Development record

IngestReading redacts every free-text field inside the ledger lock, constructing a fresh scanner per field (each shells out to git config), so a 100-item batch holds the lock about 8 seconds against a 5-second lockTimeout and any concurrent capture, disposition or promote fails with allocator contention; the issue-capture path redacts before taking the lock. Also, promoteReadingItem reads the standing disposition state outside the lock and re-checks only promoted_to inside it, so a disposition landing between preflight and stamp leaves a standing rejected beside a promoted_to; and the readings tree is read through symlinks on the disposition and promote paths (only ingest calls ensureFamilyDir), so a symlinked readings root lets promote write its stamp through the link to a file outside the ledger.