Budget growing history and import recovery encoding

headless/README.md

@@ -1003,8 +1003,21 @@ or scheduling failures retain the pending Root for retry and produce no partial
 storage commit. Initial DTO membership copying, synchronous preparation, unknown
 subtrees, first-time immutable normalization and individual scalar operations
 remain synchronous. This is partial time slicing, not a strict whole-Root latency
-bound. In particular, large history/import objects still need producer ownership
-review before their internal loops can safely be deferred.
+bound. Grouped history entries now keep shape ownership for newly built changes and
+operation-ID arrays, including undo/redo lifecycle remaps. Import runners keep it
+for their own job envelopes, completed-key arrays and binding dictionaries; newly
+allocated identity tables use the same private constructor. The engine's source
+proof refresh preserves this envelope ownership. Arbitrary host checkpoint
+replacements keep defensive capture. These constructors still freeze nested data
+before freezing their container, retaining the prior deep-freeze behavior; their
+brand alone never permits mutable child values to escape capture.
+
+Primitive values captured in these tables cannot change while suspended. Their
+normalization and UTF-8 sizing now run in the cooperative traversal rather than
+the preparation scan. Unknown object/proxy reflection stays entirely within the
+original normalizer; preparation adds no proxy traps or callback invocations.
+Membership copying and the preparation scan itself remain synchronous, as do
+unknown subtrees and individual native operations.
 
 A blocked schema upgrade retires its pending open. If the old connection closes
 later, that abandoned request aborts in `onupgradeneeded` rather than silently
@@ -1102,3 +1115,13 @@ CPU/allocation diagnostics found repeated history-transition validation under
 resource retention. The production mixed-input probe and a same-machine old
 history-path control both pass, but observed total runtimes are similar; this
 change demonstrates reduced repeated interpretation, not an end-to-end speedup.
+
+The 10k production copy/input probe keeps one native editor focused from the
+first presented copy through the 50% and 90% publication thresholds, read from
+the actual import status UI. Samples record phase, committed count, focus/DOM
+retention and input-to-two-rAF delay; middle/tail samples also record CDP dispatch
+round-trip time separately. That round trip includes transport and driver work,
+and is not a precise browser queue-time measurement. The final server document
+must retain the original's later edits while the copy retains its earlier source
+snapshot. Smaller scenarios retain the early burst because they can finish
+before a later publication threshold is observed.