Concurrent work and recovery

Preserve local work, retry uncertain commits, and safely pull shared changes.

Every publication caller, including the existing browser and runner, uses a distinct Ablo participant and a short claim on the project row. The commit carries that claim and the captured head read into the same Ablo transaction. Immutable bytes are uploaded first. The claim covers publication, not an entire editing session: unrelated file preparation remains concurrent. Long-lived document claims, explicit CLI claim commands and automatic renewal across separate CLI invocations are not implemented in this slice.

Disjoint changes merge onto main; differing changes to the same file reject. On uncertain failure, run knowledge commit --retry. The pending operation ID, message, baseline, uploaded references and staged tree persist on disk, so a new process sends the same intent and receives the original receipt if accepted. Index-changing commands are blocked until that pending operation is resolved. commit --abort is allowed only after a recorded definite validation/conflict rejection; it retains staged bytes and working files. It never cancels an unknown remote outcome. To resolve a content conflict, preserve your local changes separately, unstage them, return tracked files to their known baseline, pull the latest version, then reapply and stage a deliberate resolution.

pull requires a clean tracked tree/index and uses Git’s safe two-tree checkout to reject untracked collisions. It never runs reset --hard. If publication includes external files absent from the local snapshot, more staging/committing is blocked until pull materializes those bytes. Offline edits remain local.

A local .knowledge/knowledge.lock prevents concurrent CLI commands from racing over a pending publication. After an abrupt process kill, verify the recorded PID is no longer running before removing that lock and retrying. An interruption during pull may leave safely staged incoming changes; retain the directory and inspect it rather than deleting local work. Automatic process-crash recovery for filesystem materialization is subsequent work.

Only regular files are published; symlinks, submodules, escaping paths, Git/ Knowledge metadata and .env* paths are refused. .gitignore applies to local staging. Limits remain 1,000 files per project and 20 MiB per file. Uploads are sequential and bounded; large-file streaming/resume and watch mode can follow.