[forhappy]

Native crab add and Git-clean previously kept separate ingestion and payload lifetimes. Switching paths could retain another full large-file representation, while push/recovery could lose delegated recipes or retire the wrong owners. This integration applies the shared streaming staging engine, Git-index handoff/recovery and exact post-publication retirement to the authenticated indexed-catalog branch.

This is a draft integration PR, stacked on #577 (codex/sqlite-wal-safety, 4ebfc3dcece). It brings together the staging series through #576; the indexed catalog, cache WAL and SQLite changes belong to the base. It is not the completed eight-stage initiative.

Changes

• Native add and Git-clean use one streaming ingestion owner. Preserve caller-specific Git-index transactions, verified delegated handoffs, rollback and flush-before-pointer ordering.
• Retain segment/prepared payloads through recipe reuse and push snapshots; recover committed historical recipes before rollback; retire only captured eligible owners after confirmed remote publication.
• Preserve explicit force/matched-lease semantics when the discarded remote tip is unavailable locally, retaining expected-old publication checks and replacement visibility.
• Share exact post-push retirement assertions across managed, committed-history and 10-GiB multi-edit qualification. Repair packed-object fault injection without weakening checksum rejection.
• Keep the base's checkpoint/run catalog formats and captured visibility authority. No alternate metadata reader or new format is introduced.

Evidence and review map

Surface	Entry / owner / downstream contract	Evidence / remaining gap
Shared ingestion	crab/src/cmd/add.rs, crab/src/git/clean.rs → crates/crab-staging/src/stream.rs → canonical recipe/payload ownership	Both paths compile; the integrated smoke and alternating native/Git 10-GiB entropy run pass.
Git handoff and recovery	crab/src/git/filter_process.rs, crab/src/git/index.rs → staging publication history and leases	Recovery regression tests included; current-source release tests pending.
Push lifecycle	crab/src/git/capsule_push.rs, crab/src/git/push_staging.rs → StagingPushSnapshot → confirmed publication and exact retirement	Integrated smoke and all four 10-GiB pushes confirm exact retirement; predecessor negative control retained.
Catalog authority	Captured paged checkpoint/run catalogs supplied by #571/#577; staging reuses that owner	Foreground shared/protected preparation, hydration/mount and current-state lookup conversion remains separate work.
Sibling surfaces	Native CLI, Git remote helper, deferred clean handoff and protected finalize response validation	Full protected/provider/cross-platform qualification remains open.
Main comparison	This branch is based on the unmerged indexed/SQLite stack, not main	Review as a stacked integration. Rebase/resolve the stack before landing; no main-level completion verdict.

Is this the best fix? The intended ownership is one ingestion engine plus caller-owned publication transactions, rather than duplicate native/Git payload paths. This draft needs combined runtime, lifecycle and scaling evidence before that can receive a final verdict.

Validation

• Passed on 0e84ca14b00: cargo check -p crab --lib --bin crab --locked --no-default-features --features simd-accel,gix-pathmatch --jobs 2 (19m46s). The minimal profile reports 17 warnings; this is not a strict-lint pass.
• Passed on this integration tree: cargo fmt --all -- --check, git diff --check and 17 Python qualification tests (11 source-isolation, six protocol-log tests).
• Passed on 0e84ca14b00: release-profile staging regression build and all seven tests in push_snapshot_guard, publication_history_recovery and retained_recipe_visibility (build 6m17s).
• Passed on 0e84ca14b00: the release CLI build with simd-accel,gix-pathmatch and no default features (30m41s); binary/source hashes retained. Current-source integrated smoke passes 163 commands / 84 checks after replacing an obsolete pre-push lease-count assertion with exact retained file-version coverage. The failed original run is preserved; an independent 16-command / 19-check probe proves the two published/history plus two delegated owners push, retire to zero and cold-reconstruct both versions. Exact post-push zero retirement and both cold byte checks remain unchanged. The integrated native-first entropy workload now passes 75 commands / 57 checks on this same frozen binary: two 10,737,418,240-byte files, four native/Git/native/Git versions, no duplicate full local payload, exact zero-owner retirement after each push, incremental uploads, all eight cold historical SHA-256 checks, Git integrity and remote fsck with zero errors/repairs. Report SHA-256 c64adcfbb6dce9cd3a5c5fbadfcbc66d633fc285edfa69aec1c07cde6391e6ab; binary SHA-256 d4b8a1e9f17c5b7933d685021f1203e076f7b7bcf61c86f64ebaa65e8e5b8f77. Source capture is 0e84ca14b00 plus the recorded qualification patch; c70c8a374f7 commits that harness/docs correction without changing Rust. This receipt does not qualify later catalog consumers.
• Component evidence only: fix(push): force rewrites without fetching discarded tips #575 protocol unit/transcript tests and macOS/Windows contract jobs pass; its shared release build remains queued. The strengthened retirement oracle passes 83 commands / 65 checks on the frozen fix(push): retain and retire capsule staging #572 binary. Its negative control rejects fix(push): admit delegated capsule recipes #570 after successful remote publication because heads, leases and payload references remain.
• Component evidence only: the earlier 10-GiB entropy multi-edit workload passes 52 commands / 41 checks, including cold historical reconstruction and remote fsck. That artifact predates this integrated source and does not qualify this PR.
• Component evidence only: the frozen fix(push): retain and retire capsule staging #572 Git-first repeated-data 10-GiB workload also passes 71 commands / 53 checks, including cold historical reconstruction, local storage accounting and Git/remote fsck. The native-first zero-data 10-GiB workload also passes 71 commands / 53 checks, including all eight cold historical byte checks and remote integrity. Both use the frozen fix(push): retain and retire capsule staging #572 binary, not this integrated binary.
• The final combined-source 10-GiB pattern/ingestion-order matrix, publication interruption/concurrency, full protocol/provider CI and representative S3 latency remain required. History-scaling, migration/GC and fuller Git blame also remain open initiative gates.

The requested crab/docs/benchmarks/large-file-push-audit-summary.json and crab/docs/benchmarks/large-file-push-audit.md are excluded. No benchmark fixture, architecture inventory or expected-failure baseline is relaxed.