[yaacovcorcos]

What this changes

A follow-up to step 4 (#633) that brings publication in line with contract section 9: the network is never awaited while holding the checkout.

#633 kept the confirm's application section through the push to Overleaf. While a push was in flight, a Git pull, branch switch or checkpoint restore of that checkout had to wait, however slow the network was. Nothing was affected in practice: nothing mounts the coordinator until step 5, and this lands first.

How it works now

Publication is split in two:

• Inside the application section (unchanged): the gate, verification of the folder, the re-check of kept copies, the candidate commit, and the attempt recorded as unknown with its pins.
• After the section is released:

  1. Send admission, a short application section of its own. Inside that section, the send goes ahead only if:

     • it's the same checkout as at verification: every key of its identity chain matches, so a replaced or removed checkout, or a nested one that went away, fails;
     • the checkout's epoch hasn't moved, meaning no pull, switch or restore has run;
     • no pull, switch or restore is running now;
     • the checkout and folder are still the physical folders the connection recorded;
     • the credential is still the one the review used. This is checked last, inside the section.

     Otherwise the attempt is recorded not-sent (send-refused), and nothing is sent.

  2. Send once, holding no section. A change to the checkout after admission is a later local change, and it never alters what is sent.

A new test hook, admitting, sits between the two.

Tests

Six new real-Git tests in OverleafCoordinator.publication.test.ts:

• Checkout changed before admission: a pull of the checkout runs between verification and admission. The attempt is not-sent, with no push.
• Checkout replaced, folder replaced (same checkout and epoch), and nested checkout gone (the remaining chain's epochs add up the same) before admission: not-sent, no push.
• Credential renewed while admission enters its section: not-sent, no push.
• Pull during the push: a pull started while the push is in flight runs to completion. With feat(overleaf): publication — verify, record, send once, settle by evidence (step 4) #633's coordinator, the same test waits until it times out.

Each guard was broken in turn (the epoch, the key chain, the folder check, and the credential check moved back before the section), and its test failed. vp test run src/scient/overleaf src/scient/workspace: 584 tests pass. Typecheck, lint and knip are clean.

The engine doc and #535's step-4 design now describe the two parts.

Review

Codex (gpt-6.1-sol, high reasoning) reviewed this in two rounds. Round 1's findings are fixed, each with a test that fails without its fix. Round 2 found nothing: merge-ready (55 focused tests, 12 extra checks and two real crash-and-restart runs passed).

Round	Findings
1	Comparing only the epoch number admitted a replaced or removed checkout; the credential was checked before admission's asynchronous lookup, so a renewal meanwhile was missed.

One boundary remains, and Codex judged it acceptable: if the original folders are moved away and moved back unchanged, outside Scient, admission still passes, because their identity and epoch are the same.

Follows #633.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.6 KiB	5.6 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	4.3 KiB	4.3 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	26.2 KiB	26.2 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.6 KiB	5.6 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	4.3 KiB	4.3 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	26.6 KiB	26.6 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: be0eaf4 · PR result: 9284ca0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.
Full compact HTTP snapshot with live cursor.

• Codex decoded thread snapshot: 133.1 KiB
• Claude decoded thread snapshot: 133.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.