[beinan]

Summary

A publisher takeover must recover the transaction and source selection already being prepared. Persist immutable publication plans through the catalog group's durable quorum path, retain them across ownership changes and snapshots, and return the original plan index for exact retries under the current authority.

Plans keep independent source-group cursors and a fixed Lance target. Shared immutable metadata avoids copying the selected record list into each table view. Separate command, source-byte and active-plan limits bound admission; registered record sizes must fit the publication budget. Checkpoint decoding validates plan state and rejects noncanonical maps.

The optional application/checkpoint format advances to v3 and rejects v1/v2 directories. This increment retains pending plans; source pins, descriptor CAS, external Lance outcome resolution and reclamation remain separate work. A stored plan does not authorize an external commit or payload deletion.

Refs #378.

Testing

The complete repository CI helper passed: 605 workspace Rust tests, Python 229 passed / 2 skipped / 1 expected failure, formatting, Clippy, Ruff and Pyright. All-feature WAL Clippy, server build and workspace packaging also passed.

All 66 focused Rust tests passed, including real TCP process takeover, isolated retries, snapshot transfer, full restart, large metadata and inner-state corruption regressions. The record-budget regression failed before the admission/restoration guards and passed after them.

The process test routes source proposals to the elected source-group leader; the corrected regression passed 20 consecutive runs. All seven checkpoint corruption mutations now execute, including the three pending-plan cases. The complete qualification above passed again on the final corrected head.