbuild/canopy/actions/runs/37132672371).
 
-All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers, remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
+All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers and reviewed merges now use native publication. Remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
+
+## Native generated candidates and reviewed merges (2026-10-05 checkpoint)
+
+The public candidate, rebase and SHA-256 integration failures were caused by
+writers targeting retired SQL Git metadata. Generated work now runs under the
+resident staging owner and emits only its request-private generated objects.
+Concurrent observations join the original frozen intent and uncertain command;
+a fresh operation is admitted only after a known attempt fully drains. The
+independent physical verifier and private commit verifier prepare operation 55
+codec 1. Its owner transaction atomically commits native roots, the reserved
+fetch ref, immutable candidate result, typed audit and exact SDK acceptance.
+Large conflict results stay in the existing row behind a compact recovery reply.
+
+Reviewed merges now support generated strategies through operation 9 codec 8.
+They select the immutable Ready result, verify its audit and reserved ref, and
+recheck current full pull revision, reviews, checks on the generated target,
+branch policy, authorization, owner fence, pin, expiry and joint roots. The
+existing merge row and typed audit retain the actual generated target and
+candidate identity. Late SQL failures roll back publication and acceptance;
+retirement retains the first receipt and refuses missing audit metadata.
+
+The [technical design](design/native-generated-candidate-publication.md) explains
+these boundaries and reused structures. Focused public candidate, rebase and
+SHA-256 cases pass, along with transaction rollback, large negative outcomes,
+archived receipt recovery, uncertain intent joining and reviewed merges. The
+full frozen-source diagnostic passes all 753 server library cases. Multi-server
+finishes with 93 passed, 14 failed and nine ignored; owner-restart, repository-cell
+and smart-HTTP each retain one failure. All-target Clippy, production build,
+formatting and all 96 Python harness tests pass. Compared with the preceding
+local checkpoint, five candidate/rebase/SHA-256 failures are resolved and no new
+failed names were introduced. The results are recorded in
+[evidence](evidence/native-generated-publication-ci-20261005.json). Full CI remains
+open. Native line-thread creation, complete backup/peer restoration, selective
+fetch, detached legacy fixtures and recovery qualification remain required.
+These results do not qualify 10,000-engineer throughput or the full hard cutover.
 
 ## Native symbolic HEAD publication (2026-10-05 checkpoint)
 

From aa86f944907b64816c366a55bdca2f465e25e00e Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 20:58:12 -0700
Subject: [PATCH 48/55] fix: publish native threads and route Git streams to
 resident owners

---
 Cargo.lock                                    |  18 +-
 crates/canopy-server/Cargo.toml               |   2 +-
 .../src/git_gateway/push/native.rs            |  13 +-
 crates/canopy-server/src/git_read/mod.rs      |   2 +-
 .../canopy-server/src/git_read/patch/mod.rs   |   3 +-
 crates/canopy-server/src/lib.rs               |   2 +
 .../packs/publication/coordinator/roots.rs    |  35 ++-
 .../src/packs/publication/mod.rs              |   1 +
 .../src/packs/publication/recovery/archive.rs |   2 +-
 .../src/packs/publication/recovery/codec.rs   |   8 +-
 .../src/packs/publication/recovery/mod.rs     |  90 ++++--
 .../src/packs/publication/recovery/phase.rs   |  46 ++-
 .../publication/recovery/registration.rs      |   4 +-
 .../src/packs/publication/registry.rs         |  11 +-
 .../publication/tests/durable_recovery.rs     |  18 +-
 crates/canopy-server/src/pulls/native/mod.rs  |   2 +
 .../canopy-server/src/pulls/native/threads.rs | 177 +++++++++++
 crates/canopy-server/src/pulls/threads.rs     | 142 +++++----
 .../src/repository_http/threads.rs            |  11 +-
 crates/canopy-server/src/server/peer.rs       |  84 +++++
 .../canopy-server/src/server/residency/mod.rs |  29 +-
 .../residency/tests/serving/browser/pulls.rs  | 127 ++++++++
 .../canopy-server/tests/multi_server/main.rs  |   3 +
 .../tests/multi_server/peers/mod.rs           |  36 ++-
 .../residency/faults/git_discovery.rs         |  10 +-
 .../design/native-thread-and-owner-routing.md |  67 ++++
 docs/evidence/native-ci-routing-20261005.json | 293 ++++++++++++++++++
 .../large-repository-implementation-status.md |  19 ++
 28 files changed, 1139 insertions(+), 116 deletions(-)
 create mode 100644 crates/canopy-server/src/pulls/native/threads.rs
 create mode 100644 docs/design/native-thread-and-owner-routing.md
 create mode 100644 docs/evidence/native-ci-routing-20261005.json

diff --git a/Cargo.lock b/Cargo.lock
index 35bf2ce2..3f73fc48 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2732,6 +2732,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-core",
+ "futures-util",
  "http",
  "http-body",
  "http-body-util",
@@ -2751,12 +2752,14 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-rustls",
+ "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+ "wasm-streams 0.4.2",
  "web-sys",
  "webpki-roots",
 ]
@@ -2796,7 +2799,7 @@ dependencies = [
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
- "wasm-streams",
+ "wasm-streams 0.5.0",
  "web-sys",
 ]
 
@@ -4019,6 +4022,19 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "wasm-streams"
 version = "0.5.0"
diff --git a/crates/canopy-server/Cargo.toml b/crates/canopy-server/Cargo.toml
index 3dbe6650..ea5e82db 100644
--- a/crates/canopy-server/Cargo.toml
+++ b/crates/canopy-server/Cargo.toml
@@ -28,7 +28,7 @@ hex = "0.4"
 http-body = "1"
 object_store = "0.14.1"
 percent-encoding = "2"
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
 rusqlite = { version = "0.34", features = ["bundled", "hooks"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
diff --git a/crates/canopy-server/src/git_gateway/push/native.rs b/crates/canopy-server/src/git_gateway/push/native.rs
index 68460e0c..785d60cb 100644
--- a/crates/canopy-server/src/git_gateway/push/native.rs
+++ b/crates/canopy-server/src/git_gateway/push/native.rs
@@ -37,7 +37,15 @@ impl GitGateway {
         if let Some(response) = staging
             .replay_request(identity.clone(), &self.artifacts)
             .await
-            .map_err(|e| GatewayError::Cell(Box::new(e)))?
+            .map_err(|error| match error {
+                crate::packs::publication::RootPushReplayError::Denied(
+                    crate::packs::publication::PreparationDenial::Conflict,
+                ) => GatewayError::Push(crate::PushError::Conflict),
+                crate::packs::publication::RootPushReplayError::Denied(
+                    crate::packs::publication::PreparationDenial::Unauthorized,
+                ) => GatewayError::Unauthorized,
+                error => GatewayError::Cell(Box::new(error)),
+            })?
         {
             return Ok(with_push_id(artifact_body(response), id));
         }
@@ -322,6 +330,7 @@ impl GitGateway {
             offset = end;
         }
         let gateway = self.clone();
+        let frozen_refusal = refusal.clone();
         let ready = ticket
             .spawn_bound(move |_, _context| async move {
                 let guard = policy.ready(&prepared).await.map_err(input)?;
@@ -335,6 +344,8 @@ impl GitGateway {
                         gateway.signer_directory.as_deref(),
                     )
                     .await
+                    .map_err(input)?
+                    .with_refusal(frozen_refusal)
                     .map_err(input)
             })?
             .wait()
diff --git a/crates/canopy-server/src/git_read/mod.rs b/crates/canopy-server/src/git_read/mod.rs
index 85233dfc..196bfc02 100644
--- a/crates/canopy-server/src/git_read/mod.rs
+++ b/crates/canopy-server/src/git_read/mod.rs
@@ -89,7 +89,7 @@ pub(crate) struct FileChange {
     before: Option<Entry>,
     after: Option<Entry>,
 }
-#[derive(Clone, Deserialize)]
+#[derive(Clone, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "lowercase", deny_unknown_fields)]
 pub(crate) enum ComparisonTarget {
     Current { revision: PullRevision },
diff --git a/crates/canopy-server/src/git_read/patch/mod.rs b/crates/canopy-server/src/git_read/patch/mod.rs
index 3f890cd2..4d7ff1dc 100644
--- a/crates/canopy-server/src/git_read/patch/mod.rs
+++ b/crates/canopy-server/src/git_read/patch/mod.rs
@@ -46,7 +46,8 @@ struct Edit {
     index: usize,
 }
 
-#[derive(Serialize)]
+#[derive(Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct LineAnchor {
     pub revision: PullRevision,
     pub merge_base: String,
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 6f074196..d3d20976 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -385,6 +385,8 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("pulls/native/mod.rs"));
                 source.update(include_bytes!("pulls/native/codec.rs"));
                 source.update(include_bytes!("pulls/native/client.rs"));
+                source.update(include_bytes!("pulls/native/threads.rs"));
+                source.update(include_bytes!("pulls/threads.rs"));
                 source.update(include_bytes!("pulls/native/reads.rs"));
                 source.update(include_bytes!("packs/publication/registry.rs"));
                 source.update(include_bytes!("server/catalog_initialization.rs"));
diff --git a/crates/canopy-server/src/packs/publication/coordinator/roots.rs b/crates/canopy-server/src/packs/publication/coordinator/roots.rs
index 4fb44f30..b71b1c0a 100644
--- a/crates/canopy-server/src/packs/publication/coordinator/roots.rs
+++ b/crates/canopy-server/src/packs/publication/coordinator/roots.rs
@@ -22,6 +22,7 @@ pub struct ReadyRootPush {
     pub(super) owner: PushPreparation,
     command: RootCommand,
     pub(super) refusal: bool,
+    fallback: Option<Arc<ReadyRootPush>>,
 }
 impl PreparedCatalog {
     pub async fn ready_root_push(
@@ -49,6 +50,7 @@ impl PreparedCatalog {
             owner: PushPreparation::Catalog(self.clone()),
             command: RootCommand::Publish(command),
             refusal: false,
+            fallback: None,
         })
     }
 }
@@ -101,6 +103,7 @@ impl PreparationSession {
             owner: PushPreparation::Outcome(self.clone()),
             command: RootCommand::Outcome(command),
             refusal,
+            fallback: None,
         })
     }
 }
@@ -117,6 +120,30 @@ impl RootCommand {
     }
 }
 impl ReadyRootPush {
+    /// Freeze the same-attempt refusal before final publication admission.
+    /// Recovery executes it only after the original publication is known denied.
+    pub fn with_refusal(mut self, refusal: Arc<ReadyRootPush>) -> Result<Self, RootPushReadyError> {
+        let source = refusal.owner.session();
+        let session = self.owner.session();
+        if self.fallback.is_some()
+            || !matches!(self.command, RootCommand::Publish(_))
+            || !refusal.refusal
+            || source.target != session.target
+            || source.check != session.check
+            || source.ceiling != session.ceiling
+            || !Arc::ptr_eq(&source.deadline, &session.deadline)
+            || !Arc::ptr_eq(&source.fenced, &session.fenced)
+        {
+            return Err(PreparationBaseError::Context.into());
+        }
+        self.fallback = Some(refusal);
+        Ok(self)
+    }
+    fn fallback_command(&self) -> Option<&PreparedCommand<CompleteRootOutcome>> {
+        self.fallback
+            .as_ref()
+            .and_then(|value| value.refusal_command())
+    }
     /// Preserve the original factory's shared lifecycle authority while
     /// dispatching from its exact registered SDK snapshot and body.
     pub fn bind_recovery(
@@ -131,7 +158,7 @@ impl ReadyRootPush {
         if !registered.matches_original(
             kind,
             self.command.evidence(),
-            None,
+            self.fallback_command().map(|command| command.evidence()),
             self.owner.session(),
             store,
         ) {
@@ -193,7 +220,7 @@ impl ReadyRootPush {
                     session,
                     command,
                     super::super::recovery::Kind::Publish,
-                    None,
+                    self.fallback_command(),
                     Some(previous),
                     store,
                     identity,
@@ -245,10 +272,12 @@ impl ReadyRootPush {
         let session = self.owner.session();
         match &self.command {
             RootCommand::Publish(command) => {
-                super::super::recovery::persist(
+                super::super::recovery::persist_full(
                     session,
                     command,
                     super::super::recovery::Kind::Publish,
+                    self.fallback_command(),
+                    None,
                     store,
                     identity,
                     fault,
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index db733fc3..410a1ce4 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -271,6 +271,7 @@ pub fn register(registry: &mut RegistryBuilder) -> cellule_runtime::Result<()> {
     registry.bind_query::<crate::checks::native::ReadCommitChecks>()?;
     registry.bind_command::<crate::pulls::native::CreateNativePull>()?;
     registry.bind_command::<crate::pulls::native::ReviewNativePull>()?;
+    registry.bind_command::<crate::pulls::native::CreateNativeThread>()?;
     registry.bind_command::<crate::pulls::candidates::command::PrepareCandidate>()?;
     registry.bind_query::<crate::pulls::native::ReadNativePulls>()?;
     registry.bind_command::<ReleaseServingPin>()?;
diff --git a/crates/canopy-server/src/packs/publication/recovery/archive.rs b/crates/canopy-server/src/packs/publication/recovery/archive.rs
index cbc84d32..895f461c 100644
--- a/crates/canopy-server/src/packs/publication/recovery/archive.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/archive.rs
@@ -333,7 +333,7 @@ impl phase::Journal {
                 })
                 .transpose();
         }
-        let result = if record.kind == Kind::Policy {
+        let result = if record.kind == Kind::Policy || self.refused(record)? {
             if !self.refused(record)? {
                 return Ok(None);
             }
diff --git a/crates/canopy-server/src/packs/publication/recovery/codec.rs b/crates/canopy-server/src/packs/publication/recovery/codec.rs
index 96d8728f..4b7bb880 100644
--- a/crates/canopy-server/src/packs/publication/recovery/codec.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/codec.rs
@@ -5,7 +5,9 @@ impl WireValue for Record {
         if self.root.operation != self.check.token.artifact_operation {
             return Err(CodecError::Invalid("root recovery namespace"));
         }
-        if (self.kind == Kind::Policy) != self.refusal.is_some() {
+        if (self.kind == Kind::Policy && self.refusal.is_none())
+            || (self.refusal.is_some() && !matches!(self.kind, Kind::Policy | Kind::Publish))
+        {
             return Err(CodecError::Invalid(
                 "policy recovery requires frozen refusal",
             ));
@@ -83,7 +85,9 @@ impl WireValue for Record {
 impl WireValue for Bundle {
     fn encode(&self, e: &mut BoundedEncoder) -> Result<(), CodecError> {
         self.primary.validate(self.kind.body_limit())?;
-        if (self.kind == Kind::Policy) != self.refusal.is_some() {
+        if (self.kind == Kind::Policy && self.refusal.is_none())
+            || (self.refusal.is_some() && !matches!(self.kind, Kind::Policy | Kind::Publish))
+        {
             return Err(CodecError::Invalid("missing frozen refusal"));
         }
         if let Some(refusal) = &self.refusal {
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index f77bfeda..4a6b837e 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -345,6 +345,25 @@ impl RegisteredRootRecovery {
         authority: &PreparationAuthority,
         original: Option<&PreparationSession>,
     ) -> Result<Committed<RootCompletionReply>, PublicationError> {
+        if self.record.kind == Kind::Publish && self.record.refusal.is_some() {
+            let refusing = std::sync::atomic::AtomicBool::new(false);
+            let result = Box::pin(self.dispatch_bound(
+                client,
+                store,
+                authority,
+                &refusing,
+                original,
+                #[cfg(test)]
+                None,
+            ))
+            .await?;
+            return match result {
+                PublicationOutcome::RootPush(value) => Ok(value),
+                _ => Err(PublicationError::RootPush(InvocationError::NotStarted(
+                    Error::Command("armed root dispatch outcome differs"),
+                ))),
+            };
+        }
         let result = match self.record.kind {
             Kind::Publish => {
                 self.dispatch_command::<CompleteRootPush>(client, store, authority, false, original)
@@ -444,7 +463,7 @@ impl RegisteredRootRecovery {
                 )))
             };
         }
-        if self.record.kind != Kind::Policy {
+        if self.record.kind != Kind::Policy && self.record.refusal.is_none() {
             let result = match original {
                 Some(original) => {
                     self.dispatch_root(client, store, authority, Some(original))
@@ -454,16 +473,35 @@ impl RegisteredRootRecovery {
             };
             return result.map(PublicationOutcome::RootPush);
         }
-        let result = self
-            .dispatch_command::<RegisterRefPolicyPage>(client, store, authority, false, original)
-            .await;
-        let refused = match &result {
-            Ok(value) => {
-                matches!(value.output, RefPolicyReply::Denied(_))
-                    || matches!(value.output, RefPolicyReply::Registered(progress) if !progress.valid)
-            }
-            Err(AttemptError::Invocation(InvocationError::Rejected(_))) => true,
-            _ => false,
+        let mut page = None;
+        let mut root = None;
+        let refused = if self.record.kind == Kind::Policy {
+            let result = self
+                .dispatch_command::<RegisterRefPolicyPage>(
+                    client, store, authority, false, original,
+                )
+                .await;
+            let refused = match &result {
+                Ok(value) => {
+                    matches!(value.output, RefPolicyReply::Denied(_))
+                        || matches!(value.output, RefPolicyReply::Registered(progress) if !progress.valid)
+                }
+                Err(AttemptError::Invocation(InvocationError::Rejected(_))) => true,
+                _ => false,
+            };
+            page = Some(result);
+            refused
+        } else {
+            let result = self
+                .dispatch_command::<CompleteRootPush>(client, store, authority, false, original)
+                .await;
+            let refused = match &result {
+                Ok(value) => matches!(value.output, RootCompletionReply::Denied(_)),
+                Err(AttemptError::Invocation(InvocationError::Rejected(_))) => true,
+                _ => false,
+            };
+            root = Some(result);
+            refused
         };
         if refused {
             let journal = self
@@ -480,9 +518,15 @@ impl RegisteredRootRecovery {
                     source: Box::new(RootRecoveryError::Codec(source)),
                 })?
             {
-                return Err(PublicationError::PolicyPage(InvocationError::Pending(
-                    Box::new(self.evidence().clone()),
-                )));
+                return Err(if self.record.kind == Kind::Policy {
+                    PublicationError::PolicyPage(InvocationError::Pending(Box::new(
+                        self.evidence().clone(),
+                    )))
+                } else {
+                    PublicationError::RootPush(InvocationError::Pending(Box::new(
+                        self.evidence().clone(),
+                    )))
+                });
             }
             refusing.store(true, std::sync::atomic::Ordering::Release);
             let evidence = self
@@ -528,9 +572,18 @@ impl RegisteredRootRecovery {
                 Err(error) => Err(error.publication(evidence, PublicationError::RootPush)),
             };
         }
-        result
-            .map(PublicationOutcome::PolicyPage)
-            .map_err(|error| error.publication(self.evidence(), PublicationError::PolicyPage))
+        if let Some(result) = page {
+            result
+                .map(PublicationOutcome::PolicyPage)
+                .map_err(|error| error.publication(self.evidence(), PublicationError::PolicyPage))
+        } else {
+            match root.expect("root or policy dispatch") {
+                Ok(value) => phase::normalize_root(Ok(value))
+                    .map(PublicationOutcome::RootPush)
+                    .map_err(PublicationError::RootPush),
+                Err(error) => Err(error.publication(self.evidence(), PublicationError::RootPush)),
+            }
+        }
     }
     async fn known<C: Command>(
         &self,
@@ -787,7 +840,8 @@ pub(super) async fn persist_full<C: Command>(
         || command.evidence().incarnation() != check.token.owner.incarnation
         || command.input_bytes().is_empty()
         || command.input_bytes().len() > kind.body_limit() as usize
-        || (kind == Kind::Policy) != refusal.is_some()
+        || (kind == Kind::Policy && refusal.is_none())
+        || (refusal.is_some() && !matches!(kind, Kind::Policy | Kind::Publish))
     {
         return Err(RootRecoveryError::Context);
     }
diff --git a/crates/canopy-server/src/packs/publication/recovery/phase.rs b/crates/canopy-server/src/packs/publication/recovery/phase.rs
index 8c0c2c80..b137e9dd 100644
--- a/crates/canopy-server/src/packs/publication/recovery/phase.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/phase.rs
@@ -135,6 +135,15 @@ impl Journal {
         Ok(())
     }
     pub(super) fn refused(&self, record: &Record) -> Result<bool, CodecError> {
+        if record.kind == Kind::Publish && record.refusal.is_some() {
+            return Ok(matches!(
+                self.primary
+                    .as_ref()
+                    .map(Recorded::decode_reply::<RootCompletionReply>)
+                    .transpose()?,
+                Some(RootCompletionReply::Denied(_))
+            ));
+        }
         if record.kind != Kind::Policy {
             return Ok(false);
         }
@@ -153,7 +162,7 @@ impl Journal {
     }
     pub(super) fn may_advance(&self, record: &Record) -> Result<bool, CodecError> {
         self.validate(record)?;
-        if self.refusal.is_some() {
+        if self.refusal.is_some() || self.refused(record)? {
             return Ok(false);
         }
         let Some(primary) = &self.primary else {
@@ -298,7 +307,9 @@ pub(in crate::packs::publication) fn execute<T: WireValue>(
     let stamp = Stamp::of(&evidence);
     let refusal = if kind == record.kind && stamp == record.primary {
         false
-    } else if kind == Kind::Outcome && record.kind == Kind::Policy && record.refusal == Some(stamp)
+    } else if kind == Kind::Outcome
+        && matches!(record.kind, Kind::Policy | Kind::Publish)
+        && record.refusal == Some(stamp)
     {
         // Do not consume a pre-frozen refusal identity before a known page
         // refusal. An execution error leaves the SDK ledger absent.
@@ -517,6 +528,37 @@ mod tests {
         Ok(())
     }
     #[test]
+    fn denied_publication_keeps_its_frozen_refusal_pinned() -> Result<(), CodecError> {
+        let mut record = policy_record();
+        record.kind = Kind::Publish;
+        let primary = recorded(
+            17,
+            true,
+            RootCompletionReply::Denied(PreparationDenial::Conflict),
+        )?;
+        let mut journal = Journal {
+            primary: Some(primary),
+            refusal: None,
+        };
+        assert!(journal.refused(&record)?);
+        assert!(!journal.may_advance(&record)?);
+        let mut unarmed = record.clone();
+        unarmed.refusal = None;
+        assert!(journal.may_advance(&unarmed)?);
+        journal.refusal = Some(recorded(
+            18,
+            true,
+            RootCompletionReply::Denied(PreparationDenial::Stale),
+        )?);
+        journal.validate(&record)?;
+        assert!(!journal.may_advance(&record)?);
+        journal.refusal.as_mut().unwrap().sequence = 17;
+        assert!(journal.validate(&record).is_err());
+        journal.primary = None;
+        assert!(journal.validate(&record).is_err());
+        Ok(())
+    }
+    #[test]
     fn refusal_requires_a_known_negative_page_and_later_original_sequence() -> Result<(), CodecError>
     {
         let record = policy_record();
diff --git a/crates/canopy-server/src/packs/publication/recovery/registration.rs b/crates/canopy-server/src/packs/publication/recovery/registration.rs
index 37a38a10..93b98a30 100644
--- a/crates/canopy-server/src/packs/publication/recovery/registration.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/registration.rs
@@ -67,10 +67,10 @@ impl Command for RegisterRootRecovery {
                 if !old.0.authenticated(&seed) || old_record.check != *check {
                     return deny(PreparationDenial::Conflict);
                 }
-                // The original policy bundle already authorized this exact
+                // The original armed bundle already authorized this exact
                 // refusal. Advancing to it cannot publish refs or objects and
                 // must remain possible after current Write access is revoked.
-                let frozen_refusal = old_record.kind == Kind::Policy
+                let frozen_refusal = matches!(old_record.kind, Kind::Policy | Kind::Publish)
                     && record.kind == Kind::Outcome
                     && old_record.refusal == Some(record.primary);
                 if !permitted && !frozen_refusal {
diff --git a/crates/canopy-server/src/packs/publication/registry.rs b/crates/canopy-server/src/packs/publication/registry.rs
index 91fafa52..26505db1 100644
--- a/crates/canopy-server/src/packs/publication/registry.rs
+++ b/crates/canopy-server/src/packs/publication/registry.rs
@@ -23,7 +23,7 @@ const fn query<Q: Query>(input_limit: u32, output_limit: u32) -> OperationDescri
     }
 }
 
-pub(crate) const COMMANDS: [OperationDescriptor; 25] = [
+pub(crate) const COMMANDS: [OperationDescriptor; 26] = [
     crate::operation(1),
     command::<crate::branch_rules::command::SetBranchRule>(64 << 10, 64),
     command::<PublishReviewedMerge>(NATIVE_MERGE_BYTES, 512),
@@ -52,6 +52,7 @@ pub(crate) const COMMANDS: [OperationDescriptor; 25] = [
     command::<crate::pulls::native::ReviewNativePull>(crate::pulls::native::INPUT_BYTES, 16),
     command::<PublishNativeHead>(NATIVE_HEAD_BYTES, 512),
     command::<PublishNativeCandidate>(NATIVE_CANDIDATE_BYTES, 512),
+    command::<crate::pulls::native::CreateNativeThread>(crate::pulls::native::INPUT_BYTES, 16),
 ];
 pub(crate) const QUERIES: [OperationDescriptor; 13] = [
     crate::operation(2),
@@ -101,7 +102,7 @@ mod tests {
             ids,
             vec![
                 1, 8, 9, 10, 14, 16, 17, 22, 29, 31, 33, 35, 36, 38, 39, 40, 41, 42, 43, 46, 49,
-                51, 53, 54, 55
+                51, 53, 54, 55, 56
             ]
         );
         assert_eq!(
@@ -113,6 +114,12 @@ mod tests {
             vec![2, 15, 21, 23, 27, 30, 32, 34, 37, 47, 48, 50, 52]
         );
         for (id, codec, input, output) in [
+            (
+                56,
+                crate::pulls::native::CreateNativeThread::CODEC_VERSION,
+                crate::pulls::native::INPUT_BYTES,
+                16,
+            ),
             (
                 55,
                 PublishNativeCandidate::CODEC_VERSION,
diff --git a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
index 3fa9c7c9..d895b9ce 100644
--- a/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
+++ b/crates/canopy-server/src/packs/publication/tests/durable_recovery.rs
@@ -59,6 +59,11 @@ pub(super) async fn qualify_publish(
     ))
     .await?;
     let guard = pending.ready(&prepared).await?;
+    let refusal = Arc::new(
+        Arc::new(prepared.base.session.clone())
+            .ready_root_refusal(identity()?, store, root, budget.clone(), None)
+            .await?,
+    );
     let ready = prepared
         .ready_root_push(
             identity()?,
@@ -68,7 +73,8 @@ pub(super) async fn qualify_publish(
             crate::packs::metadata::tests::limits(),
             None,
         )
-        .await?;
+        .await?
+        .with_refusal(refusal.clone())?;
     let loser = prepared
         .ready_root_push(
             identity()?,
@@ -78,7 +84,8 @@ pub(super) async fn qualify_publish(
             crate::packs::metadata::tests::limits(),
             None,
         )
-        .await?;
+        .await?
+        .with_refusal(refusal)?;
     drop(pending);
     drop(guard);
     drop(prepared);
@@ -248,7 +255,12 @@ async fn qualify_ready(
             matches!(tokio::time::timeout(std::time::Duration::from_secs(10), observer.wait()).await?,
             PublicationState::Uncertain(error) if matches!(&*error, PublicationError::RootPush(InvocationError::Pending(evidence)) if **evidence == original))
         );
-        assert_eq!(queue.stats().await.command_bytes, 32 << 10);
+        // Publishing bundles retain both the 32 KiB publication and its
+        // 16 KiB frozen refusal; ref-free outcomes retain one command.
+        assert_eq!(
+            queue.stats().await.command_bytes,
+            if publishing { 48 << 10 } else { 32 << 10 }
+        );
         assert_eq!(queue.close_and_drain().await.len(), 1);
         observer.recover().await?;
         assert!(
diff --git a/crates/canopy-server/src/pulls/native/mod.rs b/crates/canopy-server/src/pulls/native/mod.rs
index f09c7489..033e7caf 100644
--- a/crates/canopy-server/src/pulls/native/mod.rs
+++ b/crates/canopy-server/src/pulls/native/mod.rs
@@ -13,6 +13,8 @@ mod codec;
 mod reads;
 pub(crate) use reads::{ReadData, ReadKind, ReadNativePulls, ReadReply, ReadRequest};
 mod client;
+pub(crate) mod threads;
+pub(crate) use threads::CreateNativeThread;
 
 pub(crate) const INPUT_BYTES: u32 = REF_SELECTION_BYTES + (256 << 10);
 pub(crate) const OUTPUT_BYTES: u32 = 1 << 20;
diff --git a/crates/canopy-server/src/pulls/native/threads.rs b/crates/canopy-server/src/pulls/native/threads.rs
new file mode 100644
index 00000000..456fa35a
--- /dev/null
+++ b/crates/canopy-server/src/pulls/native/threads.rs
@@ -0,0 +1,177 @@
+//! Verified line anchors are purpose-bound to native ref facts at publication.
+use super::*;
+use crate::git_read::{ComparisonTarget, patch::LineAnchor};
+use crate::pulls::threads::ThreadIntent;
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct ThreadData {
+    pub(crate) number: i64,
+    pub(crate) intent: ThreadIntent,
+    pub(crate) anchor: LineAnchor,
+}
+impl ThreadData {
+    pub(crate) fn digest(&self) -> Result<[u8; 32], CodecError> {
+        let mut encoder = BoundedEncoder::new(INPUT_BYTES)?;
+        self.encode(&mut encoder)?;
+        Ok(*blake3::hash(&encoder.finish()).as_bytes())
+    }
+}
+impl WireValue for ThreadData {
+    fn encode(&self, encoder: &mut BoundedEncoder) -> Result<(), CodecError> {
+        let invalid = || CodecError::Invalid("invalid verified thread");
+        if !(1..=20_000).contains(&self.intent.line)
+            || validate_repository_id(self.intent.id).is_err()
+            || self.anchor.revision.pull_version < 1
+            || self.anchor.revision.source_version < 1
+            || self.anchor.revision.base_version < 1
+            || parse_oid(&self.anchor.revision.source_oid).is_none()
+            || parse_oid(&self.anchor.revision.base_oid).is_none()
+            || match &self.intent.target {
+                ComparisonTarget::Current { revision } => revision != &self.anchor.revision,
+                ComparisonTarget::Review { number } => *number < 1,
+                ComparisonTarget::Merged {} => false,
+                ComparisonTarget::Thread { .. } => true,
+            }
+        {
+            return Err(invalid());
+        }
+        // Reuse the final statement validator for anchor/intent consistency.
+        crate::pulls::threads::creation_statements(
+            "validated",
+            self.number,
+            &self.intent,
+            &self.anchor,
+            0,
+        )
+        .map_err(|_| invalid())?;
+        let bytes = serde_json::to_vec(self).map_err(|_| invalid())?;
+        if bytes.len() > 256 << 10 {
+            return Err(invalid());
+        }
+        encoder.write_u8(56)?;
+        encoder.write_bytes(&bytes)
+    }
+    fn decode(decoder: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        if decoder.read_u8()? != 56 {
+            return Err(CodecError::Invalid("invalid verified thread"));
+        }
+        let bytes = decoder.read_bytes()?;
+        if bytes.len() > 256 << 10 {
+            return Err(CodecError::Invalid("oversized verified thread"));
+        }
+        let data: Self = serde_json::from_slice(bytes)
+            .map_err(|_| CodecError::Invalid("invalid verified thread"))?;
+        data.digest()?;
+        Ok(data)
+    }
+}
+pub(crate) struct ThreadRequest {
+    pub(crate) selection: RefSelection,
+    pub(crate) data: ThreadData,
+}
+impl WireValue for ThreadRequest {
+    fn encode(&self, encoder: &mut BoundedEncoder) -> Result<(), CodecError> {
+        if self.selection.actor.is_none() {
+            return Err(CodecError::Invalid("thread actor missing"));
+        }
+        self.data.encode(encoder)?;
+        self.selection.encode(encoder)
+    }
+    fn decode(decoder: &mut BoundedDecoder<'_>) -> Result<Self, CodecError> {
+        let value = Self {
+            data: ThreadData::decode(decoder)?,
+            selection: RefSelection::decode(decoder)?,
+        };
+        value.encode(&mut BoundedEncoder::new(INPUT_BYTES)?)?;
+        Ok(value)
+    }
+}
+pub(crate) struct CreateNativeThread;
+impl Command for CreateNativeThread {
+    const MODULE: &'static str = RepositoryModule::NAME;
+    const ID: u32 = 56;
+    const CODEC_VERSION: u32 = 1;
+    type Input = ThreadRequest;
+    type Output = PullChange;
+    fn execute(
+        context: &mut CommandContext<'_, '_>,
+        input: Self::Input,
+    ) -> cellule_runtime::Result<CommandResult<Self::Output>> {
+        input.encode(&mut BoundedEncoder::new(INPUT_BYTES)?)?;
+        if !input.selection.authorized(
+            context.target().cell_id(),
+            Some(context.owner_fence()),
+            context.now_ms(),
+            input.data.digest()?,
+            |q| context.sql(q),
+        )? {
+            return denial(context, &input.selection);
+        }
+        let actor = input
+            .selection
+            .actor
+            .as_deref()
+            .ok_or(Error::Command("thread actor missing"))?;
+        let statements = crate::pulls::threads::creation_statements(
+            actor,
+            input.data.number,
+            &input.data.intent,
+            &input.data.anchor,
+            context.now_ms(),
+        )?;
+        transaction(context, &input.selection, statements)
+    }
+}
+impl RepositoryCell {
+    pub(in crate::pulls) async fn native_create_thread(
+        &self,
+        identity: MutationIdentity,
+        actor: &str,
+        number: i64,
+        intent: ThreadIntent,
+        anchor: LineAnchor,
+    ) -> Result<Committed<PullChange>, NativePullError> {
+        validate_component(actor)?;
+        let data = ThreadData {
+            number,
+            intent,
+            anchor,
+        };
+        let digest = data.digest()?;
+        let selected = self
+            .sql
+            .query(
+                None,
+                SqlBatch {
+                    statements: vec![reads::selector(
+                        ReadIdentity::Account(actor),
+                        &ReadKind::Detail(number),
+                    )],
+                },
+            )
+            .await
+            .map_err(|e| NativePullError::Metadata(Box::new(e)))?;
+        let rows = &selected
+            .output
+            .first()
+            .ok_or(Error::Command("thread selection missing"))?
+            .rows;
+        let names = reads::selected_names(rows)?;
+        // Keep the admitted snapshot alive until the owner transaction resolves.
+        let (_snapshot, selection) = self.pull_ref_selection(actor, digest, &names).await?;
+        match self
+            .application
+            .command::<CreateNativeThread>(
+                &self.target,
+                identity,
+                ThreadRequest { selection, data },
+            )
+            .await
+        {
+            Ok(v) => Ok(v),
+            Err(InvocationError::Rejected(v)) => Ok(*v),
+            Err(e) => Err(NativePullError::Command(Box::new(e))),
+        }
+    }
+}
diff --git a/crates/canopy-server/src/pulls/threads.rs b/crates/canopy-server/src/pulls/threads.rs
index 3e461fea..2fd5332e 100644
--- a/crates/canopy-server/src/pulls/threads.rs
+++ b/crates/canopy-server/src/pulls/threads.rs
@@ -8,6 +8,8 @@ use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
 pub(crate) const PAGE: usize = 16;
 const THREAD_COLUMNS: &str = "number, id, author, body, resolved, version, created_ms, updated_ms, pull_version, source_oid, source_version, base_oid, base_version, merge_base, path, side, line, blob_oid";
 
+#[derive(serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct ThreadIntent {
     pub id: [u8; 16],
     pub target: ComparisonTarget,
@@ -157,69 +159,11 @@ impl RepositoryCell {
         identity: MutationIdentity,
         actor: &str,
         pull: i64,
-        input: &ThreadIntent,
+        input: ThreadIntent,
         anchor: LineAnchor,
-    ) -> Result<Committed<PullChange>, Invocation> {
-        validate_component(actor).map_err(Invocation::NotStarted)?;
-        validate_repository_id(input.id).map_err(Invocation::NotStarted)?;
-        if pull < 1
-            || !valid_body(&input.body)
-            || input.body.trim().is_empty()
-            || input.path_base64 != anchor.path_base64
-            || input.side != anchor.side
-            || input.line != anchor.line
-        {
-            return Err(invalid("thread intent differs from verified anchor"));
-        }
-        let r = &anchor.revision;
-        let mut parameters = vec![
-            SqlValue::Text(actor.into()),
-            SqlValue::Integer(pull),
-            SqlValue::Blob(input.id.to_vec()),
-            SqlValue::Blob(input.digest(actor, pull)),
-            SqlValue::Integer(r.pull_version),
-            SqlValue::Blob(
-                parse_oid(&r.source_oid).ok_or_else(|| invalid("invalid thread source"))?,
-            ),
-            SqlValue::Integer(r.source_version),
-            SqlValue::Blob(parse_oid(&r.base_oid).ok_or_else(|| invalid("invalid thread base"))?),
-            SqlValue::Integer(r.base_version),
-        ];
-        let eligible = match &input.target {
-            ComparisonTarget::Current { .. } => format!("EXISTS (SELECT 1 FROM {JOINS} WHERE p.number = ?2 AND p.version = ?5 AND s.oid = ?6 AND s.version = ?7 AND b.oid = ?8 AND b.version = ?9)"),
-            ComparisonTarget::Review { number } => { parameters.push(SqlValue::Integer(*number)); "EXISTS (SELECT 1 FROM pull_reviews WHERE pull_number = ?2 AND number = ?10 AND pull_version = ?5 AND source_oid = ?6 AND source_version = ?7 AND base_oid = ?8 AND base_version = ?9)".into() },
-            ComparisonTarget::Merged {} => "EXISTS (SELECT 1 FROM pull_merges WHERE pull_number = ?2 AND pull_version = ?5 AND source_oid = ?6 AND source_version = ?7 AND base_oid = ?8 AND base_version = ?9)".into(),
-            ComparisonTarget::Thread { .. } => return Err(invalid("threads are not creation targets")),
-        };
-        let decision = format!(
-            "CASE WHEN NOT ({ACCESS}) OR NOT EXISTS (SELECT 1 FROM pull_requests WHERE number = ?2) THEN 'missing' WHEN EXISTS (SELECT 1 FROM pull_threads WHERE id = ?3 AND (pull_number != ?2 OR creation_digest != ?4)) THEN 'conflict' WHEN EXISTS (SELECT 1 FROM pull_threads WHERE id = ?3) THEN 'applied' WHEN NOT ({eligible}) THEN 'conflict' ELSE 'applied' END"
-        );
-        let check = SqlStatement {
-            sql: format!("SELECT {decision}"),
-            parameters: parameters.clone(),
-        };
-        parameters.resize(10, SqlValue::Null);
-        parameters.extend([
-            SqlValue::Text(input.body.clone()),
-            SqlValue::Blob(
-                parse_oid(&anchor.merge_base)
-                    .ok_or_else(|| invalid("invalid thread merge base"))?,
-            ),
-            SqlValue::Blob(
-                URL_SAFE_NO_PAD
-                    .decode(&anchor.path_base64)
-                    .map_err(|_| invalid("invalid verified path"))?,
-            ),
-            SqlValue::Text(anchor.side.as_str().into()),
-            SqlValue::Integer(anchor.line),
-            SqlValue::Blob(
-                parse_oid(&anchor.blob_oid).ok_or_else(|| invalid("invalid thread blob"))?,
-            ),
-            SqlValue::Integer(identity.issued_at_ms),
-        ]);
-        self.pull_change(identity, vec![check, SqlStatement {
-            sql: format!("INSERT INTO pull_threads (id, creation_digest, pull_number, author, body, resolved, version, pull_version, source_oid, source_version, base_oid, base_version, merge_base, path, side, line, blob_oid, created_ms, updated_ms) SELECT ?3, ?4, ?2, ?1, ?11, 0, 1, ?5, ?6, ?7, ?8, ?9, ?12, ?13, ?14, ?15, ?16, ?17, ?17 WHERE ({decision}) = 'applied' AND NOT EXISTS (SELECT 1 FROM pull_threads WHERE id = ?3)"), parameters,
-        }, SqlStatement { sql: "SELECT number FROM pull_threads WHERE id = ?1".into(), parameters: vec![SqlValue::Blob(input.id.to_vec())] }]).await
+    ) -> Result<Committed<PullChange>, native::NativePullError> {
+        self.native_create_thread(identity, actor, pull, input, anchor)
+            .await
     }
     pub(crate) async fn resolve_thread(
         &self,
@@ -394,3 +338,77 @@ fn comment(row: &[SqlValue]) -> cellule_runtime::Result<Comment> {
         created_at_ms: *created,
     })
 }
+
+pub(in crate::pulls) fn creation_statements(
+    actor: &str,
+    pull: i64,
+    input: &ThreadIntent,
+    anchor: &LineAnchor,
+    now_ms: i64,
+) -> cellule_runtime::Result<Vec<SqlStatement>> {
+    validate_component(actor)?;
+    validate_repository_id(input.id)?;
+    if pull < 1
+        || !valid_body(&input.body)
+        || input.body.trim().is_empty()
+        || input.path_base64 != anchor.path_base64
+        || input.side != anchor.side
+        || input.line != anchor.line
+    {
+        return Err(Error::Command("thread intent differs from verified anchor"));
+    }
+    let r = &anchor.revision;
+    let mut parameters = vec![
+        SqlValue::Text(actor.into()),
+        SqlValue::Integer(pull),
+        SqlValue::Blob(input.id.to_vec()),
+        SqlValue::Blob(input.digest(actor, pull)),
+        SqlValue::Integer(r.pull_version),
+        SqlValue::Blob(parse_oid(&r.source_oid).ok_or(Error::Command("invalid thread source"))?),
+        SqlValue::Integer(r.source_version),
+        SqlValue::Blob(parse_oid(&r.base_oid).ok_or(Error::Command("invalid thread base"))?),
+        SqlValue::Integer(r.base_version),
+    ];
+    let eligible = match &input.target {
+            ComparisonTarget::Current { .. } => format!("EXISTS (SELECT 1 FROM {JOINS} WHERE p.number = ?2 AND p.version = ?5 AND s.oid = ?6 AND s.version = ?7 AND b.oid = ?8 AND b.version = ?9)"),
+            ComparisonTarget::Review { number } => { parameters.push(SqlValue::Integer(*number)); "EXISTS (SELECT 1 FROM pull_reviews WHERE pull_number = ?2 AND number = ?10 AND pull_version = ?5 AND source_oid = ?6 AND source_version = ?7 AND base_oid = ?8 AND base_version = ?9)".into() },
+            ComparisonTarget::Merged {} => "EXISTS (SELECT 1 FROM pull_merges WHERE pull_number = ?2 AND pull_version = ?5 AND source_oid = ?6 AND source_version = ?7 AND base_oid = ?8 AND base_version = ?9)".into(),
+            ComparisonTarget::Thread { .. } => return Err(Error::Command("threads are not creation targets")),
+        };
+    let decision = format!(
+        "CASE WHEN NOT ({ACCESS}) OR NOT EXISTS (SELECT 1 FROM pull_requests WHERE number = ?2) THEN 'missing' WHEN EXISTS (SELECT 1 FROM pull_threads WHERE id = ?3 AND (pull_number != ?2 OR creation_digest != ?4)) THEN 'conflict' WHEN EXISTS (SELECT 1 FROM pull_threads WHERE id = ?3) THEN 'applied' WHEN NOT ({eligible}) THEN 'conflict' ELSE 'applied' END"
+    );
+    let check = SqlStatement {
+        sql: format!("SELECT {decision}"),
+        parameters: parameters.clone(),
+    };
+    parameters.resize(10, SqlValue::Null);
+    parameters.extend([
+        SqlValue::Text(input.body.clone()),
+        SqlValue::Blob(
+            parse_oid(&anchor.merge_base).ok_or(Error::Command("invalid thread merge base"))?,
+        ),
+        SqlValue::Blob(
+            URL_SAFE_NO_PAD
+                .decode(&anchor.path_base64)
+                .map_err(|_| Error::Command("invalid verified path"))?,
+        ),
+        SqlValue::Text(anchor.side.as_str().into()),
+        SqlValue::Integer(anchor.line),
+        SqlValue::Blob(parse_oid(&anchor.blob_oid).ok_or(Error::Command("invalid thread blob"))?),
+        SqlValue::Integer(now_ms),
+    ]);
+    Ok(vec![
+        check,
+        SqlStatement {
+            sql: format!(
+                "INSERT INTO pull_threads (id, creation_digest, pull_number, author, body, resolved, version, pull_version, source_oid, source_version, base_oid, base_version, merge_base, path, side, line, blob_oid, created_ms, updated_ms) SELECT ?3, ?4, ?2, ?1, ?11, 0, 1, ?5, ?6, ?7, ?8, ?9, ?12, ?13, ?14, ?15, ?16, ?17, ?17 WHERE ({decision}) = 'applied' AND NOT EXISTS (SELECT 1 FROM pull_threads WHERE id = ?3)"
+            ),
+            parameters,
+        },
+        SqlStatement {
+            sql: "SELECT number FROM pull_threads WHERE id = ?1".into(),
+            parameters: vec![SqlValue::Blob(input.id.to_vec())],
+        },
+    ])
+}
diff --git a/crates/canopy-server/src/repository_http/threads.rs b/crates/canopy-server/src/repository_http/threads.rs
index 0c8789ba..fe5231bf 100644
--- a/crates/canopy-server/src/repository_http/threads.rs
+++ b/crates/canopy-server/src/repository_http/threads.rs
@@ -218,7 +218,7 @@ async fn create_inner(
         .thread_retry(&actor.account, number, &intent)
         .await
     {
-        Ok(Some(result)) => return changed(state, Ok(result), true),
+        Ok(Some(result)) => return changed::<std::convert::Infallible>(state, Ok(result), true),
         Ok(None) => (),
         Err(error) => return pulls::failed(error),
     }
@@ -250,18 +250,15 @@ async fn create_inner(
         state,
         route
             .repository
-            .create_thread(identity, &actor.account, number, &intent, anchor)
+            .create_thread(identity, &actor.account, number, intent, anchor)
             .await
             .map(|result| result.output),
         true,
     )
 }
-fn changed(
+fn changed<E: std::fmt::Display>(
     state: &RepositoryHttp,
-    result: Result<
-        PullChange,
-        cellule_runtime::InvocationError<Vec<cellule_runtime::primitives::sql::SqlResultSet>>,
-    >,
+    result: Result<PullChange, E>,
     created: bool,
 ) -> Response<Body> {
     match result {
diff --git a/crates/canopy-server/src/server/peer.rs b/crates/canopy-server/src/server/peer.rs
index abd7774a..ad77133b 100644
--- a/crates/canopy-server/src/server/peer.rs
+++ b/crates/canopy-server/src/server/peer.rs
@@ -478,3 +478,87 @@ fn status(code: StatusCode) -> Response {
     *response.status_mut() = code;
     response
 }
+
+const FORWARD_HOPS: &str = "canopy-forward-hops";
+
+impl NodePeer {
+    /// Forward transport bytes to the current resident owner. The verified
+    /// fleet advertisement supplies the TLS endpoint; the original credential
+    /// is independently authenticated there. Never redirect clients or retry a
+    /// consumed request body after an ambiguous receive-pack.
+    pub(crate) async fn forward_repository(
+        &self,
+        target: &CellTarget,
+        request: axum::http::Request<Body>,
+    ) -> Result<axum::http::Response<Body>, ServerError> {
+        let owner = self.live_owner(target).await?.ok_or(Error::Fenced)?;
+        if owner.session() == self.0.session {
+            // Ownership changed after route selection. Let a new request bind
+            // the local capability; this request must not use the stale gateway.
+            return Err(Error::Fenced.into());
+        }
+        let (parts, body) = request.into_parts();
+        let hops = match parts.headers.get(FORWARD_HOPS) {
+            None => 0,
+            Some(value) => value
+                .to_str()
+                .ok()
+                .and_then(|s| s.parse::<u8>().ok())
+                .filter(|n| *n < 2)
+                .ok_or(Error::PeerAuthorization("repository forwarding hop limit"))?,
+        };
+        let mut url = endpoint(owner.endpoint())?;
+        url.set_path(parts.uri.path());
+        url.set_query(parts.uri.query());
+        let mut headers = parts.headers;
+        strip_connection_headers(&mut headers);
+        headers.remove(axum::http::header::HOST);
+        headers.insert(
+            FORWARD_HOPS,
+            axum::http::HeaderValue::from_static(if hops == 0 { "1" } else { "2" }),
+        );
+        let response = self
+            .0
+            .client
+            .request(parts.method, url)
+            .headers(headers)
+            .body(reqwest::Body::wrap_stream(body.into_data_stream()))
+            .send()
+            .await
+            .map_err(|e| transport_error(e, true))?;
+        let status = response.status();
+        let mut headers = response.headers().clone();
+        strip_connection_headers(&mut headers);
+        let mut result = axum::http::Response::new(Body::from_stream(response.bytes_stream()));
+        *result.status_mut() = status;
+        *result.headers_mut() = headers;
+        Ok(result)
+    }
+}
+
+fn strip_connection_headers(headers: &mut axum::http::HeaderMap) {
+    // Connection may nominate additional hop-local headers. Copy their names
+    // before mutation; forwarding credentials never come from extensions.
+    let named: Vec<_> = headers
+        .get_all(axum::http::header::CONNECTION)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .flat_map(|value| value.split(','))
+        .filter_map(|name| axum::http::HeaderName::from_bytes(name.trim().as_bytes()).ok())
+        .collect();
+    for name in named {
+        headers.remove(name);
+    }
+    for name in [
+        "connection",
+        "keep-alive",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "te",
+        "trailer",
+        "transfer-encoding",
+        "upgrade",
+    ] {
+        headers.remove(name);
+    }
+}
diff --git a/crates/canopy-server/src/server/residency/mod.rs b/crates/canopy-server/src/server/residency/mod.rs
index 8b4215f2..9e25fa3b 100644
--- a/crates/canopy-server/src/server/residency/mod.rs
+++ b/crates/canopy-server/src/server/residency/mod.rs
@@ -67,14 +67,36 @@ pub(crate) struct RepositoryRoute {
     pub(crate) repository: Arc<RepositoryCell>,
     pub(crate) gateway: Arc<GitGateway>,
     router: Router,
+    remote: Option<super::peer::NodePeer>,
     pin: Arc<()>,
 }
 
 impl RepositoryRoute {
     pub(crate) async fn dispatch(self, request: Request<Body>) -> Response<Body> {
-        let response = match self.router.oneshot(request).await {
-            Ok(response) => response,
-            Err(error) => match error {},
+        let response = if let Some(peer) = &self.remote {
+            match peer
+                .forward_repository(&self.repository.target, request)
+                .await
+            {
+                Ok(response) => response,
+                Err(error) => {
+                    tracing::warn!(?error, "repository owner forwarding failed");
+                    let mut response = Response::new(Body::from(
+                        "Repository owner is unavailable; retry the same request",
+                    ));
+                    *response.status_mut() = axum::http::StatusCode::SERVICE_UNAVAILABLE;
+                    response.headers_mut().insert(
+                        axum::http::header::CONTENT_TYPE,
+                        axum::http::HeaderValue::from_static("text/plain; charset=utf-8"),
+                    );
+                    response
+                }
+            }
+        } else {
+            match self.router.oneshot(request).await {
+                Ok(response) => response,
+                Err(error) => match error {},
+            }
         };
         // A streamed reply outlives the handler. Keep its Cell resident until the
         // body finishes or is dropped; cache generations have their own worker pins.
@@ -417,6 +439,7 @@ impl RepositoryManager {
             repository: Arc::clone(&existing.repository),
             gateway: Arc::clone(&existing.gateway),
             router: existing.router.clone(),
+            remote: (!existing.local).then(|| self.peer.clone()),
             pin: Arc::clone(&existing.pin),
         })
     }
diff --git a/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
index 2c486da7..f98ffb70 100644
--- a/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
+++ b/crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs
@@ -826,3 +826,130 @@ async fn native_review_policy_observes_current_rules_reviews_membership_and_ref_
     }
     Ok(())
 }
+
+#[tokio::test]
+async fn native_thread_receiver_binds_verified_anchor_and_rechecks_editorial_revision() -> Result {
+    use crate::git_read::{ComparisonTarget, Side, patch::LineAnchor};
+    use crate::pulls::{
+        native::CreateNativeThread,
+        native::threads::{ThreadData, ThreadRequest},
+        threads::ThreadIntent,
+    };
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (server, _files) = server().await?;
+        let (repository, native, _) = fixture(&server, format).await?;
+        let (creation, input) = prepare(&repository, "canopy", data(&native)).await?;
+        assert_eq!(
+            execute(&repository, input).await?.output,
+            PullChange::Applied(1)
+        );
+        let revision = PullRevision {
+            pull_version: 1,
+            source_oid: hex::encode(native.main),
+            source_version: 1,
+            base_oid: hex::encode(native.side),
+            base_version: 1,
+        };
+        let data = ThreadData {
+            number: 1,
+            intent: ThreadIntent {
+                id: uuid::Uuid::new_v4().into_bytes(),
+                target: ComparisonTarget::Current {
+                    revision: revision.clone(),
+                },
+                path_base64: "ZmlsZQ".into(),
+                side: Side::After,
+                line: 1,
+                body: "Original discussion".into(),
+            },
+            anchor: LineAnchor {
+                revision,
+                merge_base: hex::encode(native.side),
+                path_base64: "ZmlsZQ".into(),
+                side: Side::After,
+                line: 1,
+                blob_oid: hex::encode(native.main),
+            },
+        };
+        let snapshot = repository
+            .serving_snapshot(ReadIdentity::Account("canopy"))
+            .await?;
+        let selection = snapshot
+            .ref_selection(
+                data.digest()?,
+                &["refs/heads/main".into(), "refs/heads/side".into()],
+            )
+            .await?;
+        // Each substitution keeps valid shape but must invalidate its purpose MAC.
+        let encoded = serde_json::to_vec(&data)?;
+        for change in ["body", "blob", "line"] {
+            let mut substituted: ThreadData = serde_json::from_slice(&encoded)?;
+            match change {
+                "body" => substituted.intent.body.push_str(" substituted"),
+                "blob" => substituted.anchor.blob_oid = hex::encode(native.side),
+                _ => {
+                    substituted.intent.line = 2;
+                    substituted.anchor.line = 2;
+                }
+            }
+            let result = repository
+                .application
+                .command::<CreateNativeThread>(
+                    &repository.target,
+                    crate::server::mutation_identity()?,
+                    ThreadRequest {
+                        selection: selection.clone(),
+                        data: substituted,
+                    },
+                )
+                .await;
+            let Err(InvocationError::Rejected(result)) = result else {
+                return Err("substituted anchor accepted".into());
+            };
+            assert_eq!(result.output, PullChange::Conflict);
+            assert!(
+                repository
+                    .threads("canopy", 1, 0)
+                    .await?
+                    .ok_or("thread page absent")?
+                    .is_empty()
+            );
+        }
+        repository
+            .edit_pull(
+                crate::server::mutation_identity()?,
+                "canopy",
+                1,
+                PullEdit {
+                    expected_version: 1,
+                    title: "Edited while anchor was prepared",
+                    body: "",
+                    state: PullState::Open,
+                    draft: false,
+                },
+            )
+            .await?;
+        let result = repository
+            .application
+            .command::<CreateNativeThread>(
+                &repository.target,
+                crate::server::mutation_identity()?,
+                ThreadRequest { selection, data },
+            )
+            .await;
+        let Err(InvocationError::Rejected(result)) = result else {
+            return Err("stale anchor accepted".into());
+        };
+        assert_eq!(result.output, PullChange::Conflict);
+        assert!(
+            repository
+                .threads("canopy", 1, 0)
+                .await?
+                .ok_or("thread page absent")?
+                .is_empty()
+        );
+        drop((snapshot, creation, repository));
+        timeout(Duration::from_secs(15), server.shutdown()).await??;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/tests/multi_server/main.rs b/crates/canopy-server/tests/multi_server/main.rs
index 5f1be589..9e882b53 100644
--- a/crates/canopy-server/tests/multi_server/main.rs
+++ b/crates/canopy-server/tests/multi_server/main.rs
@@ -576,6 +576,9 @@ async fn create_repository(
 }
 
 fn config(address: std::net::SocketAddr, data_dir: std::path::PathBuf) -> ServerConfig {
+    let _ = tracing_subscriber::fmt()
+        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+        .try_init();
     ServerConfig {
         tenant: TenantId::from_bytes([51; 16]),
         application: ApplicationId::from_bytes([52; 16]),
diff --git a/crates/canopy-server/tests/multi_server/peers/mod.rs b/crates/canopy-server/tests/multi_server/peers/mod.rs
index b6041dfc..6cad8fe2 100644
--- a/crates/canopy-server/tests/multi_server/peers/mod.rs
+++ b/crates/canopy-server/tests/multi_server/peers/mod.rs
@@ -341,6 +341,7 @@ async fn response_loss_proxy(
     let lose_reply = Arc::new(std::sync::atomic::AtomicBool::new(false));
     let fault = Arc::clone(&lose_reply);
     let client = Client::new();
+    let transport_client = client.clone();
     let route = post(move |request: Request<Body>| {
         let client = client.clone();
         let fault = Arc::clone(&fault);
@@ -374,10 +375,39 @@ async fn response_loss_proxy(
             result
         }
     });
+    // The advertised TLS endpoint also carries owner-routed Git/LFS streams.
+    // Keep the loss injector restricted to the exact Cell RPC above.
+    let transport = move |request: Request<Body>| {
+        let client = transport_client.clone();
+        async move {
+            let (parts, body) = request.into_parts();
+            let url = format!("http://{upstream}{}", parts.uri);
+            let mut headers = parts.headers;
+            headers.remove(reqwest::header::HOST);
+            let response = client
+                .request(parts.method, url)
+                .headers(headers)
+                .body(reqwest::Body::wrap_stream(body.into_data_stream()))
+                .send()
+                .await
+                .unwrap();
+            let status = response.status();
+            let headers = response.headers().clone();
+            let mut result = Response::new(Body::from_stream(response.bytes_stream()));
+            *result.status_mut() = status;
+            *result.headers_mut() = headers;
+            result
+        }
+    };
     let task = tokio::spawn(async move {
-        axum::serve(listener, Router::new().route("/internal/cell", route))
-            .await
-            .unwrap();
+        axum::serve(
+            listener,
+            Router::new()
+                .route("/internal/cell", route)
+                .fallback(transport),
+        )
+        .await
+        .unwrap();
     });
     Ok((address, lose_reply, Proxy(task)))
 }
diff --git a/crates/canopy-server/tests/multi_server/residency/faults/git_discovery.rs b/crates/canopy-server/tests/multi_server/residency/faults/git_discovery.rs
index e603618b..5b93ceb9 100644
--- a/crates/canopy-server/tests/multi_server/residency/faults/git_discovery.rs
+++ b/crates/canopy-server/tests/multi_server/residency/faults/git_discovery.rs
@@ -23,12 +23,15 @@ async fn ref_discovery_does_not_wait_for_a_full_history_restore() -> Result {
     .await?;
     let oid = run_git(Some(&source), &["rev-parse", "HEAD"]).await?;
     let advertised = format!("{} refs/heads/main", std::str::from_utf8(&oid)?.trim());
-    let suffix = format!("/git-blobs/{}", hex::encode(Sha256::digest(&body)));
+    // Pause the physical native pack body rather than the retired loose-blob
+    // layout. This fixture's incompressible history occupies the unique large
+    // pack part; manifests and structural metadata remain available.
+    let suffix = "/pack.parts/0000000000000000";
     let mut stored = fixture.store.inner.list(None);
     let mut blob = None;
     while let Some(meta) = std::future::poll_fn(|cx| stored.as_mut().poll_next(cx)).await {
         let meta = meta?;
-        if meta.location.as_ref().ends_with(&suffix) {
+        if meta.location.as_ref().ends_with(suffix) && meta.size >= body.len() as u64 {
             assert!(blob.replace(meta.location).is_none());
         }
     }
@@ -37,7 +40,8 @@ async fn ref_discovery_does_not_wait_for_a_full_history_restore() -> Result {
     // helper as the other cold-restore tests before starting discovery.
     fixture.make_original_cold().await?;
     assert!(!fixture.repository_dir.exists());
-    *fixture.store.paused_read.lock().unwrap() = Some(blob.ok_or("external Git body missing")?);
+    *fixture.store.paused_read.lock().unwrap() =
+        Some(blob.ok_or("external native pack body missing")?);
     let destination = fixture.workspace.path().join("cold-clone");
     let clone = async {
         run_git(
diff --git a/docs/design/native-thread-and-owner-routing.md b/docs/design/native-thread-and-owner-routing.md
new file mode 100644
index 00000000..45281937
--- /dev/null
+++ b/docs/design/native-thread-and-owner-routing.md
@@ -0,0 +1,67 @@
+# Native thread publication and Git owner routing
+
+This increment repairs native line-thread creation, cross-gateway Git/LFS
+transport, reused push UUID conflict classification, and known final catalog
+CAS refusal. It does not complete the native cutover or qualify large-team
+capacity. See [validation evidence](../evidence/native-ci-routing-20261005.json).
+
+## Verified line threads
+
+HTTP verifies the requested hunk and produces its line anchor from a certified
+Git snapshot. Command 56, codec 1 binds the complete thread intent and anchor
+into the existing purpose MAC. The owner transaction checks current access,
+owner fence, selected native refs and the pull revision before executing the
+existing editorial statements under the authenticated native-ref CTE. Body,
+blob, line or revision substitution cannot reuse that proof. No per-object SQL
+mirror or writable compatibility ref table is added.
+
+## Resident owner transport
+
+A remote ingress gateway has no resident native staging or serving capability.
+Git and LFS HTTP streams therefore go to the current live owner selected through
+the verified fleet advertisement. The existing TLS client validates that
+endpoint, forwards the original credential, and lets the owner authenticate and
+authorize it independently. Request and response bodies stream through existing
+transfer admission. Hop-local headers are stripped and forwarding is bounded to
+two hops. A consumed request is never retried automatically after an ambiguous
+receive-pack. Stale ownership or transport failure returns an unavailable
+response so a new request can bind the current route.
+
+This covers HTTP Git/LFS transport. Remote SSH principals and editorial API
+writer routing require their own qualification.
+
+## Final publication refusal
+
+The final publishing bundle retains the original publication command and the
+same frozen refusal used by ref-policy pages. Recovery executes the refusal only
+when the authenticated journal records the original publication's denial.
+Pending or unknown publication cannot select it. A denied armed publication
+cannot advance to another bundle while its refusal remains unsettled. Original
+SDK identities, command bodies, phase order and receipts remain authoritative;
+archive selection retains the terminal refusal receipt.
+
+The publishing bundle reserves 48 KiB: 32 KiB for publication and 16 KiB for the
+refusal. The cold-owner fixture now includes both commands and checks that exact
+reservation. This path does not repair revocation before the native result
+checkpoint; that requires a separately restricted negative staging capability.
+
+## Validation and remaining work
+
+The full workspace diagnostic passed 754 server library cases, with one obsolete
+32 KiB fixture assertion failing. The corrected 48 KiB assertion passed its
+cold-owner regression. Registry, refusal-ordering and purpose-bound thread
+regressions pass on the final source. All-target Clippy with warnings denied,
+formatting, the production build and 96 Python harness tests pass.
+
+The full multi-server run remains red: 97 passed, 10 failed, 9 ignored. Line
+threads, visibility, both peer-routing scenarios, and push UUID conflict now
+pass. Native discovery pauses the physical pack part and passes alone, retaining
+the two-second metadata checks, exact clone bytes and strict Git integrity
+checks. It timed out under full local contention; a listener rebinding fixture
+also encountered address reuse and passed alone. Their full-run failures remain
+in the evidence rather than being hidden by weaker assertions.
+
+Native backup, selective fetch/cache materialization, read-only restoration,
+late SSH refusal, and the three detached standalone fixtures remain open. Three
+option-error cases from Linux passed locally and need new-head Linux validation.
+No provider or large-team workload qualification is claimed.
diff --git a/docs/evidence/native-ci-routing-20261005.json b/docs/evidence/native-ci-routing-20261005.json
new file mode 100644
index 00000000..4f36f992
--- /dev/null
+++ b/docs/evidence/native-ci-routing-20261005.json
@@ -0,0 +1,293 @@
+{
+  "recorded_at_utc": "2026-10-06T03:57:58.668291+00:00",
+  "base_head": "68dad78c6bf125c95fdb13d289553e7a8ac9d485",
+  "host": "macOS, Rust 1.98.0",
+  "release_qualified": false,
+  "ci_run": "https://github.com/crabbuild/canopy/actions/runs/37397787531",
+  "sdk_pin": "161067f5a21703b3e257024bcb64e565fd9657b4",
+  "source_digest_algorithm": "SHA256 of compact sorted-key JSON mapping each Rust/SQL/TOML/lock/YAML source path to its SHA256",
+  "full_workspace_source_digest": "164030e0480e3b113d323bf91c4ea4a98458f7d87d887d41487ed059bd00994e",
+  "full_workspace_source_manifest": "/tmp/canopy-routing-final-source.json",
+  "final_source_digest": "7869f6a211217221da60792d2a2283235629733ef0bfc203588c8dfaaec601ec",
+  "final_source_manifest": "/tmp/canopy-routing-corrected-source.json",
+  "source_files": 531,
+  "source_delta_after_full_workspace": [
+    "crates/canopy-server/src/packs/publication/tests/durable_recovery.rs"
+  ],
+  "delta_description": "Only the durable-recovery fixture admission assertion changed from 32 KiB to 48 KiB for the newly armed publication bundle. No production code changed after the full diagnostic. The corrected fixture was rerun and passed.",
+  "full_workspace": {
+    "source_digest": "164030e0480e3b113d323bf91c4ea4a98458f7d87d887d41487ed059bd00994e",
+    "complete": true,
+    "phases": [
+      {
+        "name": "workspace",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "--workspace",
+          "--locked",
+          "--no-fail-fast"
+        ],
+        "exit_code": 101,
+        "seconds": 942.45,
+        "log": "/tmp/canopy-routing-final-workspace.log",
+        "log_sha256": "7f555ec9dca349e2b62a9ecc48845126a866a1bccf1a4eb46dfde231ce7b7666",
+        "summaries": [
+          "test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.98s",
+          "test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.44s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 754 filtered out; finished in 0.01s",
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 754 filtered out; finished in 0.10s",
+          "test result: FAILED. 754 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 406.28s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s",
+          "test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.88s",
+          "test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s",
+          "test result: FAILED. 97 passed; 10 failed; 9 ignored; 0 measured; 0 filtered out; finished in 419.99s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.60s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.29s",
+          "test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.43s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s",
+          "test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s"
+        ],
+        "failed_cases": [
+          "packs::publication::tests::native_capture::native_receive_durable_root_recovery_restores_joint_publication_and_fences_absent_old_owner",
+          "backup::backup_restores_git_lfs_and_collaboration_without_original_storage",
+          "listener_handoff::mismatched_listener_is_rejected_before_workspace_and_storage_writes",
+          "partial_clone::cold_single_branch_fetch_skips_unrelated_commit_and_tree_history",
+          "partial_clone::filtered_clones_lazy_fetch_reachable_objects_without_hydrating_other_blobs",
+          "residency::faults::git_discovery::ref_discovery_does_not_wait_for_a_full_history_restore",
+          "ssh::fetch::cold_ssh_blobless_clones_hydrate_only_explicit_blob_wants",
+          "ssh::fetch::cold_full_fetches_only_hydrate_blobs_reachable_from_requested_tips",
+          "ssh::filtered_preparation::cold_filters_keep_omitted_blobs_out_of_server_cache",
+          "residency::repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_node",
+          "ssh::publication::late_ssh_push_refusals_report_both_refs_and_survive_restore",
+          "a_second_node_clones_from_the_published_root_after_local_disk_loss",
+          "repository_cell_publishes_objects_and_refs_atomically",
+          "stock_git_push_and_clone_are_backed_by_one_repository_cell"
+        ]
+      },
+      {
+        "name": "build",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "build",
+          "--locked",
+          "--bin",
+          "canopy"
+        ],
+        "exit_code": 0,
+        "seconds": 78.45,
+        "log": "/tmp/canopy-routing-final-build.log",
+        "log_sha256": "97748165ff048af9ca6d46e7fcd3ba6594771b12e99cc7d63cdf627d79f3d91e",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.52,
+        "log": "/tmp/canopy-routing-final-fmt.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.05,
+        "log": "/tmp/canopy-routing-final-diff.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "source_unchanged": true,
+    "finished_at_utc": "2026-10-06T03:53:54.205561+00:00"
+  },
+  "final_focused": {
+    "source_digest": "7869f6a211217221da60792d2a2283235629733ef0bfc203588c8dfaaec601ec",
+    "complete": true,
+    "phases": [
+      {
+        "name": "phase",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "packs::publication::recovery::phase::"
+        ],
+        "exit_code": 0,
+        "seconds": 1.16,
+        "log": "/tmp/canopy-routing-corrected-phase.log",
+        "log_sha256": "38b72abb32e39250aedbb642143525009647416f9bce3ab4fedc20d15c0e199c",
+        "summaries": [
+          "test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 752 filtered out; finished in 0.02s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "registry",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "production_registers_packed_and_policy_metadata_contracts"
+        ],
+        "exit_code": 0,
+        "seconds": 0.57,
+        "log": "/tmp/canopy-routing-corrected-registry.log",
+        "log_sha256": "e61fea3524a74e4c6c9b80fcb9daf643065a900b846b8ac90f943b0718280862",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 754 filtered out; finished in 0.16s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "thread",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "test",
+          "-p",
+          "canopy-server",
+          "--locked",
+          "--lib",
+          "native_thread_receiver_binds_verified_anchor_and_rechecks_editorial_revision"
+        ],
+        "exit_code": 0,
+        "seconds": 3.1,
+        "log": "/tmp/canopy-routing-corrected-thread.log",
+        "log_sha256": "04f78821111c11b5eadf2701fdc11c69adc1ca9ff0f7efc172f5d8ed714b3842",
+        "summaries": [
+          "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 754 filtered out; finished in 2.70s"
+        ],
+        "failed_cases": []
+      },
+      {
+        "name": "clippy",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "clippy",
+          "--workspace",
+          "--all-targets",
+          "--locked",
+          "--",
+          "-D",
+          "warnings"
+        ],
+        "exit_code": 0,
+        "seconds": 36.13,
+        "log": "/tmp/canopy-routing-corrected-clippy.log",
+        "log_sha256": "5bbde0b9daf654bf2893c82e0ca225ecba76fdd98a85b8cae636df83b197c3c8",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "fmt",
+        "command": [
+          "cargo",
+          "+1.98.0",
+          "fmt",
+          "--all",
+          "--",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 1.45,
+        "log": "/tmp/canopy-routing-corrected-fmt.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      },
+      {
+        "name": "diff",
+        "command": [
+          "git",
+          "diff",
+          "--check"
+        ],
+        "exit_code": 0,
+        "seconds": 0.04,
+        "log": "/tmp/canopy-routing-corrected-diff.log",
+        "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "summaries": [],
+        "failed_cases": []
+      }
+    ],
+    "source_unchanged": true,
+    "finished_at_utc": "2026-10-06T03:56:59.917436+00:00"
+  },
+  "additional_checks": [
+    {
+      "name": "cold-owner",
+      "log": "/tmp/canopy-armed-cold-fixed.log",
+      "exit_code": 0,
+      "log_sha256": "6d831a537071030013e200ed3379512c827f48ddfda5f87279ecfd77ee28dc96",
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 754 filtered out; finished in 5.06s"
+      ],
+      "failed_cases": []
+    },
+    {
+      "name": "discovery-focused",
+      "log": "/tmp/canopy-discovery-native-repro.log",
+      "exit_code": 0,
+      "log_sha256": "ffec81ddc1b0452bedd75465553ea3a1e2a1dd4548ac50ff59af03151334da1a",
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 6.07s"
+      ],
+      "failed_cases": []
+    },
+    {
+      "name": "listener-focused",
+      "log": "/tmp/canopy-listener-repro.log",
+      "exit_code": 0,
+      "log_sha256": "a19dcea73055908eac0e766f749d7fc70e3efd94900f41538d118bd91f7c0d22",
+      "summaries": [
+        "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 115 filtered out; finished in 0.00s"
+      ],
+      "failed_cases": []
+    },
+    {
+      "name": "harness",
+      "log": "/tmp/canopy-routing-harness.log",
+      "exit_code": 0,
+      "log_sha256": "6e7fb525f14fde752af6b0614c73f13530f9e177082866daff05ad3cbc9b9f49",
+      "summaries": [],
+      "failed_cases": []
+    }
+  ],
+  "remaining": [
+    "native backup artifact graph (retired objects/git_packs queries)",
+    "selective native provider reads and retained object cache",
+    "read-only residency restoration root advancement",
+    "late pre-bind SSH ACL revocation needs a purpose-restricted negative staging path",
+    "standalone owner_restart/repository_cell/smart_http fixtures use detached or retired APIs",
+    "discovery latency and listener rebinding fail under full local contention; focused tests pass",
+    "three option-error failures from the referenced Linux run did not reproduce on macOS; new-head Linux qualification required"
+  ]
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 3a8ee575..8635b59c 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -18,6 +18,25 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers and reviewed merges now use native publication. Remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Native line threads and owner routing (2026-10-05 checkpoint)
+
+The [native thread and owner routing contract](design/native-thread-and-owner-routing.md)
+repairs purpose-bound line-thread publication, HTTP Git/LFS forwarding to the
+live resident owner, push UUID conflict classification, and durable frozen
+refusal after a known final catalog CAS denial. Both peer tests, line-thread and
+visibility integrations, and the leased push UUID test now pass. The final
+cold-owner fixture includes the publication and refusal command reservations.
+
+[The evidence](evidence/native-ci-routing-20261005.json) distinguishes the full
+workspace source from its one assertion-only test correction and final focused
+checks. The full diagnostic had 754 passing library cases and the corrected
+admission assertion; multi-server had 97 passed / 10 failed / 9 ignored. All
+three detached standalone fixtures still fail. Native discovery and listener
+rebinding pass alone but fail under full local contention. Clippy, build,
+formatting and 96 harness tests pass. Full CI, native backup/selective fetch,
+late pre-bind SSH refusal, read-only residency restoration, and new-head Linux
+qualification remain open. The capacity goal remains paused and incomplete.
+
 ## Native generated candidates and reviewed merges (2026-10-05 checkpoint)
 
 The public candidate, rebase and SHA-256 integration failures were caused by

From f60cdce40d24184b73d8e0848b8c5181714d80b5 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 21:40:18 -0700
Subject: [PATCH 49/55] fix: retain native backup graphs and await staging
 readiness

---
 crates/canopy-server/Cargo.toml               |    2 +-
 .../src/deployment/backup/bodies.rs           |  128 +-
 .../src/deployment/backup/mod.rs              |    3 +
 .../src/deployment/backup/native.rs           |  366 +++
 .../src/git_gateway/push/native.rs            |    2 +-
 crates/canopy-server/src/lib.rs               |    7 +
 crates/canopy-server/src/packs/backup.rs      |  240 ++
 .../src/packs/directory/index/mod.rs          |    2 +
 .../src/packs/directory/index/visit.rs        |   61 +
 crates/canopy-server/src/packs/mod.rs         |    1 +
 .../src/packs/publication/backup.rs           |  184 ++
 .../candidate_publication/audit.rs            |   12 +
 .../publication/candidate_publication/mod.rs  |   15 +
 .../src/packs/publication/inputs.rs           |   25 +
 .../src/packs/publication/mod.rs              |    2 +
 .../src/packs/publication/native_merge.rs     |   20 +
 .../packs/publication/native_merge/audit.rs   |   16 +
 .../src/packs/publication/native_result.rs    |   19 +
 .../src/packs/publication/outcome.rs          |   21 +
 .../src/packs/publication/recovery/archive.rs |    8 +-
 .../src/packs/publication/recovery/backup.rs  |  127 +
 .../src/packs/publication/recovery/mod.rs     |    2 +
 .../packs/publication/root_completion/mod.rs  |    2 +
 .../publication/root_completion/retention.rs  |   12 +
 .../src/packs/publication/staging_service.rs  |   63 +
 .../publication/tests/staging_service.rs      |   43 +
 .../canopy-server/src/packs/ref_state/mod.rs  |    7 +
 .../tests/multi_server/backup.rs              |  134 +-
 .../native-backup-readiness-20261006.json     | 2143 +++++++++++++++++
 .../large-repository-implementation-status.md |   27 +
 30 files changed, 3599 insertions(+), 95 deletions(-)
 create mode 100644 crates/canopy-server/src/deployment/backup/native.rs
 create mode 100644 crates/canopy-server/src/packs/backup.rs
 create mode 100644 crates/canopy-server/src/packs/directory/index/visit.rs
 create mode 100644 crates/canopy-server/src/packs/publication/backup.rs
 create mode 100644 crates/canopy-server/src/packs/publication/recovery/backup.rs
 create mode 100644 docs/evidence/native-backup-readiness-20261006.json

diff --git a/crates/canopy-server/Cargo.toml b/crates/canopy-server/Cargo.toml
index ea5e82db..6fb4d336 100644
--- a/crates/canopy-server/Cargo.toml
+++ b/crates/canopy-server/Cargo.toml
@@ -9,6 +9,7 @@ name = "canopy"
 path = "src/main.rs"
 
 [dependencies]
+async-trait = "0.1"
 canopy-git-format = { path = "../canopy-git-format" }
 canopy-object-storage = { path = "../canopy-object-storage" }
 axum = "0.8.9"
@@ -54,4 +55,3 @@ libc = "0.2"
 rcgen = "0.14.10"
 tokio-rustls = "0.26.5"
 tokio = { version = "1.49", features = ["test-util"] }
-async-trait = "0.1"
diff --git a/crates/canopy-server/src/deployment/backup/bodies.rs b/crates/canopy-server/src/deployment/backup/bodies.rs
index fecb42aa..7b68f3c3 100644
--- a/crates/canopy-server/src/deployment/backup/bodies.rs
+++ b/crates/canopy-server/src/deployment/backup/bodies.rs
@@ -1,24 +1,9 @@
 use super::*;
-use crate::{
-    blob::{LargeBlobReference, LargeBlobStore, blob_path},
-    lfs::{LfsObject, lfs_path, verify_lfs_object},
-};
-use cellule_ltx::rusqlite::{Connection, OpenFlags, OptionalExtension, params};
+use crate::lfs::{LfsObject, lfs_path, verify_lfs_object};
+use cellule_ltx::rusqlite::{Connection, OpenFlags, params};
 use cellule_runtime::{NodeLeaseGuard, cell::catalog::CatalogRole};
 use object_store::{ObjectStore, prefix::PrefixStore};
 
-#[derive(Clone, Copy)]
-enum BodyKind {
-    Git,
-    Pack,
-    PackIndex,
-    Lfs,
-}
-enum Reference {
-    Git(LargeBlobReference),
-    Lfs(LfsObject),
-}
-
 impl Deployment {
     pub(super) async fn verify_bodies(
         &self,
@@ -82,7 +67,8 @@ impl Deployment {
                 u64::from(verified.page_size()) * u64::from(verified.database_pages());
             let _disk = host.local_disk_budget().try_reserve(database_bytes)?;
             verified.restore(&database).await?;
-            let repository_id = read_identity(database.clone()).await?;
+            let identity = native::identity(database.clone()).await?;
+            let repository_id = identity.as_ref().map(|value| value.repository);
             if let Some(id) = repository_id {
                 let target = crate::repository_target(
                     self.identity.tenant(),
@@ -95,22 +81,34 @@ impl Deployment {
                     ));
                 }
             }
-            for kind in [
-                BodyKind::Git,
-                BodyKind::Pack,
-                BodyKind::PackIndex,
-                BodyKind::Lfs,
-            ] {
+            count = count
+                .checked_add(
+                    native::verify(
+                        self,
+                        host,
+                        guard,
+                        &database,
+                        &directory,
+                        identity,
+                        source,
+                        source_store.clone(),
+                        destination_store.clone(),
+                    )
+                    .await?,
+                )
+                .ok_or(BackupError::Invalid("external object count overflow"))?;
+            {
                 let mut cursor = Vec::new();
                 loop {
-                    let page = read_page(database.clone(), kind, cursor).await?;
+                    let page = read_page(database.clone(), cursor).await?;
                     if page.is_empty() {
                         break;
                     }
-                    cursor = match page.last().ok_or(BackupError::Invalid("empty page"))? {
-                        Reference::Git(value) => value.oid.to_vec(),
-                        Reference::Lfs(value) => value.sha256.to_vec(),
-                    };
+                    cursor = page
+                        .last()
+                        .ok_or(BackupError::Invalid("empty page"))?
+                        .sha256
+                        .to_vec();
                     for reference in page {
                         // A crash may leave a provisioned Cell before owner initialization.
                         // That Cell can be empty, but external bytes require a durable UUID.
@@ -118,16 +116,10 @@ impl Deployment {
                             "external body has no repository identity",
                         ))?;
                         guard.check()?;
-                        let path = match &reference {
-                            Reference::Git(value) => blob_path(repository_id, &value.sha256),
-                            Reference::Lfs(value) => lfs_path(repository_id, &value.sha256),
-                        };
+                        let path = lfs_path(repository_id, &reference.sha256);
                         if let (Some(source), Some(source_store)) = (source, &source_store) {
                             verify(source_store.clone(), repository_id, &reference).await?;
-                            let size = match &reference {
-                                Reference::Git(value) => value.size,
-                                Reference::Lfs(value) => value.size,
-                            };
+                            let size = reference.size;
                             crate::external::copy_parts(
                                 self.layout.store().inner().as_ref(),
                                 &source.parts().chain(path.parts()).collect(),
@@ -161,73 +153,29 @@ impl Deployment {
     }
 }
 
-async fn read_identity(database: PathBuf) -> BackupResult<Option<[u8; 16]>> {
-    tokio::task::spawn_blocking(move || {
-        let connection = Connection::open_with_flags(
-            database,
-            OpenFlags::SQLITE_OPEN_READ_ONLY | OpenFlags::SQLITE_OPEN_NO_MUTEX,
-        )?;
-        let id: Option<Vec<u8>> = connection
-            .query_row(
-                "SELECT repository_id FROM repository_identity WHERE singleton = 1",
-                [],
-                |row| row.get(0),
-            )
-            .optional()?;
-        id.map(|id| {
-            id.try_into()
-                .map_err(|_| BackupError::Invalid("invalid repository UUID"))
-        })
-        .transpose()
-    })
-    .await?
-}
-
 async fn verify(
     store: Arc<dyn ObjectStore>,
     repository_id: [u8; 16],
-    reference: &Reference,
+    reference: &LfsObject,
 ) -> BackupResult<()> {
-    match reference {
-        Reference::Git(value) => {
-            LargeBlobStore::new(store, repository_id)
-                .verify(value)
-                .await?;
-        }
-        Reference::Lfs(value) => {
-            verify_lfs_object(store, repository_id, *value, None).await?;
-        }
-    }
+    verify_lfs_object(store, repository_id, *reference, None).await?;
     Ok(())
 }
 
-async fn read_page(
-    database: PathBuf,
-    kind: BodyKind,
-    cursor: Vec<u8>,
-) -> BackupResult<Vec<Reference>> {
+async fn read_page(database: PathBuf, cursor: Vec<u8>) -> BackupResult<Vec<LfsObject>> {
     tokio::task::spawn_blocking(move || {
         let connection = Connection::open_with_flags(database, OpenFlags::SQLITE_OPEN_READ_ONLY | OpenFlags::SQLITE_OPEN_NO_MUTEX)?;
-        let sql = match kind {
-            BodyKind::Git => "SELECT oid, size, digest, external_sha256 FROM objects WHERE storage = 'external' AND oid > ?1 ORDER BY oid LIMIT 256",
-            BodyKind::Pack => "SELECT DISTINCT pack_oid, pack_size, pack_digest, sha256 FROM git_packs WHERE pack_oid > ?1 ORDER BY pack_oid LIMIT 256",
-            BodyKind::PackIndex => "SELECT DISTINCT index_oid, index_size, index_digest, index_sha256 FROM git_packs WHERE index_oid > ?1 ORDER BY index_oid LIMIT 256",
-            BodyKind::Lfs => "SELECT sha256, size, digest, sha256 FROM lfs_objects WHERE sha256 > ?1 ORDER BY sha256 LIMIT 256",
-        };
-        let mut statement = connection.prepare(sql)?;
+        let mut statement = connection.prepare("SELECT sha256,size,digest FROM lfs_objects WHERE sha256 > ?1 ORDER BY sha256 LIMIT 256")?;
         let mut rows = statement.query(params![cursor])?;
         let mut page = Vec::new();
         while let Some(row) = rows.next()? {
-            let oid: Vec<u8> = row.get(0)?;
+            let sha256: Vec<u8> = row.get(0)?;
             let size: i64 = row.get(1)?;
             let digest: Vec<u8> = row.get(2)?;
-            let sha256: Vec<u8> = row.get(3)?;
-            let size = u64::try_from(size).map_err(|_| BackupError::Invalid("invalid body size"))?;
-            let digest = digest.try_into().map_err(|_| BackupError::Invalid("invalid body digest"))?;
-            let sha256 = sha256.try_into().map_err(|_| BackupError::Invalid("invalid body SHA-256"))?;
-            page.push(match kind {
-                BodyKind::Git | BodyKind::Pack | BodyKind::PackIndex => Reference::Git(LargeBlobReference { oid: oid.try_into().map_err(|_| BackupError::Invalid("invalid Git OID"))?, size, blake3: digest, sha256 }),
-                BodyKind::Lfs => Reference::Lfs(LfsObject { sha256, size, parts_digest: digest }),
+            page.push(LfsObject {
+                sha256: sha256.try_into().map_err(|_| BackupError::Invalid("invalid LFS SHA-256"))?,
+                size: size.try_into().map_err(|_| BackupError::Invalid("invalid LFS size"))?,
+                parts_digest: digest.try_into().map_err(|_| BackupError::Invalid("invalid LFS digest"))?,
             });
         }
         Ok(page)
diff --git a/crates/canopy-server/src/deployment/backup/mod.rs b/crates/canopy-server/src/deployment/backup/mod.rs
index 18453490..76dd6ace 100644
--- a/crates/canopy-server/src/deployment/backup/mod.rs
+++ b/crates/canopy-server/src/deployment/backup/mod.rs
@@ -17,6 +17,7 @@ use std::path::PathBuf;
 
 mod bodies;
 mod enrollment;
+mod native;
 
 const MAX_CELLS: usize = 100_000;
 
@@ -42,6 +43,8 @@ pub enum BackupError {
     Io(#[from] std::io::Error),
     #[error("backup task failed")]
     Task(#[from] tokio::task::JoinError),
+    #[error("backup native artifact graph failed")]
+    Native(#[source] Box<dyn std::error::Error + Send + Sync>),
     #[error("backup rejected: {0}")]
     Invalid(&'static str),
 }
diff --git a/crates/canopy-server/src/deployment/backup/native.rs b/crates/canopy-server/src/deployment/backup/native.rs
new file mode 100644
index 00000000..77371c15
--- /dev/null
+++ b/crates/canopy-server/src/deployment/backup/native.rs
@@ -0,0 +1,366 @@
+//! Pinned native roots, keyset-paged SQL inventory and admitted disk deduplication.
+use super::*;
+use crate::{
+    ObjectFormat,
+    packs::{
+        backup::{ArtifactVisitor, Inventory},
+        directory::index::WalkResult,
+    },
+};
+use canopy_object_storage::artifact::{ArtifactDescriptor, ArtifactKey, ArtifactStore};
+use cellule_ltx::{
+    DiskReservation,
+    rusqlite::{Connection, OpenFlags, OptionalExtension, params, params_from_iter, types::Value},
+};
+use cellule_runtime::NodeLeaseGuard;
+use object_store::ObjectStore;
+use std::sync::Mutex;
+
+pub(super) struct Identity {
+    pub repository: [u8; 16],
+    format: ObjectFormat,
+    seed: [u8; 32],
+}
+pub(super) async fn identity(database: PathBuf) -> BackupResult<Option<Identity>> {
+    tokio::task::spawn_blocking(move || {
+        let c = Connection::open_with_flags(database,OpenFlags::SQLITE_OPEN_READ_ONLY | OpenFlags::SQLITE_OPEN_NO_MUTEX)?;
+        let row = c.query_row("SELECT repository_id,object_format,push_cert_seed FROM repository_identity WHERE singleton=1",[],|row| Ok((row.get::<_,Vec<u8>>(0)?,row.get::<_,String>(1)?,row.get::<_,Vec<u8>>(2)?))).optional()?;
+        row.map(|(repository,format,seed)| Ok(Identity {
+            repository: repository.try_into().map_err(|_| BackupError::Invalid("invalid repository UUID"))?,
+            format: match format.as_str() { "sha1" => ObjectFormat::Sha1, "sha256" => ObjectFormat::Sha256, _ => return Err(BackupError::Invalid("invalid repository format")) },
+            seed: seed.try_into().map_err(|_| BackupError::Invalid("invalid repository seed"))?,
+        })).transpose()
+    }).await?
+}
+struct Purpose {
+    table: &'static str,
+    keys: &'static str,
+    fields: &'static [&'static str],
+    predicate: &'static str,
+    cursor: Vec<Value>,
+}
+fn purposes() -> Vec<Purpose> {
+    [
+        (
+            "catalog_generations",
+            "generation",
+            &["catalog", "refs"][..],
+            "1",
+            vec![Value::Integer(-1)],
+        ),
+        (
+            "pushes",
+            "id",
+            &["response_root"][..],
+            "response_root IS NOT NULL",
+            vec![Value::Blob(vec![])],
+        ),
+        (
+            "pull_merges",
+            "id",
+            &["publication"][..],
+            "1",
+            vec![Value::Blob(vec![])],
+        ),
+        (
+            "merge_candidates",
+            "id",
+            &["native_publication"][..],
+            "native_publication IS NOT NULL",
+            vec![Value::Blob(vec![])],
+        ),
+        (
+            "catalog_head_updates",
+            "id",
+            &["fact"][..],
+            "1",
+            vec![Value::Blob(vec![])],
+        ),
+        (
+            "catalog_initialization",
+            "singleton",
+            &["result"][..],
+            "1",
+            vec![Value::Integer(0)],
+        ),
+        (
+            "catalog_leases",
+            "incarnation,admission_sequence",
+            &[
+                "input_checkpoint",
+                "attestation",
+                "recovery",
+                "recovery_phase",
+            ][..],
+            "1",
+            vec![Value::Blob(vec![]), Value::Integer(0)],
+        ),
+        (
+            "catalog_recovery_receipts",
+            "incarnation,admission_sequence",
+            &["recovery", "recovery_phase", "recovery_release"][..],
+            "1",
+            vec![Value::Blob(vec![]), Value::Integer(0)],
+        ),
+    ]
+    .into_iter()
+    .map(|(table, keys, fields, predicate, cursor)| Purpose {
+        table,
+        keys,
+        fields,
+        predicate,
+        cursor,
+    })
+    .collect()
+}
+struct Row {
+    key: Vec<Value>,
+    columns: Vec<Option<Vec<u8>>>,
+}
+async fn page(database: PathBuf, purpose: &Purpose) -> BackupResult<Vec<Row>> {
+    // All identifiers and predicates above are compile-time schema declarations.
+    let n = purpose.cursor.len();
+    let parameters = (1..=n)
+        .map(|i| format!("?{i}"))
+        .collect::<Vec<_>>()
+        .join(",");
+    let sql = format!(
+        "SELECT {},{} FROM {} WHERE {} AND ({}) > ({}) ORDER BY {} LIMIT 32",
+        purpose.keys,
+        purpose.fields.join(","),
+        purpose.table,
+        purpose.predicate,
+        purpose.keys,
+        parameters,
+        purpose.keys
+    );
+    let cursor = purpose.cursor.clone();
+    let fields = purpose.fields.len();
+    tokio::task::spawn_blocking(move || {
+        let c = Connection::open_with_flags(
+            database,
+            OpenFlags::SQLITE_OPEN_READ_ONLY | OpenFlags::SQLITE_OPEN_NO_MUTEX,
+        )?;
+        let mut stmt = c.prepare(&sql)?;
+        let mut rows = stmt.query(params_from_iter(cursor))?;
+        let mut page = Vec::new();
+        while let Some(row) = rows.next()? {
+            let key = (0..n)
+                .map(|i| row.get(i))
+                .collect::<std::result::Result<Vec<Value>, _>>()?;
+            let columns = (n..n + fields)
+                .map(|i| row.get(i))
+                .collect::<std::result::Result<Vec<Option<Vec<u8>>>, _>>()?;
+            page.push(Row { key, columns });
+        }
+        Ok(page)
+    })
+    .await?
+}
+
+#[expect(
+    clippy::too_many_arguments,
+    reason = "one pinned copy carries source and destination capabilities"
+)]
+pub(super) async fn verify(
+    deployment: &Deployment,
+    host: &Host,
+    guard: &NodeLeaseGuard,
+    database: &std::path::Path,
+    directory: &std::path::Path,
+    identity: Option<Identity>,
+    source: Option<&Path>,
+    source_store: Option<Arc<dyn ObjectStore>>,
+    destination: Arc<dyn ObjectStore>,
+) -> BackupResult<u64> {
+    let mut purposes = purposes();
+    let Some(identity) = identity else {
+        for purpose in &purposes {
+            if page(database.into(), purpose)
+                .await?
+                .iter()
+                .any(|row| row.columns.iter().any(Option::is_some))
+            {
+                return Err(BackupError::Invalid(
+                    "native roots have no repository identity",
+                ));
+            }
+        }
+        return Ok(0);
+    };
+    let target = crate::repository_target(
+        deployment.identity.tenant(),
+        deployment.identity.application(),
+        identity.repository,
+    )?;
+    let destination = Arc::new(ArtifactStore::new(destination, identity.repository));
+    let store = source_store
+        .map(|store| Arc::new(ArtifactStore::new(store, identity.repository)))
+        .unwrap_or_else(|| destination.clone());
+    let disk = host.local_disk_budget().try_reserve(128 * 1024)?;
+    let dedup_root = tempfile::Builder::new()
+        .prefix("native-backup-")
+        .tempdir_in(directory)?;
+    let dedup = dedup_root.path().join("artifacts.sqlite");
+    let c = tokio::task::spawn_blocking(move || -> BackupResult<Connection> {
+        let c = Connection::open(dedup)?;
+        c.execute_batch("PRAGMA journal_mode=OFF; PRAGMA synchronous=OFF; PRAGMA cache_size=-256; CREATE TABLE retained(path TEXT PRIMARY KEY,size INTEGER NOT NULL,digest BLOB NOT NULL,manifest BLOB NOT NULL) WITHOUT ROWID;")?;
+        Ok(c)
+    }).await??;
+    let mut copier = Copier {
+        deployment: deployment.clone(),
+        source: source.cloned(),
+        store: store.clone(),
+        destination,
+        guard: guard.clone(),
+        dedup: Arc::new(Dedup {
+            connection: Mutex::new(c),
+            _root: dedup_root,
+            disk,
+        }),
+        count: 0,
+    };
+    let mut inventory =
+        Inventory::new(store, identity.format, target, &mut copier).map_err(BackupError::Native)?;
+    for (kind, purpose) in purposes.iter_mut().enumerate() {
+        loop {
+            guard.check()?;
+            let rows = page(database.into(), purpose).await?;
+            if rows.is_empty() {
+                break;
+            }
+            purpose.cursor = rows
+                .last()
+                .ok_or(BackupError::Invalid("empty native page"))?
+                .key
+                .clone();
+            for row in rows {
+                crate::packs::publication::backup::row(
+                    kind as u8,
+                    &row.columns,
+                    &identity.seed,
+                    &mut inventory,
+                )
+                .await
+                .map_err(BackupError::Native)?;
+            }
+        }
+    }
+    Ok(copier.count)
+}
+struct Copier {
+    deployment: Deployment,
+    source: Option<Path>,
+    store: Arc<ArtifactStore>,
+    destination: Arc<ArtifactStore>,
+    guard: NodeLeaseGuard,
+    dedup: Arc<Dedup>,
+    count: u64,
+}
+// Field drop order closes SQLite, removes its files, then returns admission.
+// Blocking lookups retain this same owner even if their caller is canceled.
+struct Dedup {
+    connection: Mutex<Connection>,
+    _root: tempfile::TempDir,
+    disk: DiskReservation,
+}
+async fn checked(
+    store: &ArtifactStore,
+    key: ArtifactKey,
+    value: ArtifactDescriptor,
+) -> WalkResult<()> {
+    let mut reader = store.read(key, value).await?;
+    while reader.next().await?.is_some() {}
+    Ok(())
+}
+#[async_trait::async_trait]
+impl ArtifactVisitor for Copier {
+    async fn artifact(&mut self, key: ArtifactKey, value: ArtifactDescriptor) -> WalkResult<bool> {
+        self.guard.check()?;
+        let path = self.store.path(key, value.digest)?;
+        let dedup = self.dedup.clone();
+        let name = path.to_string();
+        let retained = tokio::task::spawn_blocking(move || -> WalkResult<bool> {
+            let c = dedup
+                .connection
+                .lock()
+                .map_err(|_| BackupError::Invalid("backup dedup poisoned"))?;
+            let old = c
+                .query_row(
+                    "SELECT size,digest,manifest FROM retained WHERE path=?1",
+                    params![name],
+                    |row| {
+                        Ok((
+                            row.get::<_, u64>(0)?,
+                            row.get::<_, Vec<u8>>(1)?,
+                            row.get::<_, Vec<u8>>(2)?,
+                        ))
+                    },
+                )
+                .optional()?;
+            if let Some((size, digest, manifest)) = old {
+                if size != value.size || digest != value.digest || manifest != value.manifest_digest
+                {
+                    return Err(
+                        BackupError::Invalid("conflicting native artifact descriptors").into(),
+                    );
+                }
+                return Ok(true);
+            }
+            Ok(false)
+        })
+        .await??;
+        if retained {
+            return Ok(false);
+        }
+        if let Some(source) = &self.source {
+            checked(&self.store, key, value).await?;
+            let from = source.parts().chain(path.parts()).collect();
+            let to = self.deployment.prefix.parts().chain(path.parts()).collect();
+            crate::external::copy_parts(
+                self.deployment.layout.store().inner().as_ref(),
+                &from,
+                &to,
+                value.size,
+            )
+            .await?;
+            match self
+                .deployment
+                .layout
+                .store()
+                .copy_if_not_exists(&from, &to)
+                .await
+            {
+                Ok(()) | Err(StorageError::StateConflict { .. }) => {}
+                Err(error) => return Err(error.into()),
+            }
+        }
+        checked(&self.destination, key, value).await?;
+        // Reserve before the insert. 4 KiB per physical artifact conservatively
+        // covers its bounded key/descriptor and B-tree page overhead.
+        self.dedup.disk.try_grow(4096)?;
+        let dedup = self.dedup.clone();
+        tokio::task::spawn_blocking(move || -> WalkResult<()> {
+            dedup
+                .connection
+                .lock()
+                .map_err(|_| BackupError::Invalid("backup dedup poisoned"))?
+                .execute(
+                    "INSERT INTO retained VALUES(?1,?2,?3,?4)",
+                    params![
+                        path.to_string(),
+                        value.size,
+                        value.digest.as_slice(),
+                        value.manifest_digest.as_slice()
+                    ],
+                )?;
+            Ok(())
+        })
+        .await??;
+        self.count = self
+            .count
+            .checked_add(1)
+            .ok_or(BackupError::Invalid("native artifact count overflow"))?;
+        Ok(true)
+    }
+}
diff --git a/crates/canopy-server/src/git_gateway/push/native.rs b/crates/canopy-server/src/git_gateway/push/native.rs
index 785d60cb..9e4095f1 100644
--- a/crates/canopy-server/src/git_gateway/push/native.rs
+++ b/crates/canopy-server/src/git_gateway/push/native.rs
@@ -523,7 +523,7 @@ pub(in crate::git_gateway) async fn checkpoint(
         .register_inputs(proof, mutation()?)
         .map_err(|(error, _)| error)?;
     loop {
-        match registration.wait().await {
+        match registration.wait_ready().await {
             Ok(_) => return Ok(()),
             Err(_) if matches!(ticket.state(), StagingState::Uncertain(_)) => {
                 staging.recover(ticket)?;
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index d3d20976..0de04438 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -37,6 +37,7 @@ pub mod issues;
 pub mod blob {
     //! Verified, immutable Git blob bodies stored outside the Repository Cell.
 
+    #[cfg(test)]
     pub(crate) use canopy_object_storage::blob::blob_path;
     pub use canopy_object_storage::blob::{
         LargeBlobError, LargeBlobRead, LargeBlobReference, LargeBlobStore,
@@ -174,6 +175,12 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("lib.rs"));
                 source.update(include_bytes!("deployment/mod.rs"));
                 source.update(include_bytes!("deployment/root.rs"));
+                source.update(include_bytes!("deployment/backup/bodies.rs"));
+                source.update(include_bytes!("deployment/backup/native.rs"));
+                source.update(include_bytes!("packs/backup.rs"));
+                source.update(include_bytes!("packs/directory/index/visit.rs"));
+                source.update(include_bytes!("packs/publication/backup.rs"));
+                source.update(include_bytes!("packs/publication/recovery/backup.rs"));
                 source.update(include_bytes!("server/mod.rs"));
                 source.update(include_bytes!("server/lifecycle.rs"));
                 source.update(include_bytes!("admission.rs"));
diff --git a/crates/canopy-server/src/packs/backup.rs b/crates/canopy-server/src/packs/backup.rs
new file mode 100644
index 00000000..5a2e03cb
--- /dev/null
+++ b/crates/canopy-server/src/packs/backup.rs
@@ -0,0 +1,240 @@
+//! Repository-scoped typed artifact inventory for pinned backup snapshots.
+use super::{
+    catalog::{CatalogIndexes, CatalogSnapshot, StoredCatalog},
+    directory::{
+        StoredRun,
+        index::{IndexVisitor, WalkResult},
+        snapshot::DirectorySnapshot,
+    },
+    ref_state::{RefStateRecord, RefStateSnapshotRoot},
+    sources::{NativeInputRoot, NativePackDescriptor, SourceRecord},
+};
+use crate::ObjectFormat;
+use canopy_object_storage::artifact::{
+    ArtifactDescriptor, ArtifactKey, ArtifactKind, ArtifactStore,
+};
+use cellule_runtime::{
+    CellTarget,
+    codec::{BoundedDecoder, WireValue},
+};
+use std::sync::Arc;
+
+pub(crate) use super::directory::index::ArtifactVisitor;
+
+pub(crate) struct Inventory<'a> {
+    store: Arc<ArtifactStore>,
+    format: ObjectFormat,
+    indexes: Arc<CatalogIndexes>,
+    visitor: &'a mut dyn ArtifactVisitor,
+    target: CellTarget,
+}
+impl<'a> Inventory<'a> {
+    pub(crate) fn new(
+        store: Arc<ArtifactStore>,
+        format: ObjectFormat,
+        target: CellTarget,
+        visitor: &'a mut dyn ArtifactVisitor,
+    ) -> WalkResult<Self> {
+        if crate::repository_target(target.tenant(), target.application(), store.repository())?
+            != target
+        {
+            return Err(super::directory::index::IndexError::Integrity.into());
+        }
+        Ok(Self {
+            indexes: Arc::new(CatalogIndexes::new(store.clone(), format)),
+            store,
+            format,
+            visitor,
+            target,
+        })
+    }
+    pub(crate) fn target(&self) -> &CellTarget {
+        &self.target
+    }
+    pub(crate) fn store(&self) -> Arc<ArtifactStore> {
+        self.store.clone()
+    }
+    pub(crate) fn format(&self) -> ObjectFormat {
+        self.format
+    }
+    pub(crate) async fn artifact(
+        &mut self,
+        key: ArtifactKey,
+        descriptor: ArtifactDescriptor,
+    ) -> WalkResult<bool> {
+        self.visitor.artifact(key, descriptor).await
+    }
+    pub(crate) async fn input(
+        &mut self,
+        operation: [u8; 16],
+        descriptor: ArtifactDescriptor,
+    ) -> WalkResult<bool> {
+        self.artifact(
+            ArtifactKey {
+                operation,
+                binding_digest: descriptor.digest,
+                kind: ArtifactKind::InputRoot,
+            },
+            descriptor,
+        )
+        .await
+    }
+    pub(crate) async fn body(
+        &mut self,
+        operation: [u8; 16],
+        descriptor: ArtifactDescriptor,
+    ) -> WalkResult<()> {
+        self.artifact(
+            ArtifactKey {
+                operation,
+                binding_digest: descriptor.digest,
+                kind: ArtifactKind::InputBody,
+            },
+            descriptor,
+        )
+        .await?;
+        Ok(())
+    }
+    pub(crate) async fn catalog(&mut self, stored: StoredCatalog) -> WalkResult<()> {
+        if stored.format != self.format {
+            return Err(super::directory::index::IndexError::Integrity.into());
+        }
+        let snapshot = CatalogSnapshot::download(&self.store, stored).await?;
+        self.artifact(
+            ArtifactKey {
+                operation: stored.operation,
+                binding_digest: stored.artifact.digest,
+                kind: ArtifactKind::CatalogNode,
+            },
+            stored.artifact,
+        )
+        .await?;
+        let directory = DirectorySnapshot::download(&self.store, snapshot.directory).await?;
+        self.artifact(
+            ArtifactKey {
+                operation: snapshot.directory.operation,
+                binding_digest: snapshot.directory.artifact.digest,
+                kind: ArtifactKind::CatalogNode,
+            },
+            snapshot.directory.artifact,
+        )
+        .await?;
+        let indexes = self.indexes.clone();
+        for root in directory
+            .level_zero
+            .iter()
+            .chain(directory.levels.iter().flatten())
+        {
+            indexes.ranges().visit(*root, self).await?;
+        }
+        if let Some(root) = snapshot.sources {
+            indexes.sources().visit(root, self).await?;
+        }
+        Ok(())
+    }
+    /// Closed audit needs the selected metadata headers, without retaining a
+    /// superseded catalog's physical object graph as permanent Git history.
+    pub(crate) async fn catalog_headers(&mut self, stored: StoredCatalog) -> WalkResult<()> {
+        if stored.format != self.format {
+            return Err(super::directory::index::IndexError::Integrity.into());
+        }
+        let snapshot = CatalogSnapshot::download(&self.store, stored).await?;
+        DirectorySnapshot::download(&self.store, snapshot.directory).await?;
+        self.artifact(
+            ArtifactKey {
+                operation: stored.operation,
+                binding_digest: stored.artifact.digest,
+                kind: ArtifactKind::CatalogNode,
+            },
+            stored.artifact,
+        )
+        .await?;
+        self.artifact(
+            ArtifactKey {
+                operation: snapshot.directory.operation,
+                binding_digest: snapshot.directory.artifact.digest,
+                kind: ArtifactKind::CatalogNode,
+            },
+            snapshot.directory.artifact,
+        )
+        .await?;
+        Ok(())
+    }
+    pub(crate) async fn refs(&mut self, root: RefStateSnapshotRoot) -> WalkResult<()> {
+        let snapshot = root.read(&self.store).await?;
+        if snapshot.format != self.format {
+            return Err(super::directory::index::IndexError::Integrity.into());
+        }
+        if !self.input(root.operation(), root.artifact()).await? {
+            return Ok(());
+        }
+        if let Some(root) = snapshot.root {
+            self.indexes.clone().refs().visit(root, self).await?;
+        }
+        Ok(())
+    }
+    pub(crate) async fn native_inputs(&mut self, root: NativeInputRoot) -> WalkResult<()> {
+        self.indexes.clone().inputs().visit(root, self).await
+    }
+    async fn pack(&mut self, pack: NativePackDescriptor) -> WalkResult<()> {
+        pack.validate(self.store.repository(), self.format)?;
+        self.artifact(pack.key(ArtifactKind::Pack)?, pack.pack)
+            .await?;
+        self.artifact(pack.key(ArtifactKind::Index)?, pack.index)
+            .await?;
+        Ok(())
+    }
+}
+
+#[async_trait::async_trait]
+impl ArtifactVisitor for Inventory<'_> {
+    async fn artifact(
+        &mut self,
+        key: ArtifactKey,
+        descriptor: ArtifactDescriptor,
+    ) -> WalkResult<bool> {
+        self.visitor.artifact(key, descriptor).await
+    }
+}
+#[async_trait::async_trait]
+impl IndexVisitor<StoredRun> for Inventory<'_> {
+    async fn record(&mut self, record: &StoredRun) -> WalkResult<()> {
+        self.artifact(
+            ArtifactKey {
+                operation: record.run.operation,
+                binding_digest: record.artifact.digest,
+                kind: ArtifactKind::DirectoryRun,
+            },
+            record.artifact,
+        )
+        .await?;
+        Ok(())
+    }
+}
+#[async_trait::async_trait]
+impl IndexVisitor<SourceRecord> for Inventory<'_> {
+    async fn record(&mut self, record: &SourceRecord) -> WalkResult<()> {
+        self.artifact(record.metadata_key(), record.metadata.artifact)
+            .await?;
+        self.pack(record.native()).await
+    }
+}
+#[async_trait::async_trait]
+impl IndexVisitor<NativePackDescriptor> for Inventory<'_> {
+    async fn record(&mut self, record: &NativePackDescriptor) -> WalkResult<()> {
+        self.pack(*record).await
+    }
+}
+#[async_trait::async_trait]
+impl IndexVisitor<RefStateRecord> for Inventory<'_> {
+    async fn record(&mut self, _: &RefStateRecord) -> WalkResult<()> {
+        Ok(())
+    }
+}
+
+pub(crate) fn decode<T: WireValue>(bytes: &[u8], limit: u32) -> WalkResult<T> {
+    let mut decoder = BoundedDecoder::new(bytes, limit)?;
+    let value = T::decode(&mut decoder)?;
+    decoder.finish()?;
+    Ok(value)
+}
diff --git a/crates/canopy-server/src/packs/directory/index/mod.rs b/crates/canopy-server/src/packs/directory/index/mod.rs
index 7410100f..b1dc2d88 100644
--- a/crates/canopy-server/src/packs/directory/index/mod.rs
+++ b/crates/canopy-server/src/packs/directory/index/mod.rs
@@ -18,8 +18,10 @@ mod changes;
 mod cursor;
 mod rewrite;
 mod update;
+mod visit;
 pub use changes::RangeChanges;
 pub use cursor::RangeCursor;
+pub(crate) use visit::{ArtifactVisitor, IndexVisitor, WalkResult};
 
 pub const FANOUT: usize = 128;
 pub const NODE_BYTES: u32 = 64 << 10;
diff --git a/crates/canopy-server/src/packs/directory/index/visit.rs b/crates/canopy-server/src/packs/directory/index/visit.rs
new file mode 100644
index 00000000..582e8845
--- /dev/null
+++ b/crates/canopy-server/src/packs/directory/index/visit.rs
@@ -0,0 +1,61 @@
+//! Typed physical-artifact traversal with bounded depth and shared-node reuse.
+use super::*;
+
+pub(crate) type WalkResult<T> = Result<T, Box<dyn std::error::Error + Send + Sync>>;
+
+#[async_trait::async_trait]
+pub(crate) trait ArtifactVisitor: Send {
+    /// False only after this exact key/descriptor was successfully retained.
+    /// Callers use admitted disk to bound physical-artifact deduplication.
+    async fn artifact(
+        &mut self,
+        key: ArtifactKey,
+        descriptor: ArtifactDescriptor,
+    ) -> WalkResult<bool>;
+}
+
+#[async_trait::async_trait]
+pub(crate) trait IndexVisitor<R: IndexRecord>: ArtifactVisitor {
+    async fn record(&mut self, record: &R) -> WalkResult<()>;
+}
+
+impl<R: IndexRecord> RangeIndex<R> {
+    pub(crate) async fn visit<V: IndexVisitor<R> + ?Sized>(
+        &self,
+        root: NodeRef<R>,
+        visitor: &mut V,
+    ) -> WalkResult<()> {
+        root.validate(self.format)?;
+        let limit = (R::FANOUT - 1) * (usize::from(R::MAX_HEIGHT) + 1) + 1;
+        let mut pending = vec![root];
+        while let Some(reference) = pending.pop() {
+            // Validate this reference's complete bounds even if its physical
+            // node was previously copied through another generation/root.
+            let node = self.load(reference.clone()).await?;
+            if !visitor
+                .artifact(reference.key(), reference.artifact)
+                .await?
+            {
+                continue;
+            }
+            match &node.contents {
+                Contents::Runs(records) => {
+                    for record in records {
+                        visitor.record(record).await?;
+                    }
+                }
+                Contents::Children(children) => {
+                    if pending
+                        .len()
+                        .checked_add(children.len())
+                        .is_none_or(|n| n > limit)
+                    {
+                        return Err(IndexError::Limit.into());
+                    }
+                    pending.extend(children.iter().rev().cloned());
+                }
+            }
+        }
+        Ok(())
+    }
+}
diff --git a/crates/canopy-server/src/packs/mod.rs b/crates/canopy-server/src/packs/mod.rs
index 41463d22..bd3cb07f 100644
--- a/crates/canopy-server/src/packs/mod.rs
+++ b/crates/canopy-server/src/packs/mod.rs
@@ -3,6 +3,7 @@
 //! These structures are inputs to trusted catalog verification. Native pack
 //! membership alone does not certify graph closure or authorize object reads.
 
+pub(crate) mod backup;
 pub mod catalog;
 pub mod closure;
 pub mod directory;
diff --git a/crates/canopy-server/src/packs/publication/backup.rs b/crates/canopy-server/src/packs/publication/backup.rs
new file mode 100644
index 00000000..ff3facd5
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/backup.rs
@@ -0,0 +1,184 @@
+//! Typed graph edges selected exclusively from a pinned repository database.
+use super::*;
+use crate::packs::{
+    backup::{Inventory, decode},
+    directory::index::WalkResult,
+    wire_request::WireRequestRoot,
+};
+
+pub(super) fn context(
+    tenant: [u8; 16],
+    application: [u8; 16],
+    repository: [u8; 16],
+    inventory: &Inventory<'_>,
+) -> WalkResult<()> {
+    if tenant != *inventory.target().tenant().as_bytes()
+        || application != *inventory.target().application().as_bytes()
+        || repository != inventory.store().repository()
+    {
+        return Err(CodecError::Invalid("backup repository context").into());
+    }
+    Ok(())
+}
+pub(super) async fn fact(value: GenerationFact, inventory: &mut Inventory<'_>) -> WalkResult<()> {
+    value.validate()?;
+    if let Some(root) = value.catalog {
+        inventory.catalog(root).await?;
+    }
+    if let Some(root) = value.refs {
+        inventory.refs(root).await?;
+    }
+    Ok(())
+}
+pub(super) async fn catalog_certificate(
+    value: &CatalogCertificate,
+    seed: &[u8; 32],
+    inventory: &mut Inventory<'_>,
+) -> WalkResult<()> {
+    if !value.authenticated(seed) {
+        return Err(CodecError::Invalid("backup catalog MAC").into());
+    }
+    let data = value.data()?;
+    context(
+        data.tenant,
+        data.application,
+        data.token.repository,
+        inventory,
+    )?;
+    fact(data.base, inventory).await?;
+    inventory.catalog(data.catalog).await
+}
+pub(super) async fn wire(root: WireRequestRoot, inventory: &mut Inventory<'_>) -> WalkResult<()> {
+    let record = root.read(&inventory.store()).await?;
+    context(
+        *record.tenant.as_bytes(),
+        *record.application.as_bytes(),
+        record.identity.repository,
+        inventory,
+    )?;
+    if record.format != inventory.format() {
+        return Err(CodecError::Invalid("backup wire format").into());
+    }
+    inventory.input(root.operation(), root.artifact()).await?;
+    inventory.body(record.operation, record.request.body).await
+}
+async fn outcomes(value: RootPushOutcomes, inventory: &mut Inventory<'_>) -> WalkResult<()> {
+    for root in [value.native, value.rejected, value.replayed] {
+        root_completion::backup_graph(root, inventory).await?;
+    }
+    Ok(())
+}
+pub(super) async fn command(
+    kind: recovery::Kind,
+    bytes: &[u8],
+    seed: &[u8; 32],
+    inventory: &mut Inventory<'_>,
+) -> WalkResult<()> {
+    use recovery::Kind;
+    match kind {
+        Kind::Publish => {
+            let value: RootPushCompletion = decode(bytes, ROOT_COMPLETION_BYTES)?;
+            catalog_certificate(&value.proof.certificate, seed, inventory).await?;
+            inventory.refs(value.proof.snapshot).await?;
+            outcomes(value.outcomes, inventory).await?;
+        }
+        Kind::Outcome => {
+            let value: RootOutcomeCompletion = decode(bytes, ROOT_COMPLETION_BYTES)?;
+            outcome::backup_graph(&value.proof, seed, inventory).await?;
+            outcomes(value.outcomes, inventory).await?;
+        }
+        Kind::Policy => {
+            let value: RefPolicyPage = decode(bytes, REF_POLICY_PAGE_BYTES)?;
+            catalog_certificate(&value.proof.certificate, seed, inventory).await?;
+        }
+        Kind::Initialization => {
+            let value: InitialRefProof = decode(bytes, INITIALIZATION_BYTES)?;
+            catalog_certificate(&value.certificate, seed, inventory).await?;
+            inventory.refs(value.refs).await?;
+        }
+        Kind::Head => {
+            let value: NativeHeadProof = decode(bytes, NATIVE_HEAD_BYTES)?;
+            catalog_certificate(&value.certificate, seed, inventory).await?;
+            if let Some(root) = value.refs {
+                inventory.refs(root).await?;
+            }
+        }
+        Kind::Candidate => {
+            candidate_publication::backup_graph(
+                &decode(bytes, NATIVE_CANDIDATE_BYTES)?,
+                seed,
+                inventory,
+            )
+            .await?
+        }
+        Kind::Merge => {
+            native_merge::backup_graph(&decode(bytes, NATIVE_MERGE_BYTES)?, seed, inventory).await?
+        }
+    }
+    Ok(())
+}
+
+/// Each row kind uses its declared codec; a blob cannot select its own purpose.
+pub(crate) async fn row(
+    kind: u8,
+    columns: &[Option<Vec<u8>>],
+    seed: &[u8; 32],
+    inventory: &mut Inventory<'_>,
+) -> WalkResult<()> {
+    let at = |n: usize| {
+        columns
+            .get(n)
+            .and_then(Option::as_deref)
+            .ok_or(CodecError::Invalid("backup graph row"))
+    };
+    match kind {
+        0 => {
+            if let Some(bytes) = columns.first().and_then(Option::as_deref) {
+                inventory.catalog(decode(bytes, 256)?).await?;
+            }
+            if let Some(bytes) = columns.get(1).and_then(Option::as_deref) {
+                inventory.refs(decode(bytes, 128)?).await?;
+            }
+        }
+        1 => root_completion::backup_graph(decode(at(0)?, 128)?, inventory).await?,
+        2 => native_merge::audit::backup_graph(decode(at(0)?, 128)?, inventory).await?,
+        3 => {
+            let value: candidate_publication::audit::Selected = decode(at(0)?, 512)?;
+            if let Some(root) = value.root {
+                candidate_publication::audit::backup_graph(root, inventory).await?;
+            }
+        }
+        4 => {
+            let value: GenerationFact = decode(at(0)?, 512)?;
+            value.validate()?;
+            if let Some(root) = value.catalog {
+                inventory.catalog_headers(root).await?;
+            }
+            if let Some(root) = value.refs {
+                inventory.refs(root).await?;
+            }
+        }
+        5 => fact(decode(at(0)?, 512)?, inventory).await?,
+        6 => {
+            if let Some(bytes) = columns.first().and_then(Option::as_deref) {
+                inputs::backup_graph(&decode(bytes, 1024)?, seed, inventory).await?;
+            }
+            if let Some(bytes) = columns.get(1).and_then(Option::as_deref) {
+                catalog_certificate(&decode(bytes, 1024)?, seed, inventory).await?;
+            }
+            if let Some(bytes) = columns.get(2).and_then(Option::as_deref) {
+                recovery::backup::graph(
+                    bytes,
+                    columns.get(3).and_then(Option::as_deref),
+                    None,
+                    seed,
+                    inventory,
+                )
+                .await?;
+            }
+        }
+        7 => recovery::backup::graph(at(0)?, Some(at(1)?), Some(at(2)?), seed, inventory).await?,
+        _ => return Err(CodecError::Invalid("backup graph purpose").into()),
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/candidate_publication/audit.rs b/crates/canopy-server/src/packs/publication/candidate_publication/audit.rs
index e83fe6c4..4c9bdd70 100644
--- a/crates/canopy-server/src/packs/publication/candidate_publication/audit.rs
+++ b/crates/canopy-server/src/packs/publication/candidate_publication/audit.rs
@@ -305,3 +305,15 @@ pub(in crate::packs::publication) async fn verify_ready(
     }
     Ok(())
 }
+
+pub(in crate::packs::publication) async fn backup_graph(
+    root: StoredInputRoot,
+    inventory: &mut crate::packs::backup::Inventory<'_>,
+) -> crate::packs::directory::index::WalkResult<()> {
+    let audit: Audit = root.read(&inventory.store(), INPUT_ROOT_BYTES).await?;
+    if !inventory.input(root.operation, root.artifact).await? {
+        return Ok(());
+    }
+    inventory.catalog_headers(audit.catalog).await?;
+    inventory.refs(audit.refs).await
+}
diff --git a/crates/canopy-server/src/packs/publication/candidate_publication/mod.rs b/crates/canopy-server/src/packs/publication/candidate_publication/mod.rs
index 4d9274df..d8f89b0c 100644
--- a/crates/canopy-server/src/packs/publication/candidate_publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/candidate_publication/mod.rs
@@ -321,3 +321,18 @@ impl PreparedCatalog {
         .map_err(|_| PreparationBaseError::Inactive)?
     }
 }
+
+pub(super) async fn backup_graph(
+    proof: &NativeCandidateProof,
+    seed: &[u8; 32],
+    inventory: &mut crate::packs::backup::Inventory<'_>,
+) -> crate::packs::directory::index::WalkResult<()> {
+    super::backup::catalog_certificate(&proof.certificate, seed, inventory).await?;
+    if let Some(root) = proof.refs {
+        inventory.refs(root).await?;
+    }
+    if let Some(root) = proof.audit {
+        audit::backup_graph(root, inventory).await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/inputs.rs b/crates/canopy-server/src/packs/publication/inputs.rs
index 100b9478..f0428edb 100644
--- a/crates/canopy-server/src/packs/publication/inputs.rs
+++ b/crates/canopy-server/src/packs/publication/inputs.rs
@@ -977,3 +977,28 @@ pub(super) async fn observe_bound_registration(
     session.refresh(minimum).await?;
     Ok(())
 }
+
+pub(super) async fn backup_graph(
+    value: &NativeInputCertificate,
+    seed: &[u8; 32],
+    inventory: &mut crate::packs::backup::Inventory<'_>,
+) -> crate::packs::directory::index::WalkResult<()> {
+    if !value.0.authenticated(seed) {
+        return Err(CodecError::Invalid("backup input MAC").into());
+    }
+    let data: Inputs = value.0.data()?;
+    value.scoped_check(inventory.target())?;
+    if data.format != inventory.format() {
+        return Err(CodecError::Invalid("backup input format").into());
+    }
+    if let Some(root) = data.root {
+        inventory.native_inputs(root).await?;
+    }
+    if let Some(root) = data.wire_request {
+        super::backup::wire(root, inventory).await?;
+    }
+    if let Some(root) = data.native_result {
+        super::native_result::backup_graph(root, true, inventory).await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/mod.rs b/crates/canopy-server/src/packs/publication/mod.rs
index 410a1ce4..ccbc3dd6 100644
--- a/crates/canopy-server/src/packs/publication/mod.rs
+++ b/crates/canopy-server/src/packs/publication/mod.rs
@@ -310,3 +310,5 @@ pub use candidate_publication::{
     CandidatePublicationReply, NATIVE_CANDIDATE_BYTES, NativeCandidateProof,
     NativeCandidatePublicationError, PublishNativeCandidate,
 };
+
+pub(crate) mod backup;
diff --git a/crates/canopy-server/src/packs/publication/native_merge.rs b/crates/canopy-server/src/packs/publication/native_merge.rs
index 9f54e5e6..40c85fd3 100644
--- a/crates/canopy-server/src/packs/publication/native_merge.rs
+++ b/crates/canopy-server/src/packs/publication/native_merge.rs
@@ -678,3 +678,23 @@ fn publish_authenticated(
     ))?)?;
     Ok(CommandResult::Success(result))
 }
+
+pub(super) async fn backup_graph(
+    proof: &NativeMergeProof,
+    seed: &[u8; 32],
+    inventory: &mut crate::packs::backup::Inventory<'_>,
+) -> crate::packs::directory::index::WalkResult<()> {
+    super::backup::catalog_certificate(&proof.certificate, seed, inventory).await?;
+    if let Some(t) = &proof.transition {
+        if let Some(root) = t.refs {
+            inventory.refs(root).await?;
+        }
+        if let Some(root) = t.audit {
+            audit::backup_graph(root, inventory).await?;
+        }
+        if let Some(root) = t.candidate {
+            super::candidate_publication::audit::backup_graph(root, inventory).await?;
+        }
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/native_merge/audit.rs b/crates/canopy-server/src/packs/publication/native_merge/audit.rs
index 8380b94a..c6e7bde6 100644
--- a/crates/canopy-server/src/packs/publication/native_merge/audit.rs
+++ b/crates/canopy-server/src/packs/publication/native_merge/audit.rs
@@ -309,3 +309,19 @@ pub(in crate::packs::publication) async fn closed_graph(
     )?;
     Ok(())
 }
+
+pub(in crate::packs::publication) async fn backup_graph(
+    root: StoredInputRoot,
+    inventory: &mut crate::packs::backup::Inventory<'_>,
+) -> crate::packs::directory::index::WalkResult<()> {
+    let audit: Audit = root.read(&inventory.store(), INPUT_ROOT_BYTES).await?;
+    if !inventory.input(root.operation, root.artifact).await? {
+        return Ok(());
+    }
+    inventory.catalog_headers(audit.catalog).await?;
+    inventory.refs(audit.refs).await?;
+    if let Some(root) = audit.candidate {
+        super::super::candidate_publication::audit::backup_graph(root, inventory).await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/native_result.rs b/crates/canopy-server/src/packs/publication/native_result.rs
index 81d50965..fc5d75ac 100644
--- a/crates/canopy-server/src/packs/publication/native_result.rs
+++ b/crates/canopy-server/src/packs/publication/native_result.rs
@@ -383,3 +383,22 @@ async fn reopen(
         certificate,
     })
 }
+
+pub(super) async fn backup_graph(
+    root: NativeResultRoot,
+    active: bool,
+    inventory: &mut crate::packs::backup::Inventory<'_>,
+) -> crate::packs::directory::index::WalkResult<()> {
+    let record = root.read(&inventory.store()).await?;
+    inventory.input(root.operation(), root.artifact()).await?;
+    for (key, body) in record.audit_bodies() {
+        inventory.artifact(key, body).await?;
+    }
+    if active {
+        super::backup::wire(record.request, inventory).await?;
+        inventory
+            .body(record.operation, record.response.body)
+            .await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/publication/outcome.rs b/crates/canopy-server/src/packs/publication/outcome.rs
index a0994b2c..f6687622 100644
--- a/crates/canopy-server/src/packs/publication/outcome.rs
+++ b/crates/canopy-server/src/packs/publication/outcome.rs
@@ -223,3 +223,24 @@ pub(super) fn current_authority(
             generation,
         )? == data.floor)
 }
+
+pub(super) async fn backup_graph(
+    value: &OutcomeCertificate,
+    seed: &[u8; 32],
+    inventory: &mut crate::packs::backup::Inventory<'_>,
+) -> crate::packs::directory::index::WalkResult<()> {
+    if !value.0.authenticated(seed) {
+        return Err(CodecError::Invalid("backup outcome MAC").into());
+    }
+    let data: OutcomeData = value.0.data()?;
+    super::backup::context(
+        data.tenant,
+        data.application,
+        data.check.token.repository,
+        inventory,
+    )?;
+    if data.format != inventory.format() {
+        return Err(CodecError::Invalid("backup outcome format").into());
+    }
+    super::backup::fact(data.floor, inventory).await
+}
diff --git a/crates/canopy-server/src/packs/publication/recovery/archive.rs b/crates/canopy-server/src/packs/publication/recovery/archive.rs
index 895f461c..28f06f59 100644
--- a/crates/canopy-server/src/packs/publication/recovery/archive.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/archive.rs
@@ -490,7 +490,7 @@ impl RegisteredRootRecovery {
         })
     }
 }
-fn validate_bundle(
+pub(super) fn validate_bundle(
     bundle: &Bundle,
     record: &Record,
     target: &CellTarget,
@@ -790,6 +790,12 @@ impl ReadyTerminalRelease {
     }
 }
 
+pub(super) fn backup_release(bytes: &[u8]) -> Result<(), RootRecoveryError> {
+    let _: ReleaseRecord =
+        crate::packs::backup::decode(bytes, 1024).map_err(|_| RootRecoveryError::Context)?;
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/canopy-server/src/packs/publication/recovery/backup.rs b/crates/canopy-server/src/packs/publication/recovery/backup.rs
new file mode 100644
index 00000000..96d273f4
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/recovery/backup.rs
@@ -0,0 +1,127 @@
+//! Unknown commands retain their original bytes; closed frames retain metadata.
+use super::*;
+use crate::packs::{
+    backup::{Inventory, decode},
+    directory::index::WalkResult,
+};
+
+pub(in crate::packs::publication) async fn graph(
+    bytes: &[u8],
+    saved: Option<&[u8]>,
+    release: Option<&[u8]>,
+    seed: &[u8; 32],
+    inventory: &mut Inventory<'_>,
+) -> WalkResult<()> {
+    let certificate: RootRecoveryCertificate = decode(bytes, 1024)?;
+    if !certificate.0.authenticated(seed) {
+        return Err(RootRecoveryError::Context.into());
+    }
+    let mut record: Record = certificate.0.data()?;
+    super::super::backup::context(
+        record.tenant,
+        record.application,
+        record.check.token.repository,
+        inventory,
+    )?;
+    let journal = match saved {
+        Some(bytes) => phase::journal(&SqlValue::Blob(bytes.to_vec()), &record)?,
+        None => phase::Journal {
+            primary: None,
+            refusal: None,
+        },
+    };
+    if let Some(bytes) = release {
+        archive::backup_release(bytes)?;
+        journal
+            .terminal(&record)?
+            .ok_or(RootRecoveryError::Context)?;
+    }
+    let check = record.check.clone();
+    let mut first = true;
+    loop {
+        let bundle = record
+            .root
+            .read::<Bundle>(&inventory.store(), ROOT_BYTES)
+            .await?;
+        archive::validate_bundle(&bundle, &record, inventory.target())?;
+        inventory
+            .input(record.root.operation, record.root.artifact)
+            .await?;
+        if first && release.is_none() {
+            if journal.primary.is_none() {
+                command(&record, &bundle.primary, record.kind, seed, inventory).await?;
+            }
+            // A frozen future refusal remains necessary while its command is
+            // unresolved, including before the primary's result is known.
+            if journal.refusal.is_none()
+                && (journal.primary.is_none() || journal.refused(&record)?)
+                && let Some(saved) = &bundle.refusal
+            {
+                command(&record, saved, Kind::Outcome, seed, inventory).await?;
+            }
+        }
+        if first && let Some(terminal) = journal.terminal(&record)? {
+            match terminal {
+                archive::Terminal::Push(value) => {
+                    super::super::root_completion::backup_graph(value.root, inventory).await?
+                }
+                archive::Terminal::Initialization(InitializationReply::Initialized(fact)) => {
+                    super::super::backup::fact(*fact, inventory).await?
+                }
+                _ => {} // Permanent selected merge/candidate/HEAD rows are scanned independently.
+            }
+        }
+        first = false;
+        let Some(previous) = record.previous else {
+            break;
+        };
+        let frame = previous
+            .read::<phase::Frame>(&inventory.store(), ROOT_BYTES)
+            .await?;
+        if !frame.certificate.0.authenticated(seed) {
+            return Err(RootRecoveryError::Context.into());
+        }
+        let next: Record = frame.certificate.0.data()?;
+        if next.check != check
+            || next.tenant != record.tenant
+            || next.application != record.application
+            || next.step.checked_add(1) != Some(record.step)
+        {
+            return Err(RootRecoveryError::Context.into());
+        }
+        if !inventory
+            .input(previous.operation, previous.artifact)
+            .await?
+        {
+            break;
+        }
+        record = next;
+    }
+    Ok(())
+}
+async fn command(
+    record: &Record,
+    saved: &SavedCommand,
+    kind: Kind,
+    seed: &[u8; 32],
+    inventory: &mut Inventory<'_>,
+) -> WalkResult<()> {
+    let limit = kind.body_limit();
+    if saved.body.size == 0 || saved.body.size > u64::from(limit) {
+        return Err(RootRecoveryError::Context.into());
+    }
+    let key = ArtifactKey {
+        operation: record.check.token.artifact_operation,
+        binding_digest: saved.body.digest,
+        kind: ArtifactKind::InputBody,
+    };
+    let mut reader = inventory.store().read(key, saved.body).await?;
+    let mut bytes = Vec::with_capacity(saved.body.size as usize);
+    while let Some(part) = reader.next().await? {
+        bytes.extend_from_slice(&part);
+    }
+    // The SDK snapshot's operation digest includes this exact input body.
+    // Registration already bound the complete frozen contract to its MAC.
+    inventory.artifact(key, saved.body).await?;
+    super::super::backup::command(kind, &bytes, seed, inventory).await
+}
diff --git a/crates/canopy-server/src/packs/publication/recovery/mod.rs b/crates/canopy-server/src/packs/publication/recovery/mod.rs
index 4a6b837e..92b95dad 100644
--- a/crates/canopy-server/src/packs/publication/recovery/mod.rs
+++ b/crates/canopy-server/src/packs/publication/recovery/mod.rs
@@ -972,3 +972,5 @@ impl From<NativeCandidateAuditError> for RootRecoveryError {
         Self::CandidateAudit(Box::new(error))
     }
 }
+
+pub(in crate::packs::publication) mod backup;
diff --git a/crates/canopy-server/src/packs/publication/root_completion/mod.rs b/crates/canopy-server/src/packs/publication/root_completion/mod.rs
index 363a8265..4448c3fd 100644
--- a/crates/canopy-server/src/packs/publication/root_completion/mod.rs
+++ b/crates/canopy-server/src/packs/publication/root_completion/mod.rs
@@ -150,3 +150,5 @@ impl RootPushCompletion {
         Ok(())
     }
 }
+
+pub(in crate::packs::publication) use retention::backup_graph;
diff --git a/crates/canopy-server/src/packs/publication/root_completion/retention.rs b/crates/canopy-server/src/packs/publication/root_completion/retention.rs
index 989d2709..d2136b3d 100644
--- a/crates/canopy-server/src/packs/publication/root_completion/retention.rs
+++ b/crates/canopy-server/src/packs/publication/root_completion/retention.rs
@@ -45,3 +45,15 @@ async fn verify(
     while reader.next().await?.is_some() {}
     super::super::recovery::archive::descriptor(hash, key.operation, key.kind, body)
 }
+
+pub(in crate::packs::publication) async fn backup_graph(
+    root: NativeOutcomeRoot,
+    inventory: &mut crate::packs::backup::Inventory<'_>,
+) -> crate::packs::directory::index::WalkResult<()> {
+    let record: OutcomeRecord = root.0.read(&inventory.store(), INPUT_ROOT_BYTES).await?;
+    inventory.input(root.operation(), root.artifact()).await?;
+    super::super::native_result::backup_graph(record.native, false, inventory).await?;
+    inventory
+        .body(record.body_operation, record.response.body)
+        .await
+}
diff --git a/crates/canopy-server/src/packs/publication/staging_service.rs b/crates/canopy-server/src/packs/publication/staging_service.rs
index a2d52753..041e09a5 100644
--- a/crates/canopy-server/src/packs/publication/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service.rs
@@ -336,6 +336,11 @@ struct Admission {
     jobs: HashMap<[u8; 16], Arc<Job>>,
     actors: HashMap<String, ActorAdmission>,
 }
+#[cfg(test)]
+type CheckpointProbeGate = (
+    tokio::sync::oneshot::Sender<()>,
+    tokio::sync::oneshot::Receiver<()>,
+);
 struct Inner {
     authority: PreparationAuthority,
     target: CellTarget,
@@ -351,6 +356,8 @@ struct Inner {
     drained: Notify,
     #[cfg(test)]
     fault: std::sync::atomic::AtomicU8,
+    #[cfg(test)]
+    checkpoint_probe_gate: Mutex<Option<CheckpointProbeGate>>,
 }
 struct Local {
     lease: Option<StagingLease>,
@@ -712,6 +719,8 @@ impl StagingCoordinator {
                 drained: Notify::new(),
                 #[cfg(test)]
                 fault: std::sync::atomic::AtomicU8::new(0),
+                #[cfg(test)]
+                checkpoint_probe_gate: Mutex::new(None),
             }),
         })
     }
@@ -962,6 +971,22 @@ impl StagingCoordinator {
         }
     }
     #[cfg(test)]
+    pub(crate) fn pause_checkpoint_probe_for_test(
+        &self,
+    ) -> (
+        tokio::sync::oneshot::Receiver<()>,
+        tokio::sync::oneshot::Sender<()>,
+    ) {
+        let (entered, receive) = tokio::sync::oneshot::channel();
+        let (release, wait) = tokio::sync::oneshot::channel();
+        *self
+            .inner
+            .checkpoint_probe_gate
+            .lock()
+            .expect("checkpoint gate") = Some((entered, wait));
+        (receive, release)
+    }
+    #[cfg(test)]
     pub(crate) fn fault_for_test(&self, fault: u8) {
         self.inner
             .fault
@@ -997,6 +1022,25 @@ pub struct StagedInputsTicket {
     registration: Arc<InputRegistration>,
 }
 impl StagedInputsTicket {
+    /// Order the next producer after the controller has installed its fresh
+    /// phase. `wait` independently retains the original committed receipt.
+    pub(crate) async fn wait_ready(&self) -> Result<Receipt, Arc<StagingError>> {
+        let receipt = self.wait().await?;
+        let mut state = self.job.status.subscribe();
+        loop {
+            match state.borrow_and_update().clone() {
+                StagingState::Active(_) | StagingState::Bound(_) => return Ok(receipt),
+                StagingState::Uncertain(error) | StagingState::Fenced(error) => return Err(error),
+                StagingState::Stopped | StagingState::Published(_) => {
+                    return Err(Arc::new(StagingError::Inactive));
+                }
+                _ => {}
+            }
+            if state.changed().await.is_err() {
+                return Err(Arc::new(StagingError::Worker));
+            }
+        }
+    }
     /// Observe the original durable registration receipt. An uncertain error
     /// retains the exact command in the coordinator; recover and wait again.
     /// A receipt is not a fresh authority or lease observation.
@@ -1833,6 +1877,8 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
                         .clone()
                         .expect("bound checkpoint slot");
                     registration.finish(Ok(value.receipt));
+                    #[cfg(test)]
+                    checkpoint_probe_for_test(&inner).await;
                     let matched = matches!(&value.output, StagingReply::Granted(lease)
                         if lease.token == session.lease.token && lease.format == session.lease.format);
                     let result = if matched {
@@ -1923,6 +1969,10 @@ async fn run(inner: Arc<Inner>, job: Arc<Job>, mut recover: bool) {
                             l.lease = Some(*lease);
                         }
                     }
+                    #[cfg(test)]
+                    if checkpoint {
+                        checkpoint_probe_for_test(&inner).await;
+                    }
                     match probe(&job, value.receipt).await {
                         Ok((lease, deadline)) => {
                             let differs = job
@@ -2343,3 +2393,16 @@ fn remove(inner: &Inner, job: &Job) {
     }
     inner.drained.notify_waiters();
 }
+
+#[cfg(test)]
+async fn checkpoint_probe_for_test(inner: &Inner) {
+    let gate = inner
+        .checkpoint_probe_gate
+        .lock()
+        .expect("checkpoint gate")
+        .take();
+    if let Some((entered, wait)) = gate {
+        let _ = entered.send(());
+        let _ = wait.await;
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/tests/staging_service.rs b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
index d3d65075..fc3cf777 100644
--- a/crates/canopy-server/src/packs/publication/tests/staging_service.rs
+++ b/crates/canopy-server/src/packs/publication/tests/staging_service.rs
@@ -923,3 +923,46 @@ async fn generated_candidate_intent_joins_uncertain_original_and_retries_only_af
     }
     Ok(())
 }
+
+#[tokio::test]
+async fn checkpoint_receipt_precedes_custody_probe_but_next_work_waits_for_active_phase() -> Result
+{
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let c = StagingCoordinator::new(f.target.clone(), StagingLimits::default(), f.authority())?;
+        let ticket = submit(&f, &c, [236; 16], "owner").await?;
+        active(&ticket).await?;
+        let store = Arc::new(canopy_object_storage::artifact::ArtifactStore::new(
+            Arc::new(InMemory::new()),
+            f.repository,
+        ));
+        let proof = super::inputs::seal(&f, &ticket, store, 0).await?;
+        let (entered, release) = c.pause_checkpoint_probe_for_test();
+        let registration = ticket
+            .register_inputs(proof, identity()?)
+            .map_err(|(e, _)| e)?;
+        timeout(Duration::from_secs(10), entered).await??;
+        assert!(matches!(ticket.state(), StagingState::RegisteringInputs));
+        let original = timeout(Duration::from_secs(10), registration.wait())
+            .await?
+            .map_err(|e| e.to_string())?;
+        // Dropping the release sender resumes a failed test's held controller.
+        assert!(
+            timeout(Duration::from_millis(20), registration.wait_ready())
+                .await
+                .is_err(),
+            "known checkpoint receipt leaked into the still-registering phase"
+        );
+        let _ = release.send(());
+        assert_eq!(
+            timeout(Duration::from_secs(10), registration.wait_ready())
+                .await?
+                .map_err(|e| e.to_string())?,
+            original
+        );
+        assert!(matches!(ticket.state(), StagingState::Active(_)));
+        assert!(c.close_and_drain().await.is_empty());
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/crates/canopy-server/src/packs/ref_state/mod.rs b/crates/canopy-server/src/packs/ref_state/mod.rs
index 51d88879..e06da63f 100644
--- a/crates/canopy-server/src/packs/ref_state/mod.rs
+++ b/crates/canopy-server/src/packs/ref_state/mod.rs
@@ -56,6 +56,13 @@ impl RefTransition {
     }
 }
 impl RefStateIndex {
+    pub(crate) async fn visit<V: super::directory::index::IndexVisitor<RefStateRecord> + ?Sized>(
+        &self,
+        root: RefStateRoot,
+        visitor: &mut V,
+    ) -> super::directory::index::WalkResult<()> {
+        self.tree.visit(root, visitor).await
+    }
     pub fn new(store: Arc<ArtifactStore>, format: ObjectFormat) -> Self {
         Self {
             tree: RefStateTree::new(store, format),
diff --git a/crates/canopy-server/tests/multi_server/backup.rs b/crates/canopy-server/tests/multi_server/backup.rs
index e9996774..c1767851 100644
--- a/crates/canopy-server/tests/multi_server/backup.rs
+++ b/crates/canopy-server/tests/multi_server/backup.rs
@@ -97,14 +97,103 @@ async fn backup_restores_git_lfs_and_collaboration_without_original_storage() ->
             .await
             .is_err()
     );
+    // Simulate an uploaded creating body whose attempt never registered a
+    // root. Provider listings must not turn this orphan into a backup root.
+    use canopy_object_storage::artifact::{ArtifactKey, ArtifactKind, ArtifactStore};
+    let orphan_store = ArtifactStore::new(
+        Arc::new(object_store::prefix::PrefixStore::new(
+            store.clone(),
+            source_prefix.clone(),
+        )),
+        *uuid::Uuid::parse_str(
+            repository["repository_id"]
+                .as_str()
+                .ok_or("repository UUID missing")?,
+        )?
+        .as_bytes(),
+    );
+    let mut orphan = b"unregistered creating input".as_slice();
+    let digest = *blake3::hash(orphan).as_bytes();
+    orphan_store
+        .put(
+            ArtifactKey {
+                operation: [99; 16],
+                binding_digest: digest,
+                kind: ArtifactKind::InputBody,
+            },
+            orphan.len() as u64,
+            digest,
+            &mut orphan,
+        )
+        .await?;
     let report = deployment
         .create_backup(id, backup.clone(), worker())
         .await?;
-    assert_eq!(report.external_objects, 3);
+    // Native backup counts all retained physical artifacts, including typed
+    // catalog/ref roots and closed command/audit headers, plus the LFS body.
+    assert_eq!(report.external_objects, 25);
     assert_eq!(report.cells, 2);
     deployment
         .create_backup(id, backup.clone(), worker())
         .await?;
+    // Retired input/command bodies and unselected native responses are not
+    // permanent audit edges. Remove all this fixture's unretained native bytes
+    // and prove the same pinned backup remains independently reproducible.
+    use futures_util::TryStreamExt;
+    let native_repository = format!(
+        "repos/{}",
+        hex::encode(
+            uuid::Uuid::parse_str(
+                repository["repository_id"]
+                    .as_str()
+                    .ok_or("missing repository id")?
+            )?
+            .as_bytes()
+        )
+    );
+    let retained_prefix = StorePath::from(format!("{backup}/{native_repository}"));
+    let retained = store
+        .list(Some(&retained_prefix))
+        .try_collect::<Vec<_>>()
+        .await?
+        .into_iter()
+        .map(|entry| {
+            entry
+                .location
+                .as_ref()
+                .strip_prefix(backup.as_ref())
+                .map(str::to_owned)
+                .ok_or("backup namespace differs")
+        })
+        .collect::<std::result::Result<std::collections::HashSet<_>, _>>()?;
+    let creating_prefix = StorePath::from(format!("{source_prefix}/{native_repository}"));
+    let creating = store
+        .list(Some(&creating_prefix))
+        .try_collect::<Vec<_>>()
+        .await?;
+    let mut retired = 0;
+    for entry in creating {
+        let relative = entry
+            .location
+            .as_ref()
+            .strip_prefix(source_prefix.as_ref())
+            .ok_or("source namespace differs")?;
+        if !retained.contains(relative) {
+            store.delete(&entry.location).await?;
+            retired += 1;
+        }
+    }
+    assert!(
+        retired > 0,
+        "fixture must contain unretained native input artifacts"
+    );
+    assert_eq!(
+        deployment
+            .create_backup(id, backup.clone(), worker())
+            .await?
+            .external_objects,
+        report.external_objects
+    );
     let mut forbidden = config(
         available_address().await?,
         files.path().join("backup-server"),
@@ -130,9 +219,10 @@ async fn backup_restores_git_lfs_and_collaboration_without_original_storage() ->
     }
     let emptied = store.list_with_delimiter(Some(&source_prefix)).await?;
     assert!(emptied.objects.is_empty() && emptied.common_prefixes.is_empty());
-    deployment
+    let verified = deployment
         .verify_backup(id, backup.clone(), worker())
         .await?;
+    assert_eq!(verified.external_objects, report.external_objects);
     let mut constrained = worker();
     constrained.local_disk_limit_bytes = 1;
     assert!(
@@ -235,6 +325,46 @@ async fn backup_restores_git_lfs_and_collaboration_without_original_storage() ->
             .as_str()
             .ok_or("missing repository id")?,
     )?;
+    // A complete backup must verify the native parts as well as LFS. Locate
+    // this fixture's one pack solely to inject provider corruption; production
+    // traversal derives its authority from the pinned typed graph.
+    let native_prefix = StorePath::from(format!(
+        "{backup}/repos/{}/git-packs",
+        hex::encode(repository_id.as_bytes())
+    ));
+    let parts = store
+        .list(Some(&native_prefix))
+        .try_collect::<Vec<_>>()
+        .await?;
+    let native_part = parts
+        .iter()
+        .find(|entry| {
+            entry
+                .location
+                .as_ref()
+                .ends_with("/pack.parts/0000000000000000")
+        })
+        .ok_or("backup native pack part absent")?
+        .location
+        .clone();
+    let original = store.get(&native_part).await?.bytes().await?;
+    store
+        .put(&native_part, vec![0; original.len()].into())
+        .await?;
+    assert!(
+        deployment
+            .verify_backup(id, backup.clone(), worker())
+            .await
+            .is_err()
+    );
+    store.put(&native_part, original.into()).await?;
+    assert_eq!(
+        deployment
+            .verify_backup(id, backup.clone(), worker())
+            .await?
+            .external_objects,
+        report.external_objects
+    );
     let lfs_path = StorePath::from(format!(
         "{backup}/repos/{}/lfs/{}.parts/0000000000000000",
         hex::encode(repository_id.as_bytes()),
diff --git a/docs/evidence/native-backup-readiness-20261006.json b/docs/evidence/native-backup-readiness-20261006.json
new file mode 100644
index 00000000..b752d0dc
--- /dev/null
+++ b/docs/evidence/native-backup-readiness-20261006.json
@@ -0,0 +1,2143 @@
+{
+  "source_parent": "aa86f944907b64816c366a55bdca2f465e25e00e",
+  "source_manifest_sha256": "4aa711e91ae7830335432a5a8c954014b5a5531964cb2c8a025bffb20173d215",
+  "sources": [
+    {
+      "path": "Cargo.lock",
+      "sha256": "ea876788c7c48d013f588730c28c719d3b88283921be3f42418f186421fb954d"
+    },
+    {
+      "path": "Cargo.toml",
+      "sha256": "577b251e8bb21314d338c7dccfb42429de3cfdb2191be3b854786bb394de507c"
+    },
+    {
+      "path": "crates/canopy-git-format/Cargo.toml",
+      "sha256": "60b0e162738fb11e55a1eb7e02b21add376b0f19c6e5119171c2b7d11359738d"
+    },
+    {
+      "path": "crates/canopy-git-format/src/lib.rs",
+      "sha256": "5b5a8674b1804564e1195ba6b79231b3024b00f202fb087c9012214dd67d5b73"
+    },
+    {
+      "path": "crates/canopy-git-format/src/pack_index/mod.rs",
+      "sha256": "c3d086276a6d64d0f79afd1feef2f0a65e172ae5865f11f1d9a6c63154aeea44"
+    },
+    {
+      "path": "crates/canopy-git-format/src/pack_index/tests.rs",
+      "sha256": "c5930d97ecb1923a0364b54fef733dcd3001c84af54a79090c94a49e34a2ed4f"
+    },
+    {
+      "path": "crates/canopy-object-storage/Cargo.toml",
+      "sha256": "f7b22c443cfc6beb1abe41542d22af6002442f4a43b9c651e34e95aed717c826"
+    },
+    {
+      "path": "crates/canopy-object-storage/src/artifact.rs",
+      "sha256": "767506bf5d48ccd1d454139538361d99e76952bafb8bb0c761f89e97958a0d4a"
+    },
+    {
+      "path": "crates/canopy-object-storage/src/artifact/tests.rs",
+      "sha256": "75b3ce3def1b32f29b0ede0e86a6f5ea6dcd0b164a57920874a08e9abb311829"
+    },
+    {
+      "path": "crates/canopy-object-storage/src/blob/mod.rs",
+      "sha256": "fa2a21fd07cb56bc314de7b134ab669c1caa0b8b59dedcf3049ca3cd882cc99a"
+    },
+    {
+      "path": "crates/canopy-object-storage/src/blob/read.rs",
+      "sha256": "e2994c3398fdf41fcf43acab00a0ccbf26606ce401183c5a9e9f691c1f5726b3"
+    },
+    {
+      "path": "crates/canopy-object-storage/src/blob/tests.rs",
+      "sha256": "d49b9ea9bd9e017adae3bebc773d5fe4b52ce83757dd7b13bd126af68a6dc0a7"
+    },
+    {
+      "path": "crates/canopy-object-storage/src/external.rs",
+      "sha256": "28b5178ef81d72489db7201d81ba3c21e42a25c030262dae733f86664a75339c"
+    },
+    {
+      "path": "crates/canopy-object-storage/src/lib.rs",
+      "sha256": "377b85fd4124e42d177f290b8ac7c8149f9223c2bec0b07c7dd5fbca936571db"
+    },
+    {
+      "path": "crates/canopy-server/Cargo.toml",
+      "sha256": "cbfe82768a262d1e49c5442534dfa0811cf31cba886992068e480ce92a14ad0f"
+    },
+    {
+      "path": "crates/canopy-server/examples/benchmark.rs",
+      "sha256": "2a1ae5437fec4a402e74fea55643c265a85bfc153ea7f03df76a5b8863a62c9b"
+    },
+    {
+      "path": "crates/canopy-server/examples/support/mod.rs",
+      "sha256": "e2d78a6c801bd113bcdd0214a91712455b58e620f85f3f2a3ba32fe7368eb24a"
+    },
+    {
+      "path": "crates/canopy-server/src/access.rs",
+      "sha256": "cd9378763fea7f81c87b201a506dd3d9f9c235a061158e6cbeae434390ec9570"
+    },
+    {
+      "path": "crates/canopy-server/src/admission.rs",
+      "sha256": "5d0ef8cde0c4d31b3da9b301d37529b8c38d24cb4bf4a156510fe8ba9ea132c0"
+    },
+    {
+      "path": "crates/canopy-server/src/ancestry.rs",
+      "sha256": "61342aa4d982de2fbfae1591fe994be77482bcdce2aa75c511d879457b5861ef"
+    },
+    {
+      "path": "crates/canopy-server/src/branch_rules/command.rs",
+      "sha256": "abd39aae1d4400b678c23b4a0cfb21691affef3f6803a6d721e90d53541464ec"
+    },
+    {
+      "path": "crates/canopy-server/src/branch_rules/mod.rs",
+      "sha256": "26f588ccffde24b83cf42c0e34f3ea2f2d1ba87af64c4631ea1126d9975f320f"
+    },
+    {
+      "path": "crates/canopy-server/src/checks/mod.rs",
+      "sha256": "f7550d692056fb0046a296778e22e7f9152acfef646bfd359cd654d423d0e0ba"
+    },
+    {
+      "path": "crates/canopy-server/src/checks/mutations.rs",
+      "sha256": "c4522f0ada18a414b3da8de99ae8813c58a28350a4659765d674c57394fa0e9a"
+    },
+    {
+      "path": "crates/canopy-server/src/checks/native.rs",
+      "sha256": "7f4c12d84f322dc4dc38478eee2f3d34e29e6ee0537b2e832c41253efc18c591"
+    },
+    {
+      "path": "crates/canopy-server/src/checks/native/codec.rs",
+      "sha256": "1df0d06bfe77a3d62d713f666e9ceb27b0981810567d97ddb80e6f0530d535de"
+    },
+    {
+      "path": "crates/canopy-server/src/default_branch.rs",
+      "sha256": "32d424a454f791a9b42c48e72a252ebaf9f3eea332d25265c366cb4ee7070c14"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/backup/bodies.rs",
+      "sha256": "2e53f959411301c36a774f1e3fb652a576f2264318c0f5f0380df02120a8fd58"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/backup/enrollment.rs",
+      "sha256": "a3cf53c74a8c101d61c443154aeec8eb3610aabb860c43ffd46144eca17302e7"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/backup/mod.rs",
+      "sha256": "7172ee744beb899f898cefad0d8aea75a8f30dbd6bab61010206b1a3caefd9a0"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/backup/native.rs",
+      "sha256": "4ba572997a014d3837058b16a7b1e73beca90bb81e307c74e2221292597b1668"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/mod.rs",
+      "sha256": "253de4f08871587fb456a54c51da7305f186cbc16dd6b06ddf7e26e59349199c"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/recovery.rs",
+      "sha256": "6e9922b30c01ef6dff61358aab565921285feca1fa67388dc07a8d0029b8e07c"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/root.rs",
+      "sha256": "109308ed8013362532179505dfb7cb7e2941a7e8deb7fd2879a66aede58d8b22"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/tests.rs",
+      "sha256": "d5379b84c34bfe460ece1a5a18c8ca338882ebb3a1397c0697d9ded46c8270cf"
+    },
+    {
+      "path": "crates/canopy-server/src/deployment/tests/retained_maintenance.rs",
+      "sha256": "7d349038bccc8918775750ba8e098049f5aa0132d1bca5e47705457871400c79"
+    },
+    {
+      "path": "crates/canopy-server/src/directory/accounts.rs",
+      "sha256": "baa4b36abede25ef4c68b67fe953c90eee6057879a9445429169e9b56607cc7d"
+    },
+    {
+      "path": "crates/canopy-server/src/directory/audit.rs",
+      "sha256": "a34dd0649778a8bd1f56b5320c9c41d73efc5f45813c0f24723cb79d691532dc"
+    },
+    {
+      "path": "crates/canopy-server/src/directory/lfs_auth.rs",
+      "sha256": "b26f7845cfff1a8265331ece9bbfbdba8c26d17fbbfc2198cb7b444d18855b41"
+    },
+    {
+      "path": "crates/canopy-server/src/directory/mod.rs",
+      "sha256": "050579edfc80a6558089ae2cfb52a061a54b798e3c93c006a96dbef4cc8be6d3"
+    },
+    {
+      "path": "crates/canopy-server/src/directory/ssh_keys.rs",
+      "sha256": "28ce2c0f6d6111d88968684ee8049792341d5064fb4e15a0d25224bea6fec246"
+    },
+    {
+      "path": "crates/canopy-server/src/directory/timed_sql.rs",
+      "sha256": "6bef4ea0c8c22e6f26ebd2369a071108489959382388399dc9879822f0c2a0f6"
+    },
+    {
+      "path": "crates/canopy-server/src/directory/tokens.rs",
+      "sha256": "5c4521a715cc1be01e2cab811f78a26ba55eb12a62bc288f8c1a6a20da801415"
+    },
+    {
+      "path": "crates/canopy-server/src/git_cache/artifacts.rs",
+      "sha256": "0f6c5de936ed8ad3b15e3a86030b845d7e90e0d9baebdf66cb0250ce308bc091"
+    },
+    {
+      "path": "crates/canopy-server/src/git_cache/cleanup.rs",
+      "sha256": "8b693536daa4585d8f93b49f97ed1d0edb9ff4a3433ff665af18999332ce9260"
+    },
+    {
+      "path": "crates/canopy-server/src/git_cache/maintenance.rs",
+      "sha256": "b2d9a6fac5c27a201ed1c3845505ed19be70ba0c86b59ee7c6d291aec0def2f8"
+    },
+    {
+      "path": "crates/canopy-server/src/git_cache/mod.rs",
+      "sha256": "e8a75eebd96174a248de4919f0f5c59ac12d2c613f50d6ed697aa617a3521297"
+    },
+    {
+      "path": "crates/canopy-server/src/git_cache/serving_refs.rs",
+      "sha256": "3089ce8b3b3e45ee4bc6db54affd2755f3b66b7ab3f082d9d13a2c1fa4db5b57"
+    },
+    {
+      "path": "crates/canopy-server/src/git_cache/tests.rs",
+      "sha256": "f3120de4cacea738497895c38921693f1c5190714e32e7b7208d494e21e3ca12"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/branch_policy.rs",
+      "sha256": "59054d18711f292bd1175d4007ba0fbf36f55d5b08945b2304e0970973fb0b00"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/candidates/mod.rs",
+      "sha256": "17ec718c07bade59eabfe1b1a36edb891e7b17b1ad0f516bcdf1f2c6c7f0e2b2"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/candidates/produce.rs",
+      "sha256": "d9832a5717df96c58d9f9559dccecd8ce9ed23abeb0c7e428c974d4dbc5fbeb9"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/candidates/rebase.rs",
+      "sha256": "84f83e62c70f3608a8f53c59e2bc62964be4021439d9ae70538276ea8f46d550"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/discovery.rs",
+      "sha256": "8666944df14e09482837d959297049fd28474ce692a24c837f3f9eb2ea4511f5"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/fetch.rs",
+      "sha256": "2513866510850a4ac95cb123429664f0332bdd81c86528a136679b2a4dee04e8"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/head.rs",
+      "sha256": "f5b95ee17bacf9bbaf62b33ec02543b894afb7ddda2348d8541b3fa5bf03daf2"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/merge.rs",
+      "sha256": "bee44b53b02eadfae5a6beb5bbdaae63677534344697b14bea65f1d58cbccf32"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/mod.rs",
+      "sha256": "2126cdd9216e56a16420ff6d20de7d8c66d4b55a8f33bb7dd8e96225895c3a3e"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/preflight.rs",
+      "sha256": "336c40e3ac3e9aefa37a1dd238dd5810b810726898730e7075b5d6da05ecc322"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/preflight/retention.rs",
+      "sha256": "c66d79c5fae991827ee8314ef78a4e0f208cc8be64672ddca268dea66bebef53"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/preflight/tests.rs",
+      "sha256": "07edb88ab4c7e2dc149306f8281211ec9e5bc658402683849ee8585780385699"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/push.rs",
+      "sha256": "f89a94a262eecd72b8f97b3b81611f57225638212ee8228860148c00edaa135c"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/push/native.rs",
+      "sha256": "7a82d4ec5480241dc98aacf0eece4bb7dcbb8a09dcc63e76f7c19105dd215b13"
+    },
+    {
+      "path": "crates/canopy-server/src/git_gateway/ssh.rs",
+      "sha256": "171679a84f1efcbc7bda16343c096175e4b281312fb9267f6b601de608786f4c"
+    },
+    {
+      "path": "crates/canopy-server/src/git_http/capture.rs",
+      "sha256": "f6cc7e63f61d02b9416f376d1a90080cbeac97cf5c2dec1673f88fe6b3cd1b1d"
+    },
+    {
+      "path": "crates/canopy-server/src/git_http/mod.rs",
+      "sha256": "7a925f1621606e8e94c7a0384f2d8dffacabfa5f357d7343dc860aef9eef3129"
+    },
+    {
+      "path": "crates/canopy-server/src/git_http/stream_tests.rs",
+      "sha256": "8f9ee6a67b996840b9f4f4f6ca9300645033698c8860f6ae3fc8c0f3836ebe63"
+    },
+    {
+      "path": "crates/canopy-server/src/git_input/mod.rs",
+      "sha256": "7923a390a20f22630d71c53ff5ec785e97e380cc4d86c10e532b866bf98b18c0"
+    },
+    {
+      "path": "crates/canopy-server/src/git_input/tests.rs",
+      "sha256": "39edbe9765186bca88162a6dfa6f0520964a896d6265f956449dcd14e1f5daf4"
+    },
+    {
+      "path": "crates/canopy-server/src/git_objects/mod.rs",
+      "sha256": "2f6def3f82b1797aec9792381f043557a35f623e20e685eddd77ce5878c2cc64"
+    },
+    {
+      "path": "crates/canopy-server/src/git_objects/tests.rs",
+      "sha256": "1ef594ea8c8751138a2946558d802c849e0783ea44da0a1cd57350c0d37fd2b2"
+    },
+    {
+      "path": "crates/canopy-server/src/git_read/browse.rs",
+      "sha256": "eb95b3f65b86511062e42e0731ae98a0bc949ba696ef2e0339219f8fa75d485d"
+    },
+    {
+      "path": "crates/canopy-server/src/git_read/graph.rs",
+      "sha256": "472bd76c8d61f85e425b05deed2bf14f0506342311948fabeaf50404e7efde70"
+    },
+    {
+      "path": "crates/canopy-server/src/git_read/mod.rs",
+      "sha256": "7f10eda407af801aa82c1c0fdf2941ba3aa5c586b40eae0bd879020fdb947832"
+    },
+    {
+      "path": "crates/canopy-server/src/git_read/patch/mod.rs",
+      "sha256": "9eebb7e66e678680fbdc80dfe5edd60318b4fbd766f57e127a14f429fbb134bb"
+    },
+    {
+      "path": "crates/canopy-server/src/git_read/patch/tests.rs",
+      "sha256": "228be85ffd003755a3a061c452f3ecfc20392cf72155a084f723d5db2caa5e6b"
+    },
+    {
+      "path": "crates/canopy-server/src/git_read/trees.rs",
+      "sha256": "38b78d05e44fa792831e548e75fa81651bc7f56d9d5bed17c3fda4c0ca0b276e"
+    },
+    {
+      "path": "crates/canopy-server/src/graph/mod.rs",
+      "sha256": "cb6cb2ea01a8262d0df04b7a33620b1f053918b376375d860760e81c7be66862"
+    },
+    {
+      "path": "crates/canopy-server/src/graph/preparation.rs",
+      "sha256": "56a3c91d6857942ce927895c3c74dd7715ae674d998c0c86bfc1db6e0c487d81"
+    },
+    {
+      "path": "crates/canopy-server/src/graph/stream.rs",
+      "sha256": "1d6dd023572d606134a084f16b929c509e611c2fb4901830f91e9d0f40a3e8f7"
+    },
+    {
+      "path": "crates/canopy-server/src/graph/stream/tests.rs",
+      "sha256": "5c847aab9a0e3b79038f8cf7958ab7ed40e97c0a227382f7b4d5d157051b4a37"
+    },
+    {
+      "path": "crates/canopy-server/src/graph/tests.rs",
+      "sha256": "685ef8995614d7f4e67e08670907ea4ff1a94860ab9869ee7aece141f0fb569c"
+    },
+    {
+      "path": "crates/canopy-server/src/http/lfs_locks.rs",
+      "sha256": "73f82df87b221795e6531ea968ab8630ce5e5fe769d69ea0d3c7a2f8c5c80d82"
+    },
+    {
+      "path": "crates/canopy-server/src/http/mod.rs",
+      "sha256": "b200ac8fe6a62d22946e95491e72f2f731ed766238b2d355b8fc841f5353416c"
+    },
+    {
+      "path": "crates/canopy-server/src/issues/mod.rs",
+      "sha256": "0bb4c4e5cae85be3714e485fb4bbd93052e1902fbc4c140d972c059ba36004ac"
+    },
+    {
+      "path": "crates/canopy-server/src/issues/mutations.rs",
+      "sha256": "725f0936b2f8622c6cefe9c52ea6349b61631ead7d49fbd453ee558085609014"
+    },
+    {
+      "path": "crates/canopy-server/src/lfs/locks.rs",
+      "sha256": "710844a9f4edeec5a83bc22e4200827b9288d29ff0263ef5c904822e00e7b1e8"
+    },
+    {
+      "path": "crates/canopy-server/src/lfs/mod.rs",
+      "sha256": "8ca41399d63aba98020b317bcd96ed965cf70d5328d953f1280d7abde3de6be2"
+    },
+    {
+      "path": "crates/canopy-server/src/lfs/read.rs",
+      "sha256": "6286b9e235ff6435db778854f131602823261404bfc9fc7642e9a7f471251d36"
+    },
+    {
+      "path": "crates/canopy-server/src/lfs/tests.rs",
+      "sha256": "4aa4b2dd43cb742df80b83407cf1cbfa4c8637c671bf2b1b7271ea5297a910f1"
+    },
+    {
+      "path": "crates/canopy-server/src/lfs/upload.rs",
+      "sha256": "5018ea81930c481ceaa2bf8829af1709d56821086ff2aba1e172c368990074a3"
+    },
+    {
+      "path": "crates/canopy-server/src/lib.rs",
+      "sha256": "bf650db6f31b945b43e1aa70159b83d3c17173622ac340161944525e02ac4890"
+    },
+    {
+      "path": "crates/canopy-server/src/main.rs",
+      "sha256": "1e6954a8d42e8c45dc26d216684773c72758fd962191d38140cda3814be6a10f"
+    },
+    {
+      "path": "crates/canopy-server/src/native_git.rs",
+      "sha256": "3c2cc2520e1da5bc14191835624ea1b794cf385b3c2154065da29bbb09802c29"
+    },
+    {
+      "path": "crates/canopy-server/src/native_git/process.rs",
+      "sha256": "58abb05aa26e31f679a5a17378f4847b8ad08f1c77e0d8e554d4bcc00c925734"
+    },
+    {
+      "path": "crates/canopy-server/src/native_git/process/fence.rs",
+      "sha256": "b62b004c41a5c2610ea50d77bb7dccb420d0ac92f9b085bdec866de5d22d5da9"
+    },
+    {
+      "path": "crates/canopy-server/src/native_git/process/tests.rs",
+      "sha256": "98df7fb19f03448b37d24cb705ba6ee351aafc303b418cb99b1aecb375ba4e55"
+    },
+    {
+      "path": "crates/canopy-server/src/native_resources.rs",
+      "sha256": "488d2c527d61a73dd2698e3a4b5be7a7e922ad7c449ea2a22b58d67a59121113"
+    },
+    {
+      "path": "crates/canopy-server/src/native_resources/tests.rs",
+      "sha256": "075e86dadc5f517a9f22aa1c26eb5445b1f74beed031eba5f8b279e4874778d7"
+    },
+    {
+      "path": "crates/canopy-server/src/object_batch/mod.rs",
+      "sha256": "13d00cae66d61c3eeee9b287973ad16d5b52341a8c7d422f48bc45131ac8c557"
+    },
+    {
+      "path": "crates/canopy-server/src/object_batch/tests.rs",
+      "sha256": "f37acb996c1ce8dd1cdcb90049244de714585fa5f2781e602fcd49b94d4b94f5"
+    },
+    {
+      "path": "crates/canopy-server/src/object_chunks/mod.rs",
+      "sha256": "71961b2bf93518169f12eadfe5d927a9ba193a36406400d03a8fb0c89c5c8abb"
+    },
+    {
+      "path": "crates/canopy-server/src/object_chunks/tests.rs",
+      "sha256": "8fd4431cac7079485e0e0d514a1074e925f5b58c8f985cb6f8d6b940698a89dc"
+    },
+    {
+      "path": "crates/canopy-server/src/object_reads/mod.rs",
+      "sha256": "6559a5077717e876892ff33ed5551c9b5a9397fe488beb65a73daaa18b1cfa38"
+    },
+    {
+      "path": "crates/canopy-server/src/pack_store.rs",
+      "sha256": "3e1ff0991afbc57e0ebb6b0da2fc8d17e8d116f3a595822c37d511525738773d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/backup.rs",
+      "sha256": "061bc8a3fd847de54b5d186e551c82d803889b303c52d4cb58c86c595572f25d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/codec.rs",
+      "sha256": "fb7d384cef71f7be93bc586a0e79badd915dcc89b2f9853a9c034ca40587b62f"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/files.rs",
+      "sha256": "faf185a7aed6bc85deaf17abe5152bb06850f05f9b28843e5a3f9dc2be09b14e"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/graph_spool.rs",
+      "sha256": "f1cf72be8a36d6adc94e11a1c3a5d57be1fa9c3ed813bb531055ba1cc2c69d97"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/graph_spool/tests.rs",
+      "sha256": "7bcc7eb29daef7a9385fb15d674f612a16e43bc1a444bd061da93ebbb5141053"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/mod.rs",
+      "sha256": "2d762f30991a826aedd2e4796800258520e953d1fc2f8cd0e07a8a63ff851477"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/native.rs",
+      "sha256": "a6f50f40a9599b04214187b50ddac9a6df0cd9dbeb3c0eb1667c0becf64895af"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/native/tests.rs",
+      "sha256": "159ae4101c65b0d3a6a2eb040af9b71c12329af6e0ea9f0c460c6140d0b34816"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/reader.rs",
+      "sha256": "8f1774ef6840f73e37da188899dabdce6ae31b656475f5e8ee6b8dc87464f73b"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/serving_fixture.rs",
+      "sha256": "9f32d456083fea3895a8f96ff62c3df670635c636988b484b9e74267c07ea448"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/tests.rs",
+      "sha256": "322652548da8be5a472214b9d571300913e031851d3db244d1d99107f4082750"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/catalog/tests/files.rs",
+      "sha256": "d88fe635fec473c6788c5a01a4059472881a4444507ac7a16a69333e2db4eeb0"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/copy.rs",
+      "sha256": "83e2cdfca589d2f9ebaa32d9120ef8d8f893cbd01ad3c6458fa035e5a44ac9fb"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/graph.rs",
+      "sha256": "a0e270769bd0b3f7d2c33c933197928ecb84368e5531b2861b08f0de66c0300d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/mod.rs",
+      "sha256": "622eb0dd3358ffdaa097b45f10c03dd252306453e65284da696446c641af4391"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/retained.rs",
+      "sha256": "07b8da1838af56db5b418e28cc2516ca60c54c95e5ad58411f37515181940bcd"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/spool.rs",
+      "sha256": "32a102501cc02a20d1be6ce4a8f26182f809a5204b8890e6964dc3ba692c3e69"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/tests.rs",
+      "sha256": "61087054d068316cc398173a7fcd3fba8e2c9220cc501575cafc56a0cd73140e"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/tests/graph.rs",
+      "sha256": "c6df580a117db5731cb7d9b74556f3770e8e100781bc1d8f394bab60db4168c9"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/tests/resources.rs",
+      "sha256": "c285d66f9ef8be7dd80411c6dad239c1f88e8c0ff31c3da6f8153d134b5ce795"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/verifier.rs",
+      "sha256": "021788bf15327410a67b1f4ea29af6ff99d015171fd53c3707fad37131b5e3b8"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/closure/witness.rs",
+      "sha256": "e62f1c0a02d7c11008290b814bb416971bfddab49ca52e464050a7c8a6463572"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/coverage.rs",
+      "sha256": "d9912fdb2d6d47714e1e428c718cc841ef54d369a9f502731078eca93bb3e546"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/bulk.rs",
+      "sha256": "5ca4f597f8ed66ea335ed9b05376736e21d683c4e023f6ff37ecd281cec60346"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/changes.rs",
+      "sha256": "d707f098a9361b63d384b80dbf9341f14abadfacf3018f4fdb025d1d402c8929"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/codec.rs",
+      "sha256": "1449ebf119023aa6760dd9a2608f7090f35dd0f16c6d2d0e5bc00e04c2ad4e3a"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/cursor.rs",
+      "sha256": "b0f46cda70163ed19313f0d6d8dcc7bf6fed1706b81c8986aa25ac1bd324e20d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/mod.rs",
+      "sha256": "aaaa8c49b35818f058a3cd88aabb57e429841a3d4160497f7c57b62bc53d3488"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/record.rs",
+      "sha256": "a50df6a8b76bc30d935bd8d7bc380a54840efdcc7d0ee05848e8b19f3f61b482"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/rewrite.rs",
+      "sha256": "0abed8b2621d92bba8431514ad77c009cca210d08da5964aa16952ea1f19b7bf"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/tests.rs",
+      "sha256": "14e82703358df5b69c0e7d1b857d6d853e37787d56fb7f6c2a39619872352abd"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/update.rs",
+      "sha256": "a3a0d8d2bbc87d49f314d29fedbd14afbb66fd322f94b61f54b8aef5b5916e77"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/index/visit.rs",
+      "sha256": "249cddbef4a4f541e19c7af35f828e119b66d003e70c757c15273caa6087df33"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/mod.rs",
+      "sha256": "cbb8bea03ca7578da4b1902b5aa57ddc2b1a0d0c12c18352a86743bb82082108"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/partition.rs",
+      "sha256": "b66fde6b96e4aff4a215b5a8be66311987dfc918323cbd65e426cf402956b178"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/snapshot.rs",
+      "sha256": "31effd077751267730844b55a2a0c09f104212523975392f332094efd566b896"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/snapshot/codec.rs",
+      "sha256": "c4bf30e83f912f4c69f44113495869b0abc08b00ce63c301c547de5b42ea3500"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/tests.rs",
+      "sha256": "109dcada74b316a14727f40a738ff280d378050765082da65ab0ec21513e1e69"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/tests/compaction_inventory.rs",
+      "sha256": "61f21c445cbe3aa66a78c74f808515aadce97943d1841d706f803f0b629a392a"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/tests/coverage.rs",
+      "sha256": "821ff1b16bd0434cd49bd8c0f75e319ae690df72e13e1ae79f7d6ae64c6b8f06"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/tests/partition.rs",
+      "sha256": "b439cac8a8d0cda00920eff596a8be29883d406d3510c10121a864edc7ae783b"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/tests/partition_lifetime.rs",
+      "sha256": "ac6a9ab5635ee16bc9b8bb0309861f41c65e4ec178c824874cbff981d8866d0e"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/directory/writer.rs",
+      "sha256": "ef0260442eb0d9cd397a8f7735077d99e03940489815b1ad143004bb183f2ab8"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/input_artifact.rs",
+      "sha256": "028c8cee3f92a897836c62a8fa362465e924bdec52c2ae5cb48aa2db6103b5ea"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/metadata/growth.rs",
+      "sha256": "adf24b9a2833ac5ba8fd7ba75a484b3b3687f1a6005f0f8788e0ffb4115868af"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/metadata/mod.rs",
+      "sha256": "fd5f7d946155a2fb6ca2d2175b2bc58ef11ffaf621bb155a06bf459667a660e1"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/metadata/tests.rs",
+      "sha256": "234b77dc39eecc3bc6b7715b73e1b7ab8456a60e04753bfd71e559176ae41d05"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/metadata/transport.rs",
+      "sha256": "594b33d6ec656cb3701461fa6ac0e7b37f2497048ea48383d109386bdd34d062"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/metadata/writer.rs",
+      "sha256": "34b1bc202818d310694d103ecfd437824f9e6f97e90e84b06e9f870e8dde793b"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/mod.rs",
+      "sha256": "62796e522c496ae2c962822872aa0183370e7c29abf2eb091955c8054e66b6e9"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/admission_receipt.rs",
+      "sha256": "853a2f275b382cbfe4a8c14fd6e1d1fadbd98e86e829442e3e6522a64c45f00b"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/attestation.rs",
+      "sha256": "2f542b7076a6aaabdedd1da3a93e60eff64040b83061f92cddddb98313d47c71"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/backup.rs",
+      "sha256": "43591258f92d0abaecb201c4b8968d5752d6df30f7350195b9e59bee916d9ced"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/base.rs",
+      "sha256": "d363f6ce5ea211ab26aca6b98ec869f61e2f875b5110c247085496520a0d64fb"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/candidate_publication/audit.rs",
+      "sha256": "1de82267ac55f9c21b8f7bbe7ae01725f2f120ebe8d0d3cc3c0592b8f40953bb"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/candidate_publication/mod.rs",
+      "sha256": "6db2a153228bad4a772c7ce125923eff33cc2bc496d9f45b8c640bc3f118add4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/candidate_publication/publish.rs",
+      "sha256": "121c6bab8bd4f4eec01939af0ae3786ddf4f1abdd771e22664ac1e17faae2ade"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/certificate.rs",
+      "sha256": "4fddfc005a6c0434054a69619d9605a79ae59813698e3482af76ccb57968382e"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/codec.rs",
+      "sha256": "edb6f140e9a18047ee7c6f7e11849a7cad2620dcaa479b53ab04bf0b30fa8453"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/commands.rs",
+      "sha256": "5873ec8a53dfa0952636f3c7516769e678e69742b794db5a93b804f933b98bc0"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/commit_membership.rs",
+      "sha256": "0e45acfcd01d071fb23b88daa5e332a798130a6eaf6f3562f9df75018d2056c4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/compaction.rs",
+      "sha256": "002cbf8d7982cf781e9d9774c19d7813405f7eeb7690ecfdcd5c968b119f6e99"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/compaction/prepare.rs",
+      "sha256": "e5d28aa35dfad62ea54601e97e6f0b893efc710aa93f129a2de7855405b092cb"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/compaction/publish.rs",
+      "sha256": "03d588e5706462c05fdbda81fee79d257cfbd7a67708d9cc738ec599f42962d3"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/compaction/range.rs",
+      "sha256": "7897baf94150939daa0edbe5c1ebb711e6d1c236c80560071c238fe1e3bea8da"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/compaction/schedule.rs",
+      "sha256": "897a16e193135c4984802b3b63d67cbab4b3d6a24ac6fe1debbbaa9cf68e4669"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/compaction/schedule/tests.rs",
+      "sha256": "14d839203d6b1e4cedb968b4e3b7ea3323338e9020d000653b74602dd995a197"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/completion.rs",
+      "sha256": "cfd215d215b695ba07f63b9fa3050442dc1761e7e18804f2586734aea8016ff3"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator.rs",
+      "sha256": "fcac106eec0eb655a8e6188d154f5e98b342477dfe10e3eed2437fea436b2551"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/budget.rs",
+      "sha256": "182a7035e72c12d80b157f05a7390bd6534c28f5230a5112daf7dc6a130ffff5"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/budget/tests.rs",
+      "sha256": "7994b1ff59478dc13215c1dc92316c8d1a07e840d595e063bd8ff876ddad4a33"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/initialization.rs",
+      "sha256": "e08beb2e36f94203e648c47e3cb3bdf847a669e700d1681dd2c0d83cf66c6e36"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/inputs.rs",
+      "sha256": "871d23d2a227dd6e84971c6115a2e24fc80e1a43a332b8aba6b673cf953c5d85"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/native_candidate.rs",
+      "sha256": "f46a442a2dfc4107dc872f86e040e9e56ec8caeea3a5d84431ab79d45ddfdd76"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/native_head.rs",
+      "sha256": "086b82da54699264e763ea21c13368fbb3cecbc33452e2a10c5a196cd2d04e51"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/native_merge.rs",
+      "sha256": "4c0eedf1275f193499006041bcf7c8f91d3a8c05398b32ce9686a4251ecd6948"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/policy.rs",
+      "sha256": "0aa684ed7a784f4cf6c0e69eeb19be318eed66d1ced803595553aaef267c8cf3"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/preparation.rs",
+      "sha256": "20e6e33970eb1c069a25cf5121ec5efe29ede36cae2b39090d14d82f2687257a"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/recovery.rs",
+      "sha256": "21a2445d9749ab4f9c6cf157dc8b4221ae5e20208cadd2b09b1999e1a5716427"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/roots.rs",
+      "sha256": "df2cd3bc3627c9ee718f2dd54072c911a62358d97fb6e6eb210fed186d30ec56"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/serving_drain.rs",
+      "sha256": "1c9c5d800932fd6dac1c0ec03d05a919c406f1cc8236cc1a301846e562f4a544"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/coordinator/work.rs",
+      "sha256": "a1beaa1d190b157e2b6e9c916953494eec706aeb5550d3f2455f97c54efbbb36"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/custody/codec.rs",
+      "sha256": "9fa386277a41473d32100d6156e2a21fba071180ca838d8da055400d59a0c79e"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/custody/commands.rs",
+      "sha256": "f3900da141bd1b7ff93beb97f8e596dc2105ac6870d4bfaf7631e2cf012efd03"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/custody/dispatch.rs",
+      "sha256": "02952eab2f46096f8306ff0924255d6aee5f4aaa48bb235f5f198937baba5b66"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/custody/mod.rs",
+      "sha256": "a7eb484936670b58e99371a55c2ef931ed889e23ed2efc8ee58249bd664c73f2"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/custody/scan.rs",
+      "sha256": "c5e39c9ae07a31523a66c905e94135d8afbdc4513b1c480d86a1ab28e7f64f04"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/custody/stop.rs",
+      "sha256": "0725424880cfeb285489f0958a85f2b41b07417a1ed4baa0a5fb80906040e8e4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/exact.rs",
+      "sha256": "e486a4b7878323492bf4a5bf017a4f0d6398fab75859354525bb6376062d6b68"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/initialization.rs",
+      "sha256": "2612099bb024ab078f7c65e939334578ca59208df3ef189b791e766f7bb4e595"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/initialization/publish.rs",
+      "sha256": "072663cbbbac08b4b537a463da2901b7f1473fadea90d462491b5b78cd36025c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/inputs.rs",
+      "sha256": "d170786ad21555f5e2692825b23b543f38f1e33dfa26f37c6af3c196db50ab14"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/inputs/custody.rs",
+      "sha256": "a7330cbe522f13dc4687d9a400e131742993033611992b5adf1b0e81f11d8d81"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/inputs/limits_tests.rs",
+      "sha256": "1e1ddc8c5a514e7184054b77a47ebdbbcf7ccaa3d5616637f198cff7eb5b0064"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/mod.rs",
+      "sha256": "d96142365f9b3aa276af5637b8407d540f4d557217027d0667c30b829dadef37"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_candidate.rs",
+      "sha256": "3c5a52ed9cbb4d83fb24453ce1d36a3b64cefb0ef4f3d0ae8d1b08ca708ef07d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_head.rs",
+      "sha256": "ac1a8e33d737964854b9f57d22ec5495aaa42ed33733851e1438d264e1082308"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_head/publish.rs",
+      "sha256": "a624b7bc3969b9b88f31f6515e8d7fe9cb4a7d3d8261c2112d5d870cd062f9d8"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_merge.rs",
+      "sha256": "41753bbd0f9d61f959c9dd0c338ec88143a110965ed1321792be5518bd1a9c97"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_merge/audit.rs",
+      "sha256": "817568743fb85fa2cc6b1dfc9b3b96f3f44c824cbc1385c942324e0bb35ffae1"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_result.rs",
+      "sha256": "e922b3dcdbf7d23fbbf9f73e359b1bc207df7e7fe1fc040ffbeaa1407b4e613c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_result/codec.rs",
+      "sha256": "1feafe06d85ed11bb9fe5b9a82c3baf436bd6d8d9a868c766fd50456104615fd"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_result/plan.rs",
+      "sha256": "2ae3202244a62d9db96a6c0a0b0e5fbcaa8cc641f3139b675eb29ca4b983bad6"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/native_result/plan/tests.rs",
+      "sha256": "0f715c006257db00402a24e59310f360d0fac5aaae0b30a0c16a080e23e50e91"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/outcome.rs",
+      "sha256": "b043a053a93d7f7c74c3c6469c66b4770cf79bcd33b2df5ef6b1edd039d28327"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/owner.rs",
+      "sha256": "78a98de316e19bcaffe10439b7cd9edf187af2c55e00bef12db9a4cf5ed9a878"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/preparation_receipt.rs",
+      "sha256": "a7df0fb19ef0107dc4da8f0719975ee53d04eaf8c1fff1d3a93230960843067e"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/prepare.rs",
+      "sha256": "4d11017e2f5ce092ba7d63827740ad761fc0913fb806cd0f1ab5895e4355c153"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/publish.rs",
+      "sha256": "02438ea8b529a69915897c55a93dce68a3e479801f9d04a7fba38af69d6844d1"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/archive.rs",
+      "sha256": "6acd4cf545934f7e4f136042d4cc7cf3c71e26a2b3c2ccdb82abc406bb7e3bd0"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/backup.rs",
+      "sha256": "01a21e8aa99dd1f2abd396d4b24cc086bf6316621f5813e70cb75576b16da01d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/codec.rs",
+      "sha256": "d201599b14e5102fa2ea6ddce27c5116c1eb6f4b178c6c47d38742746012a03d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/initialization.rs",
+      "sha256": "902d875e49573c0f024516ce4a411302d0e53875517f340120f759d7565e059a"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/mod.rs",
+      "sha256": "6c7c4d5716773e2a6d3002212e217a331942ff898510aa66e2b018180d889322"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/phase.rs",
+      "sha256": "6eb95cb63c96002c9d0f80cf13eef0b54bce20ad91e7e1b1129a74b08c827559"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/ready.rs",
+      "sha256": "dcc010dc3096b8db881535846f6fc3715848d8b6936a8ed85803b7f5e6b3285f"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/registration.rs",
+      "sha256": "9365df807689d02a841e1d9bee8d0a187c1c6c81a6b29c750133f0a2ff9c74fe"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/supervisor.rs",
+      "sha256": "cd19249f899e7ffa21a60c1a3189f249f30933af7a67db939b153dcd43548645"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/recovery/tests.rs",
+      "sha256": "fb5e4cf523fe385a32ba962b40cbd89a6c2e9edeef71c566572b9b495c9c04d8"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_observation.rs",
+      "sha256": "e669d1cb0562003a796c47be824108d4a80a8d57234d293f5e310e4ac5d29789"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_observation/selection.rs",
+      "sha256": "20702f14f9b9458e9ea83131f2f22114a5612e7dfa357a7a2129d545d6e1d66f"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_policy/codec.rs",
+      "sha256": "0c37d1d8ccd3ab74c253e08d4d86a5c8f3230a7e128ed0a11718ee5e666209d4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_policy/commands.rs",
+      "sha256": "f7e0f63db8c51f8c7fde9bbc14b108caea2d35a6305547b756cc36fb2375e897"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_policy/mod.rs",
+      "sha256": "5554daaaee47984d51cebe20ad5037970fa61cc4e09663c3d4358581864adf9f"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_policy/prepare.rs",
+      "sha256": "195de5ece8888b4457a56fdfe8b1f1dabc30f8684f90e8a4f019b5d1c59743c4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_proof.rs",
+      "sha256": "8bd48176fd2f5e42673c5fcdcf1e2d4eb0f95d6db8fce4a6dd251cb7b5bb2458"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_proof/ancestry.rs",
+      "sha256": "a9653535785221d35f667a73f9072b608e60f2ac44daaf04d7f0809937305665"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_proof/ancestry/tests.rs",
+      "sha256": "cc67e987b1a73c732dc157e4fbb23f966894eb027b296e7c895dc908cd262786"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_proof/tests.rs",
+      "sha256": "180fb28b58f8a0874bb8a6703b78754950d5ade6caf94e3449d9c8cf102a7100"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/ref_snapshot.rs",
+      "sha256": "9e866e2523cfeebe7f56b88377a52e3f3ed41a2bac2931ec47a7f0080611091c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/registry.rs",
+      "sha256": "7bd735a021c3c8bcbb7d614aa6323a8f56ef1580d7edc613905a261bb90cbb98"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/codec.rs",
+      "sha256": "2957177a85ccaccf04d1344e81be696ca55d9a0f5fb4d5ba620c4daccf80e629"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/mod.rs",
+      "sha256": "0639981a833493a515b0bb53fdc2c501529f53a3433a58dd32e2eb3b6ae4797c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/outcome.rs",
+      "sha256": "3d0a4c7acb6ac5ee06d1c99ec0e394118ea1d875ff82ffa2804a1445bb6189d4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/prepare.rs",
+      "sha256": "7dbd745790166926f3274d99c856af25b996ecbd6bc6d9f3c815091f27b4a5a8"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/publish.rs",
+      "sha256": "e450c466521ef0c6ba38d8d7465197aeadb259c703ecd56575366ce5e32997e6"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/read.rs",
+      "sha256": "db5a23dd942eb39b87b750fbf4115d49d60fbb082eb34a8cf1eb74dfdf89b076"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/ref_free.rs",
+      "sha256": "c0e13d9453941ef8cc112bf48039f4ada115fab55d21a53dff3409c5b46da7ba"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/result.rs",
+      "sha256": "219ca8b4443c65cdf16c62a1bacd4e7c2b7555417977ee11941ae6ec551b19fe"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/retention.rs",
+      "sha256": "42db60cf1db5956a3a10417f7096a58719affbda1a42cddc4336cb4fa3bd7346"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/root_completion/tests.rs",
+      "sha256": "069a39e4009d0b700803f158bbaedff2172de0c77e21eb3c62b52a0e3371bd0a"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/scan.rs",
+      "sha256": "0ec626f85bc8fb8aea33cdd3ecb935afe8b34428a6b1f48587b8a2d9f80d54f6"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/scan/tests.rs",
+      "sha256": "3cc3ee92ba5436652f4024bd5edeff7400fd7c199260857e5886e96a417ad840"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving.rs",
+      "sha256": "af6e2d42f1d192a30f3aa1853eeeafdc3a0f12ed6365490c9c763b6e55623ffd"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/codec.rs",
+      "sha256": "ad49731468721723a5733dee5d1288c5351b328ef179e470988eb6f18c30d64b"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/command_owner.rs",
+      "sha256": "edf8a7c5c98df0054b27bb2af2890bb84d55f6921f57f058677962674014f96d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/commands.rs",
+      "sha256": "925a8fafa2a80f81bc8bf897006bba5ec959eabfc47e2796539af6972cbd01dd"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/lifecycle.rs",
+      "sha256": "819f4360fddc64e746cef0c0167337519798324f01b4d8e610c4184bc34292a6"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/ownership.rs",
+      "sha256": "49332ddd4b616293a1195a8a2284eede89f9e2d3a74c19715053cf5875bb6653"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/pool.rs",
+      "sha256": "1ab9411bcc7e55f75c0098ac549bf1ee378082ec68925d1c75a36edb3bd67d23"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session.rs",
+      "sha256": "8d98101d6da7a9e137c7caeb46f33103df6bc53348a2b72cfe5a8a7e77357bb0"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/body.rs",
+      "sha256": "2eec6c39ca50cfb7827b20a003cb45c98c1e81cf99c19c1d8f729e5b810748e6"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/edges.rs",
+      "sha256": "5cf07e6fa1c02b829295195d7e9c76f39c006d1d6aae0e877594c37621c7bb10"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/handoff.rs",
+      "sha256": "7635151d254fb4fa5b344630cda3604a57eb409967bd2f372cd03f0ccae7ed0c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/membership.rs",
+      "sha256": "6ea3c5d3344f0f7fdf8d4feeded9ac879469d16a8f548fbcc1c3879af640e821"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/native_base.rs",
+      "sha256": "b5c02892acec7bfac119cb027e3fb7ad518978e46d551b83d2b5e6bfe380f2a9"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/reads.rs",
+      "sha256": "34e7d1bd70fb99da1699abc4d4fc286de8e70be3b5f1ee4d07100c1c0d4ec179"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/ref_observation.rs",
+      "sha256": "e25d0e5b52db5f9a3d9fe6c603f9bf00f631d90b41b7d6e64c50a2961af34094"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/refs.rs",
+      "sha256": "4a3323df513ee8043de070435623d492afc10dab45851c26ba87185a5398b029"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/serving/session/workspace.rs",
+      "sha256": "9e2529f7fad4ca6227d5f6416669cd254a23e60e5b5b8418ae9f648cae4ec7ab"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/session.rs",
+      "sha256": "8e78d9b77cd9ea3fb83bdd9413df237cbecd73c71bde8d66c64dd9393f934d5a"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/sql.rs",
+      "sha256": "550b74680fd9321bbc87eead9fd7a97fd1aac5f871bfe20daa0fd76c5bd76691"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/staging.rs",
+      "sha256": "4a1adee4036816c35eaf3c47aeef87ad1fa5219d7fcf2925e486c55603742896"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/staging_receipt.rs",
+      "sha256": "e81841b2d6279887475284cdc05878ee57b85cc9c98fbb3a77dbf4693a900d79"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/staging_service.rs",
+      "sha256": "31784da153daa126c6b6b1bae1d7ec63ec05079dc3d9781c46cf19ee03e2cfb2"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/staging_service/bound.rs",
+      "sha256": "34252e371e893ece236ee467ce4beda4fe67b66fe41280f1949dd41876cfdee4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/staging_service/driver.rs",
+      "sha256": "689cf2dda06d75c4dbf83bd52f7ad3fe08b8026e27953d3ff8fc461cb589845b"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/staging_service/publication.rs",
+      "sha256": "f27b93ffc26d947c911a5878ba91daca836e0afe451b1fbeeb1182d3f1b18051"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/staging_service/restore.rs",
+      "sha256": "64557e0c96871042cbb189fbc7f6d8d10fdbd25f0926b05cb706dc512cf1c28b"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/staging_service/retirement.rs",
+      "sha256": "9bcf81192841b4e18af815057d1ff78f504fc33e91a29fc0eabb5eb2c3094e09"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests.rs",
+      "sha256": "c9bcbb356e83cb32e3c2b44aa3af038b45daf0b5f79c868bf4b2c9907fc212f2"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/attestation.rs",
+      "sha256": "5abaefe62a42ccacd1e7eb8a5fba5878b89c07ed5e829cf69f0b189656a63e04"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/candidate_publication.rs",
+      "sha256": "497f149e734c9aeae3321c1452d1775e701188abcbd9839abfb58aa8ea1fed02"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/compaction.rs",
+      "sha256": "af38c1ca3b9d1e2a4e9aca806a14cbd247149ced9a95e185ffdf0ceeabb00d41"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/compaction/coordinator.rs",
+      "sha256": "7f0991a6f5402a23f6c15036a3c0f1247c33eff3718de4cb49bd98314aee071f"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/compaction/range.rs",
+      "sha256": "53d350883acda875ea5f627d5e0c87d375e52b3c98cea5d33df05cf570ad1226"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/compaction/recovery.rs",
+      "sha256": "00bd4d3fd1e10c86bd42853e22da77cc714538931d34eb822d69bcf5ef7ed004"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/compaction/schedule.rs",
+      "sha256": "e0b325ed57ed59ee0160d65ad5d6a3f624dd2557f1316f7e252fb0c9dc29444c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/completion.rs",
+      "sha256": "6bdfa78c607b8bbe917c72c4eec4039500cbcb739a996581588adfbe00c9043c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/completion/outcome.rs",
+      "sha256": "c791f27aa1ca8998a0a0edefb9392f678a363bb836fb4b5288e4ffbea1131e13"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/coordinator.rs",
+      "sha256": "dcde91ab16f212fec306990d544e699a0987077122faba5c59192c47f0e1db8f"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/coordinator/budget.rs",
+      "sha256": "f8d9107a7bbd0c42c700b27055ef0362dfc9b642172f388d7670db63dcaa0c8a"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/coordinator/held.rs",
+      "sha256": "8d5361446c88fc189d4c9b1f97348cdb1d66e364b298482b30798ac0ac8ce2bc"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/coordinator/preparation.rs",
+      "sha256": "d11e296ffd59d61cba3b7aa7f912e4d8f90a7eb70e67f85d828ea50749499641"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/custody.rs",
+      "sha256": "b92d931dc3af0be158d3ae7fd6fc98fb9efde1b726f2cbeb8b9d9ead887c56a9"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/custody_stop.rs",
+      "sha256": "d0a9f91817b2bf3304e5788ee3ff619097306819d01a462263426751e081c91f"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/durable_policy.rs",
+      "sha256": "278120a30e9922f493b5766d00cde4c60f6ac81ac23b545fe709e44f8a9badc8"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/durable_recovery.rs",
+      "sha256": "6a1c4aacb7c04c0c6c999a08174eef468455dec5d18375a0f1eef8f91051ff22"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/frontier.rs",
+      "sha256": "bde9906e106a600781e43114a3ed2a52f2cc9596eddaceb40f4a8d2421d7cb25"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/initialization.rs",
+      "sha256": "a8990c949e117c398c5f48bff66b7cfa1a595dac94c4a3df45284a499b8a2df6"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/initialization_recovery.rs",
+      "sha256": "6282169f15f22a5d329c3cac507b7b98f7aeb20244e7da7071fcbe09a0cda091"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/initialization_retirement.rs",
+      "sha256": "419df2e898cc04826597a660bc101eb1f88f0d60994beae23ee3b37584b1e5c3"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/inputs.rs",
+      "sha256": "4d525d99be4815e8bc194157d0d6005b52ebe3f46d34e974ce53ecaba178a669"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/inputs/bound.rs",
+      "sha256": "06aedc222fba530bd443299648ab7d6da44d73101698482f9ed3460d22abd8a2"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/inputs/custody.rs",
+      "sha256": "b0240837a59f6713f1db428ac82eeece47fa906428244aa4e5acd67b246b5389"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/inputs/requests.rs",
+      "sha256": "30676fde880087809efe5e96dc71afcabc356d08b359b4169562d3da0d0d6250"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/inputs/requests/results.rs",
+      "sha256": "9499fce0dbf7836c170d4265e0e1fe24cf6e09d8663791481b0f1cbb4f9d9bc6"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/inputs/requests/results/signed.rs",
+      "sha256": "89ce2f7bd6343df03def6a2f9991b4f9a017e007572b7df3af03a452d559b428"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/mandatory_registration.rs",
+      "sha256": "1134588791dcf2b89781b532c1b13aa362e28416696d1bf7776eebe0cf29e2f6"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/namespaces.rs",
+      "sha256": "305ea1ebbc813441780e37e097b4bc4bc2f602225379200e9e87ec6f6c455cad"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/native_candidate.rs",
+      "sha256": "6cf33f32770d23ee2a7bf4e571bf0795b42b62f5f5b8e42d7927bfbae2ce8fc9"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/native_capture.rs",
+      "sha256": "794b63e6bcb11b6447b21caff491007f2e33f0a81c5045c1fab89d163d784364"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/native_head.rs",
+      "sha256": "f19cfe5e9bc32ecebdb7eb0951ea0acfa126a1e7b3d0d22fc89d17c0a11044f2"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/native_merge.rs",
+      "sha256": "b99c0b6da67a33107f191674a22fcc7885481ccc3cb32240d5499514f5ac3284"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/native_merge/retirement.rs",
+      "sha256": "71e2b969aa7c7b3778290961bd39d852a8d4d61d962d127b4c2e29561a51bbac"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/policy_dispatch.rs",
+      "sha256": "0ac49afd97502d167d965aa5da2fe569b778d4391d695cbf018470a457cae869"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/policy_refusal.rs",
+      "sha256": "4bc84b7fe7c3d801bebb8f11d763c7d14b0960fd0b458def55b900367b1b7238"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/preparation_receipt.rs",
+      "sha256": "a9173028cbb75a77792b6b81f94fd94c59d3f553346c44a6b4673253a8ef6bd0"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/prepare.rs",
+      "sha256": "07e92a7180f2e91eadcad16bec6706d2f2dc52cc83887be60eacaeaa705eeb61"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/publishing.rs",
+      "sha256": "e6381a6b08b687f8c551984df12673c98d9576525ebc3df4a23489abb5a66183"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/reconcile.rs",
+      "sha256": "5a98610905fad39777c6d1f28259e257b7c65836cf77284685f588d65c135446"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/recovery_discovery.rs",
+      "sha256": "84ba4e59589ddf48f01f235e88e1675d059c05021def9e6801e37c7df34338e4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/ref_policy.rs",
+      "sha256": "4c1b1c43b5c53ff80c69175ca011de7f70fd4d49413cc97ec2e4676441c2da74"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/ref_policy/cleanup.rs",
+      "sha256": "ad85a9468d6a2b32627a0697b6080701d3cefc7e43491623815ea7ce991ca728"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/ref_policy/fixture.rs",
+      "sha256": "36124def6b4919bc35102997364566645d4a05aaf3b4ecb261d852ae6139005b"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/ref_policy/freshness.rs",
+      "sha256": "0fc05e45d2cda9455ce5e4e8991c65d9eb04bfddeb9839a46efca84ba250a50a"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/ref_policy/pages.rs",
+      "sha256": "65a2f8abd9801777c2e5064b2d8c852f73919d2cf55f44062b0a8825090643e1"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/ref_snapshot.rs",
+      "sha256": "30dc48306354c340a827b3d77547e0a98d2b837c27d07ab79dab7e14de35218d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/refs.rs",
+      "sha256": "6aa86153f3d5e9ffeb7a555c263eafd34679e4c2db738d2ea591e9b220afa5cf"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/root_completion.rs",
+      "sha256": "d08626c6a4d43438c2ea3ebe8a98f8913727d6488259e8abcbdb328fef654ba8"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/root_dispatch.rs",
+      "sha256": "2d76a771dcd441024465d3b5a9bb96a79d84b7863ef4c5fb5fe4f9c1b7fc20de"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/root_outcome.rs",
+      "sha256": "f332bb90e407c09b130c068216dfb734fdedee79b06f7a9b646c0afc8d04c23c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving.rs",
+      "sha256": "7c994b993f92417c58516e9c4332b35cc6b9cc98450694a89d73c52850e3bc42"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/blocked.rs",
+      "sha256": "729ee569bbc1b11343946033a8aaf0dd326f2ca54c8986df17c9c6191d3c7e24"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/body.rs",
+      "sha256": "08a21be58e1b7cd14829422c8fec2e9f6b006592d0f849aeadb7de51646df160"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/custody.rs",
+      "sha256": "f3539f3a063fa141edbb9533d3c5b3582f2c2d0821ed880b44d123b85c18f139"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/edges.rs",
+      "sha256": "df0141d94987d6f2c3a8f88d11e58b7409874e0140ffc006d1e867da3213f46e"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/lifecycle.rs",
+      "sha256": "c502b7ee59f0fd2eb6aaf950ae896d77a44f2addd9f17b048c0accf82aab3395"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/lifecycle/restarts.rs",
+      "sha256": "3b6432badcfebbfb5d9f24b67962f97719475dd301b56e252a9114650e35f036"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/pool.rs",
+      "sha256": "32ca15fe71a43474599da7dd59acef17450c332cfdb71df9595c8f5724956c86"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/refs.rs",
+      "sha256": "d20b42f78a26b3be3c08547a4652f8ed14acc5b31d32b8f8fb8018dbc8de55b5"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/selection_drain.rs",
+      "sha256": "eb1fc5049aacf6eaa49f33f4791ddd4be6fea1bc31a51b4213c5c78541d3eea2"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/serving/workspace.rs",
+      "sha256": "0e92817ac8df5a48152352396ae63912def7439ab0a919fcd5fdbaf7a4fdf21c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staged_durable.rs",
+      "sha256": "af865b638c57e18136d01554aea81378418b36f9334d2a7cdd01a87ab37d0db3"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging.rs",
+      "sha256": "7ae5a651ee0b8208a4cfa540713b9bb8e5e505479900112819403ba269314fcd"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging_receipt.rs",
+      "sha256": "0068520761bf0de573cb6c440cdbfe68748c6e5d067c09c9ba553e44b8bfe765"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging_service.rs",
+      "sha256": "f6f6e39a4457f4d6f658b0cef37687e4defa7f965848cdbe019e446eeb36df1c"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging_service/bound.rs",
+      "sha256": "e96afc48ef6db71e2ebcf23b3c3ab8c9cc646d7c97383c1ede80db0fdfcd7997"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging_service/budget.rs",
+      "sha256": "9744dc0ec00111b8a7838914a894357893e2f84e697c3baaa9435ea377618ec8"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging_service/physical.rs",
+      "sha256": "d8799cef5f5c92ac0798a517fb60d15d910dc4f4ed84bd8cd43280063e65d9ab"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging_service/publication.rs",
+      "sha256": "3cbbeae4a2dd4e6515c114996028429ca7966e70fcdd1b405cb4638dea48faff"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging_service/restore.rs",
+      "sha256": "01194fe2d728d5768215304f2ff971526bfebb5eb286bb60cf24fbf32b5afe85"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/staging_service/retirement.rs",
+      "sha256": "60fc3ddd18458730d8867655492bafc0689f395eb0c15628fa882a15f2a08a00"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/publication/tests/terminal_retention.rs",
+      "sha256": "d9ecbeb70ea470e50508e27b158a62c5fa904c8743a21d6b8a84a9ec0ef6aa4d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/ref_state/mod.rs",
+      "sha256": "b19c1b77637ceb49c268878165ee9f782f118d23374daefa415d2e45d9705c94"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/ref_state/record.rs",
+      "sha256": "ad4df7d06930b0e0455763532465fcf6a63e0eb96efdbea0ebc373115c90c348"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/ref_state/snapshot.rs",
+      "sha256": "3a8c117feeb5bab67bba0183e299cdf61c9794b8d154dbae50f6d44c8254e710"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/ref_state/tests.rs",
+      "sha256": "94cd171a6f9d82d00239d2cb5c3c814553d93bd2bb12b34a9c990630903b3387"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/ref_state/transition.rs",
+      "sha256": "dd2e05a762943bb77c92b636e0a3026058cdd286c4dae08407d6ecdc72ec1c30"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/sources/codec.rs",
+      "sha256": "9c4cc37f78743adbd89a70d8cde27139e1447524f44a56b7e746e40b95b69fd4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/sources/inputs.rs",
+      "sha256": "24bc235354aec1cdf9828ed44214e9378cecddbb5e6f9060424da89849464a5d"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/sources/mod.rs",
+      "sha256": "616a99f5e0a989ef35cf0cc4305756171026727904b15a71e69a2b17b919eca9"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/sources/native.rs",
+      "sha256": "006362684fffa7ce2560374bc360b73b361f01866da510db92f8284ce96d1387"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/sources/resolve.rs",
+      "sha256": "987d0875307a4df8cb8936b5372a91ce820daa7ed31303ac093e2921c5fc81cb"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/sources/tests.rs",
+      "sha256": "88bc9ce33a50900498d67303280f90ce8325c91e51e7e56a91c72564f7ecbcd1"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/sources/tests/changes.rs",
+      "sha256": "ab60c729a4b33b6031fcd84e7ef0ddec30bf0c62aacad7d300fdde77751b4692"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/sources/verification.rs",
+      "sha256": "7899af543f21c0e2fda126883bd4b8d69a70e4116ea819ae5de4d1efe1388b64"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/mod.rs",
+      "sha256": "901e0f3d216bd443009361636eac0ccf43f0b3350c84557c9a06178025d8e275"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/physical.rs",
+      "sha256": "6ea01d9253170daf3ee9b6cc575214417a4d480f8f4df51f28a304b3391be56f"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/physical/partition.rs",
+      "sha256": "99314756f75cf01e50742b31a704c4b6020818ad2b90175b572345d50b8ffe22"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/physical/staged.rs",
+      "sha256": "e778841ec760f8651c6c58f4a86b305da3848f4a29dd9efca95afe953be37419"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/physical/staged/tests.rs",
+      "sha256": "f95bda28402334586884d227c20ac55f4b379e4811c3691fafd95d04b4dba112"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/physical/tests.rs",
+      "sha256": "59d191aebbf36d1178252d3b94145283c4b0d9b5305f5bb34b0ce3cc13976d73"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/physical/tests/independence.rs",
+      "sha256": "4d7012c1b5c783fa199ffc03ce7956d2b6eb083ca6b290ff97faac16b6c08618"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/spool.rs",
+      "sha256": "ef78b2ff1f57ee40f7fab5863c0113f730fb6516d3aeb3a48c5d0411fb8d5524"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/spool/tests.rs",
+      "sha256": "bd68135bbdc74dab25e074a9e23c71424d9da0f306dad979853a268ae9bfe4db"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/verification/tests.rs",
+      "sha256": "887f09d2f9d5fddacbca1e6d74aac2e893768d45f2dad4375d008d9d0fe37fc4"
+    },
+    {
+      "path": "crates/canopy-server/src/packs/wire_request.rs",
+      "sha256": "d37771c383d9ae171cdfb469e3c7c63aff597fde2f698ae0c5ceadba1122d172"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/candidates/command.rs",
+      "sha256": "ecb8a985eb7433743d8094bdc7978554515ca52f4c234e9348fa2139cfc3642c"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/candidates/mod.rs",
+      "sha256": "05a40bd4b4e473fcd10b67361bbb95567545ea63832f99ec2ad990407e5e92bc"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/candidates/rebase.rs",
+      "sha256": "e01080d2dd6c06f311329cc91aa34d369eda959799b7ce92119ea0b89057bbaf"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/merge/command.rs",
+      "sha256": "5f640f3627222189281842605e3edd1f1287cc8a5426c787c184f5dacd0c0b36"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/merge/mod.rs",
+      "sha256": "cb3128d2bdcd06fd248f114db6038fd5890e85c07a2b1818956dde941a722889"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/mod.rs",
+      "sha256": "c361d2550b0dbc35b83f4ba334469bbbb2811f43e06e32a7ab9954f7e12e1122"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/mutations.rs",
+      "sha256": "e2842cbeb241ef6a4d1616cc7d2f36e915b0dad7605d0a7988be34a2672a36b6"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/native/client.rs",
+      "sha256": "f726dee079725e0df74211d268e7cfffdfb152852121910703d7a46133af05fe"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/native/codec.rs",
+      "sha256": "38b3462d08077b15d2090547b8982668349e3fac50a8c1ded893b96dad693154"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/native/mod.rs",
+      "sha256": "ebe3cc02ffee4de5cfb25ed7fb36efa2533cd7c982e193c33b126b9d91044fb8"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/native/reads.rs",
+      "sha256": "71ce40bdb9d2b18edf87d9bdeed086ec6e70f5c9d3ced4d0b02e64041c29b427"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/native/threads.rs",
+      "sha256": "30e9baf91149ad28ac9e8d5eac6cc79fa2b6c160c8f73399c3547f393ad5f5a1"
+    },
+    {
+      "path": "crates/canopy-server/src/pulls/threads.rs",
+      "sha256": "b4a59e2d1d77f82fead62b540de60612466fe45eb48520e41f0d8d6b791b5793"
+    },
+    {
+      "path": "crates/canopy-server/src/push/certificate.rs",
+      "sha256": "01c0d3634fcec05d7832d23a7b42256b3a9425417ccdedb8ac7d1384122e47a8"
+    },
+    {
+      "path": "crates/canopy-server/src/push/mod.rs",
+      "sha256": "bb126cd9c0d78c4d5147b5f22aa0a1df4b93af05ecabbe3906910a9670b7fff9"
+    },
+    {
+      "path": "crates/canopy-server/src/push/report.rs",
+      "sha256": "0a26f9407710126e38321b91bfe8eda808d9f30b7d8cd20cbb8af10d30f591d1"
+    },
+    {
+      "path": "crates/canopy-server/src/refs.rs",
+      "sha256": "d0307212fad83f43f4fc00156f9382ef9f6ea915227e4e50b892a39d82b71537"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/accounts.rs",
+      "sha256": "87af39ed1c7ec1b0d0e77153848d52d62f7637542838df2db7e5e2c7d10aa2e6"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/authorization.rs",
+      "sha256": "6e1c0c6878336a7026641c5782ae4dcf7a0433542a414c5157a4be8111e3d407"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/branch_rules.rs",
+      "sha256": "66a591d88d779d100e9a3862e96372df1b6132b3643f3d118bc784059f26c829"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/browse.rs",
+      "sha256": "fa411fc2f31bc2b8efe1015be970d36dc1a78c8fc7928a5e1f6ef6e74a82632e"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/candidates.rs",
+      "sha256": "f8731c09c6554e6ff7cfc0c31d1fadab0561a07ed4085af4bc10bb842345d02e"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/checks.rs",
+      "sha256": "d606ca47ef429f9fc15e0b47c2a35e38970f7c5a43636cb1450db45fd91034cb"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/collaborators.rs",
+      "sha256": "f1a40c9211d6698a4df699a576d21bd6c0d8b7e7ee938534946022709e20ccba"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/comparison.rs",
+      "sha256": "ee16dc2d6012e985206d18228e0826fe7a078ebfadc143ada3d9fe087e1cf2c2"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/default_branch.rs",
+      "sha256": "2278ae157b16975f0180377cd1f3a727a57af165d1e0b8dcaa99887f97628c7d"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/issues.rs",
+      "sha256": "267b9620d4acc43740aea18282e7e9c387968fbf1f673a2b1d04c3f853527b10"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/merge.rs",
+      "sha256": "2a23852beb3ee4af078006a73a10c3671b583a92c1c267bd2c91a9aa8f5205ee"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/mod.rs",
+      "sha256": "1a6bffd1203ef780c80513cdfdd76d617e980d0ee7c3ac8e1d1a096437084e62"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/pulls.rs",
+      "sha256": "391974ba50b813e6043b61fa2d289986406aa29f1bd52609793c77f6512ee52f"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/pushes.rs",
+      "sha256": "da2efe9bf8141aa897227c9132d4e4400ddac73822dac62775e0f88339c509cc"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/ssh_keys.rs",
+      "sha256": "44f1df9e9f46cef9aa832f1d7208a2afb6938cd5f90d3b7cb483af2b25f9695e"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/threads.rs",
+      "sha256": "8c48158c2bb545b6fb10b684b8fcf1bf514d0fd759e7b99fe797882cf2dc76a4"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/tokens.rs",
+      "sha256": "5a7b5a3307e035b5bc820a566f8b54bca68fa02e9376315023db84ec313c9561"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/transport.rs",
+      "sha256": "b4d5398919d1456287d6905903312b404c64a0d4688a693335414ffb03b71366"
+    },
+    {
+      "path": "crates/canopy-server/src/repository_http/visibility.rs",
+      "sha256": "78c70641e85aa869f16d7efa6c4fc45a57e0d84fe5797b878871084dcda94f07"
+    },
+    {
+      "path": "crates/canopy-server/src/server/catalog_admission.rs",
+      "sha256": "d0ccfd3a6663c0d7be1de113a287d76530007e9ec0b7f22d1a1e2761347b1f08"
+    },
+    {
+      "path": "crates/canopy-server/src/server/catalog_admission/tests.rs",
+      "sha256": "f8c55dd0da6f2fe85a7303843687dfa97476927e1cff426efa2c28d0570b6f39"
+    },
+    {
+      "path": "crates/canopy-server/src/server/catalog_initialization.rs",
+      "sha256": "b9b2ed27d87e437dcfc81ef68c7f5bc9aaecf831f9ef947fd58f90ec68cfe86b"
+    },
+    {
+      "path": "crates/canopy-server/src/server/catalog_initialization/tests.rs",
+      "sha256": "19b48f3e57e7a0cab2e1a70604e2590918667a930787e736f82fa38b0418d5a5"
+    },
+    {
+      "path": "crates/canopy-server/src/server/discovery.rs",
+      "sha256": "76a68f28b052d7e76e338f50cea877a07bec9ac60fcc4ff78b7d8e7a8007c320"
+    },
+    {
+      "path": "crates/canopy-server/src/server/lifecycle.rs",
+      "sha256": "0c8a908e772c2747c732463cb0a942557569108df1217a380e33b721b056cbe5"
+    },
+    {
+      "path": "crates/canopy-server/src/server/lifecycle/tests.rs",
+      "sha256": "adde3500c84d4e17fb5bd98e8a59618c3cbfa8287c7210c8ec919cb689a52489"
+    },
+    {
+      "path": "crates/canopy-server/src/server/listeners.rs",
+      "sha256": "01abcaef27d49a009ed4df5e1a2843637da8ee057725123f92409abb7c82f534"
+    },
+    {
+      "path": "crates/canopy-server/src/server/mod.rs",
+      "sha256": "f6cc7a3a30e8572d84f75f1255a2f5705240d8e9c22ad552eb79a76070c16fce"
+    },
+    {
+      "path": "crates/canopy-server/src/server/peer.rs",
+      "sha256": "d3388a448809680a383310d5f26687049b02a2b65d2c319e50bb8590672a2175"
+    },
+    {
+      "path": "crates/canopy-server/src/server/request_trace.rs",
+      "sha256": "126cb6f7ddc313b2e1e3eab7b07bc7190730b6c18aaa5f57b105ee7e3f7c2bda"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/mod.rs",
+      "sha256": "11474f670ce1b12fab28faffe36ced6438c119fe2035fe449f6a8bf2886569f2"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/recovery.rs",
+      "sha256": "9cd845589293808869831ef68429a52a5230be182abc9f70f1cb071788740853"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/tests.rs",
+      "sha256": "8f6ad39a1aafa28e1f2f674252472e3ee0b9da4604b25cdcfb708d65458ef570"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/tests/recovery.rs",
+      "sha256": "23f781b71762ff0d648bfb3a783af5a9b96b89718ce008380a54e555d9f7cbf9"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/tests/serving.rs",
+      "sha256": "bf7bc70914aba49e5372c230f69419250c23d8d3a153b0edb384fb05199ef78a"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/tests/serving/browser.rs",
+      "sha256": "52d5e68fa321f951050c8224beec774291d2a0530f71d664f0da9b5b619fc286"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/tests/serving/browser/checks.rs",
+      "sha256": "755bcd70e0f5f6af5b58e45566073f44e6a4a41fea361a2def5997492c6428d5"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/tests/serving/browser/pulls.rs",
+      "sha256": "8288d13567d908720815ae46e4e60f085ef003ef100ee6c28543464d178d3232"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/tests/serving/browser/pulls/candidates.rs",
+      "sha256": "1cd851040c126a904cc7d1571c30f8f7a7979d2a84ba575bf94f752e321baf5d"
+    },
+    {
+      "path": "crates/canopy-server/src/server/residency/tests/staging.rs",
+      "sha256": "cf61fbfd579744eafdb4f64533cd047b8f7081db5317d59b1bb4d038bea64a07"
+    },
+    {
+      "path": "crates/canopy-server/src/server/storage.rs",
+      "sha256": "780a50bcc9676b6a4a85bf2d97213da182e7ab940e0de89b83b06456b0e46100"
+    },
+    {
+      "path": "crates/canopy-server/src/server/tokens.rs",
+      "sha256": "2d853e04134d6354dc322a1d1e8293c933d9185d2603f9534c90c9d601d7656a"
+    },
+    {
+      "path": "crates/canopy-server/src/server/workspace/mod.rs",
+      "sha256": "2ce836de9402b3518a95320d1099f71cefea4febecb5d952382173d180f5adda"
+    },
+    {
+      "path": "crates/canopy-server/src/server/workspace/tests.rs",
+      "sha256": "a256a4e91a9262e32b950d3b0cd4fda885a032fe8b0d17095aacc69a04fc212d"
+    },
+    {
+      "path": "crates/canopy-server/src/ssh.rs",
+      "sha256": "2381428f1cdfed2d384c4a80910e89a7032ecacc086d3a8b2d14754774692aff"
+    },
+    {
+      "path": "crates/canopy-server/src/transfer.rs",
+      "sha256": "059140411b105ef66db14412f959d2411c47674d2b3ce404049e6820fbade526"
+    },
+    {
+      "path": "crates/canopy-server/src/visibility.rs",
+      "sha256": "33da635eb46483ed01f54363a3e3f1edcd16c401e1069ac672d13a79467aaec5"
+    },
+    {
+      "path": "crates/canopy-server/src/web.rs",
+      "sha256": "4612e8505c58bedf37a76f87d249163c028625e429b65968870a6105c2773ec7"
+    },
+    {
+      "path": "crates/canopy-server/tests/directory_cell/accounts.rs",
+      "sha256": "b58dc29e8a643258b1420389e1ccaccc8371ac48276db904c7ec148691ba30d9"
+    },
+    {
+      "path": "crates/canopy-server/tests/directory_cell/capacity.rs",
+      "sha256": "7e84df7b6ac84dff5a10dbdc30f67e629df59a557b9e38e7445faacc0f98b081"
+    },
+    {
+      "path": "crates/canopy-server/tests/directory_cell/compatibility.rs",
+      "sha256": "ec6ce5fa0b65f96a52613077dd660e06b93ac703f7dfd7f0bc9aa822e698fcce"
+    },
+    {
+      "path": "crates/canopy-server/tests/directory_cell/expiry.rs",
+      "sha256": "fb0df4bfbfd808af0fcf4afb5a99196c156779a592594bb3e5802580b5384404"
+    },
+    {
+      "path": "crates/canopy-server/tests/directory_cell/main.rs",
+      "sha256": "fdf62f903fdebd0588f0076607b225e7e53ed5bc1bbde569ec9b23fa3b6bff02"
+    },
+    {
+      "path": "crates/canopy-server/tests/directory_cell/ssh_keys.rs",
+      "sha256": "80b24299e5d0f8e3841c194c87b721cbab90262af0b0714d85764c65197be274"
+    },
+    {
+      "path": "crates/canopy-server/tests/git_http.rs",
+      "sha256": "0aac63148f766387ead058dd3e786b90db3639e83b6ae27dd39623fd7e70a2c4"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/account_admin.rs",
+      "sha256": "1077a611e4c0f1daa90f3941ca1c972696a93f6cedba1a8b89a299a0d9792560"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/account_audit.rs",
+      "sha256": "421c8cac840561db25fd8759e980fd76631d363999c497a7823937ae61d8d7be"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/accounts.rs",
+      "sha256": "042fb25082907112c9bc0a4d83463f02c97e6b365b5f07c8a2a1605a093469a8"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/backup.rs",
+      "sha256": "cbc3b6a87516f8484860953655b975bb395f789d313f546fb0662bfa7bbabd1e"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/branch_rules.rs",
+      "sha256": "4d02419340248dc585a2dad0b9250e590b89636f89a9c5cd801b36b30f3c98e2"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/browse.rs",
+      "sha256": "3d8294dc3a12ebf661ab87bf2615e9da9a2f3c6c80c180ed7c89e8bf777f6f76"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/bulk_refs.rs",
+      "sha256": "d50f7c66ff69b2ac8e11c5e771219776256c22a2d598ca15bf3bd11f74c20f9e"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/candidates.rs",
+      "sha256": "b2a385f2dc132f8f1d47eda3cac1e247a63e601ad72f7f2554ca39d40c789c9c"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/checks.rs",
+      "sha256": "3ea687fd2b6d93b9989ad243703bf3ce402eafaa62fe85a9c7229880fdc928f2"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/collaborators.rs",
+      "sha256": "2e4f16d446de002db4bef4aee887947ec5e9e22f7517dca42e71df50b09ed4e0"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/comparison/history.rs",
+      "sha256": "5db6d2c8b6b4dd2e4d63486854895e993c89e075778663cb60cf557654a510d6"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/comparison/mod.rs",
+      "sha256": "bee76ba171fd7f5a1b0e093fad8862552648cbffc74e6d8967761f07bee09793"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/comparison/patches.rs",
+      "sha256": "9943cd8b2cd26c6400856416b1f9a8db0b91a8e9a90a8a426a64656e24725354"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/comparison/threads.rs",
+      "sha256": "348a76fdc0eaa7427fd1ed0f7f450952fb7219cb5b8786cac0c285bd43c81a42"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/compatibility.rs",
+      "sha256": "c2aa24acc5361aa3d4656078fb6bc4e05598416fae39643a0feddc7c722dc9b7"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/default_branch.rs",
+      "sha256": "8c089f74cf9aec71f179b986f63ffd87c893d7cc42958fd6919da73cb6c4bc10"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/deployment.rs",
+      "sha256": "79fde24ff8809a3ad509f583a926c722dcdb196a1f4269dcf571db2546a0a7ef"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/discovery.rs",
+      "sha256": "791936ceaf3475772111002c421ffa82b340a68e44b9d8a2fbc2f2e8f156dae5"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/issues.rs",
+      "sha256": "4ab2fc8ee471296bb4e5e226f2641aaf475f182b3847accbeba58877a2366850"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/large_objects.rs",
+      "sha256": "7aaae9075a61365b01d31a337f5f87b6748c0a805d44cc0af33cf18d7c302743"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/lfs_locks.rs",
+      "sha256": "862bb8a6b1b9e0b0fc29017b4d7f47c488458e81e7fa4fbdc8abdb39f3deaa07"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/lifecycle/fork.rs",
+      "sha256": "3d64e4155771d4b9e72a8f93ac5a750e651036737048a254d9bc8159c9901992"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/lifecycle/lease.rs",
+      "sha256": "ee825b88b88f9231321255ff2afede6f13cbf2ae1e9ea503a48f0c0a0e82a768"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/lifecycle/mod.rs",
+      "sha256": "63d54dc7f5ecbf48c102d0dd83519f0dbb857b2cae35cce5fb50652795e77cd3"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/listener_handoff.rs",
+      "sha256": "bc0a56596a0f1910b94e04639d6aa7a23589028bf5b05cb12dc443b5248c21ec"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/main.rs",
+      "sha256": "c991ddc98a1e2f5aa597252e084a332581a07e3fff9b4e9a487935e3c9fdbdda"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/merge.rs",
+      "sha256": "f3d0d7f9bb8e45a304eb30d166488babfb61157b16bbfa69d0934b58f1ccb449"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/partial_clone.rs",
+      "sha256": "5ad3c870f546c341be0e2e529ab7058a4c04768fb3068fd4fb4c02308cf275fd"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/peers/cold_activation.rs",
+      "sha256": "6fa5fc02db45476b5cf453bf2e398a3283cfe105f978ce9dfa4e5f5bb3a31be8"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/peers/mod.rs",
+      "sha256": "2ac306aabdbd23b0adb5e9dcf873a0673775d74b6d6ef5a755f3fce2242966c4"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/pulls.rs",
+      "sha256": "b8641ad44851ea3dc2a0777d7f43d652f354289272100da30564953053d861ce"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/push_options.rs",
+      "sha256": "56015e1a5844de23ae940d6ac958f5577b7c13b45c72f2e18672c665302d48b0"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/rebase.rs",
+      "sha256": "4cda05f2118f5fe014dddee33bb1789aaa81ccc866c03c9ade40173a4c095cae"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/residency/faults/admission.rs",
+      "sha256": "de463c985f74630546b60f9cb6d64dd9e71494dcfa6aba90dfe77ad4e613681a"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/residency/faults/git_discovery.rs",
+      "sha256": "bf366e30ede6ccb090d0c8ff595e8ae0731f6d0b59cd32753ba37d5f69751ead"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/residency/faults/mod.rs",
+      "sha256": "58c0e7ad096d923ad9e83e3b81ccc268a493bc9119c2d519811f8b5239fb835a"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/residency/mod.rs",
+      "sha256": "5385e48807e47ea29bd62a5fc21c9733c0f70c16503563f7680c171a99b7d322"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/retained_catalog.rs",
+      "sha256": "0d3050a1377dae4e539862527931a8d778615f0126e9f2b422e706a78dfb447e"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/sha256.rs",
+      "sha256": "8475d53b4abb1aac8aeab951cd2232681aac81869bf058ffe08664d39ae9ceb3"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/size.rs",
+      "sha256": "36dd44784bfbba1b5bf98015d0c68afa8d75384d2819524e187aef5c2458f64d"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/ssh/fetch.rs",
+      "sha256": "7b71ff5132228409e5c2bdc8e97cb243cff69e51f8a10b7ee952abd701e618d3"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/ssh/filtered_preparation.rs",
+      "sha256": "ea2bf58aac22046f09709d69e0da9bd9f0f517ecf57c8d5ee916d0f91991aa98"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/ssh/lfs.rs",
+      "sha256": "3a45615da9d498d167ca4d14b7efeef81b5650309e5e99dc7300536aea9c151b"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/ssh/mod.rs",
+      "sha256": "05e32ec5efc1d85e9b993bc51f5cbc243a994292483f0f69fa5a386b9b7a8441"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/ssh/publication.rs",
+      "sha256": "a43bb4563bc7d06a28cd9ce1717c69dc297a22ed41b062602dc2ce435d34cf88"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/ssh_keys.rs",
+      "sha256": "dee0f7d857ce06a27e4a6188543ddb23f293be642ee3ecdc2292d2020e81158d"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/tokens/mod.rs",
+      "sha256": "12906439734dfee69727f3f8741638182c5467b39c997bdd38312c63390884a5"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/tokens/token_quotas.rs",
+      "sha256": "867adc7c3dea35fefb79e176f774a027ad4825720cac6acf5f5275bffdb9ad34"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/transfers.rs",
+      "sha256": "71cde977cb4cd861b6cf1d4bf9c3e47f4c2a452b101efe2bd0e0da18d7fef3a6"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/visibility.rs",
+      "sha256": "03722d5df40e7bb069d25a648d1b52cb0dee06bab8c6d71ef39df84e764b50bd"
+    },
+    {
+      "path": "crates/canopy-server/tests/multi_server/workspace.rs",
+      "sha256": "6045d31be02106df17b41d317dc2ec625662061b3aabf055b0085b769b9f86ea"
+    },
+    {
+      "path": "crates/canopy-server/tests/owner_restart.rs",
+      "sha256": "a48eb12f4d8b3246bf3eb67bbd6b680f34396b619d5105682122b639913c03a0"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/batches.rs",
+      "sha256": "33073182ca181eaa859bb7745fcd2791f31c7f02b44fd57206943dc8400bd6af"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/branch_rules.rs",
+      "sha256": "2f8bf6eaf1d4dd6851442c5e8eef91d84d7d4cb681645d2f9819ffc7884407c0"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/bulk_refs.rs",
+      "sha256": "9223c138a0f94a52d709e00c4db53d407a3f03b37ee07eefd08a83ed02371407"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/checks.rs",
+      "sha256": "e736205b3f6b5da05c3ef9c2fcf1edc38c9743d9fcf3decc5d492090b8af3b22"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/chunks.rs",
+      "sha256": "4d0ba1b064b3ba0da7187ce22a54926b8c50fe4965325c6f33f53904705d713a"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/default_branch.rs",
+      "sha256": "6f901bb2f07e9a83ae6033ec8c633b53db9dc865bf8f387a08c78a964f83148c"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/graph.rs",
+      "sha256": "e9a9c00ec4aa3c0ea8c445ea08af801d3e51eee93198798f185d4e6f31d1f404"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/issues.rs",
+      "sha256": "d5b3367b6e62327b61b1b689c4712cfc1be1f87fb4d0e613855ec34692bb2fa1"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/main.rs",
+      "sha256": "6595a32386e7077d86c3a2d458996c24251f78cfbf0258e714bfcd2ec4087c62"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/merge.rs",
+      "sha256": "b154dce0f308ddbb3661de3ef2b577458f079a4fdf432df5ad8cc88b1db738e2"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/pages.rs",
+      "sha256": "782f8058103b1b621d2a4145761250fd527cdf5b7998ef7640ba866fec424847"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/pulls.rs",
+      "sha256": "d5fc6426c4a9caac0b57caac56f9378bb7ea6b0b34b3ceca673acf26d3a33e2f"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/rebase.rs",
+      "sha256": "288f51d8876620385473e3428adb28d672ef45b8135e73b25b0e0431d7d35124"
+    },
+    {
+      "path": "crates/canopy-server/tests/repository_cell/visibility.rs",
+      "sha256": "4a7f1f1e7b1a97064a6b31dac2d14bc6dbc41f8c3bad47a277a7564a0fa5060f"
+    },
+    {
+      "path": "crates/canopy-server/tests/smart_http/cache_admission.rs",
+      "sha256": "721c05836efc6ee6db3424c41118b6e380097a202e404bfb04b939217ce47e1d"
+    },
+    {
+      "path": "crates/canopy-server/tests/smart_http/cache_reuse.rs",
+      "sha256": "001f1fc9a67c48b54ab7d999b26da58696df25d843148fc05fd531ef4538d1f6"
+    },
+    {
+      "path": "crates/canopy-server/tests/smart_http/encoded_input.rs",
+      "sha256": "5a47511b31c8a6753fc2c43cdde6189e1216819e3bb5b6e583c36b7ac67c3e37"
+    },
+    {
+      "path": "crates/canopy-server/tests/smart_http/main.rs",
+      "sha256": "949aa477e98c604bd5a5ba2b4cf83e4c28184859c016cd9cfd352fd86c857145"
+    },
+    {
+      "path": "crates/canopy-server/tests/smart_http/native_resources.rs",
+      "sha256": "fa4299bca19049a8038b96b31e978f6b0ce95841a600b24f229359470ee5fa22"
+    },
+    {
+      "path": "crates/canopy-server/tests/smart_http/publication.rs",
+      "sha256": "900e1f8acd082541b327d084da139702581f4cdf86a6bddc48a011b6b336ef05"
+    },
+    {
+      "path": "crates/canopy-server/tests/smart_http/push_uploads.rs",
+      "sha256": "d64ecd6480177d4c40271866382f540b58245809bbb5e23817fcef5bed8e85d9"
+    },
+    {
+      "path": "crates/canopy-server/tests/smart_http/ref_snapshots.rs",
+      "sha256": "9d46ae59c25f646cb5ec57cd72868c42e13082330154d66a684e6e17506c694c"
+    },
+    {
+      "path": "crates/canopy-server/tests/support/mod.rs",
+      "sha256": "04d62438601197007ba0b813813e1326a6c820bb214c23c4778cf61cc13a1f6a"
+    },
+    {
+      "path": "crates/canopy-server/tests/support/objects.rs",
+      "sha256": "85b142a97480bfe46e9c7331ffdca6b6d137c109dced696ed29f191160c2c1ae"
+    },
+    {
+      "path": "crates/canopy-server/tests/support/paused_blobs.rs",
+      "sha256": "14d8954c785737eb4776ca9234aabf6224adf1e29fdbb98210514c4ad5007b59"
+    },
+    {
+      "path": "crates/canopy-server/tests/support/retained_directory.rs",
+      "sha256": "499db26adc781b702c770badf7f87d4941b604f41c3db51d0252b1e84ca6411d"
+    }
+  ],
+  "validation": {
+    "backup": {
+      "result": "passed",
+      "seconds": 100.81,
+      "log": "/tmp/canopy-native-backup-final2.log"
+    },
+    "checkpoint_race": {
+      "before": "failed deterministically: receipt observed in RegisteringInputs",
+      "after": "passed both SHA-1 and SHA-256",
+      "log": "/tmp/canopy-checkpoint-race-after.log"
+    },
+    "push_options": {
+      "passed": 4,
+      "ignored": 1,
+      "failed": 0,
+      "seconds": 3.51,
+      "log": "/tmp/canopy-checkpoint-push-options.log"
+    },
+    "clippy": {
+      "result": "passed",
+      "command": "cargo +1.98.0 clippy --workspace --all-targets --locked -- -D warnings",
+      "log": "/tmp/canopy-native-backup-clippy2.log"
+    },
+    "qualification_note": "Tests preceded moving one decoder helper above its test module; no behavior changed. Clippy checks the final placement. Full workspace and new-head Linux remain required."
+  },
+  "preceding_linux": {
+    "head": "aa86f944907b64816c366a55bdca2f465e25e00e",
+    "runs": [
+      37411479759,
+      37411617637
+    ],
+    "multi_server": {
+      "passed": 100,
+      "failed": 11,
+      "ignored": 9
+    }
+  },
+  "remaining": [
+    "selective native fetch/cache preparation",
+    "late pre-bind SSH rejection",
+    "read-only residency restoration assertion",
+    "detached standalone fixtures",
+    "full workspace and new-head Linux qualification"
+  ],
+  "full_ci_green": false
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 8635b59c..948e3820 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -18,6 +18,33 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers and reviewed merges now use native publication. Remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Native backup and staging readiness (2026-10-06 checkpoint)
+
+Backup inventory now follows the authenticated native catalog, ref, input,
+outcome, audit and recovery graphs from the pinned Cell snapshot. SQL inventory
+uses keyset pages; traversal uses bounded depth and disk-admitted deduplication.
+Copies preserve the original creating namespaces and authenticate source and
+destination parts. Closed recovery metadata does not demand retired command
+bodies or responses that can no longer be selected. LFS remains paged and
+verified. Provider listing is used only for fault injection in the test.
+
+The strengthened backup integration passes after deleting original storage,
+with strict Git fsck, LFS and collaboration restoration, orphan exclusion,
+repeat restore and native/LFS corruption rejection. The fixture retains 25
+physical artifacts including LFS. This is a fixture count, not a capacity claim.
+
+A deterministic gate reproduced the push-option race: the original checkpoint
+receipt became available before the controller restored its active phase.
+The production pipeline now waits for readiness separately from the immutable
+receipt. The regression passes for both object formats; all four runnable
+HTTP/SSH push-option integrations pass locally. The provider case remains
+ignored under its existing qualification rule.
+
+Linux runs 37411479759 and 37411617637 at aa86f94 both report 100 passing,
+11 failing and 9 ignored multi-server tests. These repairs require a new-head
+Linux run. Selective fetch, late pre-bind SSH rejection, read-only restoration
+and detached standalone fixtures remain open. Full CI is not green.
+
 ## Native line threads and owner routing (2026-10-05 checkpoint)
 
 The [native thread and owner routing contract](design/native-thread-and-owner-routing.md)

From 195e96d59f469ddf49bf54b0eb3206e3fdedb760 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 21:46:11 -0700
Subject: [PATCH 50/55] test: verify repository data across serving custody
 restoration

---
 .../tests/multi_server/residency/mod.rs       | 139 +++++++++++++++++-
 .../large-repository-implementation-status.md |  18 +++
 2 files changed, 152 insertions(+), 5 deletions(-)

diff --git a/crates/canopy-server/tests/multi_server/residency/mod.rs b/crates/canopy-server/tests/multi_server/residency/mod.rs
index 58068f1b..f08089f9 100644
--- a/crates/canopy-server/tests/multi_server/residency/mod.rs
+++ b/crates/canopy-server/tests/multi_server/residency/mod.rs
@@ -28,7 +28,7 @@ async fn repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_n
         settings.store_prefix.clone(),
         *application.as_bytes(),
     );
-    let authority = CellAuthority::new(layout);
+    let authority = CellAuthority::new(layout.clone());
     let server = CanopyServer::start(settings, store).await?;
     let local_root = workspace.path().join("server/canopy-pack-v1");
     let local = workspace.path().join("source");
@@ -92,6 +92,12 @@ async fn repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_n
             .await?
             .ok_or("Cell missing")?;
         let root = before.value().root.clone();
+        let before_rows = durable_rows(
+            &layout,
+            &target,
+            &workspace.path().join(format!("before-{index}.sqlite")),
+        )
+        .await?;
         let clone = workspace.path().join(format!("clone-{index}"));
         run_git(
             None,
@@ -126,10 +132,21 @@ async fn repositories_beyond_resident_capacity_restore_git_and_lfs_on_the_same_n
             .load(target.cell_id())
             .await?
             .ok_or("Cell missing")?;
-        assert_eq!(
-            after.value().root,
-            root,
-            "read-only restoration published a new root"
+        let after_rows = durable_rows(
+            &layout,
+            &target,
+            &workspace.path().join(format!("after-{index}.sqlite")),
+        )
+        .await?;
+        assert_read_only_restore(&before_rows, &after_rows);
+        assert!(
+            after
+                .value()
+                .root
+                .as_ref()
+                .ok_or("restored root absent")?
+                .commit_sequence
+                >= root.as_ref().ok_or("original root absent")?.commit_sequence
         );
     }
     server.shutdown().await?;
@@ -305,3 +322,115 @@ async fn invalid_residency_limits_fail_before_creating_local_state() -> Result {
     }
     Ok(())
 }
+
+// Inspect authenticated roots through Cellule's VFS; restored files may contain
+// sparse placeholders that ordinary SQLite cannot read independently.
+type DurableRows =
+    std::collections::BTreeMap<String, Vec<Vec<cellule_ltx::rusqlite::types::Value>>>;
+
+fn assert_read_only_restore(before: &DurableRows, after: &DurableRows) {
+    use cellule_ltx::rusqlite::types::Value;
+    assert_eq!(
+        before.keys().collect::<Vec<_>>(),
+        after.keys().collect::<Vec<_>>(),
+        "restoration changed the schema inventory"
+    );
+    for (table, rows) in before {
+        let restored = &after[table];
+        match table.as_str() {
+            "catalog_custody_commands" => {
+                // Serving purpose is 1. Existing staging intents (purpose 0)
+                // remain exact; a read cannot admit publication work.
+                let staging = |values: &Vec<Vec<Value>>| {
+                    values
+                        .iter()
+                        .filter(|row| row[0] == Value::Integer(0))
+                        .cloned()
+                        .collect::<Vec<_>>()
+                };
+                assert_eq!(staging(rows), staging(restored));
+                for original in rows {
+                    assert!(
+                        restored.iter().any(|row| row[..6] == original[..6]),
+                        "restoration replaced a custody intent"
+                    );
+                }
+            }
+            "catalog_serving_pins" => {
+                assert_eq!(restored.len(), 1, "one current generation must be pinned");
+                let generation = &after["catalog_state"][0][1];
+                for row in restored {
+                    assert_eq!(
+                        &row[4], generation,
+                        "serving pin selected another generation"
+                    );
+                }
+            }
+            "sys_requests" => {
+                for row in rows {
+                    assert!(
+                        restored.contains(row),
+                        "restoration replaced a durable receipt"
+                    );
+                }
+            }
+            "sys_meta" => {
+                let normalize = |values: &Vec<Vec<Value>>| {
+                    let mut values = values.clone();
+                    assert_eq!(values.len(), 1);
+                    // Serving commands advance sequence and logical time.
+                    values[0][3] = Value::Integer(0);
+                    values[0][4] = Value::Integer(0);
+                    values
+                };
+                assert_eq!(normalize(rows), normalize(restored));
+            }
+            _ => assert_eq!(rows, restored, "read-only restoration changed {table}"),
+        }
+    }
+}
+
+async fn durable_rows(
+    layout: &CellStorageLayout,
+    target: &cellule_runtime::CellTarget,
+    path: &Path,
+) -> Result<DurableRows> {
+    let control = CellAuthority::new(layout.clone())
+        .load(target.cell_id())
+        .await?
+        .ok_or("repository absent")?;
+    let root = control.value().ltx_root().ok_or("root absent")?;
+    let replica = cellule_ltx::CellReplica::new(
+        layout.clone(),
+        *target.cell_id().as_bytes(),
+        *control.value().incarnation.as_bytes(),
+        cellule_ltx::Limits::default(),
+    )?;
+    let root = replica.open_root(&root).await?.open_read_only(path)?;
+    let c = root.connection()?;
+    let mut names = c.prepare("SELECT name FROM sqlite_schema WHERE type='table' ORDER BY name")?;
+    let names = names
+        .query_map([], |row| row.get::<_, String>(0))?
+        .collect::<std::result::Result<Vec<_>, _>>()?;
+    let mut result = std::collections::BTreeMap::new();
+    for name in names {
+        let quoted = name.replace('"', "\"\"");
+        let query = c.prepare(&format!("SELECT * FROM \"{quoted}\""))?;
+        let count = query.column_count();
+        let order = (1..=count)
+            .map(|i| i.to_string())
+            .collect::<Vec<_>>()
+            .join(",");
+        drop(query);
+        let mut query = c.prepare(&format!("SELECT * FROM \"{quoted}\" ORDER BY {order}"))?;
+        let rows = query
+            .query_map([], |row| {
+                (0..count)
+                    .map(|i| row.get(i))
+                    .collect::<std::result::Result<Vec<cellule_ltx::rusqlite::types::Value>, _>>()
+            })?
+            .collect::<std::result::Result<Vec<_>, _>>()?;
+        result.insert(name, rows);
+    }
+    Ok(result)
+}
diff --git a/docs/large-repository-implementation-status.md b/docs/large-repository-implementation-status.md
index 948e3820..8c3adb30 100644
--- a/docs/large-repository-implementation-status.md
+++ b/docs/large-repository-implementation-status.md
@@ -18,6 +18,24 @@ Implementation is isolated in the PR worktree. The original checkout contains an
 
 All five Cellule dependency declarations and six lockfile entries pin `161067f5a21703b3e257024bcb64e565fd9657b4` from [Cellule PR #50](https://github.com/crabbuild/cellule/pull/50), including the admitted owner fence, exact-command snapshot and admitted-mutation APIs. Historical validation below remains attributed to its original source revisions. Trusted ref-plan certification, typed catalog/ref publication, immutable exact-response completion and the class/account-fair dispatcher exist. The local production cutover now selects their registry/schema and initializes new repositories through certified empty roots. Production HTTP/SSH receive-pack now uses the resident native pipeline. Generated producers and reviewed merges now use native publication. Remaining authoritative readers, complete startup recovery and the final schema hard cutover remain open.
 
+## Read-only residency restoration (2026-10-06 checkpoint)
+
+The failing physical-root equality assertion was diagnosed using authenticated
+Cellule VFS snapshots. A cold clone changes only `catalog_custody_commands`,
+`catalog_serving_pins`, `sys_meta` and `sys_requests`: serving acquisitions
+register exact command recovery and pin the selected generation. Product rows
+are unchanged. A physical root comparison therefore conflicts with durable
+serving custody.
+
+The integration now compares every table and requires identical repository
+identity/allocation, catalog/ref, LFS, collaboration and other product rows.
+It separately preserves staging intents, existing custody identities and exact
+receipts, permits runtime sequence/time advancement, and requires one serving
+pin for the current generation. All six repositories restore, clone, fsck and
+retrieve LFS successfully in the focused test (18.11 seconds). Workspace
+all-target Clippy with warnings denied passes. New-head Linux and the remaining
+selective-fetch, late SSH refusal and standalone fixture work remain open.
+
 ## Native backup and staging readiness (2026-10-06 checkpoint)
 
 Backup inventory now follows the authenticated native catalog, ref, input,

From 759d4778f2ae9a04d426470f5354618c1e904f62 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 22:54:26 -0700
Subject: [PATCH 51/55] fix: serve verified native fetches and qualify resident
 fixtures

---
 .../canopy-git-format/src/pack_index/mod.rs   |  53 ++
 .../canopy-git-format/src/pack_index/tests.rs |  18 +-
 crates/canopy-object-storage/src/artifact.rs  |  60 ++
 .../src/artifact/tests.rs                     |  40 ++
 .../canopy-server/src/git_cache/artifacts.rs  | 146 ++++
 crates/canopy-server/src/git_cache/mod.rs     |  10 +-
 crates/canopy-server/src/git_cache/tests.rs   |  62 ++
 .../canopy-server/src/git_cache/verified.rs   |  95 +++
 .../src/git_gateway/branch_policy.rs          |   2 +-
 crates/canopy-server/src/git_gateway/fetch.rs |  27 +-
 crates/canopy-server/src/git_gateway/mod.rs   |  23 +-
 crates/canopy-server/src/git_gateway/ssh.rs   |  50 +-
 crates/canopy-server/src/git_http/mod.rs      |  11 +-
 crates/canopy-server/src/git_objects/mod.rs   | 102 ++-
 crates/canopy-server/src/lib.rs               |   5 +
 .../canopy-server/src/packs/catalog/files.rs  |  26 +-
 .../src/packs/catalog/graph_spool.rs          |  18 +
 crates/canopy-server/src/packs/catalog/mod.rs |   1 +
 .../canopy-server/src/packs/catalog/native.rs |  70 +-
 .../src/packs/catalog/native/tests.rs         |   9 +-
 .../canopy-server/src/packs/catalog/sparse.rs | 304 ++++++++
 .../serving/session/native_base.rs            |   2 +-
 .../publication/serving/session/workspace.rs  |  36 +-
 .../serving/session/workspace/prepare.rs      | 365 ++++++++++
 .../publication/staging_service/driver.rs     |   5 +
 .../tests/multi_server/backup.rs              |  32 +-
 crates/canopy-server/tests/owner_restart.rs   | 658 ++----------------
 .../tests/repository_cell/main.rs             | 575 +++------------
 crates/canopy-server/tests/smart_http/main.rs | 596 ++--------------
 .../tests/support/native_server.rs            |  81 +++
 .../native-ci-fixture-migration-20261006.md   |  51 ++
 .../native-selective-ci-20261006.json         |  90 +++
 32 files changed, 1934 insertions(+), 1689 deletions(-)
 create mode 100644 crates/canopy-server/src/git_cache/verified.rs
 create mode 100644 crates/canopy-server/src/packs/catalog/sparse.rs
 create mode 100644 crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
 create mode 100644 crates/canopy-server/tests/support/native_server.rs
 create mode 100644 docs/evidence/native-ci-fixture-migration-20261006.md
 create mode 100644 docs/evidence/native-selective-ci-20261006.json

diff --git a/crates/canopy-git-format/src/pack_index/mod.rs b/crates/canopy-git-format/src/pack_index/mod.rs
index f55d87ae..d4c831cd 100644
--- a/crates/canopy-git-format/src/pack_index/mod.rs
+++ b/crates/canopy-git-format/src/pack_index/mod.rs
@@ -161,6 +161,20 @@ impl PackIndex {
         self.ids_at(0)
     }
 
+    /// Scan native offsets in hash order using one fixed page. Callers may
+    /// build an admitted disk index of packed extents without retaining an
+    /// object-count-sized heap vector or performing a hash lookup per entry.
+    pub fn offsets(&self) -> IndexOffsets<'_> {
+        IndexOffsets {
+            index: self,
+            next: 0,
+            buffer: Box::new([0; PAGE]),
+            start: 0,
+            end: 0,
+            failed: false,
+        }
+    }
+
     /// Start a bounded sequential read at a checked native ordinal. Immutable
     /// metadata shards use this to cover contiguous ranges without rescanning
     /// earlier index entries or materializing all IDs.
@@ -268,6 +282,45 @@ pub struct IndexIds<'a> {
     end: usize,
     failed: bool,
 }
+
+pub struct IndexOffsets<'a> {
+    index: &'a PackIndex,
+    next: u32,
+    buffer: Box<[u8; PAGE]>,
+    start: usize,
+    end: usize,
+    failed: bool,
+}
+impl Iterator for IndexOffsets<'_> {
+    type Item = io::Result<u64>;
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.failed || self.next == self.index.count {
+            return None;
+        }
+        if self.start == self.end {
+            let records = (self.index.count - self.next).min((PAGE / 4) as u32) as usize;
+            self.end = records * 4;
+            self.start = 0;
+            if let Err(error) = read_at(
+                &self.index.file,
+                &mut self.buffer[..self.end],
+                self.index.offsets + u64::from(self.next) * 4,
+            ) {
+                self.failed = true;
+                return Some(Err(error));
+            }
+        }
+        let mut encoded = [0; 4];
+        encoded.copy_from_slice(&self.buffer[self.start..self.start + 4]);
+        self.start += 4;
+        self.next += 1;
+        let result = self.index.offset(u32::from_be_bytes(encoded));
+        if result.is_err() {
+            self.failed = true;
+        }
+        Some(result)
+    }
+}
 impl Iterator for IndexIds<'_> {
     type Item = io::Result<ObjectId>;
     fn next(&mut self) -> Option<Self::Item> {
diff --git a/crates/canopy-git-format/src/pack_index/tests.rs b/crates/canopy-git-format/src/pack_index/tests.rs
index 4fe1ecca..85259001 100644
--- a/crates/canopy-git-format/src/pack_index/tests.rs
+++ b/crates/canopy-git-format/src/pack_index/tests.rs
@@ -60,10 +60,11 @@ fn validates_empty_and_multi_page_indexes_for_both_formats() -> io::Result<()> {
             index.pack_checksum(),
             ObjectId::try_from(vec![7; format.bytes()]).unwrap()
         );
-        for (n, oid) in index.ids().enumerate() {
+        for (n, (oid, offset)) in index.ids().zip(index.offsets()).enumerate() {
             let oid = oid?;
             assert_eq!(u32::from_be_bytes(oid[..4].try_into().unwrap()), n as u32);
             assert_eq!(index.find(oid)?.unwrap().offset, 12 + n as u64);
+            assert_eq!(index.find(oid)?.unwrap().offset, offset?);
         }
         // Shards start at a native ordinal, including positions crossing the
         // iterator's buffer boundary. The end is a valid empty iterator.
@@ -97,6 +98,20 @@ fn validates_empty_and_multi_page_indexes_for_both_formats() -> io::Result<()> {
     Ok(())
 }
 
+#[test]
+fn offset_pages_cover_native_positions_across_a_page_boundary() -> io::Result<()> {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let index = open(&fixture(format, 20_001), format)?;
+        let mut count = 0;
+        for offset in index.offsets() {
+            assert_eq!(offset?, 12 + count);
+            count += 1;
+        }
+        assert_eq!(count, 20_001);
+    }
+    Ok(())
+}
+
 #[test]
 fn rejects_truncation_and_checksum_tampering() {
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
@@ -159,6 +174,7 @@ fn supports_large_offsets_and_rejects_out_of_range_references() -> io::Result<()
         rehash(&mut bytes, format);
         let index = open(&bytes, format)?;
         assert_eq!(index.find(format.zero())?.unwrap().offset, 0x1_0000_0010);
+        assert_eq!(index.offsets().next().unwrap()?, 0x1_0000_0010);
         bytes[offsets..offsets + 4].copy_from_slice(&0x8000_0001_u32.to_be_bytes());
         rehash(&mut bytes, format);
         assert!(open(&bytes, format).is_err());
diff --git a/crates/canopy-object-storage/src/artifact.rs b/crates/canopy-object-storage/src/artifact.rs
index 6d236ca6..545b3e89 100644
--- a/crates/canopy-object-storage/src/artifact.rs
+++ b/crates/canopy-object-storage/src/artifact.rs
@@ -264,6 +264,66 @@ impl ArtifactStore {
             owner,
         })
     }
+
+    /// Authenticate the manifest before reading independently selected parts.
+    /// Each returned part is checked against that manifest. This capability
+    /// does not claim to recompute the digest of the entire artifact; callers
+    /// must already hold its certified descriptor and verify decoded objects.
+    pub async fn ranges_owned(
+        &self,
+        key: ArtifactKey,
+        descriptor: ArtifactDescriptor,
+        owner: Arc<dyn Send + Sync>,
+    ) -> Result<ArtifactRanges, ArtifactError> {
+        Ok(ArtifactRanges {
+            read: self.read_owned(key, descriptor, owner).await?,
+        })
+    }
+}
+
+/// Independent bounded reads retain the caller's physical owner through
+/// provider I/O and detached hashing. Unrequested parts are never fetched.
+pub struct ArtifactRanges {
+    read: ArtifactRead,
+}
+impl ArtifactRanges {
+    pub async fn part(&self, index: u64) -> Result<Bytes, ArtifactError> {
+        self.part_owned(index, Arc::new(())).await
+    }
+    /// Cached range capabilities retain idle file admission; the active caller
+    /// supplies its work owner separately so an idle cache cannot pin a lease.
+    pub async fn part_owned(
+        &self,
+        index: u64,
+        work: Arc<dyn Send + Sync>,
+    ) -> Result<Bytes, ArtifactError> {
+        let offset = index
+            .checked_mul(PART_BYTES as u64)
+            .filter(|offset| *offset < self.read.descriptor.size)
+            .ok_or(ArtifactError::Corrupt)?;
+        let expected = self
+            .read
+            .manifest
+            .part_digest(index)
+            .ok_or(ArtifactError::Corrupt)?;
+        let bytes = external::read(
+            self.read.store.as_ref(),
+            &self.read.path,
+            &self.read.manifest,
+            self.read.descriptor.size,
+            offset,
+        )
+        .await?;
+        let owner = (self.read.owner.clone(), work);
+        tokio::task::spawn_blocking(move || {
+            let _owner = owner;
+            if blake3::hash(&bytes).as_bytes() != &expected {
+                return Err(ArtifactError::Corrupt);
+            }
+            Ok(bytes)
+        })
+        .await?
+    }
 }
 
 /// One bounded authenticated part at a time. Errors/cancellation poison the
diff --git a/crates/canopy-object-storage/src/artifact/tests.rs b/crates/canopy-object-storage/src/artifact/tests.rs
index 287c5ec5..3fe8ba9f 100644
--- a/crates/canopy-object-storage/src/artifact/tests.rs
+++ b/crates/canopy-object-storage/src/artifact/tests.rs
@@ -11,6 +11,46 @@ fn key(body: &[u8]) -> ArtifactKey {
     }
 }
 
+#[tokio::test]
+async fn selected_parts_authenticate_without_fetching_unrequested_bytes() -> Result {
+    let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+    let artifacts = ArtifactStore::new(store.clone(), [1; 16]);
+    let mut body = vec![27; PART_BYTES + 31];
+    body[PART_BYTES..].fill(42);
+    let key = key(&body);
+    let descriptor = artifacts
+        .put(
+            key,
+            body.len() as u64,
+            key.binding_digest,
+            &mut body.as_slice(),
+        )
+        .await?;
+    let path = artifacts.path(key, descriptor.digest)?;
+    // A missing unrelated part must not affect a selected range read.
+    store.delete(&external::part(&path, 0)).await?;
+    let ranges = artifacts
+        .ranges_owned(key, descriptor, Arc::new(()))
+        .await?;
+    assert_eq!(ranges.part(1).await?.as_ref(), &[42; 31]);
+    assert!(ranges.part(0).await.is_err());
+    assert!(ranges.part(2).await.is_err());
+    assert!(ranges.part(u64::MAX).await.is_err());
+    store
+        .put(&external::part(&path, 1), vec![43; 31].into())
+        .await?;
+    assert!(matches!(ranges.part(1).await, Err(ArtifactError::Corrupt)));
+    let mut wrong = descriptor;
+    wrong.manifest_digest[0] ^= 1;
+    assert!(
+        artifacts
+            .ranges_owned(key, wrong, Arc::new(()))
+            .await
+            .is_err()
+    );
+    Ok(())
+}
+
 #[tokio::test]
 async fn catalog_artifacts_bind_their_own_digest_and_isolate_retired_incarnations() -> Result {
     let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
diff --git a/crates/canopy-server/src/git_cache/artifacts.rs b/crates/canopy-server/src/git_cache/artifacts.rs
index dbc5f60a..fee2fd8b 100644
--- a/crates/canopy-server/src/git_cache/artifacts.rs
+++ b/crates/canopy-server/src/git_cache/artifacts.rs
@@ -9,6 +9,152 @@ struct Writer {
     _owner: crate::git_objects::ReadOwner,
 }
 impl GitCache {
+    pub(crate) fn native_pack_path(&self, descriptor: NativePackDescriptor) -> PathBuf {
+        self.git_dir().join(format!(
+            "objects/pack/pack-{}.pack",
+            hex::encode(descriptor.git_checksum)
+        ))
+    }
+
+    /// Read the original index completely, retaining its manifest and native
+    /// checksums. The sparse private decoder below grants no object authority.
+    pub(crate) async fn native_index_owned(
+        self: &Arc<Self>,
+        store: &ArtifactStore,
+        descriptor: NativePackDescriptor,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Result<crate::git_format::pack_index::PackIndex, MetadataError> {
+        descriptor
+            .validate(store.repository(), self.object_format)
+            .map_err(|_| MetadataError::Integrity)?;
+        let cache = self.clone();
+        let held = owner.clone();
+        let mut writer = tokio::task::spawn_blocking(move || {
+            let _owner = held;
+            cache.reservation()?.try_grow(
+                descriptor
+                    .index
+                    .size
+                    .checked_add(4096)
+                    .ok_or(MetadataError::Limit)?,
+            )?;
+            Ok::<_, MetadataError>(Writer {
+                file: File::create_new(cache.native_pack_path(descriptor).with_extension("idx"))?,
+                _cache: cache,
+                _owner,
+            })
+        })
+        .await??;
+        let mut input = store
+            .read_owned(
+                descriptor
+                    .key(ArtifactKind::Index)
+                    .map_err(|_| MetadataError::Integrity)?,
+                descriptor.index,
+                owner.clone(),
+            )
+            .await?;
+        while let Some(bytes) = input.next().await? {
+            writer = tokio::task::spawn_blocking(move || {
+                writer.file.write_all(&bytes)?;
+                Ok::<_, MetadataError>(writer)
+            })
+            .await??;
+        }
+        tokio::task::spawn_blocking(move || {
+            let index = crate::git_format::pack_index::PackIndex::open(
+                writer
+                    ._cache
+                    .native_pack_path(descriptor)
+                    .with_extension("idx"),
+                writer._cache.object_format,
+            )?;
+            if index.len() != descriptor.object_count
+                || index.pack_checksum() != descriptor.git_checksum
+            {
+                return Err(MetadataError::Integrity);
+            }
+            Ok(index)
+        })
+        .await?
+    }
+
+    /// This is an incomplete private decoder file, never an accepted pack.
+    /// Its framing comes from the certified descriptor; selected payloads are
+    /// filled only from authenticated provider parts. Every extracted object
+    /// still needs canonical verification before leaving this workspace.
+    pub(crate) async fn sparse_native_owned(
+        self: &Arc<Self>,
+        descriptor: NativePackDescriptor,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Result<(), MetadataError> {
+        let cache = self.clone();
+        tokio::task::spawn_blocking(move || {
+            use std::io::{Seek, SeekFrom};
+            let _owner = owner;
+            let tail = descriptor
+                .pack
+                .size
+                .checked_sub(descriptor.git_checksum.len() as u64)
+                .filter(|tail| *tail >= 12)
+                .ok_or(MetadataError::Integrity)?;
+            cache.reservation()?.try_grow(8192)?;
+            let mut file = File::create_new(cache.native_pack_path(descriptor))?;
+            file.set_len(descriptor.pack.size)?;
+            file.write_all(b"PACK")?;
+            file.write_all(&2_u32.to_be_bytes())?;
+            file.write_all(&descriptor.object_count.to_be_bytes())?;
+            file.seek(SeekFrom::Start(tail))?;
+            file.write_all(descriptor.git_checksum.as_ref())?;
+            Ok::<_, MetadataError>(())
+        })
+        .await?
+    }
+
+    pub(crate) async fn sparse_payload_owned(
+        self: &Arc<Self>,
+        descriptor: NativePackDescriptor,
+        offset: u64,
+        bytes: bytes::Bytes,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Result<(), MetadataError> {
+        let cache = self.clone();
+        tokio::task::spawn_blocking(move || {
+            use std::io::{Seek, SeekFrom};
+            let _owner = owner;
+            let end = offset
+                .checked_add(bytes.len() as u64)
+                .ok_or(MetadataError::Limit)?;
+            let tail = descriptor
+                .pack
+                .size
+                .checked_sub(descriptor.git_checksum.len() as u64)
+                .ok_or(MetadataError::Integrity)?;
+            if offset < 12 || end > tail {
+                return Err(MetadataError::Integrity);
+            }
+            // Include alignment overhead before allocating sparse file blocks.
+            let charge = (bytes.len() as u64)
+                .div_ceil(4096)
+                .checked_add(1)
+                .and_then(|pages| pages.checked_mul(4096))
+                .ok_or(MetadataError::Limit)?;
+            cache.reservation()?.try_grow(charge)?;
+            let mut file = OpenOptions::new()
+                .write(true)
+                .open(cache.native_pack_path(descriptor))?;
+            file.seek(SeekFrom::Start(offset))?;
+            file.write_all(&bytes)?;
+            Ok::<_, MetadataError>(())
+        })
+        .await?
+    }
+
+    pub(crate) fn reserve_native_spool(&self, bytes: u64) -> Result<(), MetadataError> {
+        self.reservation()?.try_grow(bytes)?;
+        Ok(())
+    }
+
     /// The isolated verifier calls this exactly once on its fresh private cache.
     /// Reserve the complete pair before creating files or reading the provider.
     /// No second pack copy or blob-as-artifact wrapper is involved.
diff --git a/crates/canopy-server/src/git_cache/mod.rs b/crates/canopy-server/src/git_cache/mod.rs
index 51018bd4..d4badbbe 100644
--- a/crates/canopy-server/src/git_cache/mod.rs
+++ b/crates/canopy-server/src/git_cache/mod.rs
@@ -9,7 +9,6 @@ use std::{
 };
 
 use cellule_ltx::{DiskBudget, DiskReservation, LtxError};
-#[cfg(test)]
 use flate2::{Compression, write::ZlibEncoder};
 #[cfg(test)]
 use std::collections::BTreeMap;
@@ -29,6 +28,7 @@ pub(crate) const CACHE_PREFIX: &str = "canopy-git-";
 mod artifacts;
 mod cleanup;
 mod serving_refs;
+mod verified;
 
 #[derive(Debug, thiserror::Error)]
 pub enum CacheError {
@@ -72,7 +72,6 @@ pub(crate) struct GitCache {
     objects: Option<Arc<GitCache>>,
     // Only durable hydration writes this cache. Stripe by OID so concurrent
     // fetches share a completed loose object without serializing all objects.
-    #[cfg(test)]
     object_writes: OnceLock<[Arc<Mutex<()>>; 64]>,
     packed: RwLock<Vec<crate::git_format::pack_index::PackIndex>>,
     durable_packs: RwLock<HashSet<[u8; 32]>>,
@@ -141,8 +140,7 @@ impl GitCache {
                 reservation: Some(budget.try_reserve(0)?),
                 cleanup_owner: cleanup,
                 objects,
-                #[cfg(test)]
-    object_writes: OnceLock::new(),
+                object_writes: OnceLock::new(),
                 packed: RwLock::new(Vec::new()),
                 durable_packs: RwLock::new(HashSet::new()),
                 selection: Mutex::new(()),
@@ -226,7 +224,6 @@ impl GitCache {
         .await?
     }
 
-    #[cfg(test)]
     fn object_path(&self, oid: crate::ObjectId) -> PathBuf {
         let hex = hex::encode(oid);
         self.git_dir()
@@ -235,7 +232,6 @@ impl GitCache {
             .join(&hex[2..])
     }
 
-    #[cfg(test)]
     fn object_present(&self, oid: crate::ObjectId) -> io::Result<bool> {
         for index in self
             .packed
@@ -258,7 +254,6 @@ impl GitCache {
         }
     }
 
-    #[cfg(test)]
     fn object_write_lock(&self, oid: crate::ObjectId) -> Arc<Mutex<()>> {
         let stripes = self
             .object_writes
@@ -266,7 +261,6 @@ impl GitCache {
         Arc::clone(&stripes[oid[0] as usize % stripes.len()])
     }
 
-    #[cfg(test)]
     fn object_writer(
         self: &Arc<Self>,
         oid: crate::ObjectId,
diff --git a/crates/canopy-server/src/git_cache/tests.rs b/crates/canopy-server/src/git_cache/tests.rs
index 8fba281e..47118eb4 100644
--- a/crates/canopy-server/src/git_cache/tests.rs
+++ b/crates/canopy-server/src/git_cache/tests.rs
@@ -1,5 +1,67 @@
 use super::*;
 
+#[tokio::test]
+async fn streamed_native_extraction_publishes_only_a_verified_complete_object()
+-> Result<(), Box<dyn std::error::Error>> {
+    use crate::{git_objects::GitObjects, packs::metadata::CanonicalObject};
+    for format in [crate::ObjectFormat::Sha1, crate::ObjectFormat::Sha256] {
+        let root = tempfile::TempDir::new()?;
+        let budget = DiskBudget::new(32 << 20);
+        let native = crate::native_resources::NativeResources::default()
+            .scope(crate::native_resources::NativeClass::Foreground);
+        let source = GitCache::create(
+            root.path().into(),
+            budget.clone(),
+            "refs/heads/main",
+            format,
+            native.clone(),
+        )
+        .await?;
+        let target = GitCache::create(
+            root.path().into(),
+            budget.clone(),
+            "refs/heads/main",
+            format,
+            native.clone(),
+        )
+        .await?;
+        let mut body = vec![0; 2 << 20];
+        blake3::Hasher::new()
+            .update(b"streamed native extraction")
+            .finalize_xof()
+            .fill(&mut body);
+        let expected = CanonicalObject {
+            oid: object_id(format, ObjectKind::Blob, &body),
+            kind: ObjectKind::Blob,
+            size: body.len() as u64,
+            digest: *blake3::hash(&body).as_bytes(),
+        };
+        source
+            .store_object(expected.oid, expected.kind, body.clone())
+            .await?;
+        let mut wrong = expected;
+        wrong.digest[0] ^= 1;
+        assert!(
+            target
+                .copy_native_owned(source.git_dir(), wrong, source.clone())
+                .await
+                .is_err()
+        );
+        assert!(!target.object_present(expected.oid)?);
+        target
+            .copy_native_owned(source.git_dir(), expected, source.clone())
+            .await?;
+        assert!(target.object_present(expected.oid)?);
+        let mut objects = GitObjects::batch_owned(&target.git_dir(), &native, target.clone())?;
+        assert_eq!(objects.read_verified(expected, body.len()).await?, body);
+        objects.finish().await?;
+        drop(source);
+        drop(target);
+        wait_for_cleanup(&budget).await?;
+    }
+    Ok(())
+}
+
 async fn wait_for_cleanup(budget: &DiskBudget) -> Result<(), Box<dyn std::error::Error>> {
     tokio::time::timeout(std::time::Duration::from_secs(5), async {
         while budget.used() != 0 {
diff --git a/crates/canopy-server/src/git_cache/verified.rs b/crates/canopy-server/src/git_cache/verified.rs
new file mode 100644
index 00000000..b8e41264
--- /dev/null
+++ b/crates/canopy-server/src/git_cache/verified.rs
@@ -0,0 +1,95 @@
+//! Bounded canonical extraction into an unpublished loose-object file.
+use super::*;
+use crate::{
+    git_objects::{BodySink, GitObjects, ObjectReadError, ReadOwner},
+    packs::{catalog::NativeReadError, metadata::CanonicalObject},
+};
+use tokio::sync::OwnedMutexGuard;
+
+struct Sink {
+    encoder: Option<ZlibEncoder<CacheWriter>>,
+    temporary: tempfile::TempPath,
+    destination: PathBuf,
+    cache: Arc<GitCache>,
+    owner: ReadOwner,
+    _write: OwnedMutexGuard<()>,
+}
+impl BodySink for Sink {
+    async fn append(&mut self, bytes: bytes::Bytes) -> Result<(), ObjectReadError> {
+        let mut encoder = self.encoder.take().ok_or(ObjectReadError::Malformed)?;
+        let owner = self.owner.clone();
+        self.encoder = Some(
+            tokio::task::spawn_blocking(move || {
+                let _owner = owner;
+                encoder.write_all(&bytes)?;
+                Ok::<_, ObjectReadError>(encoder)
+            })
+            .await??,
+        );
+        Ok(())
+    }
+}
+impl GitCache {
+    /// The input is an isolated admitted native reader. Only a complete frame
+    /// matching the certified metadata and a successful child may publish it.
+    pub(crate) async fn copy_native_owned(
+        self: &Arc<Self>,
+        input: PathBuf,
+        expected: CanonicalObject,
+        owner: ReadOwner,
+    ) -> Result<(), NativeReadError> {
+        let write = self.object_write_lock(expected.oid).lock_owned().await;
+        let cache = self.clone();
+        let held = owner.clone();
+        let sink = tokio::task::spawn_blocking(move || {
+            if expected.oid.format() != cache.object_format {
+                return Err(CacheError::Io(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    "object format mismatch",
+                )));
+            }
+            if cache.object_present(expected.oid)? {
+                return Ok(None);
+            }
+            let (mut encoder, temporary, destination) = cache.object_writer(expected.oid)?;
+            encoder.write_all(
+                format!("{} {}\0", expected.kind.git_name(), expected.size).as_bytes(),
+            )?;
+            Ok::<_, CacheError>(Some(Sink {
+                encoder: Some(encoder),
+                temporary,
+                destination,
+                cache,
+                owner: held,
+                _write: write,
+            }))
+        })
+        .await??;
+        let Some(mut sink) = sink else {
+            return Ok(());
+        };
+        let mut objects = GitObjects::batch_owned(&input, &self.native, owner)?;
+        objects.copy_verified(expected, &mut sink).await?;
+        objects.finish().await?;
+        tokio::task::spawn_blocking(move || {
+            let encoder = sink
+                .encoder
+                .take()
+                .ok_or_else(|| io::Error::other("incomplete object writer"))?;
+            drop(encoder.finish()?);
+            sink.temporary
+                .persist_noclobber(&sink.destination)
+                .map_err(|error| error.error)?;
+            #[cfg(test)]
+            sink.cache
+                .loose_objects
+                .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            sink.cache
+                .write_generation
+                .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+            Ok::<_, CacheError>(())
+        })
+        .await??;
+        Ok(())
+    }
+}
diff --git a/crates/canopy-server/src/git_gateway/branch_policy.rs b/crates/canopy-server/src/git_gateway/branch_policy.rs
index c6c12352..a55aca17 100644
--- a/crates/canopy-server/src/git_gateway/branch_policy.rs
+++ b/crates/canopy-server/src/git_gateway/branch_policy.rs
@@ -295,7 +295,7 @@ fn quote(value: &str) -> String {
 fn commands(bytes: &[u8]) -> Result<PushCommands, InputError> {
     commands_in_format(bytes, None)
 }
-fn commands_in_format(
+pub(super) fn commands_in_format(
     mut bytes: &[u8],
     format: Option<crate::ObjectFormat>,
 ) -> Result<PushCommands, InputError> {
diff --git a/crates/canopy-server/src/git_gateway/fetch.rs b/crates/canopy-server/src/git_gateway/fetch.rs
index 85318d67..b27b8ad9 100644
--- a/crates/canopy-server/src/git_gateway/fetch.rs
+++ b/crates/canopy-server/src/git_gateway/fetch.rs
@@ -3,6 +3,7 @@ use super::*;
 pub(super) struct FetchRequest {
     pub(super) wants: BTreeSet<crate::ObjectId>,
     pub(super) filter: Option<String>,
+    pub(super) needs_blob_sizes: bool,
 }
 
 impl FetchRequest {
@@ -14,6 +15,7 @@ impl FetchRequest {
             return Ok(Self {
                 wants: BTreeSet::new(),
                 filter: None,
+                needs_blob_sizes: false,
             });
         }
         Self::parse(
@@ -60,18 +62,23 @@ impl FetchRequest {
             }
             bytes = &bytes[length..];
         }
-        let filter = filter
-            .map(|value| {
+        let (filter, needs_blob_sizes) = match filter {
+            Some(value) => {
                 let value = std::str::from_utf8(value).map_err(|_| InputError::Fetch)?;
-                check_filter_policy(value)?;
-                Ok::<_, InputError>(value.to_owned())
-            })
-            .transpose()?;
-        Ok(Self { wants, filter })
+                (Some(value.to_owned()), check_filter_policy(value)?)
+            }
+            None => (None, false),
+        };
+        Ok(Self {
+            wants,
+            filter,
+            needs_blob_sizes,
+        })
     }
 }
 
-fn check_filter_policy(value: &str) -> Result<(), InputError> {
+fn check_filter_policy(value: &str) -> Result<bool, InputError> {
+    let mut needs_blob_sizes = false;
     // rev-list does not enforce uploadpackfilter.*. Match the transport policy
     // before traversal, including escaped subfilters, so sparse filters cannot
     // inspect pattern blobs outside the validated wants.
@@ -87,6 +94,8 @@ fn check_filter_policy(value: &str) -> Result<(), InputError> {
                     .map_err(|_| InputError::Fetch)?;
                 pending.push(std::borrow::Cow::Owned(decoded.into_owned()));
             }
+        } else if value.starts_with("blob:limit=") {
+            needs_blob_sizes = true;
         } else if value != "blob:none"
             && !value.starts_with("blob:limit=")
             && !value.starts_with("tree:")
@@ -95,7 +104,7 @@ fn check_filter_policy(value: &str) -> Result<(), InputError> {
             return Err(InputError::Fetch);
         }
     }
-    Ok(())
+    Ok(needs_blob_sizes)
 }
 
 impl GitGateway {
diff --git a/crates/canopy-server/src/git_gateway/mod.rs b/crates/canopy-server/src/git_gateway/mod.rs
index 4a9ecf47..5069b8ac 100644
--- a/crates/canopy-server/src/git_gateway/mod.rs
+++ b/crates/canopy-server/src/git_gateway/mod.rs
@@ -249,10 +249,31 @@ impl GitGateway {
                 .await
                 .map_err(|e| GatewayError::Cell(Box::new(e)))?;
             Self::validate_wants(&workspace, &fetch.wants).await?;
+            if discovery {
+                workspace
+                    .prepare_advertisement()
+                    .await
+                    .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+            } else {
+                workspace
+                    .prepare_fetch(
+                        fetch.wants.iter().copied().collect(),
+                        fetch.filter.clone(),
+                        fetch.needs_blob_sizes,
+                    )
+                    .await
+                    .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+            }
             tracing::debug!(discovery,filter=?fetch.filter,generation=workspace.fact().generation,
                 "prepared certified Git transport");
             let backend = workspace.backend(self.certificate_nonce().await?);
-            backend.stream(request, workspace.read_owner()).await?
+            backend
+                .stream_command(
+                    request,
+                    workspace.read_owner(),
+                    backend.certified_fetch_command()?,
+                )
+                .await?
         };
         Ok(GitHttpResponse {
             status: response.status,
diff --git a/crates/canopy-server/src/git_gateway/ssh.rs b/crates/canopy-server/src/git_gateway/ssh.rs
index 217b9c30..eeb409a3 100644
--- a/crates/canopy-server/src/git_gateway/ssh.rs
+++ b/crates/canopy-server/src/git_gateway/ssh.rs
@@ -29,8 +29,12 @@ impl GitGateway {
             .ref_workspace(crate::packs::publication::WorkspaceLimits::default())
             .await
             .map_err(|e| GatewayError::Cell(Box::new(e)))?;
+        workspace
+            .prepare_advertisement()
+            .await
+            .map_err(|e| GatewayError::Cell(Box::new(e)))?;
         let backend = workspace.backend(self.certificate_nonce().await?);
-        let mut command = backend.transport_command()?;
+        let mut command = backend.certified_fetch_command()?;
         command
             .arg("upload-pack")
             .arg(backend.git_dir())
@@ -74,6 +78,14 @@ impl GitGateway {
                     remaining -= group.len();
                     let request = fetch::FetchRequest::parse(&group)?;
                     Self::validate_wants(&workspace, &request.wants).await?;
+                    workspace
+                        .prepare_fetch(
+                            request.wants.iter().copied().collect(),
+                            request.filter.clone(),
+                            request.needs_blob_sizes,
+                        )
+                        .await
+                        .map_err(|e| GatewayError::Cell(Box::new(e)))?;
                     stdin.write_all(&group).await?;
                     stdin.flush().await?;
                     if !protocol_v2 {
@@ -183,6 +195,11 @@ impl GitGateway {
             .ok_or(InputError::Commands)?;
             commands.extend_from_slice(&options);
         }
+        // Keep only bounded wire intent for a known pre-publication refusal.
+        // This report cannot acknowledge a push or alter durable state.
+        let refusal =
+            branch_policy::commands_in_format(&commands, Some(self.repository.object_format()))?
+                .rejection(crate::push::report::REJECTED)?;
         // Stock send-pack closes its write fd after pack-objects. Delete-only
         // pushes have no pack and await status without closing stdin. Preserve
         // their negotiated options group before dispatching the completed body.
@@ -193,9 +210,36 @@ impl GitGateway {
         } else {
             Body::from(commands)
         };
-        let response = self
+        let response = match self
             .handle(rpc("POST", body), actor, None, Some(admission))
-            .await?;
+            .await
+        {
+            Ok(response) => response,
+            Err(error) => {
+                // Only a known fenced attempt plus a current write downgrade
+                // can use the original per-ref ng report. Uncertain mutations,
+                // storage failures and lost replies retain their error path.
+                let inactive = match &error {
+                    GatewayError::Cell(source) => source
+                        .downcast_ref::<Arc<crate::packs::publication::StagingError>>()
+                        .is_some_and(|error| {
+                            matches!(**error, crate::packs::publication::StagingError::Inactive)
+                        }),
+                    _ => false,
+                };
+                if inactive
+                    && self
+                        .access_level(actor)
+                        .await?
+                        .is_some_and(|role| role < TokenScope::Write)
+                {
+                    let response = refusal.ok_or(error)?;
+                    write_body(Body::from(response.body), &mut writer, b"").await?;
+                    return Ok(());
+                }
+                return Err(error);
+            }
+        };
         if response.status != 200 {
             return Err(GitHttpError::Interrupted.into());
         }
diff --git a/crates/canopy-server/src/git_http/mod.rs b/crates/canopy-server/src/git_http/mod.rs
index 6e79505f..af491569 100644
--- a/crates/canopy-server/src/git_http/mod.rs
+++ b/crates/canopy-server/src/git_http/mod.rs
@@ -249,6 +249,15 @@ impl GitHttpBackend {
         Ok(process)
     }
 
+    /// Only gateways validating every want against certified live-ref
+    /// membership may use this command. Sparse transport workspaces need not
+    /// contain unrelated ref histories for Git to repeat that authorization.
+    pub(crate) fn certified_fetch_command(&self) -> Result<Command, GitHttpError> {
+        let mut command = self.transport_command()?;
+        command.args(["-c", "uploadpack.allowAnySHA1InWant=true"]);
+        Ok(command)
+    }
+
     /// Streams Git output while retaining the caller's disposable cache owner.
     pub(crate) async fn stream<T: Send + 'static>(
         &self,
@@ -259,7 +268,7 @@ impl GitHttpBackend {
             .await
     }
 
-    async fn stream_command<T: Send + 'static>(
+    pub(crate) async fn stream_command<T: Send + 'static>(
         &self,
         request: GitHttpRequest,
         keep_alive: T,
diff --git a/crates/canopy-server/src/git_objects/mod.rs b/crates/canopy-server/src/git_objects/mod.rs
index ae8d4fff..7bb6278b 100644
--- a/crates/canopy-server/src/git_objects/mod.rs
+++ b/crates/canopy-server/src/git_objects/mod.rs
@@ -121,15 +121,23 @@ impl Process {
     }
 }
 
-#[cfg(test)]
 pub(crate) struct GitObjectWalk {
     process: Process,
     revisions: AbortOnDropHandle<Result<(), io::Error>>,
     missing_only: bool,
 }
 
-#[cfg(test)]
 impl GitObjectWalk {
+    pub(crate) fn selected_owned(
+        git_dir: &Path,
+        included: Vec<crate::ObjectId>,
+        filter: Option<&str>,
+        native: &crate::native_resources::NativeScope,
+        owner: ReadOwner,
+    ) -> Result<Self, ObjectReadError> {
+        Self::start_owned(git_dir, included, Vec::new(), false, filter, native, owner)
+    }
+
     #[cfg(test)]
     pub(crate) fn missing(
         git_dir: &Path,
@@ -140,6 +148,16 @@ impl GitObjectWalk {
         Self::start(git_dir, included, Vec::new(), true, filter, native)
     }
 
+    pub(crate) fn missing_owned(
+        git_dir: &Path,
+        included: Vec<crate::ObjectId>,
+        filter: Option<&str>,
+        native: &crate::native_resources::NativeScope,
+        owner: ReadOwner,
+    ) -> Result<Self, ObjectReadError> {
+        Self::start_owned(git_dir, included, Vec::new(), true, filter, native, owner)
+    }
+    #[cfg(test)]
     fn start(
         git_dir: &Path,
         included: Vec<crate::ObjectId>,
@@ -147,6 +165,25 @@ impl GitObjectWalk {
         missing_only: bool,
         filter: Option<&str>,
         native: &crate::native_resources::NativeScope,
+    ) -> Result<Self, ObjectReadError> {
+        Self::start_owned(
+            git_dir,
+            included,
+            excluded,
+            missing_only,
+            filter,
+            native,
+            std::sync::Arc::new(()),
+        )
+    }
+    fn start_owned(
+        git_dir: &Path,
+        included: Vec<crate::ObjectId>,
+        excluded: Vec<crate::ObjectId>,
+        missing_only: bool,
+        filter: Option<&str>,
+        native: &crate::native_resources::NativeScope,
+        owner: ReadOwner,
     ) -> Result<Self, ObjectReadError> {
         let filter = filter.map(|value| format!("--filter={value}"));
         let mut args = vec!["rev-list", "--objects", "--no-object-names", "--stdin"];
@@ -156,7 +193,7 @@ impl GitObjectWalk {
         if let Some(filter) = &filter {
             args.push(filter);
         }
-        let (process, mut input) = Process::start(git_dir, &args, native)?;
+        let (process, mut input) = Process::start_owned(git_dir, &args, native, owner)?;
         // Ref lists can exceed argv limits; feed stdin concurrently with stdout consumption.
         let revisions = AbortOnDropHandle::new(tokio::spawn(async move {
             for (prefix, roots) in [("", included), ("^", excluded)] {
@@ -175,7 +212,6 @@ impl GitObjectWalk {
         })
     }
 
-    #[cfg(test)]
     pub(crate) async fn next(&mut self) -> Result<Option<crate::ObjectId>, ObjectReadError> {
         timeout(IO_TIMEOUT, async {
             while let Some(line) = header(&mut self.process.output).await? {
@@ -224,7 +260,65 @@ pub trait EdgeSink: Send {
     ) -> impl std::future::Future<Output = Result<(), ObjectReadError>> + Send;
 }
 
+/// Writes remain private until the caller observes canonical verification and
+/// the native process's successful completion.
+pub(crate) trait BodySink: Send {
+    fn append(
+        &mut self,
+        bytes: bytes::Bytes,
+    ) -> impl std::future::Future<Output = Result<(), ObjectReadError>> + Send;
+}
+
 impl GitObjects {
+    pub(crate) async fn copy_verified(
+        &mut self,
+        expected: crate::packs::metadata::CanonicalObject,
+        sink: &mut impl BodySink,
+    ) -> Result<(), ObjectReadError> {
+        if self.inspection_failed {
+            return Err(ObjectReadError::Malformed);
+        }
+        self.inspection_failed = true;
+        let mut object = timeout(IO_TIMEOUT, async {
+            self.requests
+                .write_all(format!("{}\n", hex::encode(expected.oid)).as_bytes())
+                .await?;
+            open_object(&mut self.batch.output, expected.oid).await
+        })
+        .await
+        .map_err(|_| ObjectReadError::Timeout)??;
+        if object.kind != expected.kind || object.size != expected.size {
+            return Err(ObjectReadError::Malformed);
+        }
+        let mut canonical = crate::git_format::ObjectHasher::new(
+            expected.oid.format(),
+            expected.kind,
+            expected.size,
+        );
+        let mut digest = blake3::Hasher::new();
+        loop {
+            let mut bytes = vec![0; 64 << 10];
+            let count = timeout(IO_TIMEOUT, object.reader.read(&mut bytes))
+                .await
+                .map_err(|_| ObjectReadError::Timeout)??;
+            if count == 0 {
+                break;
+            }
+            bytes.truncate(count);
+            canonical.update(&bytes);
+            digest.update(&bytes);
+            timeout(IO_TIMEOUT, sink.append(bytes.into()))
+                .await
+                .map_err(|_| ObjectReadError::Timeout)??;
+        }
+        object.finish().await?;
+        if canonical.finalize() != expected.oid || digest.finalize().as_bytes() != &expected.digest
+        {
+            return Err(ObjectReadError::Malformed);
+        }
+        self.inspection_failed = false;
+        Ok(())
+    }
     #[cfg(test)]
     pub(crate) fn start(
         git_dir: &Path,
diff --git a/crates/canopy-server/src/lib.rs b/crates/canopy-server/src/lib.rs
index 0de04438..78ec22a5 100644
--- a/crates/canopy-server/src/lib.rs
+++ b/crates/canopy-server/src/lib.rs
@@ -202,11 +202,13 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!("pack_store.rs"));
                 source.update(include_bytes!("git_objects/mod.rs"));
                 source.update(include_bytes!("git_cache/artifacts.rs"));
+                source.update(include_bytes!("git_cache/verified.rs"));
                 source.update(include_bytes!("git_cache/serving_refs.rs"));
                 source.update(include_bytes!("git_cache/cleanup.rs"));
                 source.update(include_bytes!("git_cache/mod.rs"));
                 source.update(include_bytes!("git_cache/maintenance.rs"));
                 source.update(include_bytes!("packs/catalog/native.rs"));
+                source.update(include_bytes!("packs/catalog/sparse.rs"));
                 source.update(include_bytes!("packs/catalog/reader.rs"));
                 source.update(include_bytes!("packs/catalog/graph_spool.rs"));
                 source.update(include_bytes!("packs/catalog/files.rs"));
@@ -366,6 +368,9 @@ impl CellModule for RepositoryModule {
                 source.update(include_bytes!(
                     "packs/publication/serving/session/workspace.rs"
                 ));
+                source.update(include_bytes!(
+                    "packs/publication/serving/session/workspace/prepare.rs"
+                ));
                 source.update(include_bytes!(
                     "packs/publication/serving/session/native_base.rs"
                 ));
diff --git a/crates/canopy-server/src/packs/catalog/files.rs b/crates/canopy-server/src/packs/catalog/files.rs
index 76606ce9..47f464fc 100644
--- a/crates/canopy-server/src/packs/catalog/files.rs
+++ b/crates/canopy-server/src/packs/catalog/files.rs
@@ -173,6 +173,30 @@ impl CatalogFiles {
             .await
     }
     pub(in crate::packs) async fn install_workspace(
+        &self,
+        cache: Arc<crate::git_cache::GitCache>,
+        source: &ResolvedObject,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Result<(), super::native::NativeReadError> {
+        self.native
+            .as_ref()
+            .ok_or(super::native::NativeReadError::Unavailable)?
+            .install(cache, source, owner, true)
+            .await
+    }
+    pub(in crate::packs) async fn install_transient_workspace(
+        &self,
+        cache: Arc<crate::git_cache::GitCache>,
+        source: &ResolvedObject,
+        owner: crate::git_objects::ReadOwner,
+    ) -> Result<(), super::native::NativeReadError> {
+        self.native
+            .as_ref()
+            .ok_or(super::native::NativeReadError::Unavailable)?
+            .install(cache, source, owner, false)
+            .await
+    }
+    pub(in crate::packs) async fn install_pack_workspace(
         &self,
         cache: Arc<crate::git_cache::GitCache>,
         source: super::super::sources::NativePackDescriptor,
@@ -181,7 +205,7 @@ impl CatalogFiles {
         self.native
             .as_ref()
             .ok_or(super::native::NativeReadError::Unavailable)?
-            .install(cache, source, owner)
+            .install_pack(cache, source, owner)
             .await
     }
     pub(in crate::packs) async fn graph_spool(
diff --git a/crates/canopy-server/src/packs/catalog/graph_spool.rs b/crates/canopy-server/src/packs/catalog/graph_spool.rs
index da9cad15..4e91a3fd 100644
--- a/crates/canopy-server/src/packs/catalog/graph_spool.rs
+++ b/crates/canopy-server/src/packs/catalog/graph_spool.rs
@@ -123,6 +123,24 @@ impl GraphSpool {
             Ok::<_, MetadataError>(())
         })
     }
+    /// Reuse this completed selected frontier for native Git's bounded missing
+    /// object selection. Guessed IDs cannot create new nodes through this path.
+    pub(in crate::packs) fn retry(&mut self, ids: &[ObjectId]) -> Result<(), MetadataError> {
+        if ids.len() > 128 {
+            return Err(MetadataError::Limit);
+        }
+        growth::transaction(&mut self.db, &mut self.file, self.maximum, |tx| {
+            let mut update = tx.prepare_cached(
+                "UPDATE nodes SET done=0 WHERE oid=?1 AND done=1 AND kind IS NOT NULL",
+            )?;
+            for id in ids {
+                if update.execute([id.as_ref()])? != 1 {
+                    return Err(MetadataError::Integrity);
+                }
+            }
+            Ok::<_, MetadataError>(())
+        })
+    }
     pub(in crate::packs) fn pack_seen(
         &self,
         p: NativePackDescriptor,
diff --git a/crates/canopy-server/src/packs/catalog/mod.rs b/crates/canopy-server/src/packs/catalog/mod.rs
index 5d4904aa..c5764670 100644
--- a/crates/canopy-server/src/packs/catalog/mod.rs
+++ b/crates/canopy-server/src/packs/catalog/mod.rs
@@ -18,6 +18,7 @@ use std::sync::Arc;
 mod codec;
 pub(in crate::packs) mod graph_spool;
 mod native;
+mod sparse;
 pub use native::{NativeFileStats, NativeReadError};
 mod files;
 pub use files::{CatalogFileLimits, CatalogFileStats, CatalogFiles, MAX_OPEN_CATALOG_FILES};
diff --git a/crates/canopy-server/src/packs/catalog/native.rs b/crates/canopy-server/src/packs/catalog/native.rs
index 72ed5052..381ba858 100644
--- a/crates/canopy-server/src/packs/catalog/native.rs
+++ b/crates/canopy-server/src/packs/catalog/native.rs
@@ -58,6 +58,7 @@ struct FileAdmission {
 }
 struct PackFile {
     cache: Arc<GitCache>,
+    sparse: super::sparse::SparsePack,
     _admission: Arc<FileAdmission>,
 }
 impl NativeFiles {
@@ -153,12 +154,7 @@ impl NativeFiles {
         if let Some(file) = self.cached(descriptor)? {
             return Ok(file);
         }
-        let bytes = descriptor
-            .pack
-            .size
-            .checked_add(descriptor.index.size)
-            .and_then(|size| size.checked_add(4096))
-            .ok_or(NativeReadError::Capacity)?;
+        let bytes = super::sparse::SparsePack::index_budget(descriptor)?;
         if bytes > self.budget.capacity() {
             return Err(NativeReadError::Capacity);
         }
@@ -177,28 +173,20 @@ impl NativeFiles {
             },
         )
         .await?;
-        cache
-            .download_native_owned(&self.store, descriptor, Arc::clone(&lifetime))
-            .await?;
+        let sparse = super::sparse::SparsePack::new(
+            cache.clone(),
+            &self.store,
+            descriptor,
+            self.native.clone(),
+            lifetime.clone(),
+            admission.clone(),
+        )
+        .await?;
         let file = Arc::new(PackFile {
             cache,
+            sparse,
             _admission: admission,
         });
-        let verify = Arc::clone(&file);
-        let claim = self
-            .native
-            .try_admit(crate::native_resources::NativeWork::Read)
-            .map_err(ObjectReadError::from)?;
-        tokio::task::spawn_blocking(move || {
-            let (_owner, _claim) = (lifetime, claim);
-            let pack = verify.cache.git_dir().join(format!(
-                "objects/pack/pack-{}.pack",
-                hex::encode(descriptor.git_checksum)
-            ));
-            descriptor.verify_files(&pack, &pack.with_extension("idx"))?;
-            Ok::<_, IndexError>(())
-        })
-        .await??;
         self.downloads
             .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
         let evicted = {
@@ -251,7 +239,7 @@ impl NativeFiles {
         )
         .await?)
     }
-    pub(super) async fn install(
+    pub(super) async fn install_pack(
         &self,
         cache: Arc<GitCache>,
         descriptor: NativePackDescriptor,
@@ -278,6 +266,35 @@ impl NativeFiles {
             .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
         Ok(())
     }
+    pub(super) async fn install(
+        &self,
+        cache: Arc<GitCache>,
+        object: &ResolvedObject,
+        owner: ReadOwner,
+        retain: bool,
+    ) -> Result<(), NativeReadError> {
+        let file = self
+            .load(object.source.record.native(), owner.clone())
+            .await?;
+        let owner: ReadOwner = Arc::new((owner, file.clone()));
+        file.sparse
+            .prepare(object.entry.header.object.oid, owner.clone())
+            .await?;
+        // Retain verified canonical objects in the bounded service cache.
+        // Request workspaces are disposable and cannot provide warm fetches.
+        if retain {
+            file.cache
+                .copy_native_owned(
+                    file.cache.git_dir(),
+                    object.entry.header.object,
+                    owner.clone(),
+                )
+                .await?;
+        }
+        cache
+            .copy_native_owned(file.cache.git_dir(), object.entry.header.object, owner)
+            .await
+    }
     pub(super) async fn body(
         &self,
         object: ResolvedObject,
@@ -294,6 +311,9 @@ impl NativeFiles {
             .load(object.source.record.native(), Arc::clone(&owner))
             .await?;
         let process_owner: ReadOwner = Arc::new((owner, Arc::clone(&file)));
+        file.sparse
+            .prepare(expected.oid, process_owner.clone())
+            .await?;
         let mut objects =
             GitObjects::batch_owned(&file.cache.git_dir(), &self.native, process_owner)?;
         let body = objects.read_verified(expected, limit).await?;
diff --git a/crates/canopy-server/src/packs/catalog/native/tests.rs b/crates/canopy-server/src/packs/catalog/native/tests.rs
index 42a654fc..529c92b4 100644
--- a/crates/canopy-server/src/packs/catalog/native/tests.rs
+++ b/crates/canopy-server/src/packs/catalog/native/tests.rs
@@ -33,7 +33,9 @@ async fn native_pack_cache_evicts_idle_files_for_disk_pressure_and_reuses_verifi
         let inputs = packs(format, &[300, 301]).await?;
         let size = inputs
             .iter()
-            .map(|p| p.descriptor.pack.size + p.descriptor.index.size)
+            .map(|p| super::super::sparse::SparsePack::index_budget(p.descriptor))
+            .collect::<std::result::Result<Vec<_>, _>>()?
+            .into_iter()
             .max()
             .ok_or("pair")?;
         let budget = DiskBudget::new(size + 4096);
@@ -96,9 +98,12 @@ async fn native_pack_failure_never_enters_cache_and_file_slot_follows_native_cac
         assert_eq!(files.stats()?.open_files, 0);
         assert_eq!(files.stats()?.downloaded_files, 0);
         let file = files.load(descriptor, Arc::new(())).await?;
+        let expected = inputs[0].fixture.objects.values().next().ok_or("object")?.0;
+        file.sparse
+            .prepare(expected.oid, file.cache.clone())
+            .await?;
         let mut reader =
             GitObjects::batch_owned(&file.cache.git_dir(), &files.native, file.cache.clone())?;
-        let expected = inputs[0].fixture.objects.values().next().ok_or("object")?.0;
         reader.read_verified(expected, 1 << 20).await?;
         files.cache.lock().map_err(|_| "cache")?.clear();
         drop(file);
diff --git a/crates/canopy-server/src/packs/catalog/sparse.rs b/crates/canopy-server/src/packs/catalog/sparse.rs
new file mode 100644
index 00000000..f2b65212
--- /dev/null
+++ b/crates/canopy-server/src/packs/catalog/sparse.rs
@@ -0,0 +1,304 @@
+//! Selected authenticated packed extents in a private native decoder workspace.
+use super::*;
+use crate::{
+    git_cache::GitCache,
+    git_objects::{ObjectReadError, ReadOwner},
+    native_resources::{NativeScope, NativeWork},
+    packs::{metadata::MetadataError, sources::NativePackDescriptor},
+};
+use bytes::Bytes;
+use canopy_object_storage::{artifact::ArtifactRanges, external::PART_BYTES};
+use rusqlite::{Connection, params};
+use std::sync::Mutex;
+use tokio::sync::Mutex as AsyncMutex;
+
+const MAX_DELTA_DEPTH: usize = 128;
+struct Offsets {
+    // Connection closes before the cache can remove the admitted SQLite file.
+    db: Mutex<Connection>,
+    _cache: Arc<GitCache>,
+}
+pub(super) struct SparsePack {
+    pub(super) cache: Arc<GitCache>,
+    index: Arc<crate::git_format::pack_index::PackIndex>,
+    offsets: Arc<Offsets>,
+    descriptor: NativePackDescriptor,
+    payload: ArtifactRanges,
+    native: NativeScope,
+    preparing: AsyncMutex<()>,
+    // One bounded provider part, independent of pack/object/repository size.
+    part: Mutex<Option<(u64, Bytes)>>,
+}
+impl SparsePack {
+    pub(super) fn index_budget(p: NativePackDescriptor) -> Result<u64, NativeReadError> {
+        p.index
+            .size
+            .checked_add(
+                u64::from(p.object_count)
+                    .checked_mul(64)
+                    .ok_or(NativeReadError::Capacity)?,
+            )
+            .and_then(|n| n.checked_add(128 * 1024 + 12288))
+            .ok_or(NativeReadError::Capacity)
+    }
+    pub(super) async fn new(
+        cache: Arc<GitCache>,
+        store: &ArtifactStore,
+        descriptor: NativePackDescriptor,
+        native: NativeScope,
+        owner: ReadOwner,
+        cleanup: ReadOwner,
+    ) -> Result<Self, NativeReadError> {
+        let index = Arc::new(
+            cache
+                .native_index_owned(store, descriptor, owner.clone())
+                .await?,
+        );
+        let keep = owner.clone();
+        let held = cache.clone();
+        let scan = index.clone();
+        let claim = native
+            .try_admit(NativeWork::Read)
+            .map_err(ObjectReadError::from)?;
+        let tail = descriptor
+            .pack
+            .size
+            .checked_sub(descriptor.git_checksum.len() as u64)
+            .ok_or(MetadataError::Integrity)?;
+        let offsets = tokio::task::spawn_blocking(move || {
+            let (_owner, _claim) = (keep, claim);
+            held.reserve_native_spool(u64::from(scan.len()).checked_mul(64).and_then(|n| n.checked_add(128 * 1024)).ok_or(MetadataError::Limit)?)?;
+            let mut db = Connection::open(held.root().join("native-offsets.sqlite"))?;
+            db.execute_batch("PRAGMA page_size=4096; PRAGMA journal_mode=OFF; PRAGMA synchronous=OFF; PRAGMA cache_size=-256; PRAGMA mmap_size=0; PRAGMA temp_store=MEMORY; CREATE TABLE extents(offset BLOB PRIMARY KEY,ready INTEGER NOT NULL DEFAULT 0) WITHOUT ROWID;")?;
+            let tx = db.transaction()?;
+            {
+                let mut insert = tx.prepare("INSERT INTO extents(offset) VALUES(?1)")?;
+                for offset in scan.offsets() {
+                    let offset = offset?;
+                    if offset >= tail { return Err(MetadataError::Integrity); }
+                    insert.execute([offset.to_be_bytes().as_slice()])?;
+                }
+            }
+            tx.commit()?;
+            Ok::<_, MetadataError>(Arc::new(Offsets { db: Mutex::new(db), _cache: held }))
+        }).await??;
+        cache.sparse_native_owned(descriptor, owner.clone()).await?;
+        let payload = store
+            .ranges_owned(
+                descriptor.key(ArtifactKind::Pack)?,
+                descriptor.pack,
+                cleanup,
+            )
+            .await
+            .map_err(MetadataError::from)?;
+        Ok(Self {
+            cache,
+            index,
+            offsets,
+            descriptor,
+            payload,
+            native,
+            preparing: AsyncMutex::new(()),
+            part: Mutex::new(None),
+        })
+    }
+    async fn find(&self, oid: ObjectId, owner: ReadOwner) -> Result<u64, NativeReadError> {
+        let index = self.index.clone();
+        let claim = self
+            .native
+            .try_admit(NativeWork::Read)
+            .map_err(ObjectReadError::from)?;
+        Ok(tokio::task::spawn_blocking(move || {
+            let (_owner, _claim) = (owner, claim);
+            index
+                .find(oid)?
+                .map(|entry| entry.offset)
+                .ok_or(MetadataError::Integrity)
+        })
+        .await??)
+    }
+    async fn span(&self, offset: u64, owner: ReadOwner) -> Result<(bool, u64), NativeReadError> {
+        let spool = self.offsets.clone();
+        let tail = self.descriptor.pack.size - self.descriptor.git_checksum.len() as u64;
+        let claim = self
+            .native
+            .try_admit(NativeWork::Read)
+            .map_err(ObjectReadError::from)?;
+        Ok(tokio::task::spawn_blocking(move || {
+            let (_owner, _claim) = (owner, claim);
+            let db = spool.db.lock().map_err(|_| MetadataError::Integrity)?;
+            let (ready, end): (bool, Vec<u8>) = db.query_row("SELECT ready,coalesce((SELECT min(offset) FROM extents WHERE offset>?1),?2) FROM extents WHERE offset=?1", params![offset.to_be_bytes().as_slice(), tail.to_be_bytes().as_slice()], |row| Ok((row.get(0)?, row.get(1)?)))?;
+            let end = u64::from_be_bytes(end.try_into().map_err(|_| MetadataError::Integrity)?);
+            if end <= offset || end > tail { return Err(MetadataError::Integrity); }
+            Ok::<_, MetadataError>((ready, end))
+        }).await??)
+    }
+    async fn part(&self, index: u64, owner: ReadOwner) -> Result<Bytes, NativeReadError> {
+        if let Some((saved, bytes)) = &*self.part.lock().map_err(|_| MetadataError::Integrity)?
+            && *saved == index
+        {
+            return Ok(bytes.clone());
+        }
+        let bytes = self
+            .payload
+            .part_owned(index, owner)
+            .await
+            .map_err(MetadataError::from)?;
+        *self.part.lock().map_err(|_| MetadataError::Integrity)? = Some((index, bytes.clone()));
+        Ok(bytes)
+    }
+    async fn prefix(
+        &self,
+        offset: u64,
+        end: u64,
+        owner: ReadOwner,
+    ) -> Result<Vec<u8>, NativeReadError> {
+        let end = end.min(offset.checked_add(64).ok_or(MetadataError::Integrity)?);
+        let mut bytes = Vec::with_capacity((end - offset) as usize);
+        let mut at = offset;
+        while at < end {
+            let part = self.part(at / PART_BYTES as u64, owner.clone()).await?;
+            let start = (at % PART_BYTES as u64) as usize;
+            let count = (end - at).min(
+                part.len()
+                    .checked_sub(start)
+                    .ok_or(MetadataError::Integrity)? as u64,
+            ) as usize;
+            if count == 0 {
+                return Err(MetadataError::Integrity.into());
+            }
+            bytes.extend_from_slice(&part[start..start + count]);
+            at += count as u64;
+        }
+        Ok(bytes)
+    }
+    pub(super) async fn prepare(
+        &self,
+        oid: ObjectId,
+        owner: ReadOwner,
+    ) -> Result<(), NativeReadError> {
+        let _serial = self.preparing.lock().await;
+        let mut offset = self.find(oid, owner.clone()).await?;
+        let mut prepared = Vec::with_capacity(MAX_DELTA_DEPTH);
+        loop {
+            let (ready, end) = self.span(offset, owner.clone()).await?;
+            if ready {
+                break;
+            }
+            if prepared.len() == MAX_DELTA_DEPTH {
+                return Err(NativeReadError::Capacity);
+            }
+            let prefix = self.prefix(offset, end, owner.clone()).await?;
+            let base = base(&prefix, offset, self.descriptor.git_checksum.format())?;
+            let next = match base {
+                Base::None => None,
+                Base::Offset(value) => Some(value),
+                Base::Object(value) => Some(self.find(value, owner.clone()).await?),
+            };
+            if next.is_some_and(|next| next == offset || prepared.contains(&next)) {
+                return Err(MetadataError::Integrity.into());
+            }
+            let mut at = offset;
+            while at < end {
+                let part = self.part(at / PART_BYTES as u64, owner.clone()).await?;
+                let start = (at % PART_BYTES as u64) as usize;
+                let count = (end - at).min(
+                    part.len()
+                        .checked_sub(start)
+                        .ok_or(MetadataError::Integrity)? as u64,
+                ) as usize;
+                if count == 0 {
+                    return Err(MetadataError::Integrity.into());
+                }
+                self.cache
+                    .sparse_payload_owned(
+                        self.descriptor,
+                        at,
+                        part.slice(start..start + count),
+                        owner.clone(),
+                    )
+                    .await?;
+                at += count as u64;
+            }
+            prepared.push(offset);
+            let Some(next) = next else {
+                break;
+            };
+            offset = next;
+        }
+        let spool = self.offsets.clone();
+        let claim = self
+            .native
+            .try_admit(NativeWork::Read)
+            .map_err(ObjectReadError::from)?;
+        tokio::task::spawn_blocking(move || {
+            let (_owner, _claim) = (owner, claim);
+            let mut db = spool.db.lock().map_err(|_| MetadataError::Integrity)?;
+            let tx = db.transaction()?;
+            for offset in prepared {
+                tx.execute(
+                    "UPDATE extents SET ready=1 WHERE offset=?1",
+                    [offset.to_be_bytes().as_slice()],
+                )?;
+            }
+            tx.commit()?;
+            Ok::<_, MetadataError>(())
+        })
+        .await??;
+        Ok(())
+    }
+}
+enum Base {
+    None,
+    Offset(u64),
+    Object(ObjectId),
+}
+fn base(bytes: &[u8], offset: u64, format: ObjectFormat) -> Result<Base, MetadataError> {
+    let first = *bytes.first().ok_or(MetadataError::Integrity)?;
+    let kind = (first >> 4) & 7;
+    let mut at = 1;
+    let mut size = u64::from(first & 15);
+    let mut shift = 4;
+    let mut previous = first;
+    while previous & 128 != 0 {
+        previous = *bytes.get(at).ok_or(MetadataError::Integrity)?;
+        at += 1;
+        let value = u64::from(previous & 127)
+            .checked_mul(1_u64.checked_shl(shift).ok_or(MetadataError::Integrity)?)
+            .ok_or(MetadataError::Integrity)?;
+        size = size.checked_add(value).ok_or(MetadataError::Integrity)?;
+        shift += 7;
+    }
+    let _size = size; // Native Git validates the complete encoded stream.
+    match kind {
+        1..=4 => Ok(Base::None),
+        6 => {
+            let mut byte = *bytes.get(at).ok_or(MetadataError::Integrity)?;
+            at += 1;
+            let mut distance = u64::from(byte & 127);
+            while byte & 128 != 0 {
+                byte = *bytes.get(at).ok_or(MetadataError::Integrity)?;
+                at += 1;
+                distance = distance
+                    .checked_add(1)
+                    .and_then(|n| n.checked_mul(128))
+                    .and_then(|n| n.checked_add(u64::from(byte & 127)))
+                    .ok_or(MetadataError::Integrity)?;
+            }
+            let base = offset
+                .checked_sub(distance)
+                .filter(|base| *base >= 12 && *base < offset)
+                .ok_or(MetadataError::Integrity)?;
+            Ok(Base::Offset(base))
+        }
+        7 => Ok(Base::Object(
+            ObjectId::try_from(
+                bytes
+                    .get(at..at + format.bytes())
+                    .ok_or(MetadataError::Integrity)?,
+            )
+            .map_err(|_| MetadataError::Integrity)?,
+        )),
+        _ => Err(MetadataError::Integrity),
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/serving/session/native_base.rs b/crates/canopy-server/src/packs/publication/serving/session/native_base.rs
index 2969b1e7..810a7a4d 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/native_base.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/native_base.rs
@@ -53,7 +53,7 @@ impl ServingPin {
                             inner
                                 .context
                                 .files
-                                .install_workspace(cache.clone(), native, owner.clone())
+                                .install_pack_workspace(cache.clone(), native, owner.clone())
                                 .await?;
                             observation.refresh(&inner, &actor).await?;
                             job(&spool, owner.clone(), move |s| s.imported(native)).await?;
diff --git a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
index ab672874..8e91b002 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
@@ -3,11 +3,7 @@
 //! membership spool authorizes wants; file presence never grants reachability.
 use super::*;
 use crate::packs::{catalog::graph_spool::GraphSpool, metadata::MetadataError};
-use crate::{
-    ObjectId,
-    git_cache::GitCache,
-    git_objects::{GitObjects, ReadOwner},
-};
+use crate::{ObjectId, git_cache::GitCache, git_objects::ReadOwner};
 
 #[derive(Clone, Copy, Debug)]
 pub struct WorkspaceLimits {
@@ -58,6 +54,7 @@ impl NativeWorkspace {
     }
     // Raw paths/owners stay crate-private. A decoded DTO cannot mint a native
     // read capability; producers must authorize requests and use contains.
+    #[cfg(test)]
     pub(crate) fn git_dir(&self) -> std::path::PathBuf {
         self.core.cache.git_dir()
     }
@@ -129,18 +126,7 @@ impl NativeWorkspace {
                     if expected.size > limit as u64 {
                         return Err(ServingReadError::TooLarge);
                     }
-                    let mut objects =
-                        GitObjects::batch_owned(&workspace.git_dir(), &core.cache.native, owner)
-                            .map_err(crate::packs::catalog::NativeReadError::from)?;
-                    let body = objects
-                        .read_verified(expected, limit)
-                        .await
-                        .map_err(crate::packs::catalog::NativeReadError::from)?;
-                    objects
-                        .finish()
-                        .await
-                        .map_err(crate::packs::catalog::NativeReadError::from)?;
-                    Ok(Some(body))
+                    Ok(Some(inner.context.files.body(object, limit, owner).await?))
                 },
             )
             .await
@@ -173,6 +159,7 @@ impl ServingPin {
             return Err(ServingReadError::Context);
         }
         let roots = roots.map(<[ObjectId]>::to_vec);
+        let materialize = roots.is_some();
         let pin = self.clone();
         self.read_session(
             actor.clone(),
@@ -282,11 +269,6 @@ impl ServingPin {
                         let source = object.source.record.native();
                         source.validate(inner.context.repository(), inner.lease.format)?;
                         if !job(&spool, owner.clone(), move |s| s.pack_seen(source)).await? {
-                            inner
-                                .context
-                                .files
-                                .install_workspace(cache.clone(), source, owner.clone())
-                                .await?;
                             observation.refresh(&inner, &actor).await?;
                             job(&spool, owner.clone(), move |s| s.imported(source)).await?;
                             stats.packs = stats
@@ -299,6 +281,14 @@ impl ServingPin {
                                 .and_then(|n| n.checked_add(source.index.size))
                                 .ok_or(ServingReadError::TooLarge)?;
                         }
+                        if materialize {
+                            inner
+                                .context
+                                .files
+                                .install_workspace(cache.clone(), &object, owner.clone())
+                                .await?;
+                            observation.refresh(&inner, &actor).await?;
+                        }
                         let metadata = object.source.metadata;
                         let mut cursor = None;
                         loop {
@@ -389,3 +379,5 @@ impl Observation {
         Ok(())
     }
 }
+
+mod prepare;
diff --git a/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs b/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
new file mode 100644
index 00000000..cad7a0c5
--- /dev/null
+++ b/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
@@ -0,0 +1,365 @@
+//! Requested structural closure, then native Git's exact blob filter selection.
+use super::*;
+use crate::{ObjectKind, git_objects::GitObjectWalk};
+
+const SELECTION_PAGE: usize = 128;
+
+// Native size inspection consumes bodies even when the final response omits
+// them. Retain only the candidates admitted by the other combined filters.
+fn size_candidates(filter: &str, depth: usize) -> Result<Option<String>, ServingReadError> {
+    if depth > 128 {
+        return Err(ServingReadError::TooLarge);
+    }
+    if filter.starts_with("blob:limit=") {
+        return Ok(None);
+    }
+    let Some(parts) = filter.strip_prefix("combine:") else {
+        return Ok(Some(filter.into()));
+    };
+    let mut selected = Vec::new();
+    for part in parts.split('+') {
+        let decoded = percent_encoding::percent_decode_str(part)
+            .decode_utf8()
+            .map_err(|_| ServingReadError::Context)?;
+        if let Some(value) = size_candidates(&decoded, depth + 1)? {
+            selected.push(value);
+        }
+    }
+    match selected.len() {
+        0 => Ok(None),
+        1 => Ok(selected.pop()),
+        _ => Ok(Some(format!(
+            "combine:{}",
+            selected
+                .iter()
+                .map(|value| percent_encoding::utf8_percent_encode(
+                    value,
+                    percent_encoding::NON_ALPHANUMERIC
+                )
+                .to_string())
+                .collect::<Vec<_>>()
+                .join("+")
+        ))),
+    }
+}
+
+impl NativeWorkspace {
+    pub(crate) async fn prepare_advertisement(&self) -> Result<(), ServingReadError> {
+        let core = self.core.clone();
+        let actor = core.actor.clone();
+        self.core
+            .pin
+            .read_owned(actor.clone(), move |inner, deadline, permit| async move {
+                let owner: ReadOwner = Arc::new((inner.child(), permit, core.clone()));
+                let mut observation = Observation {
+                    deadline,
+                    next: Instant::now(),
+                };
+                let refs = inner.ref_snapshot().await?.clone();
+                let mut cursor =
+                    inner
+                        .context
+                        .indexes
+                        .refs()
+                        .cursor(refs.root.clone(), None, true)?;
+                while let Some(record) = cursor.next().await? {
+                    observation.refresh(&inner, &actor).await?;
+                    let mut id = record.state().oid.ok_or(ServingReadError::Context)?;
+                    let mut finished = false;
+                    // Peeling requires only the advertised object and nested tags,
+                    // never an unrelated commit's ancestors or tree history.
+                    for _ in 0..128 {
+                        let reader = inner.catalog().await?;
+                        let object = reader
+                            .lookup(id, &*inner.context.files, &*inner.context.files)
+                            .await?
+                            .ok_or(ServingReadError::Context)?;
+                        let kind = object.entry.header.object.kind;
+                        inner
+                            .context
+                            .files
+                            .install_workspace(core.cache.clone(), &object, owner.clone())
+                            .await?;
+                        observation.refresh(&inner, &actor).await?;
+                        if kind != ObjectKind::Tag {
+                            finished = true;
+                            break;
+                        }
+                        let metadata = object.source.metadata;
+                        let held = owner.clone();
+                        let edges = tokio::task::spawn_blocking(move || {
+                            let _owner = held;
+                            metadata.edges_after(id, None)
+                        })
+                        .await?
+                        .map_err(crate::packs::directory::index::IndexError::from)?;
+                        if edges.len() != 1 {
+                            return Err(ServingReadError::Context);
+                        }
+                        id = edges[0].child;
+                    }
+                    if !finished {
+                        return Err(ServingReadError::TooLarge);
+                    }
+                }
+                inner.observe(actor).await?;
+                Ok(())
+            })
+            .await
+    }
+
+    pub(crate) async fn prepare_fetch(
+        &self,
+        roots: Vec<ObjectId>,
+        filter: Option<String>,
+        needs_blob_sizes: bool,
+    ) -> Result<(), ServingReadError> {
+        if roots.is_empty() {
+            return Ok(());
+        }
+        if roots.len() > crate::git_input::MAX_FETCH_REQUEST_BYTES as usize / 40
+            || roots
+                .iter()
+                .any(|id| id.is_zero() || id.format() != self.object_format())
+        {
+            return Err(ServingReadError::Context);
+        }
+        let core = self.core.clone();
+        let actor = core.actor.clone();
+        self.core
+            .pin
+            .read_owned(actor.clone(), move |inner, deadline, permit| async move {
+                let owner: ReadOwner = Arc::new((inner.child(), permit, core.clone()));
+                let limits = WorkspaceLimits::default();
+                let spool = inner
+                    .context
+                    .files
+                    .graph_spool(
+                        limits.max_spool_bytes,
+                        limits.cache_kib,
+                        owner.clone(),
+                        owner.clone(),
+                    )
+                    .await
+                    .map_err(crate::packs::directory::index::IndexError::from)?;
+                let mut observation = Observation {
+                    deadline,
+                    next: Instant::now(),
+                };
+                let reader = inner.catalog().await?;
+                for ids in roots.chunks(PAGE_OBJECTS) {
+                    let ids = ids.to_vec();
+                    if !job(&core.spool, owner.clone(), {
+                        let ids = ids.clone();
+                        move |s| s.contains(&ids)
+                    })
+                    .await?
+                    .into_iter()
+                    .all(|present| present)
+                    {
+                        return Err(ServingReadError::Context);
+                    }
+                    job(&spool, owner.clone(), {
+                        let ids = ids.clone();
+                        move |s| s.add(&ids.into_iter().map(|id| (id, None)).collect::<Vec<_>>())
+                    })
+                    .await?;
+                    // Explicit blob wants override a filter. They must exist before
+                    // rev-list, which cannot start from a missing root object.
+                    for id in ids {
+                        observation.refresh(&inner, &actor).await?;
+                        let object = reader
+                            .lookup(id, &*inner.context.files, &*inner.context.files)
+                            .await?
+                            .ok_or(ServingReadError::Context)?;
+                        if object.entry.header.object.kind == ObjectKind::Blob {
+                            inner
+                                .context
+                                .files
+                                .install_workspace(core.cache.clone(), &object, owner.clone())
+                                .await?;
+                        }
+                    }
+                }
+                loop {
+                    observation.refresh(&inner, &actor).await?;
+                    let pending = job(&spool, owner.clone(), |s| s.pending()).await?;
+                    if pending.is_empty() {
+                        break;
+                    }
+                    for (id, expected) in &pending {
+                        observation.refresh(&inner, &actor).await?;
+                        let object = reader
+                            .lookup(*id, &*inner.context.files, &*inner.context.files)
+                            .await?
+                            .ok_or(ServingReadError::Context)?;
+                        let kind = object.entry.header.object.kind;
+                        if expected.is_some_and(|expected| expected != kind) {
+                            return Err(ServingReadError::Context);
+                        }
+                        let id = *id;
+                        job(&spool, owner.clone(), move |s| s.add(&[(id, Some(kind))])).await?;
+                        if kind != ObjectKind::Blob {
+                            inner
+                                .context
+                                .files
+                                .install_workspace(core.cache.clone(), &object, owner.clone())
+                                .await?;
+                        } else if needs_blob_sizes {
+                            inner
+                                .context
+                                .files
+                                .install_transient_workspace(
+                                    core.cache.clone(),
+                                    &object,
+                                    owner.clone(),
+                                )
+                                .await?;
+                        }
+                        let metadata = object.source.metadata;
+                        let mut cursor = None;
+                        loop {
+                            observation.refresh(&inner, &actor).await?;
+                            let metadata = metadata.clone();
+                            let held = owner.clone();
+                            let edges = tokio::task::spawn_blocking(move || {
+                                let _owner = held;
+                                metadata.edges_after(id, cursor)
+                            })
+                            .await?
+                            .map_err(crate::packs::directory::index::IndexError::from)?;
+                            if edges.is_empty() {
+                                break;
+                            }
+                            cursor = edges.last().map(|edge| edge.child);
+                            let count = edges.len();
+                            // An explicit tag naming a blob must remain peelable.
+                            // Only tag roots can introduce tags in this closure.
+                            if kind == ObjectKind::Tag {
+                                for edge in &edges {
+                                    if edge.expected_kind == ObjectKind::Blob {
+                                        let object = reader
+                                            .lookup(
+                                                edge.child,
+                                                &*inner.context.files,
+                                                &*inner.context.files,
+                                            )
+                                            .await?
+                                            .ok_or(ServingReadError::Context)?;
+                                        if object.entry.header.object.kind != ObjectKind::Blob {
+                                            return Err(ServingReadError::Context);
+                                        }
+                                        inner
+                                            .context
+                                            .files
+                                            .install_workspace(
+                                                core.cache.clone(),
+                                                &object,
+                                                owner.clone(),
+                                            )
+                                            .await?;
+                                    }
+                                }
+                            }
+                            job(&spool, owner.clone(), move |s| {
+                                s.add(
+                                    &edges
+                                        .into_iter()
+                                        .map(|edge| (edge.child, Some(edge.expected_kind)))
+                                        .collect::<Vec<_>>(),
+                                )
+                            })
+                            .await?;
+                            if count < PAGE_OBJECTS {
+                                break;
+                            }
+                        }
+                    }
+                    job(&spool, owner.clone(), move |s| s.done(&pending)).await?;
+                }
+                // Git sees all requested structural objects and decides tree/type/
+                // combine filters exactly. Size filters require all requested blobs
+                // first, since native Git cannot inspect an absent blob's size.
+                let selection_filter = if needs_blob_sizes {
+                    filter
+                        .as_deref()
+                        .map(|value| size_candidates(value, 0))
+                        .transpose()?
+                        .flatten()
+                } else {
+                    filter.clone()
+                };
+                let walk = if needs_blob_sizes {
+                    GitObjectWalk::selected_owned
+                } else {
+                    GitObjectWalk::missing_owned
+                };
+                let mut missing = walk(
+                    &core.cache.git_dir(),
+                    roots,
+                    selection_filter.as_deref(),
+                    &core.cache.native,
+                    owner.clone(),
+                )
+                .map_err(crate::packs::catalog::NativeReadError::from)?;
+                let mut ids = Vec::with_capacity(SELECTION_PAGE);
+                while let Some(id) = missing
+                    .next()
+                    .await
+                    .map_err(crate::packs::catalog::NativeReadError::from)?
+                {
+                    observation.refresh(&inner, &actor).await?;
+                    if needs_blob_sizes {
+                        let selected = reader
+                            .lookup(id, &*inner.context.files, &*inner.context.files)
+                            .await?
+                            .ok_or(ServingReadError::Context)?;
+                        if selected.entry.header.object.kind != ObjectKind::Blob {
+                            continue;
+                        }
+                    }
+                    ids.push(id);
+                    if ids.len() == SELECTION_PAGE {
+                        let page = std::mem::replace(&mut ids, Vec::with_capacity(SELECTION_PAGE));
+                        job(&spool, owner.clone(), move |s| s.retry(&page)).await?;
+                    }
+                }
+                missing
+                    .finish()
+                    .await
+                    .map_err(crate::packs::catalog::NativeReadError::from)?;
+                if !ids.is_empty() {
+                    job(&spool, owner.clone(), move |s| s.retry(&ids)).await?;
+                }
+                // Release rev-list's native admission before starting extraction;
+                // a one-slot read budget must not require a nested native child.
+                loop {
+                    let pending = job(&spool, owner.clone(), |s| s.pending()).await?;
+                    if pending.is_empty() {
+                        break;
+                    }
+                    for (id, expected) in &pending {
+                        observation.refresh(&inner, &actor).await?;
+                        let object = reader
+                            .lookup(*id, &*inner.context.files, &*inner.context.files)
+                            .await?
+                            .ok_or(ServingReadError::Context)?;
+                        if expected != &Some(ObjectKind::Blob)
+                            || object.entry.header.object.kind != ObjectKind::Blob
+                        {
+                            return Err(ServingReadError::Context);
+                        }
+                        inner
+                            .context
+                            .files
+                            .install_workspace(core.cache.clone(), &object, owner.clone())
+                            .await?;
+                    }
+                    job(&spool, owner.clone(), move |s| s.done(&pending)).await?;
+                }
+                inner.observe(actor).await?;
+                Ok(())
+            })
+            .await
+    }
+}
diff --git a/crates/canopy-server/src/packs/publication/staging_service/driver.rs b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
index 8711f75f..de3ee49d 100644
--- a/crates/canopy-server/src/packs/publication/staging_service/driver.rs
+++ b/crates/canopy-server/src/packs/publication/staging_service/driver.rs
@@ -9,6 +9,11 @@ pub(super) type DriverJoin =
 /// Retain diagnostics without retaining rejected preparation values or their
 /// physical credits. Both message bytes and source traversal are bounded.
 fn failure(error: &StagingError) -> StagingError {
+    // A known stopped attempt remains distinguishable from ambiguous command
+    // evidence. Wire callers may report failure only for this terminal state.
+    if matches!(error, StagingError::Inactive) {
+        return StagingError::Inactive;
+    }
     struct Message(String);
     impl Write for Message {
         fn write_str(&mut self, value: &str) -> std::fmt::Result {
diff --git a/crates/canopy-server/tests/multi_server/backup.rs b/crates/canopy-server/tests/multi_server/backup.rs
index c1767851..a3661daf 100644
--- a/crates/canopy-server/tests/multi_server/backup.rs
+++ b/crates/canopy-server/tests/multi_server/backup.rs
@@ -129,9 +129,9 @@ async fn backup_restores_git_lfs_and_collaboration_without_original_storage() ->
     let report = deployment
         .create_backup(id, backup.clone(), worker())
         .await?;
-    // Native backup counts all retained physical artifacts, including typed
-    // catalog/ref roots and closed command/audit headers, plus the LFS body.
-    assert_eq!(report.external_objects, 25);
+    // Artifact deduplication depends on native Git's packing and exact
+    // response bytes. Verify the physical inventory below rather than a
+    // platform-specific number of distinct content-addressed artifacts.
     assert_eq!(report.cells, 2);
     deployment
         .create_backup(id, backup.clone(), worker())
@@ -166,6 +166,32 @@ async fn backup_restores_git_lfs_and_collaboration_without_original_storage() ->
                 .ok_or("backup namespace differs")
         })
         .collect::<std::result::Result<std::collections::HashSet<_>, _>>()?;
+    let native_manifests = retained
+        .iter()
+        .filter(|path| !path.contains(".parts/"))
+        .count() as u64;
+    // Repository inventory includes its one retained LFS body. Count
+    // artifacts, not provider parts, against the report.
+    assert_eq!(report.external_objects, native_manifests);
+    assert_eq!(
+        retained
+            .iter()
+            .filter(|path| path.contains("/lfs/") && !path.contains(".parts/"))
+            .count(),
+        1
+    );
+    for family in ["git-packs", "git-catalogs", "git-inputs"] {
+        assert!(
+            retained.iter().any(|path| path.contains(family)),
+            "missing {family}"
+        );
+    }
+    assert!(
+        !retained
+            .iter()
+            .any(|path| path.contains(&hex::encode(digest))),
+        "unregistered creating input must not become a backup root"
+    );
     let creating_prefix = StorePath::from(format!("{source_prefix}/{native_repository}"));
     let creating = store
         .list(Some(&creating_prefix))
diff --git a/crates/canopy-server/tests/owner_restart.rs b/crates/canopy-server/tests/owner_restart.rs
index bb4866c6..5c98dff3 100644
--- a/crates/canopy-server/tests/owner_restart.rs
+++ b/crates/canopy-server/tests/owner_restart.rs
@@ -1,638 +1,76 @@
-use std::{
-    path::Path,
-    sync::Arc,
-    time::{SystemTime, UNIX_EPOCH},
-};
-
-use canopy_server::{
-    CanopyApplication, PushPlan, RefUpdate, RepositoryCell, RepositoryModule, build_descriptor,
-    git_gateway::GitGateway, http::GitHttpApi, repository_target,
-};
-use cellule_app::{CellApplication, CompiledApplication};
-use cellule_host::{CellNode, CellNodeBuilder};
-use cellule_ltx::{CellReplica, DiskBudget, Host, Limits};
-use cellule_runtime::primitives::sql::{SqlBatch, SqlCell, SqlStatement, SqlValue};
-use cellule_runtime::{
-    ApplicationId, CellClient, CellModule, Digest, Error, InvocationError, NodeLeaseGuard,
-    SessionId, TenantId, cell::catalog::CatalogEntry, cell::catalog::CatalogRole,
-    cell::catalog::CellCatalog, cell::worker::SqlWorkerPool, control::ControlState, control::Owner,
-    control::authority::CellAuthority, identity::IncarnationId, identity::NodeId,
-    ltx::CellStorageLayout, node::NodeAdvertisement, node::NodeCapacity, node::NodeDirectory,
-    node::NodeFailureDomain, node::VersionedNodeAdvertisement,
-};
-use cellule_store::Store;
-use ed25519_dalek::SigningKey;
-use object_store::{ObjectStore, memory::InMemory, path::Path as StorePath};
-use tokio::{net::TcpListener, process::Command, sync::oneshot};
-use tokio_util::sync::CancellationToken;
-
-mod support;
+//! Qualify owner restart through the production resident, not detached handles.
+#[path = "support/native_server.rs"]
+mod native_server;
+use native_server::*;
+use object_store::{ObjectStore, memory::InMemory};
+use std::sync::Arc;
 
 #[tokio::test(flavor = "multi_thread")]
-async fn a_second_node_clones_from_the_published_root_after_local_disk_loss()
--> Result<(), Box<dyn std::error::Error>> {
-    let application = Arc::new(CanopyApplication::compile(build_descriptor(
-        include_bytes!("../../../Cargo.lock"),
-        "owner-restart-test",
-    ))?);
-    let tenant = TenantId::from_bytes([31; 16]);
-    let application_id = ApplicationId::from_bytes([32; 16]);
-    let mut repository_id = [33; 16];
-    repository_id[6] = 0x73;
-    repository_id[8] = 0x83;
-    let target = repository_target(tenant, application_id, repository_id)?;
-    let object_store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
-    let layout = CellStorageLayout::new(
-        Store::new(Arc::clone(&object_store)),
-        StorePath::from("owner-restart-test"),
-        *application_id.as_bytes(),
-    );
-    let registry = application.registry();
-    let code = registry
-        .module_code(RepositoryModule::NAME)
-        .ok_or(Error::Registry("repository module missing"))?;
-    let catalog = CellCatalog::new(layout.clone(), tenant);
-    let proof = catalog
-        .provision(CatalogEntry::new(&target, CatalogRole::Sql, code, 1)?)
-        .await?;
-    let authority = CellAuthority::new(layout.clone());
-    let first_session = SessionId::from_bytes([34; 16]);
-    let observed = authority
-        .create_initial(
-            &proof,
-            IncarnationId::from_bytes([35; 16]),
-            Owner {
-                session: first_session,
-                endpoint: "https://first.canopy.test".into(),
-            },
-        )
-        .await?;
-    let first_disk = tempfile::TempDir::new()?;
-    let (first, directory, first_advertisement) =
-        node(Arc::clone(&application), &layout, first_session).await?;
-    let first_handle = first
-        .runtime()
-        .bootstrap(
-            proof,
-            replica(
-                &application,
-                &layout,
-                &target,
-                *observed.value().incarnation.as_bytes(),
-            )?,
-            authority.clone(),
-            observed,
-            first_disk.path().join("repository.sqlite"),
-            |transaction| {
-                transaction.execute_batch(include_str!("../src/schema.sql"))?;
-                Ok(())
-            },
-        )
-        .await?;
-    let app_handle = first.application_handle::<CanopyApplication>(
-        CellClient::local(Arc::clone(&registry), first_handle),
-        tenant,
-        application_id,
-    )?;
-    let repository = Arc::new(RepositoryCell::new(
-        &app_handle,
-        target.clone(),
-        repository_id,
-        canopy_server::ObjectFormat::Sha1,
-    )?);
-    let owner_identity = support::identity()?;
-    repository.ensure_owner(owner_identity, "canopy").await?;
-    let first_seed = push_cert_seed(&app_handle.sql::<RepositoryModule>(target.clone())?).await?;
-    assert_eq!(first_seed.len(), 32);
-    repository.ensure_owner(owner_identity, "canopy").await?;
-    assert_eq!(
-        push_cert_seed(&app_handle.sql::<RepositoryModule>(target.clone())?).await?,
-        first_seed
-    );
-    let first_gateway = Arc::new(GitGateway::new(
-        Arc::clone(&repository),
-        first_disk.path().to_path_buf(),
-        Arc::clone(&object_store),
-        DiskBudget::new(1 << 30),
-        canopy_server::native_resources::NativeResources::default(),
-    ));
-    let (address, stop, server) = serve(first_gateway).await?;
-    let first_url = format!("http://{address}/canopy/example.git");
-    let local = first_disk.path().join("local");
-    run_git(None, &["init", "-b", "main", path_str(&local)?]).await?;
-    run_git(Some(&local), &["config", "user.name", "Canopy Test"]).await?;
-    run_git(
-        Some(&local),
-        &["config", "user.email", "canopy@example.invalid"],
+async fn a_second_node_clones_from_the_published_root_after_local_disk_loss() -> Result {
+    let workspace = tempfile::TempDir::new()?;
+    let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+    let first_disk = workspace.path().join("first-owner");
+    let first = start(&first_disk, store.clone()).await?;
+    let url = create(&first, "restart", "sha1").await?;
+    let source = workspace.path().join("source");
+    git(None, &["init", "-b", "main", path(&source)?]).await?;
+    git(Some(&source), &["config", "user.name", "Restart Test"]).await?;
+    git(
+        Some(&source),
+        &["config", "user.email", "restart@example.invalid"],
     )
     .await?;
-    tokio::fs::write(local.join("README.md"), b"published Cell root\n").await?;
-    run_git(Some(&local), &["add", "README.md"]).await?;
-    let submodule = "74".repeat(20);
-    run_git(
-        Some(&local),
+    std::fs::write(source.join("README.md"), b"published Cell root\n")?;
+    git(Some(&source), &["add", "README.md"]).await?;
+    let gitlink = "74".repeat(20);
+    git(
+        Some(&source),
         &[
             "update-index",
             "--add",
             "--cacheinfo",
-            &format!("160000,{submodule},submodule"),
+            &format!("160000,{gitlink},submodule"),
         ],
     )
     .await?;
-    run_git(Some(&local), &["commit", "-m", "Initial commit"]).await?;
-    run_git(Some(&local), &["tag", "-a", "v1", "-m", "Annotated tag"]).await?;
-    let original_tag = run_git(Some(&local), &["rev-parse", "refs/tags/v1"]).await?;
-    run_git(
-        Some(&local),
+    git(Some(&source), &["commit", "-m", "Durable native graph"]).await?;
+    git(
+        Some(&source),
+        &["tag", "-a", "v1", "-m", "Native annotated tag"],
+    )
+    .await?;
+    git(
+        Some(&source),
         &[
-            "-c",
-            "http.extraHeader=Authorization: Bearer local-test-token",
             "push",
-            &first_url,
+            &url,
             "HEAD:refs/heads/main",
             "HEAD:refs/heads/reused",
             "refs/tags/v1",
         ],
     )
     .await?;
-    let original = run_git(Some(&local), &["rev-parse", "HEAD"]).await?;
-    tokio::fs::write(
-        local.join("accepted.txt"),
-        b"accepted ref in a mixed push\n",
-    )
-    .await?;
-    run_git(Some(&local), &["add", "accepted.txt"]).await?;
-    run_git(Some(&local), &["commit", "-m", "Mixed push commit"]).await?;
-    let partial_oid = run_git(Some(&local), &["rev-parse", "HEAD"]).await?;
-    let blob = run_git(Some(&local), &["rev-parse", "HEAD:accepted.txt"]).await?;
-    let blob = std::str::from_utf8(&blob)?.trim();
-    for (atomic, accepted, rejected) in [
-        (false, "partial", "rejected"),
-        (true, "atomic-accepted", "atomic-rejected"),
-    ] {
-        let mut push = Command::new("git");
-        push.current_dir(&local)
-            .env("GIT_TERMINAL_PROMPT", "0")
-            .args([
-                "-c",
-                "credential.helper=",
-                "-c",
-                "http.extraHeader=Authorization: Bearer local-test-token",
-                "push",
-            ]);
-        if atomic {
-            push.arg("--atomic");
-        }
-        let output = push
-            .args([
-                &first_url,
-                &format!("HEAD:refs/heads/{accepted}"),
-                &format!("+{blob}:refs/heads/{rejected}"),
-            ])
-            .output()
-            .await?;
-        assert!(!output.status.success());
-        assert_eq!(
-            repository
-                .ref_state(&format!("refs/heads/{accepted}"), None)
-                .await?
-                .output
-                .is_some(),
-            !atomic
-        );
-        assert!(
-            repository
-                .ref_state(&format!("refs/heads/{rejected}"), None)
-                .await?
-                .output
-                .is_none()
-        );
-        assert!(String::from_utf8_lossy(&output.stderr).contains("[remote rejected]"));
-    }
-    let original_ref = repository
-        .ref_state("refs/heads/reused", None)
-        .await?
-        .output;
-    let command = format!(
-        "{} {} refs/heads/reused\0report-status side-band-64k\n",
-        std::str::from_utf8(&original)?.trim(),
-        "0".repeat(40)
-    );
-    let delete_request = format!("{:04x}{command}0000", command.len() + 4).into_bytes();
-    let client = reqwest::Client::new();
-    let push_id = uuid::Uuid::new_v4().to_string();
-    let retry = |url: &str| {
-        client
-            .post(format!("{url}/git-receive-pack"))
-            .bearer_auth("local-test-token")
-            .header("Content-Type", "application/x-git-receive-pack-request")
-            .header("Idempotency-Key", &push_id)
-            .body(delete_request.clone())
-    };
-    let discarded = retry(&first_url).send().await?.error_for_status()?;
-    assert_eq!(
-        discarded
-            .headers()
-            .get("X-Canopy-Push-Id")
-            .and_then(|id| id.to_str().ok()),
-        Some(push_id.as_str())
-    );
-    drop(discarded);
-    let original_reply = retry(&first_url)
-        .send()
-        .await?
-        .error_for_status()?
-        .bytes()
-        .await?;
-    let deleted_ref = repository
-        .ref_state("refs/heads/reused", None)
-        .await?
-        .output;
-    assert!(
-        deleted_ref
-            .as_ref()
-            .is_some_and(|state| state.oid.is_none() && state.version == 2)
-    );
-    let refs_generation = repository.refs_page("", None).await?.output.generation;
-    let _ = stop.send(());
-    server.await??;
-    drop(repository);
-    drop(app_handle);
+    let refs = git(None, &["ls-remote", "--refs", &url]).await?;
     first.shutdown().await?;
-    directory
-        .withdraw(&first_advertisement, unix_now_ms()?)
-        .await?;
-    drop(first_disk);
-
-    let control = authority
-        .load(target.cell_id())
-        .await?
-        .ok_or("repository control is missing")?;
-    assert_eq!(control.value().state, ControlState::Idle);
-    assert!(control.value().root.is_some());
-    let second_session = SessionId::from_bytes([36; 16]);
-    let second_disk = tempfile::TempDir::new()?;
-    let (second, directory, second_advertisement) =
-        node(Arc::clone(&application), &layout, second_session).await?;
-    let proof = catalog
-        .lookup(target.cell_id())
-        .await?
-        .ok_or("repository catalog entry is missing")?;
-    let second_handle = second
-        .runtime()
-        .acquire_idle_restored(
-            proof,
-            replica(
-                &application,
-                &layout,
-                &target,
-                *control.value().incarnation.as_bytes(),
-            )?,
-            authority,
-            control,
-            second_disk.path().join("repository.sqlite"),
-            Owner {
-                session: second_session,
-                endpoint: "https://second.canopy.test".into(),
-            },
-        )
-        .await?;
-    let app_handle = second.application_handle::<CanopyApplication>(
-        CellClient::local(registry, second_handle),
-        tenant,
-        application_id,
-    )?;
-    let sql = app_handle.sql::<RepositoryModule>(target.clone())?;
-    let repository = Arc::new(RepositoryCell::new(
-        &app_handle,
-        target,
-        repository_id,
-        canopy_server::ObjectFormat::Sha1,
-    )?);
-    assert_eq!(push_cert_seed(&sql).await?, first_seed);
-    assert_eq!(
-        repository.refs_page("", None).await?.output.generation,
-        refs_generation
-    );
+    std::fs::remove_dir_all(&first_disk)?;
+    assert!(!first_disk.exists());
+    let second = start(&workspace.path().join("second-owner"), store).await?;
+    let url = format!("http://{}/canopy/restart.git", second.local_addr());
+    assert_eq!(git(None, &["ls-remote", "--refs", &url]).await?, refs);
+    let clone = workspace.path().join("clone");
+    git(None, &["clone", "--bare", &url, path(&clone)?]).await?;
+    git(Some(&clone), &["fsck", "--strict", "--full"]).await?;
     assert_eq!(
-        repository
-            .ref_state("refs/heads/reused", None)
-            .await?
-            .output,
-        deleted_ref
-    );
-    let second_gateway = Arc::new(GitGateway::new(
-        Arc::clone(&repository),
-        second_disk.path().to_path_buf(),
-        object_store,
-        DiskBudget::new(1 << 30),
-        canopy_server::native_resources::NativeResources::default(),
-    ));
-    let (address, stop, server) = serve(second_gateway).await?;
-    let second_url = format!("http://{address}/canopy/example.git");
-    let clone = second_disk.path().join("clone");
-    run_git(
-        None,
-        &[
-            "-c",
-            "http.extraHeader=Authorization: Bearer local-test-token",
-            "clone",
-            &second_url,
-            path_str(&clone)?,
-        ],
-    )
-    .await?;
-    assert_eq!(
-        tokio::fs::read(clone.join("README.md")).await?,
+        git(Some(&clone), &["show", "main:README.md"]).await?,
         b"published Cell root\n"
     );
-    assert_eq!(
-        run_git(Some(&clone), &["rev-parse", "HEAD"]).await?,
-        original
-    );
-    assert_eq!(
-        run_git(Some(&clone), &["rev-parse", "refs/tags/v1"]).await?,
-        original_tag
-    );
-    assert_eq!(
-        run_git(Some(&clone), &["ls-tree", "HEAD", "submodule"]).await?,
-        format!("160000 commit {submodule}\tsubmodule\n").as_bytes()
-    );
-    run_git(Some(&clone), &["fsck", "--full"]).await?;
-    assert_eq!(
-        run_git(Some(&clone), &["rev-parse", "refs/remotes/origin/partial"]).await?,
-        partial_oid
-    );
-    assert_eq!(
-        run_git(
-            Some(&clone),
-            &["show", "refs/remotes/origin/partial:accepted.txt"]
-        )
-        .await?,
-        b"accepted ref in a mixed push\n"
-    );
-    assert!(
-        repository
-            .ref_state("refs/heads/rejected", None)
-            .await?
-            .output
-            .is_none()
-    );
     assert!(
-        repository
-            .ref_state("refs/heads/atomic-accepted", None)
-            .await?
-            .output
-            .is_none()
+        String::from_utf8(git(Some(&clone), &["ls-tree", "main", "submodule"]).await?)?
+            .contains(&gitlink)
     );
-    assert!(
-        repository
-            .ref_state("refs/heads/atomic-rejected", None)
-            .await?
-            .output
-            .is_none()
-    );
-    assert!(
-        run_git(
-            Some(&clone),
-            &[
-                "-c",
-                "http.extraHeader=Authorization: Bearer local-test-token",
-                "ls-remote",
-                &second_url,
-                "refs/heads/reused",
-            ]
-        )
-        .await?
-        .is_empty()
-    );
-    run_git(
-        Some(&clone),
-        &[
-            "-c",
-            "http.extraHeader=Authorization: Bearer local-test-token",
-            "push",
-            &second_url,
-            "HEAD:refs/heads/reused",
-        ],
-    )
-    .await?;
-    let recreated = repository
-        .ref_state("refs/heads/reused", None)
-        .await?
-        .output;
-    assert!(
-        recreated
-            .as_ref()
-            .is_some_and(|state| state.oid.is_some() && state.version == 3)
-    );
-    assert_eq!(
-        retry(&second_url)
-            .send()
-            .await?
-            .error_for_status()?
-            .bytes()
-            .await?,
-        original_reply
-    );
-    assert_eq!(
-        repository
-            .ref_state("refs/heads/reused", None)
-            .await?
-            .output,
-        recreated
-    );
-    assert!(matches!(
-        repository
-            .finalize_push(
-                support::identity()?,
-                PushPlan {
-                    actor: "canopy".into(),
-                    updates: vec![RefUpdate {
-                        name: "refs/heads/reused".into(),
-                        expected: original_ref,
-                        new_oid: None
-                    }],
-                }
-            )
-            .await,
-        Err(InvocationError::Rejected(_))
-    ));
-    assert_eq!(
-        repository
-            .ref_state("refs/heads/reused", None)
-            .await?
-            .output,
-        recreated
-    );
-    client
-        .post(format!("{second_url}/git-receive-pack"))
-        .bearer_auth("local-test-token")
-        .header("Content-Type", "application/x-git-receive-pack-request")
-        .header("Idempotency-Key", uuid::Uuid::new_v4().to_string())
-        .body(delete_request.clone())
-        .send()
-        .await?
-        .error_for_status()?;
-    assert!(
-        repository
-            .ref_state("refs/heads/reused", None)
-            .await?
-            .output
-            .is_some_and(|state| state.oid.is_none() && state.version == 4)
-    );
-    let _ = stop.send(());
-    server.await??;
+    git(Some(&source), &["push", &url, ":refs/heads/reused"]).await?;
+    git(Some(&source), &["push", &url, "HEAD:refs/heads/reused"]).await?;
+    assert_eq!(git(None, &["ls-remote", "--refs", &url]).await?, refs);
     second.shutdown().await?;
-    directory
-        .withdraw(&second_advertisement, unix_now_ms()?)
-        .await?;
     Ok(())
 }
-
-async fn push_cert_seed(
-    sql: &SqlCell<RepositoryModule>,
-) -> Result<Vec<u8>, Box<dyn std::error::Error>> {
-    let output = sql
-        .query(
-            None,
-            SqlBatch {
-                statements: vec![SqlStatement {
-                    sql: "SELECT push_cert_seed FROM repository_identity WHERE singleton = 1"
-                        .into(),
-                    parameters: Vec::new(),
-                }],
-            },
-        )
-        .await?
-        .output;
-    match output
-        .first()
-        .and_then(|set| set.rows.first())
-        .map(Vec::as_slice)
-    {
-        Some([SqlValue::Blob(seed)]) => Ok(seed.clone()),
-        _ => Err("missing push certificate seed".into()),
-    }
-}
-
-async fn node(
-    application: Arc<CompiledApplication>,
-    layout: &CellStorageLayout,
-    session: SessionId,
-) -> Result<(CellNode, NodeDirectory, VersionedNodeAdvertisement), Box<dyn std::error::Error>> {
-    let fleet = Digest::from_bytes([41; 32]);
-    let image = Digest::from_bytes([42; 32]);
-    let registry = application.registry();
-    let directory = NodeDirectory::new(layout.clone(), fleet, image, registry.release_digest());
-    let now_ms = unix_now_ms()?;
-    let expires_at_ms = now_ms + 10_000;
-    let advertisement = NodeAdvertisement::sign(
-        NodeId::from_bytes(*session.as_bytes()),
-        session,
-        "https://canopy.test".into(),
-        fleet,
-        Digest::from_bytes([43; 32]),
-        image,
-        registry.release_digest(),
-        &SigningKey::from_bytes(&[44; 32]),
-        1,
-        now_ms,
-        expires_at_ms,
-        registry.module_digests(),
-        vec![1],
-        NodeFailureDomain::default(),
-        NodeCapacity::default(),
-    )?;
-    let observed = directory.create(advertisement, now_ms).await?;
-    let node = CellNodeBuilder::new(application)
-        .with_runtime(SqlWorkerPool::new(1, 4)?, 16 * 1024 * 1024)
-        .with_replica_host(Host::default().with_local_disk_budget(DiskBudget::new(1 << 30)))
-        .with_session(session)
-        .build()?;
-    node.install_task_group(CancellationToken::new(), CancellationToken::new())?;
-    node.install_node_lease(NodeLeaseGuard::new(now_ms, expires_at_ms)?)?;
-    Ok((node, directory, observed))
-}
-
-fn unix_now_ms() -> Result<i64, Box<dyn std::error::Error>> {
-    Ok(i64::try_from(
-        SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis(),
-    )?)
-}
-
-fn replica(
-    application: &CompiledApplication,
-    layout: &CellStorageLayout,
-    target: &cellule_runtime::CellTarget,
-    incarnation: [u8; 16],
-) -> Result<CellReplica, Box<dyn std::error::Error>> {
-    let cell_type = application
-        .cell_types()
-        .iter()
-        .find(|cell_type| cell_type.namespace() == target.namespace())
-        .ok_or("repository Cell declaration missing")?;
-    Ok(CellReplica::new(
-        layout.clone(),
-        *target.cell_id().as_bytes(),
-        incarnation,
-        Limits {
-            max_database_bytes: cell_type.database_limit_bytes(),
-            max_capture_bytes: cell_type.capture_limit_bytes(),
-            ..Limits::default()
-        },
-    )?)
-}
-
-async fn serve(
-    gateway: Arc<GitGateway>,
-) -> Result<
-    (
-        std::net::SocketAddr,
-        oneshot::Sender<()>,
-        tokio::task::JoinHandle<Result<(), std::io::Error>>,
-    ),
-    Box<dyn std::error::Error>,
-> {
-    let listener = TcpListener::bind("127.0.0.1:0").await?;
-    let address = listener.local_addr()?;
-    let api = Arc::new(GitHttpApi::new(
-        gateway,
-        "canopy".into(),
-        "example",
-        &format!("http://{address}"),
-        Arc::new(|| true),
-    )?);
-    let (stop, stopped) = oneshot::channel();
-    let server = tokio::spawn(async move {
-        axum::serve(listener, support::git_router(api))
-            .with_graceful_shutdown(async move {
-                let _ = stopped.await;
-            })
-            .await
-    });
-    Ok((address, stop, server))
-}
-
-fn path_str(path: &Path) -> Result<&str, &'static str> {
-    path.to_str().ok_or("path is not UTF-8")
-}
-
-async fn run_git(cwd: Option<&Path>, args: &[&str]) -> Result<Vec<u8>, Box<dyn std::error::Error>> {
-    let mut command = Command::new("git");
-    command.arg("-c").arg("credential.helper=");
-    command.env("GIT_TERMINAL_PROMPT", "0");
-    if let Some(cwd) = cwd {
-        command.current_dir(cwd);
-    }
-    let output = command.args(args).output().await?;
-    if !output.status.success() {
-        return Err(format!(
-            "git {} failed: {}",
-            args.join(" "),
-            String::from_utf8_lossy(&output.stderr)
-        )
-        .into());
-    }
-    Ok(output.stdout)
-}
diff --git a/crates/canopy-server/tests/repository_cell/main.rs b/crates/canopy-server/tests/repository_cell/main.rs
index da98d22c..2c50504d 100644
--- a/crates/canopy-server/tests/repository_cell/main.rs
+++ b/crates/canopy-server/tests/repository_cell/main.rs
@@ -1,484 +1,119 @@
-mod batches;
-mod branch_rules;
-mod bulk_refs;
-mod checks;
-mod chunks;
-mod default_branch;
-mod graph;
-mod issues;
-mod merge;
-#[path = "../support/objects.rs"]
-mod objects;
-mod pages;
-mod pulls;
-mod rebase;
-mod visibility;
-
-use std::{
-    sync::Arc,
-    time::{SystemTime, UNIX_EPOCH},
-};
-
-use canopy_server::{
-    CanopyApplication, ObjectKind, PushPlan, RefExpectation, RefUpdate, RepositoryCell,
-    RepositoryModule, build_descriptor, directory::TokenScope, object_id, repository_target,
-};
-use cellule_app::{ApplicationHandle, CellApplication};
-use cellule_ltx::{CellReplica, DiskBudget, Host, Limits};
-use cellule_runtime::{
-    ApplicationId, CellClient, CellModule, CellRuntime, CellTarget, Error, InvocationError,
-    MutationIdentity, NamespaceId, SessionId, TenantId, cell::catalog::CatalogEntry,
-    cell::catalog::CatalogRole, cell::catalog::CellCatalog, cell::worker::SqlWorkerPool,
-    control::Owner, control::authority::CellAuthority, identity::IncarnationId,
-    identity::RequestId, ltx::CellStorageLayout,
-};
-use cellule_store::Store;
-use object_store::{memory::InMemory, path::Path};
+//! Native catalog publication replaces loose-object ingestion and ref commands.
+#[path = "../support/native_server.rs"]
+mod native_server;
+use canopy_server::RepositoryModule;
+use cellule_runtime::CellModule;
+use native_server::*;
+use object_store::{ObjectStore, memory::InMemory};
+use std::sync::Arc;
 
 #[tokio::test(flavor = "multi_thread")]
-async fn repository_cell_publishes_objects_and_refs_atomically()
--> Result<(), Box<dyn std::error::Error>> {
-    let application = Arc::new(CanopyApplication::compile(build_descriptor(
-        include_bytes!("../../Cargo.toml"),
-        "repository-cell-test",
-    ))?);
-    let tenant = TenantId::from_bytes([2; 16]);
-    let application_id = ApplicationId::from_bytes([3; 16]);
-    let mut repository_id = [4; 16];
-    repository_id[6] = 0x74;
-    repository_id[8] = 0x84;
-    let target = repository_target(tenant, application_id, repository_id)?;
-    let layout = CellStorageLayout::new(
-        Store::new(Arc::new(InMemory::new())),
-        Path::from("canopy-test"),
-        *application_id.as_bytes(),
+async fn repository_cell_publishes_objects_and_refs_atomically() -> Result {
+    // Hard cutover: fixture setup must not resurrect retired PutObjects (5).
+    assert!(
+        !RepositoryModule
+            .descriptor()
+            .commands
+            .iter()
+            .any(|op| op.id == 5)
     );
-    let registry = application.registry();
-    let code = registry
-        .module_code(RepositoryModule::NAME)
-        .ok_or(Error::Registry("repository module missing"))?;
-    let proof = CellCatalog::new(layout.clone(), tenant)
-        .provision(CatalogEntry::new(&target, CatalogRole::Sql, code, 1)?)
+    let workspace = tempfile::TempDir::new()?;
+    let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+    let server = start(&workspace.path().join("resident"), store).await?;
+    for format in ["sha1", "sha256"] {
+        let name = format!("atomic-{format}");
+        let url = create(&server, &name, format).await?;
+        let source = workspace.path().join(format!("source-{format}"));
+        git(
+            None,
+            &[
+                "init",
+                &format!("--object-format={format}"),
+                "-b",
+                "main",
+                path(&source)?,
+            ],
+        )
         .await?;
-    let authority = CellAuthority::new(layout.clone());
-    let incarnation = IncarnationId::from_bytes([5; 16]);
-    let session = SessionId::from_bytes([6; 16]);
-    let observed = authority
-        .create_initial(
-            &proof,
-            incarnation,
-            Owner {
-                session,
-                endpoint: "https://canopy.test".into(),
-            },
+        git(Some(&source), &["config", "user.name", "Atomic Test"]).await?;
+        git(
+            Some(&source),
+            &["config", "user.email", "atomic@example.invalid"],
         )
         .await?;
-    let files = tempfile::TempDir::new()?;
-    let runtime = CellRuntime::new_with_replica_host(
-        SqlWorkerPool::new(1, 4)?,
-        16 * 1024 * 1024,
-        session,
-        Host::default().with_local_disk_budget(DiskBudget::new(1 << 30)),
-    )?;
-    let outcome: Result<(), Box<dyn std::error::Error>> = async {
-        let handle = runtime
-            .bootstrap(
-                proof,
-                CellReplica::new(
-                    layout,
-                    *target.cell_id().as_bytes(),
-                    *incarnation.as_bytes(),
-                    Limits::default(),
-                )?,
-                authority,
-                observed,
-                files.path().join("repository.sqlite"),
-                |transaction| {
-                    transaction.execute_batch(include_str!("../../src/schema.sql"))?;
-                    Ok(())
-                },
-            )
-            .await?;
-        let application_handle = ApplicationHandle::<CanopyApplication>::new(
-            CellClient::local(registry, handle),
-            application,
-            tenant,
-            application_id,
-        )?;
-        assert!(
-            application_handle
-                .sql::<RepositoryModule>(CellTarget::new(
-                    tenant,
-                    application_id,
-                    canopy_server::REPOSITORIES,
-                    &[0; 16],
-                )?)
-                .is_err()
-        );
-        assert!(
-            application_handle
-                .sql::<RepositoryModule>(CellTarget::new(
-                    tenant,
-                    application_id,
-                    canopy_server::REPOSITORIES,
-                    &[0; 4],
-                )?)
-                .is_err()
-        );
-        assert!(
-            application_handle
-                .sql::<RepositoryModule>(CellTarget::new(
-                    TenantId::from_bytes([99; 16]),
-                    application_id,
-                    canopy_server::REPOSITORIES,
-                    target.partition(),
-                )?)
-                .is_err()
-        );
-        assert!(
-            application_handle
-                .sql::<RepositoryModule>(CellTarget::new(
-                    tenant,
-                    application_id,
-                    NamespaceId::from_bytes([99; 16]),
-                    target.partition(),
-                )?)
-                .is_err()
-        );
-        let mut other_id = repository_id;
-        other_id[0] ^= 1;
-        assert!(matches!(
-            RepositoryCell::new(&application_handle, target.clone(), other_id, canopy_server::ObjectFormat::Sha1),
-            Err(Error::Identity("repository UUID differs from Cell target"))
-        ));
-        let graph_sql = application_handle.sql::<RepositoryModule>(target.clone())?;
-        let repository = RepositoryCell::new(&application_handle, target.clone(), repository_id, canopy_server::ObjectFormat::Sha1)?;
-        let empty = repository.refs_page("", None).await?.output;
-        assert_eq!(empty.generation, 0);
-        assert!(empty.refs.is_empty());
-        let body = b"Canopy stores ordinary Git objects in a Cell";
-        let now_ms = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis())?;
-        let identity = |byte| MutationIdentity {
-            request_id: RequestId::from_bytes([byte; 16]),
-            issued_at_ms: now_ms,
-            expires_at_ms: now_ms + 60_000,
-        };
-        repository
-            .ensure_owner(
-                MutationIdentity {
-                    request_id: RequestId::from_bytes([11; 16]),
-                    issued_at_ms: now_ms,
-                    expires_at_ms: now_ms + 60_000,
-                },
-                "canopy",
-            )
-            .await?;
-        pages::exercise(&repository, &graph_sql).await?;
-        batches::exercise(&repository, &graph_sql).await?;
-        issues::exercise(&repository).await?;
-        default_branch::empty(&repository).await?;
-        let committed = objects::put(&repository,
-                MutationIdentity {
-                    request_id: RequestId::from_bytes([7; 16]),
-                    issued_at_ms: now_ms,
-                    expires_at_ms: now_ms + 60_000,
-                },
-                ObjectKind::Blob,
-                body,
-            )
-            .await?;
-        assert_eq!(committed.output, object_id(canopy_server::ObjectFormat::Sha1, ObjectKind::Blob, body));
-        assert_eq!(
-            repository
-                .object(committed.output, Some(committed.receipt))
-                .await?
-                .output,
-            Some((ObjectKind::Blob, body.to_vec()))
-        );
-        let tree = objects::put(&repository, identity(26), ObjectKind::Tree, b"")
-            .await?.output;
-        let first_commit = format!("tree {}\nauthor Canopy <test@example.invalid> 0 +0000\ncommitter Canopy <test@example.invalid> 0 +0000\n\nFirst\n", hex::encode(tree));
-        let committed = objects::put(&repository, identity(27), ObjectKind::Commit, first_commit.as_bytes())
-            .await?;
-        checks::exercise(&repository, committed.output).await?;
-        let second_commit = format!("tree {}\nparent {}\nauthor Canopy <test@example.invalid> 1 +0000\ncommitter Canopy <test@example.invalid> 1 +0000\n\nSecond\n", hex::encode(tree), hex::encode(committed.output));
-        let next = objects::put(&repository,
-                MutationIdentity {
-                    request_id: RequestId::from_bytes([8; 16]),
-                    issued_at_ms: now_ms,
-                    expires_at_ms: now_ms + 60_000,
-                },
-                ObjectKind::Commit,
-                second_commit.as_bytes(),
-            )
-            .await?;
-        // The empty-ref fast path still rejects an ancestor and descendant in
-        // the same atomic plan, with no generation change or partial writes.
-        let before = repository.refs_page("", None).await?.output;
-        assert!(before.refs.is_empty());
-        assert!(matches!(
-            repository
-                .finalize_push(
-                    identity(28),
-                    PushPlan {
-                        actor: "canopy".into(),
-                        updates: ["refs/tags/conflict", "refs/tags/conflict/child"]
-                            .into_iter()
-                            .map(|name| RefUpdate {
-                                name: name.into(),
-                                expected: None,
-                                new_oid: Some(committed.output),
-                            })
-                            .collect(),
-                    },
-                )
-                .await,
-            Err(InvocationError::Rejected(_))
-        ));
-        assert_eq!(
-            repository.default_branch(None).await?.output.generation,
-            before.generation
-        );
-        let published = repository
-            .finalize_push(
-                MutationIdentity {
-                    request_id: RequestId::from_bytes([9; 16]),
-                    issued_at_ms: now_ms,
-                    expires_at_ms: now_ms + 60_000,
-                },
-                PushPlan {
-                    actor: "canopy".into(),
-                    updates: vec![
-                        RefUpdate {
-                            name: "refs/heads/main".into(),
-                            expected: None,
-                            new_oid: Some(committed.output),
-                        },
-                        RefUpdate {
-                            name: "refs/heads/other".into(),
-                            expected: None,
-                            new_oid: Some(next.output),
-                        },
-                    ],
-                },
-            )
-            .await?;
-        assert!(published.output);
-        let expected_main = RefExpectation {
-            oid: Some(committed.output),
-            version: 1,
-        };
-        assert_eq!(
-            repository
-                .ref_state("refs/heads/main", Some(published.receipt))
-                .await?
-                .output,
-            Some(expected_main.clone())
-        );
-        let conflict = repository
-            .finalize_push(
-                MutationIdentity {
-                    request_id: RequestId::from_bytes([10; 16]),
-                    issued_at_ms: now_ms,
-                    expires_at_ms: now_ms + 60_000,
-                },
-                PushPlan {
-                    actor: "canopy".into(),
-                    updates: vec![
-                        RefUpdate {
-                            name: "refs/heads/main".into(),
-                            expected: Some(RefExpectation {
-                                oid: Some(committed.output),
-                                version: 2,
-                            }),
-                            new_oid: Some(next.output),
-                        },
-                        RefUpdate {
-                            name: "refs/tags/rejected".into(),
-                            expected: None,
-                            new_oid: Some(next.output),
-                        },
-                    ],
-                },
-            )
-            .await;
-        assert!(matches!(conflict, Err(InvocationError::Rejected(_))));
-        assert_eq!(
-            repository.ref_state("refs/heads/main", None).await?.output,
-            Some(expected_main)
-        );
-        assert_eq!(
-            repository
-                .ref_state("refs/tags/rejected", None)
-                .await?
-                .output,
-            None
-        );
-        assert!(
-            repository
-                .grant_member(identity(12), "canopy", "reader", TokenScope::Read)
-                .await?
-                .output
-        );
-        assert_eq!(repository.collaborators("canopy", None).await?.output, Some(vec![canopy_server::Collaborator { account: "reader".into(), role: TokenScope::Read }]));
-        for actor in ["reader", "outsider"] {
-            assert!(repository.collaborators(actor, None).await?.output.is_none());
+        // Cross the selected-object page boundary with native delta candidates.
+        for n in 0..600_u64 {
+            let mut body = vec![b'x'; 8192];
+            body[..8].copy_from_slice(&n.to_le_bytes());
+            std::fs::write(source.join(format!("file-{n:03}")), body)?;
         }
-        let reader_plan = PushPlan {
-            actor: "reader".into(),
-            updates: vec![RefUpdate {
-                name: "refs/tags/reader".into(),
-                expected: None,
-                new_oid: Some(next.output),
-            }],
-        };
-        assert!(matches!(
-            repository
-                .finalize_push(identity(13), reader_plan.clone())
-                .await,
-            Err(InvocationError::Rejected(_))
-        ));
-        assert!(
-            repository
-                .grant_member(identity(14), "canopy", "reader", TokenScope::Write)
-                .await?
-                .output
-        );
-        assert!(
-            repository
-                .finalize_push(identity(15), reader_plan.clone())
-                .await?
-                .output
-        );
-        assert!(
-            repository
-                .revoke_member(identity(16), "canopy", "reader")
-                .await?
-                .output
-        );
-        assert_eq!(repository.access_level("reader", None).await?.output, None);
-        assert_eq!(repository.collaborators("canopy", None).await?.output, Some(Vec::new()));
-        let after_revoke = PushPlan {
-            actor: "reader".into(),
-            updates: vec![RefUpdate {
-                name: "refs/tags/after-revoke".into(),
-                expected: None,
-                new_oid: Some(next.output),
-            }],
-        };
-        assert!(matches!(
-            repository.finalize_push(identity(17), after_revoke).await,
-            Err(InvocationError::Rejected(_))
-        ));
-        assert!(
-            repository
-                .ref_state("refs/tags/after-revoke", None)
-                .await?
-                .output
-                .is_none()
-        );
-        let original_state = repository.ref_state("refs/heads/main", None).await?.output;
-        let plan = |expected, new_oid| PushPlan {
-            actor: "canopy".into(),
-            updates: vec![RefUpdate {
-                name: "refs/heads/main".into(),
-                expected,
-                new_oid,
-            }],
-        };
-        repository
-            .finalize_push(identity(18), plan(original_state.clone(), None))
-            .await?;
-        let deleted_state = repository.ref_state("refs/heads/main", None).await?.output;
-        repository
-            .finalize_push(
-                identity(19),
-                plan(deleted_state.clone(), Some(committed.output)),
-            )
-            .await?;
-        assert!(matches!(
-            repository
-                .finalize_push(identity(20), plan(original_state, Some(next.output)))
-                .await,
-            Err(InvocationError::Rejected(_))
-        ));
-        let recreated = repository.ref_state("refs/heads/main", None).await?.output;
+        git(Some(&source), &["add", "."]).await?;
+        git(Some(&source), &["commit", "-m", "Native paged objects"]).await?;
+        git(
+            Some(&source),
+            &[
+                "push",
+                "--atomic",
+                &url,
+                "HEAD:refs/heads/main",
+                "HEAD:refs/heads/sibling",
+            ],
+        )
+        .await?;
+        let refs = git(None, &["ls-remote", "--refs", &url]).await?;
+        let clone = workspace.path().join(format!("clone-{format}"));
+        git(None, &["clone", "--bare", &url, path(&clone)?]).await?;
+        git(Some(&clone), &["fsck", "--strict", "--full"]).await?;
         assert_eq!(
-            recreated,
-            Some(RefExpectation {
-                oid: Some(committed.output),
-                version: 3
-            })
-        );
-        repository
-            .finalize_push(identity(21), plan(recreated, None))
+            git(Some(&clone), &["rev-parse", "main"]).await?,
+            git(Some(&source), &["rev-parse", "HEAD"]).await?
+        );
+        let api = format!("http://{}/api/repositories/{name}", server.local_addr());
+        let client = reqwest::Client::new();
+        let repository: serde_json::Value = client
+            .get(&api)
+            .bearer_auth(TOKEN)
+            .send()
+            .await?
+            .error_for_status()?
+            .json()
             .await?;
-        assert!(matches!(
-            repository
-                .finalize_push(identity(22), plan(deleted_state, Some(next.output)))
-                .await,
-            Err(InvocationError::Rejected(_))
-        ));
-        let deleted = repository.ref_state("refs/heads/main", None).await?.output;
-        assert_eq!(
-            deleted,
-            Some(RefExpectation {
-                oid: None,
-                version: 4
-            })
-        );
-        let child = RefUpdate {
-            name: "refs/heads/main/topic".into(),
-            expected: None,
-            new_oid: Some(next.output),
-        };
-        repository
-            .finalize_push(
-                identity(23),
-                PushPlan {
-                    actor: "canopy".into(),
-                    updates: vec![child],
-                },
+        client
+            .put(format!("{api}/branch-rules"))
+            .bearer_auth(TOKEN)
+            .json(
+                &serde_json::json!({"repository_id":repository["repository_id"],"rule":{
+                "reference":"refs/heads/main","expected_version":0,"enabled":true,
+                "deny_deletions":false,"fast_forward_only":false,"require_pull_request":true,
+                "required_approvals":0,"required_checks":[]}}),
             )
-            .await?;
-        assert!(matches!(
-            repository
-                .finalize_push(identity(24), plan(deleted.clone(), Some(committed.output)))
-                .await,
-            Err(InvocationError::Rejected(_))
-        ));
-        let child = repository
-            .ref_state("refs/heads/main/topic", None)
+            .send()
             .await?
-            .output;
-        let mut replacement = plan(deleted, Some(committed.output));
-        replacement.updates.push(RefUpdate {
-            name: "refs/heads/main/topic".into(),
-            expected: child,
-            new_oid: None,
-        });
-        repository.finalize_push(identity(25), replacement).await?;
-        assert_eq!(
-            repository.ref_state("refs/heads/main", None).await?.output,
-            Some(RefExpectation {
-                oid: Some(committed.output),
-                version: 5
-            })
-        );
-        default_branch::verify(&repository).await?;
-        visibility::verify(&repository).await?;
-        graph::verify(&repository, &graph_sql, &application_handle, &target).await?;
-        branch_rules::verify(&repository, &graph_sql, &application_handle, &target).await?;
-        pulls::verify(&repository).await?;
-        merge::verify(&repository, &graph_sql, &application_handle, &target).await?;
-        rebase::verify(&repository, &graph_sql).await?;
-        chunks::exercise(&repository, &graph_sql).await?;
-        bulk_refs::verify(&repository).await?;
-        Ok(())
+            .error_for_status()?;
+        std::fs::write(source.join("later"), b"must not publish a sibling alone")?;
+        git(Some(&source), &["add", "."]).await?;
+        git(
+            Some(&source),
+            &["commit", "-m", "Reject entire native plan"],
+        )
+        .await?;
+        let rejected = command(
+            Some(&source),
+            &[
+                "push",
+                "--atomic",
+                &url,
+                "HEAD:refs/heads/main",
+                "HEAD:refs/heads/new-sibling",
+            ],
+        )
+        .output()
+        .await?;
+        assert!(!rejected.status.success());
+        let error = String::from_utf8(rejected.stderr)?;
+        assert!(error.contains("[remote rejected]"), "{error}");
+        assert_eq!(git(None, &["ls-remote", "--refs", &url]).await?, refs);
     }
-    .await;
-    let shutdown = runtime.shutdown().await;
-    outcome?;
-    shutdown?;
+    server.shutdown().await?;
     Ok(())
 }
diff --git a/crates/canopy-server/tests/smart_http/main.rs b/crates/canopy-server/tests/smart_http/main.rs
index d1c7c3b5..57734286 100644
--- a/crates/canopy-server/tests/smart_http/main.rs
+++ b/crates/canopy-server/tests/smart_http/main.rs
@@ -1,544 +1,86 @@
-use std::{path::Path, sync::Arc};
-
-use canopy_server::{
-    CanopyApplication, ObjectStorage, RepositoryCell, RepositoryModule, build_descriptor,
-    directory::TokenScope, git_gateway::GitGateway, http::GitHttpApi, lfs::LfsError,
-    repository_target,
-};
-use cellule_app::{ApplicationHandle, CellApplication};
-use cellule_ltx::{CellReplica, DiskBudget, Host, Limits};
-use cellule_runtime::{
-    ApplicationId, CellClient, CellModule, CellRuntime, Error, SessionId, TenantId,
-    cell::catalog::CatalogEntry, cell::catalog::CatalogRole, cell::catalog::CellCatalog,
-    cell::worker::SqlWorkerPool, control::Owner, control::authority::CellAuthority,
-    identity::IncarnationId, ltx::CellStorageLayout,
-};
-use cellule_store::Store;
-use object_store::{ObjectStore, memory::InMemory, path::Path as StorePath};
-use sha2::{Digest as _, Sha256};
-use tokio::{net::TcpListener, process::Command, sync::oneshot};
-
-#[path = "../support/paused_blobs.rs"]
-mod paused_blobs;
-#[path = "../support/mod.rs"]
-mod support;
-
-mod cache_admission;
-mod cache_reuse;
-mod encoded_input;
-mod native_resources;
-mod publication;
-mod push_uploads;
-mod ref_snapshots;
+//! Stock Git qualification against resident-owned native publication.
+#[path = "../support/native_server.rs"]
+mod native_server;
+use native_server::*;
+use object_store::{ObjectStore, memory::InMemory};
+use std::sync::Arc;
 
 #[tokio::test(flavor = "multi_thread")]
-async fn stock_git_push_and_clone_are_backed_by_one_repository_cell()
--> Result<(), Box<dyn std::error::Error>> {
-    let _ = tracing_subscriber::fmt()
-        .with_env_filter("canopy_server=warn")
-        .with_test_writer()
-        .try_init();
-    let application = Arc::new(CanopyApplication::compile(build_descriptor(
-        include_bytes!("../../../../Cargo.lock"),
-        "smart-http-test",
-    ))?);
-    let tenant = TenantId::from_bytes([21; 16]);
-    let application_id = ApplicationId::from_bytes([22; 16]);
-    let mut repository_id = [23; 16];
-    repository_id[6] = 0x73;
-    repository_id[8] = 0x83;
-    let target = repository_target(tenant, application_id, repository_id)?;
-    let layout = CellStorageLayout::new(
-        Store::new(Arc::new(InMemory::new())),
-        StorePath::from("smart-http-test"),
-        *application_id.as_bytes(),
-    );
-    let registry = application.registry();
-    let code = registry
-        .module_code(RepositoryModule::NAME)
-        .ok_or(Error::Registry("repository module missing"))?;
-    let proof = CellCatalog::new(layout.clone(), tenant)
-        .provision(CatalogEntry::new(&target, CatalogRole::Sql, code, 1)?)
-        .await?;
-    let authority = CellAuthority::new(layout.clone());
-    let incarnation = IncarnationId::from_bytes([24; 16]);
-    let session = SessionId::from_bytes([25; 16]);
-    let observed = authority
-        .create_initial(
-            &proof,
-            incarnation,
-            Owner {
-                session,
-                endpoint: "https://canopy.test".into(),
-            },
-        )
-        .await?;
-    let scratch = tempfile::TempDir::new()?;
-    let runtime = CellRuntime::new_with_replica_host(
-        SqlWorkerPool::new(1, 4)?,
-        16 * 1024 * 1024,
-        session,
-        Host::default().with_local_disk_budget(DiskBudget::new(1 << 30)),
-    )?;
-    let outcome: Result<(), Box<dyn std::error::Error>> = async {
-        let handle = runtime
-            .bootstrap(
-                proof,
-                CellReplica::new(
-                    layout,
-                    *target.cell_id().as_bytes(),
-                    *incarnation.as_bytes(),
-                    Limits::default(),
-                )?,
-                authority,
-                observed,
-                scratch.path().join("repository.sqlite"),
-                |transaction| {
-                    transaction.execute_batch(include_str!("../../src/schema.sql"))?;
-                    Ok(())
-                },
-            )
-            .await?;
-        let application_handle = ApplicationHandle::<CanopyApplication>::new(
-            CellClient::local(registry, handle),
-            application,
-            tenant,
-            application_id,
-        )?;
-        let repository = Arc::new(RepositoryCell::new(
-            &application_handle,
-            target,
-            repository_id,
-            canopy_server::ObjectFormat::Sha1,
-        )?);
-        repository
-            .ensure_owner(support::identity()?, "canopy")
-            .await?;
-        let paused_blobs = Arc::new(paused_blobs::PausedBlobs::default());
-        let blob_store: Arc<dyn ObjectStore> = paused_blobs.clone();
-        let disk_budget = DiskBudget::new(1 << 30);
-        let gateway = Arc::new(GitGateway::new(
-            Arc::clone(&repository),
-            scratch.path().to_path_buf(),
-            Arc::clone(&blob_store),
-            disk_budget.clone(),
-            canopy_server::native_resources::NativeResources::default(),
-        ));
-        let invalid_oid = [0; 32];
-        assert!(matches!(
-            gateway
-                .lfs()
-                .put("canopy", invalid_oid, Body::from("wrong digest"), None)
-                .await,
-            Err(LfsError::Corrupt)
-        ));
-        assert!(repository.lfs_object(invalid_oid).await?.output.is_none());
-        let denied_body = b"reader LFS object";
-        let denied_oid: [u8; 32] = Sha256::digest(denied_body).into();
-        assert!(matches!(
-            gateway
-                .lfs()
-                .put(
-                    "reader",
-                    denied_oid,
-                    Body::from(denied_body.as_slice()),
-                    None
-                )
-                .await,
-            Err(LfsError::Forbidden)
-        ));
-        assert!(repository.lfs_object(denied_oid).await?.output.is_none());
-        repository
-            .grant_member(support::identity()?, "canopy", "reader", TokenScope::Write)
-            .await?;
-        gateway
-            .lfs()
-            .put(
-                "reader",
-                denied_oid,
-                Body::from(denied_body.as_slice()),
-                None,
-            )
-            .await?;
-        assert!(repository.lfs_object(denied_oid).await?.output.is_some());
-        repository
-            .revoke_member(support::identity()?, "canopy", "reader")
-            .await?;
-        let revoked_body = b"revoked LFS object";
-        let revoked_oid: [u8; 32] = Sha256::digest(revoked_body).into();
-        assert!(matches!(
-            gateway
-                .lfs()
-                .put(
-                    "reader",
-                    revoked_oid,
-                    Body::from(revoked_body.as_slice()),
-                    None
-                )
-                .await,
-            Err(LfsError::Forbidden)
-        ));
-        assert!(repository.lfs_object(revoked_oid).await?.output.is_none());
-        push_uploads::verify(&gateway).await?;
-        let listener = TcpListener::bind("127.0.0.1:0").await?;
-        let address = listener.local_addr()?;
-        let teardown_gateway = Arc::clone(&gateway);
-        let api = Arc::new(GitHttpApi::new(
-            gateway,
-            "canopy".into(),
-            "example",
-            &format!("http://{address}"),
-            Arc::new(|| true),
-        )?);
-        let (stop_tx, stop_rx) = oneshot::channel::<()>();
-        let server = tokio::spawn(async move {
-            axum::serve(listener, support::git_router(api))
-                .with_graceful_shutdown(async move {
-                    let _ = stop_rx.await;
-                })
-                .await
-        });
-        let url = format!("http://{address}/canopy/example.git");
-        let unauthenticated = Command::new("git")
-            .args(["-c", "credential.helper=", "ls-remote", &url])
-            .env("GIT_TERMINAL_PROMPT", "0")
-            .output()
-            .await?;
-        assert!(!unauthenticated.status.success());
-        let client = reqwest::Client::new();
-        let unsupported = client
+async fn stock_git_push_and_clone_are_backed_by_one_repository_cell() -> Result {
+    let workspace = tempfile::TempDir::new()?;
+    let store: Arc<dyn ObjectStore> = Arc::new(InMemory::new());
+    let server = start(&workspace.path().join("resident"), store).await?;
+    let url = create(&server, "smart", "sha1").await?;
+    let client = reqwest::Client::new();
+    assert_eq!(
+        client
             .post(format!("{url}/git-receive-pack"))
-            .bearer_auth("local-test-token")
+            .bearer_auth(TOKEN)
             .header("Content-Type", "text/plain")
-            .body(Vec::new())
-            .send()
-            .await?;
-        assert_eq!(
-            unsupported.status(),
-            reqwest::StatusCode::UNSUPPORTED_MEDIA_TYPE
-        );
-        let retained = disk_budget.used();
-        let occupied = disk_budget.try_reserve(disk_budget.capacity() - retained - 1)?;
-        let admission_id = uuid::Uuid::new_v4().to_string();
-        let admission_request = || {
-            client
-                .post(format!("{url}/git-receive-pack"))
-                .bearer_auth("local-test-token")
-                .header("Content-Type", "text/plain")
-                .header("Idempotency-Key", &admission_id)
-                .body("1234")
-        };
-        assert_eq!(
-            admission_request().send().await?.status(),
-            reqwest::StatusCode::INSUFFICIENT_STORAGE
-        );
-        drop(occupied);
-        assert_eq!(disk_budget.used(), retained);
-        assert_eq!(
-            admission_request().send().await?.status(),
-            reqwest::StatusCode::UNSUPPORTED_MEDIA_TYPE
-        );
-        let mut request = Vec::new();
-        for index in 0..8000 {
-            let capabilities = if index == 0 {
-                "\0report-status side-band-64k"
-            } else {
-                ""
-            };
-            let command = format!(
-                "{} {} refs/heads/bad-pack-{index:04}-{}{capabilities}\n",
-                "0".repeat(40),
-                "1".repeat(40),
-                "x".repeat(48)
-            );
-            request.extend_from_slice(format!("{:04x}{command}", command.len() + 4).as_bytes());
-        }
-        request.extend_from_slice(b"0000");
-        request.extend_from_slice(b"not a pack!!");
-        let push_id = uuid::Uuid::new_v4().to_string();
-        let response = client
-            .post(format!("{url}/git-receive-pack"))
-            .bearer_auth("local-test-token")
-            .header("Content-Type", "application/x-git-receive-pack-request")
-            .header("Idempotency-Key", &push_id)
-            .timeout(std::time::Duration::from_secs(5))
-            .body(request.clone())
-            .send()
-            .await?;
-        assert_eq!(response.status(), reqwest::StatusCode::OK);
-        let report = response.bytes().await?;
-        assert!(report.len() > 512 * 1024);
-        let replay = client
-            .post(format!("{url}/git-receive-pack"))
-            .bearer_auth("local-test-token")
-            .header("Content-Type", "application/x-git-receive-pack-request")
-            .header("Idempotency-Key", &push_id)
-            .body(request)
+            .body("invalid media")
             .send()
             .await?
-            .error_for_status()?
-            .bytes()
-            .await?;
-        assert_eq!(replay, report);
-        assert_eq!(
-            client
-                .post(format!("{url}/git-receive-pack"))
-                .bearer_auth("local-test-token")
-                .header("Content-Type", "application/x-git-receive-pack-request")
-                .header("Idempotency-Key", &push_id)
-                .body(b"0000".to_vec())
-                .send()
-                .await?
-                .status(),
-            reqwest::StatusCode::CONFLICT
-        );
-        assert!(
-            report
-                .windows(b"ng refs/heads/bad-pack".len())
-                .any(|part| part == b"ng refs/heads/bad-pack")
-        );
-        assert!(
-            repository
-                .ref_state(
-                    &format!("refs/heads/bad-pack-0000-{}", "x".repeat(48)),
-                    None
-                )
-                .await?
-                .output
-                .is_none()
-        );
-
-        cache_admission::verify(scratch.path(), &repository, &disk_budget, &client, &url).await?;
-
-        let local = scratch.path().join("local");
-        run_git(
-            None,
-            &["init", "-b", "main", local.to_str().ok_or("invalid path")?],
-        )
-        .await?;
-        run_git(Some(&local), &["config", "user.name", "Canopy Test"]).await?;
-        run_git(
-            Some(&local),
-            &["config", "user.email", "canopy@example.invalid"],
-        )
-        .await?;
-        run_git(Some(&local), &["lfs", "install", "--local"]).await?;
-        run_git(Some(&local), &["lfs", "track", "*.lfs"]).await?;
-        tokio::fs::write(
-            local.join("README.md"),
-            b"served from the repository Cell\n",
-        )
-        .await?;
-        let large_body = vec![0x5a; 1_200_000];
-        tokio::fs::write(local.join("large.bin"), &large_body).await?;
-        let lfs_body = vec![0xa5; 1_500_000];
-        tokio::fs::write(local.join("tracked.lfs"), &lfs_body).await?;
-        run_git(
-            Some(&local),
-            &[
-                "add",
-                ".gitattributes",
-                "README.md",
-                "large.bin",
-                "tracked.lfs",
-            ],
-        )
-        .await?;
-        run_git(Some(&local), &["commit", "-m", "Initial commit"]).await?;
-        let original = run_git(Some(&local), &["rev-parse", "HEAD"]).await?;
-        let original = std::str::from_utf8(&original)?.trim();
-        run_git(
-            Some(&local),
-            &[
-                "-c",
-                "http.extraHeader=Authorization: Bearer local-test-token",
-                "push",
-                &url,
-                "HEAD:refs/heads/main",
-            ],
-        )
-        .await?;
-        let expected_oid: canopy_server::ObjectId = hex::decode(original)?
-            .try_into()
-            .map_err(|_| "invalid commit ID")?;
-        assert_eq!(
-            repository
-                .ref_state("refs/heads/main", None)
-                .await?
-                .output
-                .and_then(|state| state.oid),
-            Some(expected_oid)
-        );
-        let mut cursor = None;
-        let mut external_seen = false;
-        loop {
-            let page = repository.object_page(cursor).await?.output;
-            if page.is_empty() {
-                break;
-            }
-            for object in page {
-                cursor = Some(object.oid);
-                external_seen |= matches!(object.storage, ObjectStorage::External { .. });
-            }
-        }
-        assert!(external_seen);
-        let lfs_oid: [u8; 32] = Sha256::digest(&lfs_body).into();
-        assert_eq!(
-            repository
-                .lfs_object(lfs_oid)
-                .await?
-                .output
-                .map(|object| object.size),
-            Some(lfs_body.len() as u64)
-        );
-        run_git(
-            Some(&local),
-            &[
-                "-c",
-                "http.extraHeader=Authorization: Bearer local-test-token",
-                "push",
-                &url,
-                ":refs/heads/main",
-            ],
-        )
-        .await?;
-        assert!(
-            run_git(
-                Some(&local),
-                &[
-                    "-c",
-                    "http.extraHeader=Authorization: Bearer local-test-token",
-                    "ls-remote",
-                    &url,
-                ]
-            )
-            .await?
-            .is_empty()
-        );
-        run_git(
-            Some(&local),
-            &[
-                "-c",
-                "http.extraHeader=Authorization: Bearer local-test-token",
-                "push",
-                &url,
-                "HEAD:refs/heads/main",
-            ],
-        )
-        .await?;
-        assert!(
-            repository
-                .ref_state("refs/heads/main", None)
-                .await?
-                .output
-                .is_some_and(|state| state.version == 3)
-        );
-        ref_snapshots::verify(&repository, &client, &url).await?;
-        let _ = stop_tx.send(());
-        server.await??;
-        // Axum 0.8 signals connection closure before dropping its service.
-        // Retain the final owner and wait for those service clones, then drop
-        // the gateway synchronously before checking complete cache teardown.
-        tokio::time::timeout(std::time::Duration::from_secs(5), async {
-            while Arc::strong_count(&teardown_gateway) > 1 {
-                tokio::task::yield_now().await;
-            }
-        })
-        .await?;
-        drop(teardown_gateway);
-        assert_eq!(
-            disk_budget.used(),
-            0,
-            "gateway teardown releases retained object and snapshot charges"
-        );
-
-        let gateway = Arc::new(GitGateway::new(
-            Arc::clone(&repository),
-            scratch.path().to_path_buf(),
-            blob_store,
-            DiskBudget::new(1 << 30),
-            canopy_server::native_resources::NativeResources::default(),
-        ));
-        let listener = TcpListener::bind("127.0.0.1:0").await?;
-        let address = listener.local_addr()?;
-        let api = Arc::new(GitHttpApi::new(
-            gateway,
-            "canopy".into(),
-            "example",
-            &format!("http://{address}"),
-            Arc::new(|| true),
-        )?);
-        let (stop_tx, stop_rx) = oneshot::channel::<()>();
-        let server = tokio::spawn(async move {
-            axum::serve(listener, support::git_router(api))
-                .with_graceful_shutdown(async move {
-                    let _ = stop_rx.await;
-                })
-                .await
-        });
-        let url = format!("http://{address}/canopy/example.git");
-        let clone = scratch.path().join("clone");
-        run_git(
+            .status(),
+        reqwest::StatusCode::UNSUPPORTED_MEDIA_TYPE
+    );
+    let source = workspace.path().join("source");
+    git(None, &["init", "-b", "main", path(&source)?]).await?;
+    git(Some(&source), &["config", "user.name", "HTTP Test"]).await?;
+    git(
+        Some(&source),
+        &["config", "user.email", "http@example.invalid"],
+    )
+    .await?;
+    let first = vec![17_u8; 2 * 1024 * 1024];
+    let second = vec![29_u8; 2 * 1024 * 1024];
+    std::fs::write(source.join("first"), &first)?;
+    std::fs::write(source.join("second"), &second)?;
+    git(Some(&source), &["add", "."]).await?;
+    git(Some(&source), &["commit", "-m", "Native HTTP body"]).await?;
+    git(
+        Some(&source),
+        &["push", "-o", "canopy.note=resident", &url, "main"],
+    )
+    .await?;
+    for version in ["0", "2"] {
+        let clone = workspace.path().join(format!("blobless-{version}"));
+        git(
             None,
             &[
                 "-c",
-                "http.extraHeader=Authorization: Bearer local-test-token",
+                &format!("protocol.version={version}"),
                 "clone",
+                "--filter=blob:none",
+                "--no-checkout",
                 &url,
-                clone.to_str().ok_or("invalid path")?,
-            ],
-        )
-        .await?;
-        assert_eq!(
-            tokio::fs::read(clone.join("README.md")).await?,
-            b"served from the repository Cell\n"
-        );
-        assert_eq!(tokio::fs::read(clone.join("large.bin")).await?, large_body);
-        let tags = run_git(Some(&clone), &["tag", "--list", "snapshot-*"]).await?;
-        assert_eq!(std::str::from_utf8(&tags)?.lines().count(), 300);
-        run_git(Some(&clone), &["fsck", "--full"]).await?;
-        run_git(Some(&clone), &["lfs", "install", "--local"]).await?;
-        run_git(
-            Some(&clone),
-            &[
-                "-c",
-                "http.extraHeader=Authorization: Bearer local-test-token",
-                "lfs",
-                "pull",
+                path(&clone)?,
             ],
         )
         .await?;
-        assert!(tokio::fs::read(clone.join("tracked.lfs")).await? == lfs_body);
-        native_resources::verify(scratch.path(), &url).await?;
-        cache_reuse::verify(scratch.path(), &local, &url).await?;
-        publication::verify(scratch.path(), &repository, &paused_blobs, &url).await?;
-        let _ = stop_tx.send(());
-        server.await??;
-        Ok(())
+        assert_eq!(git(Some(&clone), &["show", "HEAD:first"]).await?, first);
+        assert_eq!(git(Some(&clone), &["show", "HEAD:second"]).await?, second);
+        git(Some(&clone), &["fsck", "--strict"]).await?;
     }
-    .await;
-    let shutdown = runtime.shutdown().await;
-    outcome?;
-    shutdown?;
+    let guess = "12".repeat(20);
+    let want = format!("want {guess}\n");
+    let request = format!("{:04x}{want}00000009done\n", want.len() + 4);
+    assert_eq!(
+        client
+            .post(format!("{url}/git-upload-pack"))
+            .bearer_auth(TOKEN)
+            .header("Content-Type", "application/x-git-upload-pack-request")
+            .body(request)
+            .send()
+            .await?
+            .status(),
+        reqwest::StatusCode::BAD_REQUEST
+    );
+    git(
+        Some(&source),
+        &["push", "-o", "canopy.note=delete", &url, ":main"],
+    )
+    .await?;
+    assert!(git(None, &["ls-remote", "--refs", &url]).await?.is_empty());
+    server.shutdown().await?;
     Ok(())
 }
-
-async fn run_git(cwd: Option<&Path>, args: &[&str]) -> Result<Vec<u8>, Box<dyn std::error::Error>> {
-    let mut command = Command::new("git");
-    command.arg("-c").arg("credential.helper=");
-    command.env("GIT_TERMINAL_PROMPT", "0");
-    if let Some(cwd) = cwd {
-        command.current_dir(cwd);
-    }
-    let output = command.args(args).output().await?;
-    if !output.status.success() {
-        return Err(format!(
-            "git {} failed: {}",
-            args.join(" "),
-            String::from_utf8_lossy(&output.stderr)
-        )
-        .into());
-    }
-    Ok(output.stdout)
-}
-use axum::body::Body;
diff --git a/crates/canopy-server/tests/support/native_server.rs b/crates/canopy-server/tests/support/native_server.rs
new file mode 100644
index 00000000..e6997cca
--- /dev/null
+++ b/crates/canopy-server/tests/support/native_server.rs
@@ -0,0 +1,81 @@
+//! Production resident fixture shared by standalone transport qualifications.
+use canopy_server::server::{CanopyServer, ServerConfig};
+use cellule_runtime::{ApplicationId, Digest, TenantId, identity::NodeId};
+use ed25519_dalek::SigningKey;
+use object_store::{ObjectStore, path::Path as StorePath};
+use std::{path::Path, sync::Arc};
+use tokio::{net::TcpListener, process::Command};
+pub type Result<T = ()> = std::result::Result<T, Box<dyn std::error::Error>>;
+pub const TOKEN: &str = "local-test-token";
+
+pub async fn start(directory: &Path, store: Arc<dyn ObjectStore>) -> Result<CanopyServer> {
+    let listener = TcpListener::bind("127.0.0.1:0").await?;
+    let address = listener.local_addr()?;
+    let config = ServerConfig {
+        tenant: TenantId::from_bytes([31; 16]),
+        application: ApplicationId::from_bytes([32; 16]),
+        node: NodeId::from_bytes(uuid::Uuid::new_v4().into_bytes()),
+        fleet: Digest::from_bytes([35; 32]),
+        image: Digest::from_bytes([36; 32]),
+        signing_key: SigningKey::from_bytes(&[37; 32]),
+        owner: "canopy".into(),
+        token: TOKEN.into(),
+        public_url: format!("http://{address}"),
+        peer_endpoint: "https://native-fixture.invalid".into(),
+        peer_ca_pem: None,
+        listen: address,
+        ssh: None,
+        data_dir: directory.to_owned(),
+        store_prefix: StorePath::from("native-standalone-fixture"),
+        native_limits: canopy_server::native_resources::NativeLimits::default(),
+        local_disk_limit_bytes: 1 << 30,
+        max_active_repositories: 3,
+    };
+    Ok(CanopyServer::start_with_listener(config, store, listener).await?)
+}
+pub async fn create(server: &CanopyServer, name: &str, format: &str) -> Result<String> {
+    let body: serde_json::Value = reqwest::Client::new()
+        .post(format!("http://{}/api/repositories", server.local_addr()))
+        .bearer_auth(TOKEN)
+        .json(&serde_json::json!({"name":name,"object_format":format}))
+        .send()
+        .await?
+        .error_for_status()?
+        .json()
+        .await?;
+    Ok(body["clone_url"]
+        .as_str()
+        .ok_or("clone URL missing")?
+        .into())
+}
+pub fn path(path: &Path) -> Result<&str> {
+    Ok(path.to_str().ok_or("non-UTF8 fixture path")?)
+}
+pub fn command(cwd: Option<&Path>, arguments: &[&str]) -> Command {
+    let mut command = Command::new("git");
+    command
+        .args([
+            "-c",
+            "credential.helper=",
+            "-c",
+            "http.extraHeader=Authorization: Bearer local-test-token",
+        ])
+        .env("GIT_TERMINAL_PROMPT", "0");
+    if let Some(cwd) = cwd {
+        command.current_dir(cwd);
+    }
+    command.args(arguments);
+    command
+}
+pub async fn git(cwd: Option<&Path>, arguments: &[&str]) -> Result<Vec<u8>> {
+    let output = command(cwd, arguments).output().await?;
+    if !output.status.success() {
+        return Err(format!(
+            "git {} failed: {}",
+            arguments.join(" "),
+            String::from_utf8_lossy(&output.stderr)
+        )
+        .into());
+    }
+    Ok(output.stdout)
+}
diff --git a/docs/evidence/native-ci-fixture-migration-20261006.md b/docs/evidence/native-ci-fixture-migration-20261006.md
new file mode 100644
index 00000000..c2418bb7
--- /dev/null
+++ b/docs/evidence/native-ci-fixture-migration-20261006.md
@@ -0,0 +1,51 @@
+# Native CI fixture migration
+
+The repository cutover registers native catalog publication, staging custody,
+and serving owners. A detached `RepositoryCell` is not a serving owner, and the
+old `PutObjects` command (5) is deliberately not registered. Standalone tests
+must create repositories through a leased `CanopyServer`, just as production
+requests do. The workflow continues to run every integration test target.
+
+The standalone entry points now qualify these production paths:
+
+- `owner_restart`: publish commit/tree/blob/tag and gitlink graphs; stop the
+  first owner, delete its entire data directory, restore on a new node, clone
+  and run strict Git fsck, and delete/recreate a branch after restoration.
+- `repository_cell`: require the retired ingestion command to stay absent;
+  publish and clone 600 delta candidates across selection-page boundaries in
+  SHA-1 and SHA-256 repositories; reject an atomic two-ref update after a policy
+  change and prove that neither ref changes.
+- `smart_http`: preserve unsupported-media handling; exercise stock push
+  options, both Git protocol versions, blobless clone and explicit lazy fetch,
+  reject a guessed unreachable object, and publish a delete-only push.
+
+The old helper modules under `tests/repository_cell` and `tests/smart_http`
+remain available as historical fixture references. Their loose-object SQL,
+chunk uploads, detached gateway and graph-certificate setup are not fixtures
+for the supported storage model. Native coverage lives at the following seams:
+
+| Former fixture area | Active coverage |
+| --- | --- |
+| Object batch/page/chunk bounds and rollback | `src/packs/metadata/tests.rs`, `src/packs/catalog/graph_spool/tests.rs`, `src/packs/verification/spool/tests.rs`, and the 600-object standalone case |
+| Native object format, index binding and canonical bytes | `canopy-git-format/src/pack_index/tests.rs`, `src/packs/catalog/native/tests.rs`, `src/git_cache/tests.rs`, `src/packs/verification/tests.rs` |
+| Graph/frontier preparation and all-or-none refs | `src/packs/publication/tests/frontier.rs`, `refs.rs`, `ref_policy`, and standalone atomic publication |
+| Cache reuse, pressure and physical ownership | `src/packs/catalog/native/tests.rs`, `src/server/residency/tests`, `tests/multi_server/partial_clone.rs`, `ssh/fetch.rs`, `ssh/filtered_preparation.rs` |
+| Encoded input, uploads and completion | `src/git_input/tests.rs`, `src/packs/publication/tests/native_capture.rs`, `tests/multi_server/push_options.rs`, `ssh/publication.rs` |
+| Issues, checks, pulls, reviews, merge, rebase, visibility, default branch | Corresponding `tests/multi_server` modules and native publication unit tests |
+
+Selective reads verify each original provider part against its authenticated
+manifest and verify the extracted canonical object against its certified kind,
+size, Git OID and BLAKE3 digest. Their private sparse pack is an input to native
+Git decoding; it is not represented as a newly verified complete pack. Incoming
+pack verification and writer preparation retain their complete-pack checks.
+
+Size filters inspect bodies in a disposable workspace. The persistent cache
+retains size-inspection candidates permitted by the other combined filters;
+Git still applies the original size threshold to the response. Omitted bodies
+outside the permitted tree/type selection are not retained.
+
+A late SSH access downgrade can emit the original per-ref failure report only
+when the staging owner reports a known inactive terminal attempt and current
+access is below write. This is a wire rejection, not a durable publication or
+success acknowledgement. Uncertain mutations and lost replies keep their
+original error/recovery paths.
diff --git a/docs/evidence/native-selective-ci-20261006.json b/docs/evidence/native-selective-ci-20261006.json
new file mode 100644
index 00000000..915bbf85
--- /dev/null
+++ b/docs/evidence/native-selective-ci-20261006.json
@@ -0,0 +1,90 @@
+{
+  "base_head": "195e96d59f469ddf49bf54b0eb3206e3fdedb760",
+  "sources": {
+    "crates/canopy-git-format/src/pack_index/mod.rs": "f7f380bc9de6da545e2cfcaf11a2b710a54644420abd8e2d3d3e70888462b8de",
+    "crates/canopy-git-format/src/pack_index/tests.rs": "8d7c9556af3053d7d83773e1c060b7180df86c93885a4de3979f9b2e32a116c4",
+    "crates/canopy-object-storage/src/artifact.rs": "0a6fd498b6ef036fb7322fd414c87a75e2ca36e1711d4acbd20970dcfab91b2f",
+    "crates/canopy-object-storage/src/artifact/tests.rs": "c3bed92e00d4ed8d5f9ce0c55bd96f4c05d04500fb98ae7bc941a1c846a2993b",
+    "crates/canopy-server/src/git_cache/artifacts.rs": "e65788302f8c56eaba2d4f8748e5c7218370675ecfa5525927f4904c44d55ff8",
+    "crates/canopy-server/src/git_cache/mod.rs": "3ec2f04c075dbc3f025fb042a9e152a51a6c0cff18953eb2dea9b4c858603402",
+    "crates/canopy-server/src/git_cache/tests.rs": "03c49c42592b8f7f4a0368da46b803f56fc11347ab28a089fd2a0344046eff7a",
+    "crates/canopy-server/src/git_cache/verified.rs": "aeecdf57d51ed3230ed30f06693ed754aad29530fe4721aef5a50882d990989a",
+    "crates/canopy-server/src/git_gateway/branch_policy.rs": "b1735efd5736876871b2ee4fd23fc96857d76cf68db42fb86f661dbcb00e47a4",
+    "crates/canopy-server/src/git_gateway/fetch.rs": "e82c562fc32abc0f9cdb05ca0963fea9ddda4a9609eceb1ded504b4c5b44745e",
+    "crates/canopy-server/src/git_gateway/mod.rs": "993d600ca80b885dcb6c341c56071838efa41eb5fd8908365f6f65f6c261a294",
+    "crates/canopy-server/src/git_gateway/ssh.rs": "1cf860d7a6ff0a3110d245f810bb8320be6ff36554307c21daccf3f9c9dcd811",
+    "crates/canopy-server/src/git_http/mod.rs": "3b54b2e8d37d36829867a98c8b6733cc554f7e42c0df810dd2af687c4683dd64",
+    "crates/canopy-server/src/git_objects/mod.rs": "e7e0f9c467f99fb9c2c7676ceacb6bf1e5215b1791b9df165b6bd6729aeb880c",
+    "crates/canopy-server/src/lib.rs": "b9540acc22460674058a71d98fe8d80426eca8cb2febdc8e60414030cfe87f2b",
+    "crates/canopy-server/src/packs/catalog/files.rs": "d7257387fe68c2466c53b6c4f6245b6e5b2f671de8a3a5ba13dfced41e87b1c8",
+    "crates/canopy-server/src/packs/catalog/graph_spool.rs": "e690ef4f14cb21070817748ad9072dc119b794ec0b09a799e602be3e3755300c",
+    "crates/canopy-server/src/packs/catalog/mod.rs": "e7f14fd586b16f05491784457843e807aa3bbf446ffa83112513480df0c7a97d",
+    "crates/canopy-server/src/packs/catalog/native.rs": "4e2b4b6a21d97f695815aba1b87f11dad03519bc406718b36f09880237872e13",
+    "crates/canopy-server/src/packs/catalog/native/tests.rs": "c3fe6c17ca3e520cd8b396e85cbb28fd907845ebf7097715c6789ad8019aefd7",
+    "crates/canopy-server/src/packs/catalog/sparse.rs": "51ff764a5031a333e83f2f12691632f2f50b1af92b262d5a7dd0f2b2503de0b3",
+    "crates/canopy-server/src/packs/publication/serving/session/native_base.rs": "984656c2fc770f9eb2e870f00c95b476fbbef54810203a33a55427e4e9908a4c",
+    "crates/canopy-server/src/packs/publication/serving/session/workspace.rs": "7babc46e519d6962722aac97dd1ad92c3dc46f83e4c5b68cabeded9100941444",
+    "crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs": "7ae137c7705979f4dbed56c6405443f2ef89180f56ff20181e31b71f089ebbe9",
+    "crates/canopy-server/src/packs/publication/staging_service/driver.rs": "f9ea042bbdb577f6f8073fc99fb7bc51476062cd46a9e4aa0dac81674e8fd348",
+    "crates/canopy-server/tests/multi_server/backup.rs": "f558588d5f96337540195d2c01c9bc1dd2f6525b39f817fb0c3747c1cf10694d",
+    "crates/canopy-server/tests/owner_restart.rs": "094a48e95baf2a7d896dbdf9cbd7b1bfa6c310c7d363d3e209cca028d184fda5",
+    "crates/canopy-server/tests/repository_cell/main.rs": "4d5627ee20e0594aea08641a76caf19de6a4a67c88ca7b8e795b4792f375e210",
+    "crates/canopy-server/tests/smart_http/main.rs": "78ba45f37fda1fc0932642721d8a148dbdc34d9df05af5dce01ff6f14732a2ee",
+    "crates/canopy-server/tests/support/native_server.rs": "8a40a8d316899c91d736b22fc93073f62a693f284677acdf199ae70bc07a22ee"
+  },
+  "manifest_digest": "267ae60c739ff0e553375405fdbb23363bfd7bf63f99b280c34930be68bef049",
+  "validation": {
+    "clippy": {
+      "command": "cargo +1.98.0 clippy --workspace --all-targets --locked -- -D warnings",
+      "exit_code": 0,
+      "log": "/tmp/canopy-native-selective-clippy.log"
+    },
+    "harness": {
+      "tests": 96,
+      "exit_code": 0,
+      "log": "/tmp/canopy-native-harness-final.log"
+    },
+    "http_partial_clone": {
+      "passed": 2,
+      "existing_ignored": 1,
+      "log": "/tmp/canopy-selective-http-fixed.log"
+    },
+    "http_ssh_filter_matrix": {
+      "passed": 1,
+      "seconds": 127.01,
+      "log": "/tmp/canopy-selective-filters-fixed3.log"
+    },
+    "late_ssh_refusals": {
+      "passed": 1,
+      "seconds": 17.39,
+      "log": "/tmp/canopy-late-ssh-known-refusal.log"
+    },
+    "backup": {
+      "passed": 1,
+      "seconds": 109.51,
+      "log": "/tmp/canopy-backup-inventory2.log"
+    },
+    "native_standalones": {
+      "owner_restart_seconds": 9.39,
+      "atomic_both_formats_seconds": 60.55,
+      "smart_http_seconds": 15.24,
+      "logs": [
+        "/tmp/canopy-native-standalone-fixtures.log",
+        "/tmp/canopy-native-smart-http-fixed.log"
+      ]
+    },
+    "full_workspace": {
+      "state": "running",
+      "command": "cargo +1.98.0 test --workspace --locked",
+      "log": "/tmp/canopy-native-workspace-final.log"
+    }
+  },
+  "limitations": [
+    "Linux CI on this source has not completed.",
+    "Provider qualification has not run locally.",
+    "Size filters inspect candidate bodies before native response selection.",
+    "Serving membership still builds the full certified metadata closure; large-team capacity is not qualified.",
+    "Native writer preparation still installs complete inherited packs."
+  ],
+  "cutover_note": "Standalone fixture setup now uses the production resident. Retired ingestion operation 5 stays absent. No workflow or test target is disabled."
+}

From 772c6d00aee5ee6201a2175a35d41d3b0e65e891 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 23:10:53 -0700
Subject: [PATCH 52/55] fix: retain complete native packs for producer
 workspaces

---
 .../publication/serving/session/workspace.rs  | 41 +++++++++++++++----
 .../native-ci-fixture-migration-20261006.md   |  8 ++++
 ...native-producer-workspace-ci-20261006.json | 27 ++++++++++++
 .../native-selective-ci-20261006.json         | 16 +++++++-
 4 files changed, 81 insertions(+), 11 deletions(-)
 create mode 100644 docs/evidence/native-producer-workspace-ci-20261006.json

diff --git a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
index 8e91b002..7dfc6683 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
@@ -34,6 +34,7 @@ struct Core {
     pin: ServingPin,
     actor: Option<String>,
     stats: WorkspaceStats,
+    complete_packs: bool,
 }
 impl NativeWorkspace {
     pub(crate) fn backend(&self, nonce_seed: Option<[u8; 32]>) -> crate::git_http::GitHttpBackend {
@@ -126,7 +127,25 @@ impl NativeWorkspace {
                     if expected.size > limit as u64 {
                         return Err(ServingReadError::TooLarge);
                     }
-                    Ok(Some(inner.context.files.body(object, limit, owner).await?))
+                    if core.complete_packs {
+                        let mut objects = crate::git_objects::GitObjects::batch_owned(
+                            &core.cache.git_dir(),
+                            &core.cache.native,
+                            owner,
+                        )
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
+                        let body = objects
+                            .read_verified(expected, limit)
+                            .await
+                            .map_err(crate::packs::catalog::NativeReadError::from)?;
+                        objects
+                            .finish()
+                            .await
+                            .map_err(crate::packs::catalog::NativeReadError::from)?;
+                        Ok(Some(body))
+                    } else {
+                        Ok(Some(inner.context.files.body(object, limit, owner).await?))
+                    }
                 },
             )
             .await
@@ -269,6 +288,17 @@ impl ServingPin {
                         let source = object.source.record.native();
                         source.validate(inner.context.repository(), inner.lease.format)?;
                         if !job(&spool, owner.clone(), move |s| s.pack_seen(source)).await? {
+                            // Producer workspaces need a complete native
+                            // baseline. Install each certified pair once, rather
+                            // than expanding every object into loose copies.
+                            if materialize {
+                                inner
+                                    .context
+                                    .files
+                                    .install_pack_workspace(cache.clone(), source, owner.clone())
+                                    .await?;
+                                observation.refresh(&inner, &actor).await?;
+                            }
                             observation.refresh(&inner, &actor).await?;
                             job(&spool, owner.clone(), move |s| s.imported(source)).await?;
                             stats.packs = stats
@@ -281,14 +311,6 @@ impl ServingPin {
                                 .and_then(|n| n.checked_add(source.index.size))
                                 .ok_or(ServingReadError::TooLarge)?;
                         }
-                        if materialize {
-                            inner
-                                .context
-                                .files
-                                .install_workspace(cache.clone(), &object, owner.clone())
-                                .await?;
-                            observation.refresh(&inner, &actor).await?;
-                        }
                         let metadata = object.source.metadata;
                         let mut cursor = None;
                         loop {
@@ -335,6 +357,7 @@ impl ServingPin {
                         pin,
                         actor,
                         stats,
+                        complete_packs: materialize,
                     }),
                 })
             },
diff --git a/docs/evidence/native-ci-fixture-migration-20261006.md b/docs/evidence/native-ci-fixture-migration-20261006.md
index c2418bb7..4218372b 100644
--- a/docs/evidence/native-ci-fixture-migration-20261006.md
+++ b/docs/evidence/native-ci-fixture-migration-20261006.md
@@ -49,3 +49,11 @@ when the staging owner reports a known inactive terminal attempt and current
 access is below write. This is a wire rejection, not a durable publication or
 success acknowledgement. Uncertain mutations and lost replies keep their
 original error/recovery paths.
+
+Explicit producer-root workspaces install each certified complete pack/index
+pair once and read selected bodies from that workspace. This keeps native
+baselines packed, avoids per-object child processes during construction, and
+preserves the original cancellation/expiry/revocation file-admission tests.
+Ref-based fetch workspaces continue to use selective extraction. The producer
+correction changes no test assertions or admission limits; all 11 workspace
+unit tests pass at this revision.
diff --git a/docs/evidence/native-producer-workspace-ci-20261006.json b/docs/evidence/native-producer-workspace-ci-20261006.json
new file mode 100644
index 00000000..21fc71a1
--- /dev/null
+++ b/docs/evidence/native-producer-workspace-ci-20261006.json
@@ -0,0 +1,27 @@
+{
+  "base_head": "759d4778f2ae9a04d426470f5354618c1e904f62",
+  "sources": {
+    "crates/canopy-server/src/packs/publication/serving/session/workspace.rs": "b5ef94e49c7f941eb63289f47dd4f41ac8a9d3ec78413df9cb911aa50c1bd9ff"
+  },
+  "change": "Explicit producer roots install each certified complete pack/index pair once and verify selected bodies from that workspace. Ref-based transport workspaces retain selective extraction. No admission limits or test assertions changed.",
+  "validation": {
+    "workspace_tests": {
+      "passed": 11,
+      "seconds": 18.69,
+      "log": "/tmp/canopy-native-producer-workspace-fixed.log"
+    },
+    "clippy": {
+      "exit_code": 0,
+      "seconds": 43.12,
+      "log": "/tmp/canopy-native-producer-clippy.log"
+    },
+    "format_and_diff": {
+      "exit_code": 0
+    },
+    "full_workspace": {
+      "state": "pending",
+      "log": "/tmp/canopy-native-workspace-after-producer.log"
+    }
+  },
+  "prior_full_failure": "752 pass / 5 fail at759d477: three extra-file/admission assertions, wide workspace timeout, and contended ancestry lease expiry. The ancestry case passed isolated at the same source in37.85s; it still requires full-suite validation."
+}
diff --git a/docs/evidence/native-selective-ci-20261006.json b/docs/evidence/native-selective-ci-20261006.json
index 915bbf85..402b50c2 100644
--- a/docs/evidence/native-selective-ci-20261006.json
+++ b/docs/evidence/native-selective-ci-20261006.json
@@ -74,9 +74,21 @@
       ]
     },
     "full_workspace": {
-      "state": "running",
+      "state": "failed",
+      "head": "759d4778f2ae9a04d426470f5354618c1e904f62",
+      "library_passed": 752,
+      "library_failed": 5,
+      "seconds": 445.3,
       "command": "cargo +1.98.0 test --workspace --locked",
-      "log": "/tmp/canopy-native-workspace-final.log"
+      "log": "/tmp/canopy-native-workspace-final.log",
+      "failures": [
+        "ancestry_growth_reuses_pairs_only_in_one_exact_native_catalog",
+        "cancelled_construction_keeps_pin_and_admission_until_suspended_provider_drains",
+        "expired_lease_does_not_resurrect_or_release_suspended_construction",
+        "suspended_construction_refuses_revoked_access_after_real_transfer_finishes",
+        "complete_native_history_crosses_shards_and_wide_parent_pages_without_loose_copies"
+      ],
+      "follow_up": "Producer workspace correction keeps each complete certified pair in one workspace and reads it without extra sparse-cache admission. Targeted 11 workspace tests pass without assertion or budget changes. Ancestry test passes isolated; full-suite resource contention still requires qualification."
     }
   },
   "limitations": [

From 8ec0aefdea0b99910cdcd755001648e1c5ddd941 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 23:36:05 -0700
Subject: [PATCH 53/55] fix: accept renewed serving pins during fetch
 preparation

---
 .../serving/session/workspace/prepare.rs      | 541 +++++++++---------
 .../publication/tests/serving/workspace.rs    |  88 +++
 .../native-fetch-renewal-ci-20261006.json     |  28 +
 3 files changed, 392 insertions(+), 265 deletions(-)
 create mode 100644 docs/evidence/native-fetch-renewal-ci-20261006.json

diff --git a/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs b/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
index cad7a0c5..7b9f0c03 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
@@ -49,62 +49,66 @@ impl NativeWorkspace {
         let actor = core.actor.clone();
         self.core
             .pin
-            .read_owned(actor.clone(), move |inner, deadline, permit| async move {
-                let owner: ReadOwner = Arc::new((inner.child(), permit, core.clone()));
-                let mut observation = Observation {
-                    deadline,
-                    next: Instant::now(),
-                };
-                let refs = inner.ref_snapshot().await?.clone();
-                let mut cursor =
-                    inner
-                        .context
-                        .indexes
-                        .refs()
-                        .cursor(refs.root.clone(), None, true)?;
-                while let Some(record) = cursor.next().await? {
-                    observation.refresh(&inner, &actor).await?;
-                    let mut id = record.state().oid.ok_or(ServingReadError::Context)?;
-                    let mut finished = false;
-                    // Peeling requires only the advertised object and nested tags,
-                    // never an unrelated commit's ancestors or tree history.
-                    for _ in 0..128 {
-                        let reader = inner.catalog().await?;
-                        let object = reader
-                            .lookup(id, &*inner.context.files, &*inner.context.files)
-                            .await?
-                            .ok_or(ServingReadError::Context)?;
-                        let kind = object.entry.header.object.kind;
+            .read_session(
+                actor.clone(),
+                move |inner, deadline, permit| async move {
+                    let owner: ReadOwner = Arc::new((inner.child(), permit, core.clone()));
+                    let mut observation = Observation {
+                        deadline,
+                        next: Instant::now(),
+                    };
+                    let refs = inner.ref_snapshot().await?.clone();
+                    let mut cursor =
                         inner
                             .context
-                            .files
-                            .install_workspace(core.cache.clone(), &object, owner.clone())
-                            .await?;
+                            .indexes
+                            .refs()
+                            .cursor(refs.root.clone(), None, true)?;
+                    while let Some(record) = cursor.next().await? {
                         observation.refresh(&inner, &actor).await?;
-                        if kind != ObjectKind::Tag {
-                            finished = true;
-                            break;
+                        let mut id = record.state().oid.ok_or(ServingReadError::Context)?;
+                        let mut finished = false;
+                        // Peeling requires only the advertised object and nested tags,
+                        // never an unrelated commit's ancestors or tree history.
+                        for _ in 0..128 {
+                            let reader = inner.catalog().await?;
+                            let object = reader
+                                .lookup(id, &*inner.context.files, &*inner.context.files)
+                                .await?
+                                .ok_or(ServingReadError::Context)?;
+                            let kind = object.entry.header.object.kind;
+                            inner
+                                .context
+                                .files
+                                .install_workspace(core.cache.clone(), &object, owner.clone())
+                                .await?;
+                            observation.refresh(&inner, &actor).await?;
+                            if kind != ObjectKind::Tag {
+                                finished = true;
+                                break;
+                            }
+                            let metadata = object.source.metadata;
+                            let held = owner.clone();
+                            let edges = tokio::task::spawn_blocking(move || {
+                                let _owner = held;
+                                metadata.edges_after(id, None)
+                            })
+                            .await?
+                            .map_err(crate::packs::directory::index::IndexError::from)?;
+                            if edges.len() != 1 {
+                                return Err(ServingReadError::Context);
+                            }
+                            id = edges[0].child;
                         }
-                        let metadata = object.source.metadata;
-                        let held = owner.clone();
-                        let edges = tokio::task::spawn_blocking(move || {
-                            let _owner = held;
-                            metadata.edges_after(id, None)
-                        })
-                        .await?
-                        .map_err(crate::packs::directory::index::IndexError::from)?;
-                        if edges.len() != 1 {
-                            return Err(ServingReadError::Context);
+                        if !finished {
+                            return Err(ServingReadError::TooLarge);
                         }
-                        id = edges[0].child;
                     }
-                    if !finished {
-                        return Err(ServingReadError::TooLarge);
-                    }
-                }
-                inner.observe(actor).await?;
-                Ok(())
-            })
+                    inner.observe(actor).await?;
+                    Ok(())
+                },
+                true,
+            )
             .await
     }
 
@@ -128,238 +132,245 @@ impl NativeWorkspace {
         let actor = core.actor.clone();
         self.core
             .pin
-            .read_owned(actor.clone(), move |inner, deadline, permit| async move {
-                let owner: ReadOwner = Arc::new((inner.child(), permit, core.clone()));
-                let limits = WorkspaceLimits::default();
-                let spool = inner
-                    .context
-                    .files
-                    .graph_spool(
-                        limits.max_spool_bytes,
-                        limits.cache_kib,
-                        owner.clone(),
-                        owner.clone(),
-                    )
-                    .await
-                    .map_err(crate::packs::directory::index::IndexError::from)?;
-                let mut observation = Observation {
-                    deadline,
-                    next: Instant::now(),
-                };
-                let reader = inner.catalog().await?;
-                for ids in roots.chunks(PAGE_OBJECTS) {
-                    let ids = ids.to_vec();
-                    if !job(&core.spool, owner.clone(), {
-                        let ids = ids.clone();
-                        move |s| s.contains(&ids)
-                    })
-                    .await?
-                    .into_iter()
-                    .all(|present| present)
-                    {
-                        return Err(ServingReadError::Context);
-                    }
-                    job(&spool, owner.clone(), {
-                        let ids = ids.clone();
-                        move |s| s.add(&ids.into_iter().map(|id| (id, None)).collect::<Vec<_>>())
-                    })
-                    .await?;
-                    // Explicit blob wants override a filter. They must exist before
-                    // rev-list, which cannot start from a missing root object.
-                    for id in ids {
-                        observation.refresh(&inner, &actor).await?;
-                        let object = reader
-                            .lookup(id, &*inner.context.files, &*inner.context.files)
-                            .await?
-                            .ok_or(ServingReadError::Context)?;
-                        if object.entry.header.object.kind == ObjectKind::Blob {
-                            inner
-                                .context
-                                .files
-                                .install_workspace(core.cache.clone(), &object, owner.clone())
-                                .await?;
+            .read_session(
+                actor.clone(),
+                move |inner, deadline, permit| async move {
+                    let owner: ReadOwner = Arc::new((inner.child(), permit, core.clone()));
+                    let limits = WorkspaceLimits::default();
+                    let spool = inner
+                        .context
+                        .files
+                        .graph_spool(
+                            limits.max_spool_bytes,
+                            limits.cache_kib,
+                            owner.clone(),
+                            owner.clone(),
+                        )
+                        .await
+                        .map_err(crate::packs::directory::index::IndexError::from)?;
+                    let mut observation = Observation {
+                        deadline,
+                        next: Instant::now(),
+                    };
+                    let reader = inner.catalog().await?;
+                    for ids in roots.chunks(PAGE_OBJECTS) {
+                        let ids = ids.to_vec();
+                        if !job(&core.spool, owner.clone(), {
+                            let ids = ids.clone();
+                            move |s| s.contains(&ids)
+                        })
+                        .await?
+                        .into_iter()
+                        .all(|present| present)
+                        {
+                            return Err(ServingReadError::Context);
+                        }
+                        job(&spool, owner.clone(), {
+                            let ids = ids.clone();
+                            move |s| {
+                                s.add(&ids.into_iter().map(|id| (id, None)).collect::<Vec<_>>())
+                            }
+                        })
+                        .await?;
+                        // Explicit blob wants override a filter. They must exist before
+                        // rev-list, which cannot start from a missing root object.
+                        for id in ids {
+                            observation.refresh(&inner, &actor).await?;
+                            let object = reader
+                                .lookup(id, &*inner.context.files, &*inner.context.files)
+                                .await?
+                                .ok_or(ServingReadError::Context)?;
+                            if object.entry.header.object.kind == ObjectKind::Blob {
+                                inner
+                                    .context
+                                    .files
+                                    .install_workspace(core.cache.clone(), &object, owner.clone())
+                                    .await?;
+                            }
                         }
                     }
-                }
-                loop {
-                    observation.refresh(&inner, &actor).await?;
-                    let pending = job(&spool, owner.clone(), |s| s.pending()).await?;
-                    if pending.is_empty() {
-                        break;
-                    }
-                    for (id, expected) in &pending {
+                    loop {
                         observation.refresh(&inner, &actor).await?;
-                        let object = reader
-                            .lookup(*id, &*inner.context.files, &*inner.context.files)
-                            .await?
-                            .ok_or(ServingReadError::Context)?;
-                        let kind = object.entry.header.object.kind;
-                        if expected.is_some_and(|expected| expected != kind) {
-                            return Err(ServingReadError::Context);
-                        }
-                        let id = *id;
-                        job(&spool, owner.clone(), move |s| s.add(&[(id, Some(kind))])).await?;
-                        if kind != ObjectKind::Blob {
-                            inner
-                                .context
-                                .files
-                                .install_workspace(core.cache.clone(), &object, owner.clone())
-                                .await?;
-                        } else if needs_blob_sizes {
-                            inner
-                                .context
-                                .files
-                                .install_transient_workspace(
-                                    core.cache.clone(),
-                                    &object,
-                                    owner.clone(),
-                                )
-                                .await?;
+                        let pending = job(&spool, owner.clone(), |s| s.pending()).await?;
+                        if pending.is_empty() {
+                            break;
                         }
-                        let metadata = object.source.metadata;
-                        let mut cursor = None;
-                        loop {
+                        for (id, expected) in &pending {
                             observation.refresh(&inner, &actor).await?;
-                            let metadata = metadata.clone();
-                            let held = owner.clone();
-                            let edges = tokio::task::spawn_blocking(move || {
-                                let _owner = held;
-                                metadata.edges_after(id, cursor)
-                            })
-                            .await?
-                            .map_err(crate::packs::directory::index::IndexError::from)?;
-                            if edges.is_empty() {
-                                break;
+                            let object = reader
+                                .lookup(*id, &*inner.context.files, &*inner.context.files)
+                                .await?
+                                .ok_or(ServingReadError::Context)?;
+                            let kind = object.entry.header.object.kind;
+                            if expected.is_some_and(|expected| expected != kind) {
+                                return Err(ServingReadError::Context);
+                            }
+                            let id = *id;
+                            job(&spool, owner.clone(), move |s| s.add(&[(id, Some(kind))])).await?;
+                            if kind != ObjectKind::Blob {
+                                inner
+                                    .context
+                                    .files
+                                    .install_workspace(core.cache.clone(), &object, owner.clone())
+                                    .await?;
+                            } else if needs_blob_sizes {
+                                inner
+                                    .context
+                                    .files
+                                    .install_transient_workspace(
+                                        core.cache.clone(),
+                                        &object,
+                                        owner.clone(),
+                                    )
+                                    .await?;
                             }
-                            cursor = edges.last().map(|edge| edge.child);
-                            let count = edges.len();
-                            // An explicit tag naming a blob must remain peelable.
-                            // Only tag roots can introduce tags in this closure.
-                            if kind == ObjectKind::Tag {
-                                for edge in &edges {
-                                    if edge.expected_kind == ObjectKind::Blob {
-                                        let object = reader
-                                            .lookup(
-                                                edge.child,
-                                                &*inner.context.files,
-                                                &*inner.context.files,
-                                            )
-                                            .await?
-                                            .ok_or(ServingReadError::Context)?;
-                                        if object.entry.header.object.kind != ObjectKind::Blob {
-                                            return Err(ServingReadError::Context);
+                            let metadata = object.source.metadata;
+                            let mut cursor = None;
+                            loop {
+                                observation.refresh(&inner, &actor).await?;
+                                let metadata = metadata.clone();
+                                let held = owner.clone();
+                                let edges = tokio::task::spawn_blocking(move || {
+                                    let _owner = held;
+                                    metadata.edges_after(id, cursor)
+                                })
+                                .await?
+                                .map_err(crate::packs::directory::index::IndexError::from)?;
+                                if edges.is_empty() {
+                                    break;
+                                }
+                                cursor = edges.last().map(|edge| edge.child);
+                                let count = edges.len();
+                                // An explicit tag naming a blob must remain peelable.
+                                // Only tag roots can introduce tags in this closure.
+                                if kind == ObjectKind::Tag {
+                                    for edge in &edges {
+                                        if edge.expected_kind == ObjectKind::Blob {
+                                            let object = reader
+                                                .lookup(
+                                                    edge.child,
+                                                    &*inner.context.files,
+                                                    &*inner.context.files,
+                                                )
+                                                .await?
+                                                .ok_or(ServingReadError::Context)?;
+                                            if object.entry.header.object.kind != ObjectKind::Blob {
+                                                return Err(ServingReadError::Context);
+                                            }
+                                            inner
+                                                .context
+                                                .files
+                                                .install_workspace(
+                                                    core.cache.clone(),
+                                                    &object,
+                                                    owner.clone(),
+                                                )
+                                                .await?;
                                         }
-                                        inner
-                                            .context
-                                            .files
-                                            .install_workspace(
-                                                core.cache.clone(),
-                                                &object,
-                                                owner.clone(),
-                                            )
-                                            .await?;
                                     }
                                 }
-                            }
-                            job(&spool, owner.clone(), move |s| {
-                                s.add(
-                                    &edges
-                                        .into_iter()
-                                        .map(|edge| (edge.child, Some(edge.expected_kind)))
-                                        .collect::<Vec<_>>(),
-                                )
-                            })
-                            .await?;
-                            if count < PAGE_OBJECTS {
-                                break;
+                                job(&spool, owner.clone(), move |s| {
+                                    s.add(
+                                        &edges
+                                            .into_iter()
+                                            .map(|edge| (edge.child, Some(edge.expected_kind)))
+                                            .collect::<Vec<_>>(),
+                                    )
+                                })
+                                .await?;
+                                if count < PAGE_OBJECTS {
+                                    break;
+                                }
                             }
                         }
+                        job(&spool, owner.clone(), move |s| s.done(&pending)).await?;
                     }
-                    job(&spool, owner.clone(), move |s| s.done(&pending)).await?;
-                }
-                // Git sees all requested structural objects and decides tree/type/
-                // combine filters exactly. Size filters require all requested blobs
-                // first, since native Git cannot inspect an absent blob's size.
-                let selection_filter = if needs_blob_sizes {
-                    filter
-                        .as_deref()
-                        .map(|value| size_candidates(value, 0))
-                        .transpose()?
-                        .flatten()
-                } else {
-                    filter.clone()
-                };
-                let walk = if needs_blob_sizes {
-                    GitObjectWalk::selected_owned
-                } else {
-                    GitObjectWalk::missing_owned
-                };
-                let mut missing = walk(
-                    &core.cache.git_dir(),
-                    roots,
-                    selection_filter.as_deref(),
-                    &core.cache.native,
-                    owner.clone(),
-                )
-                .map_err(crate::packs::catalog::NativeReadError::from)?;
-                let mut ids = Vec::with_capacity(SELECTION_PAGE);
-                while let Some(id) = missing
-                    .next()
-                    .await
-                    .map_err(crate::packs::catalog::NativeReadError::from)?
-                {
-                    observation.refresh(&inner, &actor).await?;
-                    if needs_blob_sizes {
-                        let selected = reader
-                            .lookup(id, &*inner.context.files, &*inner.context.files)
-                            .await?
-                            .ok_or(ServingReadError::Context)?;
-                        if selected.entry.header.object.kind != ObjectKind::Blob {
-                            continue;
+                    // Git sees all requested structural objects and decides tree/type/
+                    // combine filters exactly. Size filters require all requested blobs
+                    // first, since native Git cannot inspect an absent blob's size.
+                    let selection_filter = if needs_blob_sizes {
+                        filter
+                            .as_deref()
+                            .map(|value| size_candidates(value, 0))
+                            .transpose()?
+                            .flatten()
+                    } else {
+                        filter.clone()
+                    };
+                    let walk = if needs_blob_sizes {
+                        GitObjectWalk::selected_owned
+                    } else {
+                        GitObjectWalk::missing_owned
+                    };
+                    let mut missing = walk(
+                        &core.cache.git_dir(),
+                        roots,
+                        selection_filter.as_deref(),
+                        &core.cache.native,
+                        owner.clone(),
+                    )
+                    .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    let mut ids = Vec::with_capacity(SELECTION_PAGE);
+                    while let Some(id) = missing
+                        .next()
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?
+                    {
+                        observation.refresh(&inner, &actor).await?;
+                        if needs_blob_sizes {
+                            let selected = reader
+                                .lookup(id, &*inner.context.files, &*inner.context.files)
+                                .await?
+                                .ok_or(ServingReadError::Context)?;
+                            if selected.entry.header.object.kind != ObjectKind::Blob {
+                                continue;
+                            }
+                        }
+                        ids.push(id);
+                        if ids.len() == SELECTION_PAGE {
+                            let page =
+                                std::mem::replace(&mut ids, Vec::with_capacity(SELECTION_PAGE));
+                            job(&spool, owner.clone(), move |s| s.retry(&page)).await?;
                         }
                     }
-                    ids.push(id);
-                    if ids.len() == SELECTION_PAGE {
-                        let page = std::mem::replace(&mut ids, Vec::with_capacity(SELECTION_PAGE));
-                        job(&spool, owner.clone(), move |s| s.retry(&page)).await?;
-                    }
-                }
-                missing
-                    .finish()
-                    .await
-                    .map_err(crate::packs::catalog::NativeReadError::from)?;
-                if !ids.is_empty() {
-                    job(&spool, owner.clone(), move |s| s.retry(&ids)).await?;
-                }
-                // Release rev-list's native admission before starting extraction;
-                // a one-slot read budget must not require a nested native child.
-                loop {
-                    let pending = job(&spool, owner.clone(), |s| s.pending()).await?;
-                    if pending.is_empty() {
-                        break;
+                    missing
+                        .finish()
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    if !ids.is_empty() {
+                        job(&spool, owner.clone(), move |s| s.retry(&ids)).await?;
                     }
-                    for (id, expected) in &pending {
-                        observation.refresh(&inner, &actor).await?;
-                        let object = reader
-                            .lookup(*id, &*inner.context.files, &*inner.context.files)
-                            .await?
-                            .ok_or(ServingReadError::Context)?;
-                        if expected != &Some(ObjectKind::Blob)
-                            || object.entry.header.object.kind != ObjectKind::Blob
-                        {
-                            return Err(ServingReadError::Context);
+                    // Release rev-list's native admission before starting extraction;
+                    // a one-slot read budget must not require a nested native child.
+                    loop {
+                        let pending = job(&spool, owner.clone(), |s| s.pending()).await?;
+                        if pending.is_empty() {
+                            break;
                         }
-                        inner
-                            .context
-                            .files
-                            .install_workspace(core.cache.clone(), &object, owner.clone())
-                            .await?;
+                        for (id, expected) in &pending {
+                            observation.refresh(&inner, &actor).await?;
+                            let object = reader
+                                .lookup(*id, &*inner.context.files, &*inner.context.files)
+                                .await?
+                                .ok_or(ServingReadError::Context)?;
+                            if expected != &Some(ObjectKind::Blob)
+                                || object.entry.header.object.kind != ObjectKind::Blob
+                            {
+                                return Err(ServingReadError::Context);
+                            }
+                            inner
+                                .context
+                                .files
+                                .install_workspace(core.cache.clone(), &object, owner.clone())
+                                .await?;
+                        }
+                        job(&spool, owner.clone(), move |s| s.done(&pending)).await?;
                     }
-                    job(&spool, owner.clone(), move |s| s.done(&pending)).await?;
-                }
-                inner.observe(actor).await?;
-                Ok(())
-            })
+                    inner.observe(actor).await?;
+                    Ok(())
+                },
+                true,
+            )
             .await
     }
 }
diff --git a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
index b12152dc..ff579616 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
@@ -772,3 +772,91 @@ async fn joint_ref_pages_stream_ten_thousand_names_without_an_object_root_limit(
     f.runtime.shutdown().await?;
     Ok(())
 }
+
+#[tokio::test]
+async fn fetch_preparation_accepts_exact_renewal_after_initial_deadline() -> Result {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let f = Fixture::new(format).await?;
+        let provider = Arc::new(super::blocked::Gate::new());
+        let native = prepare(format, provider.clone(), f.repository, 0)
+            .await
+            .map_err(|e| e.to_string())?;
+        let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
+        initialize(&f, store.clone()).await?;
+        f.install_generation(2, native.catalog, Some(native.refs))
+            .await?;
+        let q = super::pool::queue(&f)?;
+        let root = tempfile::TempDir::new()?;
+        let tasks = TaskTracker::new();
+        let (ctx, _) = super::body::serving_context(&f, store.clone(), &root, tasks.clone())?;
+        let oid = native.main;
+        let warm =
+            ServingOwner::start(ctx.clone(), q.clone(), f.begin([120; 16]), identity()?).await?;
+        timeout(Duration::from_secs(8), async {
+            while warm.stats().phase != ServingOwnerPhase::Ready {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        let view = warm.snapshot(Some("owner".into())).await?;
+        let workspace = view.ref_workspace(WorkspaceLimits::default()).await?;
+        assert!(workspace.contains(&[oid]).await?[0]);
+        drop((workspace, view));
+        assert_eq!(
+            warm.close_and_drain().await.phase,
+            ServingOwnerPhase::Released
+        );
+
+        let mut input = f.begin([121; 16]);
+        input.lease_ms = RENEWAL_LEASE_MS;
+        let owner = ServingOwner::start(ctx, q.clone(), input, identity()?).await?;
+        timeout(Duration::from_secs(8), async {
+            while owner.stats().phase != ServingOwnerPhase::Ready {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        let view = owner.snapshot(Some("owner".into())).await?;
+        let workspace = view.ref_workspace(WorkspaceLimits::default()).await?;
+        provider.armed.store(true, Ordering::Release);
+        let observer = tokio::spawn(async move {
+            workspace.prepare_fetch(vec![oid], None, false).await?;
+            Ok::<_, ServingReadError>(workspace)
+        });
+        timeout(Duration::from_secs(8), provider.entered.acquire())
+            .await??
+            .forget();
+        // Physical work must keep the closed owner renewing this same pin.
+        owner.close();
+        tokio::time::sleep(Duration::from_millis(RENEWAL_LEASE_MS * 3 / 2)).await;
+        timeout(Duration::from_secs(8), async {
+            while owner.stats().renewals < 2 {
+                assert_eq!(
+                    owner.stats().phase,
+                    ServingOwnerPhase::Ready,
+                    "{:?}",
+                    owner.stats()
+                );
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        provider.proceed.add_permits(1);
+        let workspace = timeout(Duration::from_secs(8), observer).await???;
+        assert!(workspace.contains(&[oid]).await?[0]);
+        assert_eq!(pin_count(&f).await?, 1);
+        drop((workspace, view));
+        assert_eq!(
+            timeout(Duration::from_secs(8), owner.close_and_drain())
+                .await?
+                .phase,
+            ServingOwnerPhase::Released
+        );
+        assert_eq!(pin_count(&f).await?, 0);
+        assert!(q.close_and_drain().await.is_empty());
+        tasks.close();
+        timeout(Duration::from_secs(8), tasks.wait()).await?;
+        f.runtime.shutdown().await?;
+    }
+    Ok(())
+}
diff --git a/docs/evidence/native-fetch-renewal-ci-20261006.json b/docs/evidence/native-fetch-renewal-ci-20261006.json
new file mode 100644
index 00000000..707b69f9
--- /dev/null
+++ b/docs/evidence/native-fetch-renewal-ci-20261006.json
@@ -0,0 +1,28 @@
+{
+  "base_commit": "772c6d00aee5ee6201a2175a35d41d3b0e65e891",
+  "problem": "Preparation refreshed the same serving pin but read_owned rejected completion after its original deadline. Full local run: 756 server unit tests passed, one certified HTTP clone returned HTTP 500; isolated clone passed.",
+  "reproduction": {
+    "log": "/tmp/canopy-fetch-renewal-before.log",
+    "result": "FAIL: Inactive after the gated provider spans the original lease and the exact owner renews twice"
+  },
+  "fix": "Fetch and advertisement preparation use existing renewable read_session and fresh final authority observation; no lease duration or resource/test limits changed.",
+  "qualification": {
+    "workspace_tests": {
+      "passed": 12,
+      "seconds": 30.5,
+      "log": "/tmp/canopy-fetch-renewal-after.log"
+    },
+    "clippy": {
+      "result": "PASS: workspace, all targets, locked, warnings denied",
+      "seconds": 49.27
+    },
+    "format": "PASS",
+    "diff_check": "PASS",
+    "full_workspace": "pending",
+    "linux_provider": "pending"
+  },
+  "sources": {
+    "crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs": "6f77f31a111737c4ed87490889a5d0f66ab317266c7cc75a18531bd55b709fe8",
+    "crates/canopy-server/src/packs/publication/tests/serving/workspace.rs": "009a0c43a035e5c309641b04a4ea44b52ddd6e71cf9baecf0ca8d43c6f54bde5"
+  }
+}

From 54ed25636ade52ac6bcbebc1a2fe52cf00256aec Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 23:42:33 -0700
Subject: [PATCH 54/55] fix: advertise certified refs without native pack reads

---
 .../src/git_cache/serving_refs.rs             | 42 +++++++++++++++---
 .../serving/session/native_base.rs            |  2 +-
 .../publication/serving/session/workspace.rs  |  2 +-
 .../serving/session/workspace/prepare.rs      | 43 ++++++++++++++++---
 .../native-discovery-ci-20261006.json         | 30 +++++++++++++
 5 files changed, 105 insertions(+), 14 deletions(-)
 create mode 100644 docs/evidence/native-discovery-ci-20261006.json

diff --git a/crates/canopy-server/src/git_cache/serving_refs.rs b/crates/canopy-server/src/git_cache/serving_refs.rs
index 7d7feffb..bf4727ad 100644
--- a/crates/canopy-server/src/git_cache/serving_refs.rs
+++ b/crates/canopy-server/src/git_cache/serving_refs.rs
@@ -1,24 +1,35 @@
 //! Count-bounded ref pages streamed into one unpublished, admitted native cache.
 use super::*;
-use crate::git_objects::ReadOwner;
+use crate::{ObjectId, git_objects::ReadOwner};
 
 pub(crate) struct ServingRefsWriter {
     output: BufWriter<CacheWriter>,
     last: String,
+    replace: bool,
     _owner: ReadOwner,
 }
 impl GitCache {
     pub(crate) async fn serving_refs(
         self: &Arc<Self>,
         owner: ReadOwner,
+        fully_peeled: bool,
     ) -> Result<ServingRefsWriter, CacheError> {
         let cache = self.clone();
         tokio::task::spawn_blocking(move || {
-            let mut output = BufWriter::new(cache.writer(Path::new("packed-refs"))?);
-            output.write_all(b"# pack-refs with: sorted\n")?;
+            let mut output = BufWriter::new(cache.writer(Path::new(if fully_peeled {
+                "packed-refs.lock"
+            } else {
+                "packed-refs"
+            }))?);
+            output.write_all(if fully_peeled {
+                b"# pack-refs with: peeled fully-peeled sorted\n"
+            } else {
+                b"# pack-refs with: sorted\n"
+            })?;
             Ok(ServingRefsWriter {
                 output,
                 last: String::new(),
+                replace: fully_peeled,
                 _owner: owner,
             })
         })
@@ -27,14 +38,25 @@ impl GitCache {
 }
 impl ServingRefsWriter {
     pub(crate) async fn append(
-        mut self,
+        self,
         page: Vec<(String, RefExpectation)>,
+    ) -> Result<Self, CacheError> {
+        self.append_peeled(
+            page.into_iter()
+                .map(|(name, state)| (name, state, None))
+                .collect(),
+        )
+        .await
+    }
+    pub(crate) async fn append_peeled(
+        mut self,
+        page: Vec<(String, RefExpectation, Option<ObjectId>)>,
     ) -> Result<Self, CacheError> {
         if page.len() > crate::refs::REF_PAGE_SIZE {
             return Err(CacheError::InvalidHead);
         }
         tokio::task::spawn_blocking(move || {
-            for (name, state) in page {
+            for (name, state, peeled) in page {
                 let Some(oid) = state.oid else {
                     return Err(CacheError::InvalidHead);
                 };
@@ -46,6 +68,12 @@ impl ServingRefsWriter {
                     return Err(CacheError::InvalidHead);
                 }
                 writeln!(self.output, "{} {name}", hex::encode(oid))?;
+                if let Some(peeled) = peeled {
+                    if peeled.is_zero() || peeled.format() != oid.format() {
+                        return Err(CacheError::InvalidHead);
+                    }
+                    writeln!(self.output, "^{}", hex::encode(peeled))?;
+                }
                 self.last = name;
             }
             Ok(self)
@@ -56,6 +84,10 @@ impl ServingRefsWriter {
         tokio::task::spawn_blocking(move || {
             self.output.flush()?;
             self.output.get_ref().file.sync_all()?;
+            if self.replace {
+                let path = self.output.get_ref().cache.git_dir();
+                std::fs::rename(path.join("packed-refs.lock"), path.join("packed-refs"))?;
+            }
             Ok(())
         })
         .await?
diff --git a/crates/canopy-server/src/packs/publication/serving/session/native_base.rs b/crates/canopy-server/src/packs/publication/serving/session/native_base.rs
index 810a7a4d..56ea4f55 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/native_base.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/native_base.rs
@@ -69,7 +69,7 @@ impl ServingPin {
                     .await?;
                 let mut names = inner.context.indexes.refs().cursor(refs.root, None, true)?;
                 let mut writer = cache
-                    .serving_refs(owner.clone())
+                    .serving_refs(owner.clone(), false)
                     .await
                     .map_err(crate::packs::catalog::NativeReadError::from)?;
                 loop {
diff --git a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
index 7dfc6683..a1f45ea9 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/workspace.rs
@@ -230,7 +230,7 @@ impl ServingPin {
                             .refs()
                             .cursor(refs.root.clone(), None, true)?;
                     let mut writer = cache
-                        .serving_refs(owner.clone())
+                        .serving_refs(owner.clone(), false)
                         .await
                         .map_err(crate::packs::catalog::NativeReadError::from)?;
                     loop {
diff --git a/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs b/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
index 7b9f0c03..89473ba8 100644
--- a/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
+++ b/crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs
@@ -64,12 +64,20 @@ impl NativeWorkspace {
                             .indexes
                             .refs()
                             .cursor(refs.root.clone(), None, true)?;
+                    let mut writer = core
+                        .cache
+                        .serving_refs(owner.clone(), true)
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    let mut page = Vec::with_capacity(crate::refs::REF_PAGE_SIZE);
                     while let Some(record) = cursor.next().await? {
                         observation.refresh(&inner, &actor).await?;
                         let mut id = record.state().oid.ok_or(ServingReadError::Context)?;
                         let mut finished = false;
-                        // Peeling requires only the advertised object and nested tags,
-                        // never an unrelated commit's ancestors or tree history.
+                        let mut peeled = None;
+                        let mut expected = None;
+                        // Certified metadata supplies peeled targets. Native Git can
+                        // advertise fully peeled packed refs without pack bodies.
                         for _ in 0..128 {
                             let reader = inner.catalog().await?;
                             let object = reader
@@ -77,11 +85,10 @@ impl NativeWorkspace {
                                 .await?
                                 .ok_or(ServingReadError::Context)?;
                             let kind = object.entry.header.object.kind;
-                            inner
-                                .context
-                                .files
-                                .install_workspace(core.cache.clone(), &object, owner.clone())
-                                .await?;
+                            if expected.is_some_and(|expected| expected != kind) {
+                                return Err(ServingReadError::Context);
+                            }
+
                             observation.refresh(&inner, &actor).await?;
                             if kind != ObjectKind::Tag {
                                 finished = true;
@@ -99,11 +106,33 @@ impl NativeWorkspace {
                                 return Err(ServingReadError::Context);
                             }
                             id = edges[0].child;
+                            peeled = Some(id);
+                            expected = Some(edges[0].expected_kind);
                         }
                         if !finished {
                             return Err(ServingReadError::TooLarge);
                         }
+                        page.push((record.name().to_owned(), record.state().clone(), peeled));
+                        if page.len() == crate::refs::REF_PAGE_SIZE {
+                            writer = writer
+                                .append_peeled(std::mem::replace(
+                                    &mut page,
+                                    Vec::with_capacity(crate::refs::REF_PAGE_SIZE),
+                                ))
+                                .await
+                                .map_err(crate::packs::catalog::NativeReadError::from)?;
+                        }
                     }
+                    if !page.is_empty() {
+                        writer = writer
+                            .append_peeled(page)
+                            .await
+                            .map_err(crate::packs::catalog::NativeReadError::from)?;
+                    }
+                    writer
+                        .finish()
+                        .await
+                        .map_err(crate::packs::catalog::NativeReadError::from)?;
                     inner.observe(actor).await?;
                     Ok(())
                 },
diff --git a/docs/evidence/native-discovery-ci-20261006.json b/docs/evidence/native-discovery-ci-20261006.json
new file mode 100644
index 00000000..0c986821
--- /dev/null
+++ b/docs/evidence/native-discovery-ci-20261006.json
@@ -0,0 +1,30 @@
+{
+  "base_commit": "8ec0aefdea0b99910cdcd755001648e1c5ddd941",
+  "problem": "Both Linux runs at 772c6d0 passed all 757 server unit tests and 110 multi-server cases, failing only ref discovery while a large native pack part was deliberately paused. Advertised commit or tag bodies can share that physical part.",
+  "fix": "Stream fully peeled packed refs from certified ref and catalog metadata in bounded pages. Native Git owns v0/v2 discovery and capability formatting; discovery does not fetch native pack bodies. Validate tag-edge kinds and retain depth bound and fresh authority checks. The admitted replacement uses packed-refs.lock then atomic rename, with conservative disk charging.",
+  "qualification": {
+    "paused_pack_discovery": {
+      "result": "PASS with unchanged two-second requests",
+      "seconds": 10.99
+    },
+    "stock_git_tags_history_shallow_and_cold_clone": {
+      "result": "PASS",
+      "seconds": 20.64
+    },
+    "default_branch_fresh_restore_discovery": {
+      "result": "PASS",
+      "seconds": 9.01
+    },
+    "clippy": "PASS: workspace, all targets, locked, warnings denied",
+    "format": "PASS",
+    "diff_check": "PASS",
+    "full_workspace": "pending",
+    "linux_provider": "pending"
+  },
+  "sources": {
+    "crates/canopy-server/src/git_cache/serving_refs.rs": "d080e0e19a179ca2bd3fa668c54145499e6fdc29d38f7932643cb4e828e3b626",
+    "crates/canopy-server/src/packs/publication/serving/session/native_base.rs": "96c9358ac1b2e1255bd9b97840eac1b00d464605a2248d91c41c7e1a20a6655a",
+    "crates/canopy-server/src/packs/publication/serving/session/workspace.rs": "4d17485a9155d6c0e90d92fdad2ca08d28f699a52d5f326720958e139514caf8",
+    "crates/canopy-server/src/packs/publication/serving/session/workspace/prepare.rs": "af01cc2468948f4a6d9fc3442d19c782908de67103da56b1259efe0d4b08550a"
+  }
+}

From 85abb779842f293bc09c59821bce160944e73012 Mon Sep 17 00:00:00 2001
From: forhappy <haipingf@gmail.com>
Date: Mon, 5 Oct 2026 23:57:57 -0700
Subject: [PATCH 55/55] test: isolate serving lease checks from cold fixture
 setup

---
 .../publication/tests/serving/workspace.rs    | 114 +++++++++++++++---
 .../native-lease-fixture-ci-20261006.json     |  19 +++
 2 files changed, 114 insertions(+), 19 deletions(-)
 create mode 100644 docs/evidence/native-lease-fixture-ci-20261006.json

diff --git a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
index ff579616..4103fbe0 100644
--- a/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
+++ b/crates/canopy-server/src/packs/publication/tests/serving/workspace.rs
@@ -658,6 +658,23 @@ async fn expired_lease_does_not_resurrect_or_release_suspended_construction() ->
     let tasks = TaskTracker::new();
     let (ctx, files) =
         super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
+    // Warm immutable metadata before the deliberately short expiry lease;
+    // cold hashing must not consume the setup phase of this gated expiry case.
+    let oid = *native.fixture.objects.keys().next().ok_or("object")?;
+    let warm = ServingOwner::start(ctx.clone(), q.clone(), f.begin([122; 16]), identity()?).await?;
+    timeout(Duration::from_secs(8), async {
+        while warm.stats().phase != ServingOwnerPhase::Ready {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await?;
+    let view = warm.snapshot(Some("owner".into())).await?;
+    assert!(view.headers(&[oid]).await?[0].is_some());
+    drop(view);
+    assert_eq!(
+        warm.close_and_drain().await.phase,
+        ServingOwnerPhase::Released
+    );
     let mut input = f.begin([123; 16]);
     input.lease_ms = 1000;
     let owner = ServingOwner::start(ctx, q.clone(), input, identity()?).await?;
@@ -668,7 +685,6 @@ async fn expired_lease_does_not_resurrect_or_release_suspended_construction() ->
     })
     .await?;
     let view = owner.snapshot(Some("owner".into())).await?;
-    let oid = *native.fixture.objects.keys().next().ok_or("object")?;
     assert!(view.headers(&[oid]).await?[0].is_some());
     let (dispatch, entered) = q.pause_for_test().await;
     provider.armed.store(true, Ordering::Release);
@@ -775,21 +791,52 @@ async fn joint_ref_pages_stream_ten_thousand_names_without_an_object_root_limit(
 
 #[tokio::test]
 async fn fetch_preparation_accepts_exact_renewal_after_initial_deadline() -> Result {
+    use crate::packs::ref_state::{
+        RefStateRecord, RefStateSnapshot, RefStateSnapshotRoot, RefStateTree,
+    };
     for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
         let f = Fixture::new(format).await?;
         let provider = Arc::new(super::blocked::Gate::new());
-        let native = prepare(format, provider.clone(), f.repository, 0)
-            .await
-            .map_err(|e| e.to_string())?;
-        let store = Arc::new(ArtifactStore::new(provider.clone(), f.repository));
-        initialize(&f, store.clone()).await?;
-        f.install_generation(2, native.catalog, Some(native.refs))
+        let (native, catalog) = super::body::catalog(&f, provider.clone()).await?;
+        // One reachable native blob isolates renewal from unrelated graph setup.
+        let oid = *native
+            .fixture
+            .objects
+            .iter()
+            .find(|(_, (o, _))| o.kind == ObjectKind::Blob)
+            .ok_or("blob")?
+            .0;
+        let refs = RefStateTree::new(native.store.clone(), format)
+            .build_sorted(
+                operation(126),
+                [RefStateRecord::new(
+                    "refs/tags/body",
+                    crate::RefExpectation {
+                        oid: Some(oid),
+                        version: 1,
+                    },
+                    format,
+                )],
+            )
             .await?;
+        let refs = RefStateSnapshotRoot::upload(
+            &native.store,
+            operation(127),
+            RefStateSnapshot {
+                repository: f.repository,
+                format,
+                generation: 2,
+                default_branch: "refs/heads/main".into(),
+                root: refs,
+            },
+        )
+        .await?;
+        f.install_generation(3, catalog, Some(refs)).await?;
         let q = super::pool::queue(&f)?;
         let root = tempfile::TempDir::new()?;
         let tasks = TaskTracker::new();
-        let (ctx, _) = super::body::serving_context(&f, store.clone(), &root, tasks.clone())?;
-        let oid = native.main;
+        let (ctx, _) =
+            super::body::serving_context(&f, native.store.clone(), &root, tasks.clone())?;
         let warm =
             ServingOwner::start(ctx.clone(), q.clone(), f.begin([120; 16]), identity()?).await?;
         timeout(Duration::from_secs(8), async {
@@ -797,9 +844,13 @@ async fn fetch_preparation_accepts_exact_renewal_after_initial_deadline() -> Res
                 tokio::time::sleep(Duration::from_millis(10)).await;
             }
         })
-        .await?;
+        .await
+        .map_err(|e| format!("{format:?}: warm readiness: {e}; {:?}", warm.stats()))?;
         let view = warm.snapshot(Some("owner".into())).await?;
-        let workspace = view.ref_workspace(WorkspaceLimits::default()).await?;
+        let workspace = view
+            .ref_workspace(WorkspaceLimits::default())
+            .await
+            .map_err(|e| format!("{format:?}: warm workspace: {e}"))?;
         assert!(workspace.contains(&[oid]).await?[0]);
         drop((workspace, view));
         assert_eq!(
@@ -815,17 +866,39 @@ async fn fetch_preparation_accepts_exact_renewal_after_initial_deadline() -> Res
                 tokio::time::sleep(Duration::from_millis(10)).await;
             }
         })
-        .await?;
+        .await
+        .map_err(|e| {
+            format!(
+                "{format:?}: short owner readiness: {e}; {:?}",
+                owner.stats()
+            )
+        })?;
         let view = owner.snapshot(Some("owner".into())).await?;
-        let workspace = view.ref_workspace(WorkspaceLimits::default()).await?;
+        let workspace = view
+            .ref_workspace(WorkspaceLimits::default())
+            .await
+            .map_err(|e| format!("{format:?}: short workspace: {e}; {:?}", owner.stats()))?;
         provider.armed.store(true, Ordering::Release);
-        let observer = tokio::spawn(async move {
+        let mut observer = tokio::spawn(async move {
             workspace.prepare_fetch(vec![oid], None, false).await?;
             Ok::<_, ServingReadError>(workspace)
         });
-        timeout(Duration::from_secs(8), provider.entered.acquire())
-            .await??
-            .forget();
+        timeout(Duration::from_secs(8), async {
+            tokio::select! {
+                permit = provider.entered.acquire() => {
+                    permit?.forget();
+                    Ok::<_, Box<dyn std::error::Error>>(())
+                }
+                result = &mut observer => {
+                    let error = match result {
+                        Ok(Err(error)) => format!("preparation refused before provider entry: {error}"),
+                        Err(error) => format!("preparation worker failed before provider entry: {error}"),
+                        Ok(Ok(_)) => "preparation completed without reaching the armed provider".into(),
+                    };
+                    Err(error.into())
+                },
+            }
+        }).await.map_err(|e| format!("{format:?}: provider entry: {e}; {:?}", owner.stats()))??;
         // Physical work must keep the closed owner renewing this same pin.
         owner.close();
         tokio::time::sleep(Duration::from_millis(RENEWAL_LEASE_MS * 3 / 2)).await;
@@ -840,9 +913,12 @@ async fn fetch_preparation_accepts_exact_renewal_after_initial_deadline() -> Res
                 tokio::time::sleep(Duration::from_millis(10)).await;
             }
         })
-        .await?;
+        .await
+        .map_err(|e| format!("{format:?}: exact renewals: {e}; {:?}", owner.stats()))?;
         provider.proceed.add_permits(1);
-        let workspace = timeout(Duration::from_secs(8), observer).await???;
+        let workspace = timeout(Duration::from_secs(8), observer)
+            .await
+            .map_err(|e| format!("{format:?}: renewed completion: {e}; {:?}", owner.stats()))???;
         assert!(workspace.contains(&[oid]).await?[0]);
         assert_eq!(pin_count(&f).await?, 1);
         drop((workspace, view));
diff --git a/docs/evidence/native-lease-fixture-ci-20261006.json b/docs/evidence/native-lease-fixture-ci-20261006.json
new file mode 100644
index 00000000..65c61862
--- /dev/null
+++ b/docs/evidence/native-lease-fixture-ci-20261006.json
@@ -0,0 +1,19 @@
+{
+  "base_commit": "54ed25636ade52ac6bcbebc1a2fe52cf00256aec",
+  "observed_full_run": "756 server unit tests passed; short-lease expiry setup returned Inactive and initial renewal regression returned Elapsed. HTTP clone passed.",
+  "change": "Warm immutable expiry metadata before starting the unchanged one-second lease. Minimize renewal regression to one reachable native blob; same five-second lease, delayed provider, two renewals, final membership, original pin and full drain. Distinguish premature worker refusal from provider-gate timeout with stage-specific diagnostics.",
+  "validation": {
+    "workspace_tests": {
+      "passed": 12,
+      "seconds": 18.16
+    },
+    "clippy": "PASS: workspace, all targets, locked, warnings denied",
+    "format": "PASS",
+    "diff_check": "PASS",
+    "full_workspace": "pending",
+    "linux_provider": "pending"
+  },
+  "sha256": {
+    "crates/canopy-server/src/packs/publication/tests/serving/workspace.rs": "6fa05ccfe00b15e98ee897df54afc7a95f0c2e0ddddcf6061b770bef10410c35"
+  }
+}