Release v19.4.1

Fixed

• A kernel with a large artifact set could no longer start. Registering projections awaited a reconciliation pass whose cost scales with projections × namespaces, inside the caller's response timeout, so every registration timed out and the silo never became ready. Registration now schedules that pass instead of awaiting it. (#4088)

---

Bounding concurrent observer subscriptions (#4058) was correct — it stops a real cluster-wide recovery storm — but it changed the resubscribe fan-out from "fast because unbounded" into work of unbounded duration. Register awaited that work on every call, including the unchanged-definitions fast path.

The activation-time timer had already been moved off the activation turn for exactly this reason. That left Register as the remaining path: whichever of the two won the in-flight guard performed the whole fan-out, and when Register won it, the call exceeded the response timeout. Raising the timeout only moves the threshold, since the pass has no bound a fixed timeout can rely on.

Registration still subscribes the definitions it actually changed, so events seeded immediately after it are not missed. Repairing projections left dark by an earlier activation is background work whose failures are logged — which is how the timer-driven pass already treated them.

The spec asserts both halves of the contract: Register subscribes nothing itself, and the projection is still subscribed once the scheduled pass runs. Verified non-vacuous — should_not_subscribe_while_registering fails when the inline await is restored.