the startup tombstone rebuild read every sealed segment in full (readFileAlloc, ~1.7s each) before block-level seq pruning could reject it — hours on the production archive, the '3h restart pause'. upstream's rebuildLiveTombstones skips a segment whose header max_seq is at or below the watermark without reading its blocks: rebuild cost scales with the watermark backlog, not the archive. port that skip into foldSegment, which serves both the startup rebuild and steady chunk folds. test mirrors upstream TestRebuildLiveTombstones_BoundedByWatermark and goes one step further: the covered segment is truncated to its bare header, so the test fails if any code path reads its blocks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>