Checkpoint.NativeTreePublication

Durable publication over a bounded-fan-out hierarchy (Representation.ParticipantTree) in which no participant ever holds another participant's tensor bytes. Every participant writes its own shards durably to the admitted store, then a *group manifest*: the capture prefix, a record (descriptor, digest) for each own shard, and one record per child naming the child's role, its subtree size and the digest of the child's group manifest. It sends its parent only a commitment -- capture prefix plus that one record -- so the parent's work and memory are bounded by the fan-out. The root's group manifest is the published root: it identifies one complete state through a chain of digests, each level checked by the participant above it. Coverage is structural. Roles are numbered in preorder, so a child's subtree is the role range [child, child + size); a parent checks that each received commitment names exactly the child and subtree size the hierarchy prescribes, which by induction establishes complete coverage at the root. A missing subtree cannot commit (its parent waits, then aborts), and a commitment with a different (version, cursor, epoch) prefix is refused. Completion is released down the tree only after the root is durable, so no participant reports success for a generation that was never published. Fixed membership, one durable publisher (the root): this is the shape the fleet profile scales, not its failure-tolerant authority (S12) or its failure-domain storage placement (S14). The store is the POSIX filesystem named by the paths; it must be the admitted shared store for the generation (Runtime.NativeFilePlan's caller obligations).

51constructor NativeTreeCheckpointOf