docs(sync): record the images-off-card decision — skip-media-in-apply

Repo stays untouched (remanso reads images as git blobs); the device
half landed as media-invisible apply_tree_diff. Documents the accepted
trade: stale card media, phantom git-status noise, never hand-commit
from the card.

docs/notes/git-sync-images-and-repo-size.md

@@ -126,17 +126,28 @@ commit "delete all images" and push it → remanso loses every image. So with
 the current staging, a full checkout is mandatory — which is what feeds costs
 2 and 3.
 
-## Fix for increment C (git module in the editor)
+## Fix for increment C (git module in the editor) — LANDED 2026-07-14
 
-Change two things together:
+Both halves shipped, months apart, each by its own route:
 
-- **Stage specific paths, not `add_all(["*"])`.** The editor knows which note
-  file it wrote — commit that path explicitly.
-- Then a **sparse checkout that excludes media** is safe: the device never
-  writes images to its working tree, killing the checkout OOM and the 2×
-  storage. The bytes still transit `.git` on fetch (no partial clone), but
-  writing objects to disk is far lower memory risk than a checkout that
-  materializes them in RAM.
+- **Stage specific paths, not `add_all(["*"])`** — delivered by the v0.6
+  splice commit (2026-07-13): the device commits exactly the dirty-journal
+  paths. This is what disarmed the trap below — a working tree missing its
+  images can no longer be committed as "delete all images".
+- **Skip media in the pull apply** (the sparse-checkout idea, done the
+  `apply_tree_diff` way, 2026-07-14): media extensions are invisible to both
+  of the apply's passes — never written, never deleted, and never
+  belt-hashed (hashing a stale 16 MB image would re-open the same OOM). The
+  blobs still arrive in `.git` on fetch (streamed, no partial clone in
+  libgit2); only the working-tree copy is skipped. `is_media_path` in
+  `git_sync.rs` holds the extension list.
+
+The accepted trade: the card's media files go stale/absent relative to HEAD,
+so a computer opening the card clone sees phantom `modified`/`deleted`
+images in `git status`. The card is device-owned — refresh it with
+`just load`, never hand-commit from it (`git add -A` there would commit the
+staleness for real and break remanso). `git checkout -- .` on a computer
+restores every image from `.git` if a clean tree is ever wanted.
 
 ## Related
 

docs/v0.7-search-and-git.md

@@ -143,6 +143,12 @@ Sync performance — inherited from the
       now removes its scratch tree itself, same decoding as the palette
       walk. The aborted run left `/sd/sdbench` on the card — the next bench
       run's setup sweep removes it.)
-- [ ] The images-off-card lever
-      ([notes/git-sync-images-and-repo-size.md](notes/git-sync-images-and-repo-size.md))
-      composes with the splice — decide whether to take it here (user's call).
+- [x] The images-off-card lever — **decided + landed 2026-07-14
+      (skip-media-in-apply)**: the repo stays untouched (its images are
+      remanso's blob-served CDN), and the device-side half shipped as media
+      paths invisible to `apply_tree_diff` (never written/deleted/belt-hashed
+      — a pulled 16 MB image was `:gl`'s last OOM path). Accepted trade: the
+      card's media go stale vs HEAD, so a computer sees phantom
+      modified/deleted images in `git status` — device-owned card, refresh
+      with `just load`, never hand-commit from it. Full write-up in
+      [notes/git-sync-images-and-repo-size.md](notes/git-sync-images-and-repo-size.md).