The catalog and the ledger are not described: 4-resource-management.md has no section for what the catalog holds, what the ledger snapshot records, and when a digest is computed #906

Epic: #444 — the resource model. A documentation task, its own worktree, taken while #904 is fresh.

Feature: #908 Catalog (placed by the owner 2026-09-22; the section it writes describes both, and the ledger, #909, is the record the catalog leaves).

The gap

docs/architecture/4-resource-management.md describes resource identity (§2, §5), lifecycle states (§3), shadowing
(§4) and recovery (§6), and says the catalog travels with the graph -- but nowhere does it say, as a reader of
pkg/op/resource_catalog.go would need:

• what the catalog holds: produced entries (claimed by a unit, ProducerID set) beside discovered ones (a
  boundary or an occupant observed by a provider, no producer), and how each arrives -- GetOrCreate, Discover,
  Shadow, MarkGone;
• what the ledger snapshot is: the catalog serialized into a trace -- per entry, id, URI, producer, state, and
  for an Active entry its Etag and Digest -- and when it is captured (Run's defer, Trace(), a pause);
• the Etag/Digest ladder: an etag is one lstat (size, mtime, ino); a digest is content, and for a directory a
  Merkle root of the whole tree; a changed etag is the trigger for a digest comparison
  (verifyLocationFreshness), and -- after The ledger snapshot digests every Active resource, twice per run: a discovered directory boundary such as ~ is Merkle-walked (1.7M files) at the end of every deploy, silently, and the walk is discarded #904 -- a snapshot recomputes a digest only on a changed etag and never
  digests a discovered directory;
• what a reader of a trace's ledger may rely on: which fields are identity, which are observation, and what an
  empty digest means.

Found 2026-09-21 diagnosing #904: three correct rulings, each documented in its own place, composed into a
Merkle walk of the home directory, and no page of the architecture shows them side by side.

Done when

• 4-resource-management.md gains a section on the catalog and the ledger covering the four points above, with
  the code's names, and §9 records the The ledger snapshot digests every Active resource, twice per run: a discovered directory boundary such as ~ is Merkle-walked (1.7M files) at the end of every deploy, silently, and the walk is discarded #904 rulings: §5.8 (2026-09-22); §9 items 20-21 landed in PR The ledger snapshot compares before it hashes, a tree the run only found records its etag, and mkdir claims what it made #911
• 4-resource-management.status.md carries the row (2026-09-22)
• the section reads true against pkg/op/resource_catalog.go at the commit that lands it: read at 75350893; the file's comments now say "entries" where they meant the slice and "ledger" only for the record

Plan and design documents

Epic: #444 · Feature: #908 Catalog