amalgm 0.1.238 → 0.1.240

package/runtime/scripts/amalgm-mcp/tests/workspace-tree-store.test.js

@@ -5,6 +5,7 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { spawn } = require('child_process');
 
 const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-workspace-tree-test-'));
 process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
@@ -12,10 +13,14 @@ process.env.AMALGM_WORKSPACES_DIR = path.join(tempRoot, 'workspaces');
 process.env.AMALGM_COMPUTER_ID = 'computer-tree-test';
 fs.mkdirSync(process.env.AMALGM_WORKSPACES_DIR, { recursive: true });
 
-const { closeLocalDb, openLocalDb } = require('../state/db');
+const {
+  backfillWorkspaceTrashComponents,
+  closeLocalDb,
+  openLocalDb,
+} = require('../state/db');
 const docs = require('../state/docs');
 const { handleProjectRegister, handleTreeList } = require('../workspace/rest');
-const { upsertWorkspace } = require('../workspace/store');
+const { listWorkspaces, upsertWorkspace } = require('../workspace/store');
 const {
   commitPathCreate,
   commitPathRename,
@@ -24,9 +29,18 @@ const {
   enrollRegisteredWorkspaces,
   listWorkspaceNodes,
   nodeForPath,
+  reconcileRegisteredWorkspaceTrees,
   reconcileWorkspaceTree,
 } = require('../workspace/tree-store');
-const { isUuidV7 } = require('../workspace/tree/identity');
+const {
+  crossTreeOperationWithRaceCapture,
+  finishTreeOperationPlan,
+  projectStoredTreeOperation,
+  recoverAllTreePlans,
+} = require('../workspace/tree-cloud');
+const treeMaterialization = require('../workspace/tree-materialization');
+const { isUuidV7, uuidV7 } = require('../workspace/tree/identity');
+const { trashPath } = require('../workspace/tree/local-state');
 
 test.after(() => {
   docs.closeAllDocs();
@@ -70,7 +84,7 @@ test('enrollment gives every node a UUID and open docs keep one resource through
   assert.equal(state.node_id, beforeNode.id);
 });
 
-test('bounded automatic tree passes skip large workspaces without blocking explicit enrollment', () => {
+test('bounded discovery may skip a large tree but recurring reconciliation repairs it uncapped', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'bounded-observer');
   fs.mkdirSync(root, { recursive: true });
   fs.writeFileSync(path.join(root, 'one.txt'), 'one\n');
@@ -78,7 +92,15 @@ test('bounded automatic tree passes skip large workspaces without blocking expli
   const workspace = upsertWorkspace({ path: root, name: 'Bounded observer', source: 'computer' });
 
   const boundedEnrollment = enrollWorkspace(workspace.id, { maxNodes: 1 });
-  assert.equal(boundedEnrollment.skipped, 'node_limit');
+  assert.equal(
+    boundedEnrollment.skipped,
+    'workspace-root-enrollment-pending',
+  );
+  assert.equal(boundedEnrollment.state, 'held');
+  assert.ok(listWorkspaces().find((item) => item.id === workspace.id)
+    .treeObservation.holds.some((hold) => (
+      hold.reason === 'workspace-root-enrollment-pending'
+    )));
   assert.equal(listWorkspaceNodes(workspace.id).length, 1, 'bounded scan must not persist a partial tree');
 
   const explicitEnrollment = enrollWorkspace(workspace.id);
@@ -87,7 +109,156 @@ test('bounded automatic tree passes skip large workspaces without blocking expli
   fs.writeFileSync(path.join(root, 'three.txt'), 'three\n');
   const boundedReconcile = reconcileWorkspaceTree(workspace.id, { maxNodes: 1 });
   assert.equal(boundedReconcile.skipped, 'node_limit');
-  assert.equal(nodeForPath(path.join(root, 'three.txt')), null, 'automatic reconciliation skips the oversized tree');
+  assert.equal(nodeForPath(path.join(root, 'three.txt')), null, 'an optional bounded pass may skip the oversized tree');
+
+  reconcileRegisteredWorkspaceTrees();
+  assert.ok(
+    nodeForPath(path.join(root, 'three.txt')),
+    'the recurring correctness pass has no permanent size blind spot',
+  );
+});
+
+test('an unbound large root remains baseline state until one uncapped enrollment', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'large-baseline-enrollment',
+  );
+  fs.mkdirSync(root, { recursive: true });
+  for (let index = 0; index < 2_001; index += 1) {
+    fs.writeFileSync(path.join(root, `file-${index}.txt`), `${index}\n`);
+  }
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Large baseline enrollment',
+    source: 'computer',
+  });
+  const held = enrollRegisteredWorkspaces({
+    database: openLocalDb(),
+    maxNodes: 2_000,
+  }).find((result) => result.workspaceId === workspace.id);
+  assert.equal(held.state, 'held');
+  assert.equal(held.skipped, 'workspace-root-enrollment-pending');
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+  `).get(`workspace-tree:${workspace.id}`).count, 0);
+
+  const [enrolled] = reconcileRegisteredWorkspaceTrees({
+    database: openLocalDb(),
+  }).filter((result) => result.workspaceId === workspace.id);
+  assert.equal(enrolled.state, 'ready');
+  assert.equal(listWorkspaceNodes(workspace.id).length, 2_002);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+  `).get(`workspace-tree:${workspace.id}`).count, 0);
+
+  fs.writeFileSync(path.join(root, 'after-baseline.txt'), 'new\n');
+  const observed = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(observed.operations.map((operation) => operation.kind), [
+    'tree.create',
+  ]);
+});
+
+test('a missing or replaced workspace root holds without lending its UUID', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'durable-root-binding',
+  );
+  const movedRoot = `${root}-moved`;
+  const originalFile = path.join(root, 'original.txt');
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(originalFile, 'original\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Durable root binding',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const originalId = nodeForPath(originalFile).node.id;
+  const journalCount = () => openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+  `).get(`workspace-tree:${workspace.id}`).count;
+  const before = journalCount();
+
+  fs.renameSync(root, movedRoot);
+  assert.throws(() => commitTreeOperation({
+    kind: 'tree.rename',
+    workspaceId: workspace.id,
+    nodeId: originalId,
+    name: 'renamed.txt',
+  }), (error) => error?.code === 'WORKSPACE_TREE_ROOT_UNVERIFIED');
+  assert.ok(listWorkspaces().find((item) => item.id === workspace.id)
+    .treeObservation.holds.some((hold) => (
+      hold.reason === 'workspace-root-missing'
+    )));
+  const missing = reconcileWorkspaceTree(workspace.id);
+  assert.equal(missing.skipped, 'workspace-root-missing');
+  assert.equal(missing.state, 'held');
+  assert.equal(journalCount(), before);
+
+  fs.mkdirSync(root);
+  fs.writeFileSync(path.join(root, 'unrelated.txt'), 'unrelated\n');
+  const replaced = reconcileWorkspaceTree(workspace.id);
+  assert.equal(replaced.skipped, 'workspace-root-replaced');
+  assert.equal(replaced.state, 'held');
+  assert.equal(nodeForPath(path.join(root, 'unrelated.txt')), null);
+  assert.equal(journalCount(), before);
+  assert.equal(
+    listWorkspaces().find((item) => item.id === workspace.id).status,
+    'held',
+  );
+
+  fs.rmSync(root, { recursive: true });
+  fs.renameSync(movedRoot, root);
+  const restored = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(restored.operations, []);
+  assert.equal(nodeForPath(originalFile).node.id, originalId);
+  assert.equal(journalCount(), before);
+  assert.equal(
+    listWorkspaces().find((item) => item.id === workspace.id).treeObservation,
+    null,
+  );
+});
+
+test('an observed symlink escape is held before it can enter the mutation rail', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'observed-symlink-escape',
+  );
+  fs.mkdirSync(root, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Observed symlink escape',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const link = path.join(root, 'outside');
+  fs.symlinkSync('../../outside', link);
+
+  const held = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(held.operations, []);
+  assert.ok(held.held.some((item) => (
+    item.reason === 'symlink-escapes-workspace'
+    && item.paths.includes('outside')
+  )));
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+  `).get(`workspace-tree:${workspace.id}`).count, 0);
+  assert.equal(nodeForPath(link), null);
+
+  fs.unlinkSync(link);
+  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
+  assert.equal(
+    listWorkspaces().find((item) => item.id === workspace.id).treeObservation,
+    null,
+  );
 });
 
 test('first-update enrollment assigns UUIDs to existing files and ignores nested noise', async () => {
@@ -162,6 +333,13 @@ test('a git checkout never becomes per-file workspace operations', () => {
   const enrolled = enrollWorkspace(workspace.id);
   assert.equal(enrolled.skipped, 'git-owned');
   assert.equal(listWorkspaceNodes(workspace.id).length, 1);
+  const boundRoot = openLocalDb().prepare(`
+    SELECT device_id, inode
+    FROM workspace_nodes
+    WHERE workspace_id = ? AND id = ?
+  `).get(workspace.id, workspace.id);
+  assert.ok(boundRoot.device_id);
+  assert.ok(boundRoot.inode);
 
   fs.writeFileSync(path.join(root, 'more.txt'), 'more\n');
   const reconciled = reconcileWorkspaceTree(workspace.id);
@@ -172,6 +350,25 @@ test('a git checkout never becomes per-file workspace operations', () => {
       .get(`workspace-tree:${workspace.id}`).count,
     0,
   );
+
+  const originalRoot = `${root}-original`;
+  fs.renameSync(root, originalRoot);
+  fs.mkdirSync(path.join(root, '.git'), { recursive: true });
+  const unrelated = path.join(root, 'unrelated.txt');
+  fs.writeFileSync(unrelated, 'unrelated\n');
+  assert.equal(nodeForPath(unrelated), null);
+  assert.ok(listWorkspaces().find((item) => item.id === workspace.id)
+    .treeObservation.holds.some((hold) => (
+      hold.reason === 'workspace-root-replaced'
+    )));
+
+  fs.rmSync(root, { recursive: true });
+  fs.renameSync(originalRoot, root);
+  assert.equal(reconcileWorkspaceTree(workspace.id).skipped, 'git-owned');
+  assert.equal(
+    listWorkspaces().find((item) => item.id === workspace.id).treeObservation,
+    null,
+  );
 });
 
 test('trash is editor-class while permanent removal is owner-only', () => {
@@ -218,7 +415,285 @@ test('direct shell creates and renames enter the same UUID tree journal', () =>
   assert.deepEqual(rows.map((row) => row.operation_kind), ['tree.create', 'tree.rename']);
 });
 
-test('a missing node never lends its UUID to a recreated path with a recycled inode', () => {
+test('a failed physical identity fence rolls back its UUID projection', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'identity-fence-rollback',
+  );
+  const target = path.join(root, 'adopted.txt');
+  const retained = path.join(root, 'retained.txt');
+  fs.mkdirSync(root);
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Identity fence rollback',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  fs.writeFileSync(target, 'receipt-owned bytes\n');
+  const identity = fs.lstatSync(target);
+  const nodeId = uuidV7();
+  const mutationId = `mut_${'identityfencerollback'.padEnd(32, '0')}`;
+  const changedAt = new Date().toISOString();
+  const operation = {
+    kind: 'tree.create',
+    workspaceId: workspace.id,
+    nodeId,
+    parentId: workspace.id,
+    nodeKind: 'file',
+    name: path.basename(target),
+    createdAt: changedAt,
+    changedAt,
+  };
+
+  assert.throws(
+    () => commitTreeOperation(operation, {
+      role: 'owner',
+      mutationId,
+      diskAlreadyApplied: true,
+      expectedDiskIdentity: {
+        path: target,
+        kind: 'file',
+        deviceId: String(identity.dev),
+        inode: String(identity.ino),
+      },
+      testHooks: {
+        afterOperationDatabaseProjectionBeforeIdentityFence() {
+          fs.renameSync(target, retained);
+          fs.writeFileSync(target, 'same-kind replacement\n');
+        },
+      },
+    }),
+    (error) => error?.code === 'WORKSPACE_TREE_PHYSICAL_BINDING_CHANGED',
+  );
+
+  assert.equal(
+    openLocalDb().prepare(`
+      SELECT COUNT(*) AS count
+      FROM workspace_nodes
+      WHERE workspace_id = ? AND id = ?
+    `).get(workspace.id, nodeId).count,
+    0,
+    'the rejected replacement never keeps the adopted UUID',
+  );
+  assert.notEqual(nodeForPath(target)?.node.id, nodeId);
+
+  fs.unlinkSync(target);
+  fs.renameSync(retained, target);
+  commitTreeOperation(operation, {
+    role: 'owner',
+    mutationId,
+    diskAlreadyApplied: true,
+    expectedDiskIdentity: {
+      path: target,
+      kind: 'file',
+      deviceId: String(identity.dev),
+      inode: String(identity.ino),
+    },
+  });
+  assert.equal(nodeForPath(target).node.id, nodeId);
+});
+
+test('operation receipts keep endpoint resemblance independent', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'receipt-not-resemblance');
+  fs.mkdirSync(root);
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Receipt not resemblance',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+
+  const createdId = uuidV7();
+  const createdPath = path.join(root, 'created.txt');
+  commitTreeOperation({
+    kind: 'tree.create',
+    workspaceId: workspace.id,
+    nodeId: createdId,
+    parentId: workspace.id,
+    nodeKind: 'file',
+    name: 'created.txt',
+  }, {
+    role: 'owner',
+    testHooks: {
+      afterOperationPlan() {
+        fs.writeFileSync(createdPath, '');
+      },
+    },
+  });
+  assert.equal(nodeForPath(createdPath).node.id, createdId);
+  const retainedCreate = fs.readdirSync(root)
+    .find((name) => name.startsWith('created.amalgm-retained-'));
+  assert.ok(retainedCreate);
+  reconcileWorkspaceTree(workspace.id);
+  const retainedCreateNode = nodeForPath(path.join(root, retainedCreate)).node;
+  assert.notEqual(retainedCreateNode.id, createdId);
+
+  const source = path.join(root, 'before.txt');
+  const destination = path.join(root, 'after.txt');
+  fs.writeFileSync(source, 'same inode and bytes\n');
+  reconcileWorkspaceTree(workspace.id);
+  const movedId = nodeForPath(source).node.id;
+  commitTreeOperation({
+    kind: 'tree.rename',
+    workspaceId: workspace.id,
+    nodeId: movedId,
+    name: 'after.txt',
+  }, {
+    role: 'owner',
+    testHooks: {
+      afterOperationPlan() {
+        fs.renameSync(source, destination);
+      },
+    },
+  });
+  assert.equal(fs.existsSync(source), false);
+  assert.equal(nodeForPath(destination).node.id, movedId);
+});
+
+test('a target-parent symlink swap cannot send a tree move outside its workspace', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'parent-symlink-race');
+  const outside = path.join(tempRoot, 'parent-symlink-outside');
+  const source = path.join(root, 'source.txt');
+  const folder = path.join(root, 'A');
+  const heldFolder = path.join(root, 'A-held');
+  fs.mkdirSync(folder, { recursive: true });
+  fs.mkdirSync(outside);
+  fs.writeFileSync(source, 'source bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Parent symlink race',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const sourceId = nodeForPath(source).node.id;
+  const folderId = nodeForPath(folder).node.id;
+
+  assert.throws(
+    () => commitTreeOperation({
+      kind: 'tree.move',
+      workspaceId: workspace.id,
+      nodeId: sourceId,
+      parentId: folderId,
+      name: 'source.txt',
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationPlan() {
+          fs.renameSync(folder, heldFolder);
+          fs.symlinkSync(outside, folder, 'dir');
+        },
+      },
+    }),
+    (error) => (
+      error?.code === 'WORKSPACE_TREE_RETRY_PENDING'
+      && error.reason === 'symlink-escapes-workspace'
+    ),
+  );
+
+  assert.deepEqual(fs.readdirSync(outside), []);
+  assert.ok(listWorkspaces().find((item) => item.id === workspace.id)
+    .treeObservation.holds.some((hold) => (
+      hold.reason === 'symlink-escapes-workspace'
+    )));
+  fs.unlinkSync(folder);
+  recoverAllTreePlans();
+  assert.equal(
+    fs.readFileSync(path.join(heldFolder, 'source.txt'), 'utf8'),
+    'source bytes\n',
+  );
+  assert.equal(nodeForPath(path.join(heldFolder, 'source.txt')).node.id, sourceId);
+  assert.equal(nodeForPath(heldFolder).node.id, folderId);
+});
+
+test('a both-retained source race is captured with every value visible', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'source-both-retained');
+  const source = path.join(root, 'source.txt');
+  const movedOriginal = path.join(root, 'moved-original.txt');
+  fs.mkdirSync(root);
+  fs.writeFileSync(source, 'original source\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Source both retained',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const sourceId = nodeForPath(source).node.id;
+  let child;
+  commitTreeOperation({
+    kind: 'tree.rename',
+    workspaceId: workspace.id,
+    nodeId: sourceId,
+    name: 'official-name.txt',
+  }, {
+    role: 'owner',
+    testHooks: {
+      afterOperationPlan() {
+        child = spawn(process.execPath, [
+          '-e',
+          'const fs=require("fs");'
+            + `setTimeout(()=>{`
+            + `fs.renameSync(${JSON.stringify(source)},${JSON.stringify(movedOriginal)});`
+            + `fs.writeFileSync(${JSON.stringify(source)},"first replacement\\n");`
+            + '},250);'
+            + `setTimeout(()=>{`
+            + `fs.writeFileSync(${JSON.stringify(source)},"second replacement\\n");`
+            + '},900);',
+        ], { stdio: 'ignore' });
+      },
+      operationStageRename: {
+        pauseBeforeInstall: 600,
+        pauseAfterTreeMove: 600,
+      },
+    },
+  });
+  child?.unref();
+  assert.equal(fs.readFileSync(movedOriginal, 'utf8'), 'original source\n');
+  assert.equal(fs.readFileSync(source, 'utf8'), 'second replacement\n');
+  const retained = fs.readdirSync(root)
+    .find((name) => name.startsWith('source.amalgm-retained-'));
+  assert.ok(retained);
+  assert.equal(fs.readFileSync(path.join(root, retained), 'utf8'), 'first replacement\n');
+  assert.equal(nodeForPath(movedOriginal).node.id, sourceId);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('a killed native stage resumes from its durable pre-rename receipt', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'killed-tree-stage');
+  const source = path.join(root, 'source.txt');
+  const target = path.join(root, 'target.txt');
+  fs.mkdirSync(root);
+  fs.writeFileSync(source, 'survives kill\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Killed tree stage',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const sourceId = nodeForPath(source).node.id;
+  assert.throws(
+    () => commitTreeOperation({
+      kind: 'tree.rename',
+      workspaceId: workspace.id,
+      nodeId: sourceId,
+      name: 'target.txt',
+    }, {
+      role: 'owner',
+      testHooks: {
+        operationStageRename: { crashAfterTreeMove: true },
+      },
+    }),
+    /native file transaction failed/,
+  );
+  recoverAllTreePlans();
+  assert.equal(fs.readFileSync(target, 'utf8'), 'survives kill\n');
+  assert.equal(nodeForPath(target).node.id, sourceId);
+});
+
+test('a deleted node never lends its UUID to a recreated path with a recycled inode', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'inode-reuse');
   const target = path.join(root, 'note.md');
   fs.mkdirSync(root);
@@ -229,9 +704,9 @@ test('a missing node never lends its UUID to a recreated path with a recycled in
 
   fs.unlinkSync(target);
   enrollWorkspace(workspace.id);
-  const missing = listWorkspaceNodes(workspace.id, { includeMissing: true })
+  const deleted = listWorkspaceNodes(workspace.id, { includeTrashed: true })
     .find((node) => node.id === original.id);
-  assert.ok(missing.missingAt);
+  assert.ok(deleted.trashedAt);
 
   fs.writeFileSync(target, 'replacement identity\n');
   const replacementStats = fs.lstatSync(target);
@@ -244,11 +719,11 @@ test('a missing node never lends its UUID to a recreated path with a recycled in
   const replacement = nodeForPath(target).node;
   assert.notEqual(replacement.id, original.id);
   assert.equal(
-    listWorkspaceNodes(workspace.id, { includeMissing: true }).some(
-      (node) => node.id === original.id && node.missingAt,
+    listWorkspaceNodes(workspace.id, { includeTrashed: true }).some(
+      (node) => node.id === original.id && node.trashedAt,
     ),
     true,
-    'the old identity remains tombstoned',
+    'the old identity remains durably trashed',
   );
 });
 
@@ -276,7 +751,7 @@ test('tree lookup enrolls an existing path on demand before sharing', () => {
   assert.equal(response.body.node.id, firstId, 'repeated sharing preserves identity');
 });
 
-test('moving a node requires write access at both source and destination', () => {
+test('moving or restoring a node requires write access at both source and destination', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'move-authority');
   const sourcePath = path.join(root, 'source');
   const destinationPath = path.join(root, 'destination');
@@ -309,25 +784,76 @@ test('moving a node requires write access at both source and destination', () =>
       workspaceId: workspace.id,
       nodeId: file.id,
       parentId: destination.id,
+    }, {
+      role: 'editor',
     }), /tree destination is forbidden/);
     assert.equal(nodeForPath(filePath).node.id, file.id);
 
+    commitTreeOperation({
+      kind: 'tree.trash',
+      workspaceId: workspace.id,
+      nodeId: file.id,
+    });
+    assert.throws(() => commitTreeOperation({
+      kind: 'tree.restore',
+      workspaceId: workspace.id,
+      nodeId: file.id,
+      parentId: destination.id,
+    }, {
+      role: 'editor',
+    }), /tree destination is forbidden/);
+
     database.prepare(`
       UPDATE workspace_node_permissions SET role = 'editor'
       WHERE node_id = ? AND user_id = ?
     `).run(destination.id, memberId);
     commitTreeOperation({
-      kind: 'tree.move',
+      kind: 'tree.restore',
       workspaceId: workspace.id,
       nodeId: file.id,
       parentId: destination.id,
-    });
+    }, { role: 'editor' });
     assert.equal(nodeForPath(path.join(destinationPath, 'note.md')).node.id, file.id);
   } finally {
     identity.userId = currentUserId;
   }
 });
 
+test('repeat enrollment journals an offline deletion as one durable trash birth', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'offline-deletion');
+  const target = path.join(root, 'gone.txt');
+  fs.mkdirSync(root);
+  fs.writeFileSync(target, 'delete while stopped\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Offline deletion',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const nodeId = nodeForPath(target).node.id;
+
+  fs.unlinkSync(target);
+  const reconciled = enrollWorkspace(workspace.id);
+  assert.equal(reconciled.operations.length, 1);
+  assert.equal(reconciled.operations[0].kind, 'tree.trash');
+  const tombstone = listWorkspaceNodes(workspace.id, {
+    includeMissing: true,
+    includeTrashed: true,
+  }).find((node) => node.id === nodeId);
+  assert.equal(tombstone.missingAt, null);
+  assert.ok(tombstone.trashedAt);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+      AND mutation_origin = 'local'
+      AND operation_kind = 'tree.trash'
+      AND json_extract(operation_json, '$.nodeId') = ?
+  `).get(`workspace-tree:${workspace.id}`, nodeId).count, 1);
+
+  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
+});
+
 test('recursive create enrolls missing parents without overwriting existing disk entries', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'recursive');
   fs.mkdirSync(root);
@@ -348,6 +874,350 @@ test('recursive create enrolls missing parents without overwriting existing disk
   assert.ok(nodeForPath(existing)?.node.id);
 });
 
+test('purge retains a pre-existing writer as a new durable node', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'purge-open-writer');
+  const file = path.join(root, 'draft.txt');
+  fs.mkdirSync(root);
+  fs.writeFileSync(file, 'still being written\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Purge open writer',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const originalId = nodeForPath(file).node.id;
+  const writer = fs.openSync(file, 'r+');
+  try {
+    commitTreeOperation({
+      kind: 'tree.trash',
+      workspaceId: workspace.id,
+      nodeId: originalId,
+    }, { role: 'owner' });
+    commitTreeOperation({
+      kind: 'tree.purge',
+      workspaceId: workspace.id,
+      nodeId: originalId,
+    }, { role: 'owner' });
+    const successor = listWorkspaceNodes(workspace.id)
+      .find((node) => node.id !== workspace.id && node.id !== originalId);
+    const successorPath = path.join(
+      root,
+      ...successor.relativePath.split('/'),
+    );
+    assert.match(successor.name, /^draft\.amalgm-retained-[0-9a-f]{12}\.txt$/);
+    assert.equal(fs.readFileSync(successorPath, 'utf8'), 'still being written\n');
+    assert.equal(isUuidV7(successor.id), true);
+    assert.notEqual(successor.id, originalId);
+    const purged = listWorkspaceNodes(workspace.id, {
+      includeTrashed: true,
+      includePurged: true,
+    }).find((node) => node.id === originalId);
+    assert.ok(purged.purgedAt);
+    const successorMutation = openLocalDb().prepare(`
+      SELECT mutation_state
+      FROM mutation_journal
+      WHERE local_resource = ?
+        AND mutation_origin = 'local'
+        AND operation_kind = 'tree.create'
+      ORDER BY journal_id DESC
+      LIMIT 1
+    `).get(`workspace-tree:${workspace.id}`);
+    assert.equal(successorMutation.mutation_state, 'saved-local');
+  } finally {
+    fs.closeSync(writer);
+  }
+});
+
+test('equal trash timestamps never merge independent physical components', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'equal-trash-time');
+  const folderPath = path.join(root, 'folder');
+  const childPath = path.join(folderPath, 'child.txt');
+  fs.mkdirSync(folderPath, { recursive: true });
+  fs.writeFileSync(childPath, 'independent bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Equal trash timestamp',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const folderId = nodeForPath(folderPath).node.id;
+  const childId = nodeForPath(childPath).node.id;
+  const changedAt = '2026-07-21T12:01:00.000Z';
+  const childTrashPath = trashPath(workspace.id, childId, workspace.path);
+  const folderTrashPath = trashPath(workspace.id, folderId, workspace.path);
+
+  commitTreeOperation({
+    kind: 'tree.trash',
+    workspaceId: workspace.id,
+    nodeId: childId,
+    trashedAt: changedAt,
+  });
+  commitTreeOperation({
+    kind: 'tree.trash',
+    workspaceId: workspace.id,
+    nodeId: folderId,
+    trashedAt: changedAt,
+  });
+  const tombstones = listWorkspaceNodes(workspace.id, { includeTrashed: true });
+  assert.equal(tombstones.find((node) => node.id === childId).trashComponentId, childId);
+  assert.equal(tombstones.find((node) => node.id === folderId).trashComponentId, folderId);
+
+  commitTreeOperation({
+    kind: 'tree.purge',
+    workspaceId: workspace.id,
+    nodeId: folderId,
+  }, { role: 'owner' });
+  assert.equal(fs.existsSync(folderTrashPath), false);
+  assert.equal(fs.existsSync(childTrashPath), false);
+  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
+});
+
+test('purging a writer-held cascaded child gives it a live recovery UUID', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'cascaded-writer-purge');
+  const folderPath = path.join(root, 'folder');
+  const childPath = path.join(folderPath, 'child.txt');
+  fs.mkdirSync(folderPath, { recursive: true });
+  fs.writeFileSync(childPath, 'writer survives\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Cascaded writer purge',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const folderId = nodeForPath(folderPath).node.id;
+  const childId = nodeForPath(childPath).node.id;
+  const writer = fs.openSync(childPath, 'r+');
+  try {
+    commitTreeOperation({
+      kind: 'tree.trash',
+      workspaceId: workspace.id,
+      nodeId: folderId,
+    });
+    commitTreeOperation({
+      kind: 'tree.purge',
+      workspaceId: workspace.id,
+      nodeId: childId,
+    }, { role: 'owner' });
+
+    const successor = listWorkspaceNodes(workspace.id)
+      .find((node) => node.id !== workspace.id && node.id !== folderId);
+    assert.ok(successor);
+    assert.notEqual(successor.id, childId);
+    assert.equal(successor.parentId, workspace.id);
+    assert.match(successor.name, /^child\.amalgm-retained-[0-9a-f]{12}\.txt$/);
+    assert.equal(
+      fs.readFileSync(path.join(root, successor.name), 'utf8'),
+      'writer survives\n',
+    );
+    const oldChild = listWorkspaceNodes(workspace.id, {
+      includeTrashed: true,
+      includePurged: true,
+    }).find((node) => node.id === childId);
+    assert.ok(oldChild.purgedAt);
+    assert.equal(
+      openLocalDb().prepare(
+        'SELECT count(*) AS count FROM workspace_tree_operation_materializations',
+      ).get().count,
+      0,
+    );
+  } finally {
+    fs.closeSync(writer);
+  }
+});
+
+test('an occupied purge recovery name fails closed until both byte sets have durable births', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'purge-recovery-collision');
+  const file = path.join(root, 'draft.txt');
+  fs.mkdirSync(root);
+  fs.writeFileSync(file, 'writer bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Purge recovery collision',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const originalId = nodeForPath(file).node.id;
+  const writer = fs.openSync(file, 'r+');
+  let recoveryTarget = null;
+  try {
+    commitTreeOperation({
+      kind: 'tree.trash',
+      workspaceId: workspace.id,
+      nodeId: originalId,
+    });
+    assert.throws(() => commitTreeOperation({
+      kind: 'tree.purge',
+      workspaceId: workspace.id,
+      nodeId: originalId,
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationPlan(plan) {
+          recoveryTarget = plan.actions.find((action) => action.type === 'remove').retainTarget;
+          fs.writeFileSync(recoveryTarget, 'independent collision\n');
+        },
+      },
+    }), (error) => (
+      error?.code === 'WORKSPACE_TREE_RETRY_PENDING'
+      && error?.reason === 'retained-target-occupied'
+    ));
+
+    assert.equal(fs.readFileSync(recoveryTarget, 'utf8'), 'independent collision\n');
+    assert.ok(nodeForPath(recoveryTarget), 'the racing target receives its own birth');
+    assert.equal(openLocalDb().prepare(`
+      SELECT count(*) AS count
+      FROM workspace_tree_operation_materializations
+      WHERE resource_id = ? AND materialization_state = 'committed'
+    `).get(workspace.id).count, 1);
+
+    fs.unlinkSync(recoveryTarget);
+    recoverAllTreePlans({ database: openLocalDb() });
+    const visible = fs.readdirSync(root).map((name) => path.join(root, name));
+    const retainedPath = visible.find(
+      (candidate) => fs.readFileSync(candidate, 'utf8') === 'writer bytes\n',
+    );
+    assert.ok(retainedPath);
+    const retainedNode = nodeForPath(retainedPath).node;
+    assert.notEqual(retainedNode.id, originalId);
+    assert.equal(openLocalDb().prepare(`
+      SELECT count(*) AS count
+      FROM workspace_tree_operation_materializations
+      WHERE resource_id = ?
+    `).get(workspace.id).count, 0);
+  } finally {
+    fs.closeSync(writer);
+  }
+});
+
+test('purge recovery follows a live parent UUID across restart rename', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'purge-recovery-parent');
+  const parent = path.join(root, 'parent');
+  const movedParent = path.join(root, 'moved-parent');
+  const file = path.join(parent, 'draft.txt');
+  fs.mkdirSync(parent, { recursive: true });
+  fs.writeFileSync(file, 'writer follows parent\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Purge recovery parent',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const parentId = nodeForPath(parent).node.id;
+  const originalId = nodeForPath(file).node.id;
+  const writer = fs.openSync(file, 'r+');
+  try {
+    commitTreeOperation({
+      kind: 'tree.trash',
+      workspaceId: workspace.id,
+      nodeId: originalId,
+    });
+    assert.throws(() => commitTreeOperation({
+      kind: 'tree.purge',
+      workspaceId: workspace.id,
+      nodeId: originalId,
+    }, {
+      role: 'owner',
+      testHooks: { crashAfterOperationCommit: true },
+    }), /simulated workspace tree crash after local operation commit/);
+
+    fs.renameSync(parent, movedParent);
+    fs.mkdirSync(parent);
+    fs.writeFileSync(path.join(parent, 'replacement.txt'), 'replacement parent\n');
+    recoverAllTreePlans({ database: openLocalDb() });
+
+    assert.equal(nodeForPath(movedParent).node.id, parentId);
+    assert.notEqual(nodeForPath(parent).node.id, parentId);
+    const successor = listWorkspaceNodes(workspace.id)
+      .find((node) => (
+        node.parentId === parentId
+        && /^draft\.amalgm-retained-[0-9a-f]{12}\.txt$/.test(node.name)
+      ));
+    assert.ok(successor);
+    assert.equal(successor.parentId, parentId);
+    assert.equal(
+      fs.readFileSync(path.join(movedParent, successor.name), 'utf8'),
+      'writer follows parent\n',
+    );
+    assert.equal(openLocalDb().prepare(`
+      SELECT count(*) AS count
+      FROM workspace_tree_operation_materializations
+      WHERE resource_id = ?
+    `).get(workspace.id).count, 0);
+  } finally {
+    fs.closeSync(writer);
+  }
+});
+
+test('legacy trash migration waits for physical ownership and never guesses from time', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'legacy-trash-provenance');
+  const folderPath = path.join(root, 'folder');
+  const childPath = path.join(folderPath, 'child.txt');
+  fs.mkdirSync(folderPath, { recursive: true });
+  fs.writeFileSync(childPath, 'legacy bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Legacy trash provenance',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const folderId = nodeForPath(folderPath).node.id;
+  const childId = nodeForPath(childPath).node.id;
+  const changedAt = '2026-07-21T12:01:00.000Z';
+  commitTreeOperation({
+    kind: 'tree.trash',
+    workspaceId: workspace.id,
+    nodeId: childId,
+    trashedAt: changedAt,
+  });
+  commitTreeOperation({
+    kind: 'tree.trash',
+    workspaceId: workspace.id,
+    nodeId: folderId,
+    trashedAt: changedAt,
+  });
+
+  const childTrashPath = trashPath(workspace.id, childId, workspace.path);
+  const trashRoot = path.dirname(childTrashPath);
+  const unavailableTrashRoot = `${trashRoot}-unavailable`;
+  fs.renameSync(trashRoot, unavailableTrashRoot);
+  openLocalDb().prepare(`
+    UPDATE workspace_nodes
+    SET trash_component_id = NULL
+    WHERE id IN (?, ?)
+  `).run(folderId, childId);
+  backfillWorkspaceTrashComponents(openLocalDb());
+  let rows = openLocalDb().prepare(`
+    SELECT id, trash_component_id
+    FROM workspace_nodes
+    WHERE id IN (?, ?)
+    ORDER BY id
+  `).all(folderId, childId);
+  assert.equal(rows.every((row) => row.trash_component_id === null), true);
+
+  fs.renameSync(unavailableTrashRoot, trashRoot);
+  backfillWorkspaceTrashComponents(openLocalDb());
+  rows = openLocalDb().prepare(`
+    SELECT id, trash_component_id
+    FROM workspace_nodes
+    WHERE id IN (?, ?)
+  `).all(folderId, childId);
+  assert.equal(rows.find((row) => row.id === folderId).trash_component_id, folderId);
+  assert.equal(rows.find((row) => row.id === childId).trash_component_id, childId);
+
+  openLocalDb().prepare(`
+    UPDATE workspace_nodes
+    SET purged_at = ?, trash_component_id = ?
+    WHERE id = ?
+  `).run(changedAt, childId, childId);
+  backfillWorkspaceTrashComponents(openLocalDb());
+  assert.equal(
+    openLocalDb().prepare(
+      'SELECT trash_component_id FROM workspace_nodes WHERE id = ?',
+    ).get(childId).trash_component_id,
+    null,
+  );
+});
+
 test('parent restore leaves an independently trashed child in its own trash slot', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'trash-cascades');
   const folderPath = path.join(root, 'folder');
@@ -358,8 +1228,8 @@ test('parent restore leaves an independently trashed child in its own trash slot
   enrollWorkspace(workspace.id);
   const folderId = nodeForPath(folderPath).node.id;
   const childId = nodeForPath(childPath).node.id;
-  const childTrashPath = path.join(process.env.AMALGM_DIR, 'trash', 'workspaces', workspace.id, childId);
-  const folderTrashPath = path.join(process.env.AMALGM_DIR, 'trash', 'workspaces', workspace.id, folderId);
+  const childTrashPath = trashPath(workspace.id, childId, workspace.path);
+  const folderTrashPath = trashPath(workspace.id, folderId, workspace.path);
 
   commitTreeOperation({
     kind: 'tree.trash',
@@ -368,6 +1238,11 @@ test('parent restore leaves an independently trashed child in its own trash slot
     trashedAt: '2026-07-21T12:01:00.000Z',
   });
   assert.equal(fs.readFileSync(childTrashPath, 'utf8'), 'child bytes\n');
+  assert.equal(
+    fs.lstatSync(path.dirname(root), { bigint: true }).dev,
+    fs.lstatSync(path.dirname(childTrashPath), { bigint: true }).dev,
+  );
+  assert.equal(childTrashPath.startsWith(`${process.env.AMALGM_DIR}${path.sep}`), false);
   commitTreeOperation({
     kind: 'tree.trash',
     workspaceId: workspace.id,
@@ -386,3 +1261,2251 @@ test('parent restore leaves an independently trashed child in its own trash slot
   assert.equal(fs.existsSync(folderTrashPath), false);
   assert.equal(fs.existsSync(childTrashPath), false);
 });
+
+test('purging a cascaded child removes it from the parent trash carrier permanently', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'cascaded-child-purge');
+  const folderPath = path.join(root, 'folder');
+  const childPath = path.join(folderPath, 'child.txt');
+  fs.mkdirSync(folderPath, { recursive: true });
+  fs.writeFileSync(childPath, 'must stay deleted\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Cascaded child purge',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const folderId = nodeForPath(folderPath).node.id;
+  const childId = nodeForPath(childPath).node.id;
+
+  commitTreeOperation({
+    kind: 'tree.trash',
+    workspaceId: workspace.id,
+    nodeId: folderId,
+  });
+  commitTreeOperation({
+    kind: 'tree.purge',
+    workspaceId: workspace.id,
+    nodeId: childId,
+  }, { role: 'owner' });
+  commitTreeOperation({
+    kind: 'tree.restore',
+    workspaceId: workspace.id,
+    nodeId: folderId,
+  });
+
+  assert.equal(fs.existsSync(folderPath), true);
+  assert.equal(fs.existsSync(childPath), false);
+  const child = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+    includePurged: true,
+  }).find((node) => node.id === childId);
+  assert.ok(child.purgedAt);
+  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
+});
+
+test('renaming a parent ignores duplicate logical paths held only by tombstones', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'tombstone-paths');
+  const folderPath = path.join(root, 'before');
+  const firstPath = path.join(folderPath, 'same.txt');
+  fs.mkdirSync(folderPath, { recursive: true });
+  fs.writeFileSync(firstPath, 'first\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Tombstone paths',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const folderId = nodeForPath(folderPath).node.id;
+  const firstId = nodeForPath(firstPath).node.id;
+  commitTreeOperation({
+    kind: 'tree.trash',
+    workspaceId: workspace.id,
+    nodeId: firstId,
+  });
+
+  fs.writeFileSync(firstPath, 'second\n');
+  commitPathCreate(firstPath, 'file');
+  const secondId = nodeForPath(firstPath).node.id;
+  assert.notEqual(secondId, firstId);
+  commitTreeOperation({
+    kind: 'tree.trash',
+    workspaceId: workspace.id,
+    nodeId: secondId,
+  });
+
+  commitTreeOperation({
+    kind: 'tree.rename',
+    workspaceId: workspace.id,
+    nodeId: folderId,
+    name: 'after',
+  });
+  assert.equal(fs.existsSync(path.join(root, 'after')), true);
+  const tombstones = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+  }).filter((node) => node.name === 'same.txt');
+  assert.equal(tombstones.length, 2);
+  assert.equal(new Set(tombstones.map((node) => node.relativePath)).size, 1);
+});
+
+test('a parent rename after source staging is captured and causally replanned', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'staged-parent-rename');
+  const folder = path.join(root, 'A');
+  const movedFolder = path.join(root, 'C');
+  const source = path.join(folder, 'x.txt');
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(source, 'staged parent bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Staged parent rename',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const fileId = nodeForPath(source).node.id;
+  let raced = false;
+  commitTreeOperation({
+    kind: 'tree.rename',
+    workspaceId: workspace.id,
+    nodeId: fileId,
+    name: 'y.txt',
+  }, {
+    role: 'owner',
+    testHooks: {
+      afterOperationStaging() {
+        if (raced) return;
+        raced = true;
+        fs.renameSync(folder, movedFolder);
+      },
+    },
+  });
+  const finalPath = path.join(movedFolder, 'y.txt');
+  assert.equal(fs.readFileSync(finalPath, 'utf8'), 'staged parent bytes\n');
+  assert.equal(nodeForPath(finalPath).node.id, fileId);
+  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('cancellation births a source occupant before its restore sidecar plan retires', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'cancelled-source-occupant',
+  );
+  const folder = path.join(root, 'A');
+  const movedFolder = path.join(root, 'C');
+  const source = path.join(folder, 'source.txt');
+  const movedSource = path.join(movedFolder, 'source.txt');
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(source, 'official source bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Cancelled source occupant',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const sourceId = nodeForPath(source).node.id;
+  assert.throws(
+    () => commitTreeOperation({
+      kind: 'tree.rename',
+      workspaceId: workspace.id,
+      nodeId: sourceId,
+      name: 'official-name.txt',
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationStaging() {
+          fs.renameSync(folder, movedFolder);
+          fs.writeFileSync(movedSource, 'independent source occupant\n');
+        },
+        afterOperationCancellationOutputReceipt(outputs) {
+          assert.ok(outputs.some((output) => (
+            output.provenance === 'independent-occupant'
+            && output.path.includes('.amalgm-retained-')
+          )));
+          throw new Error('simulated crash after source occupant receipt');
+        },
+      },
+    }),
+    /simulated crash after source occupant receipt/,
+  );
+  const held = openLocalDb().prepare(`
+    SELECT plan_json AS planJson
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id);
+  assert.ok(JSON.parse(held.planJson).retainedOutputs.some((output) => (
+    output.provenance === 'independent-occupant'
+  )));
+
+  recoverAllTreePlans();
+
+  const official = path.join(movedFolder, 'official-name.txt');
+  assert.equal(fs.readFileSync(official, 'utf8'), 'official source bytes\n');
+  assert.equal(nodeForPath(official).node.id, sourceId);
+  const sidecar = fs.readdirSync(movedFolder).find((name) => (
+    name.startsWith('source.amalgm-retained-')
+    && name.endsWith('.txt')
+  ));
+  assert.ok(sidecar);
+  const sidecarPath = path.join(movedFolder, sidecar);
+  assert.equal(
+    fs.readFileSync(sidecarPath, 'utf8'),
+    'independent source occupant\n',
+  );
+  assert.notEqual(nodeForPath(sidecarPath).node.id, sourceId);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('prepared retained hardlinks hold visibly until one physical name wins', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'cancelled-source-hardlink-hold',
+  );
+  const folder = path.join(root, 'A');
+  const movedFolder = path.join(root, 'C');
+  const source = path.join(folder, 'source.txt');
+  const movedSource = path.join(movedFolder, 'source.txt');
+  const alias = path.join(movedFolder, 'alias.txt');
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(source, 'official source bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Cancelled source hardlink hold',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const sourceId = nodeForPath(source).node.id;
+  let linked = false;
+  assert.throws(
+    () => commitTreeOperation({
+      kind: 'tree.rename',
+      workspaceId: workspace.id,
+      nodeId: sourceId,
+      name: 'official-name.txt',
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationStaging() {
+          fs.renameSync(folder, movedFolder);
+          fs.writeFileSync(movedSource, 'independent source occupant\n');
+        },
+        afterOperationCancellationOutputMove(outputs) {
+          if (linked) return;
+          linked = true;
+          const retained = outputs.find(
+            (output) => output.provenance === 'independent-occupant',
+          );
+          fs.linkSync(retained.path, alias);
+          throw new Error('simulated crash after retained hardlink appeared');
+        },
+      },
+    }),
+    /simulated crash after retained hardlink appeared/,
+  );
+
+  assert.throws(
+    () => recoverAllTreePlans(),
+    /ambiguous-physical-alias/,
+  );
+  const heldWorkspace = listWorkspaces().find(
+    (candidate) => candidate.id === workspace.id,
+  );
+  assert.equal(heldWorkspace.treeObservation.state, 'held');
+  assert.ok(heldWorkspace.treeObservation.holds.some((hold) => (
+    hold.reason === 'ambiguous-physical-alias'
+    && hold.paths.some((heldPath) => heldPath.endsWith('alias.txt'))
+  )));
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 1);
+  assert.equal(nodeForPath(alias), null);
+
+  fs.unlinkSync(alias);
+  recoverAllTreePlans();
+
+  const sidecar = fs.readdirSync(movedFolder).find((name) => (
+    name.startsWith('source.amalgm-retained-')
+    && name.endsWith('.txt')
+  ));
+  assert.ok(sidecar);
+  assert.equal(
+    fs.readFileSync(path.join(movedFolder, sidecar), 'utf8'),
+    'independent source occupant\n',
+  );
+  assert.equal(
+    listWorkspaces().find((candidate) => candidate.id === workspace.id)
+      .treeObservation,
+    null,
+  );
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('prepared creates cancel cleanly when their parent moves', () => {
+  for (const [index, kind] of ['file', 'folder', 'symlink'].entries()) {
+    const root = path.join(
+      process.env.AMALGM_WORKSPACES_DIR,
+      `prepared-create-parent-${kind}`,
+    );
+    const folder = path.join(root, 'A');
+    const movedFolder = path.join(root, 'C');
+    fs.mkdirSync(folder, { recursive: true });
+    const workspace = upsertWorkspace({
+      path: root,
+      name: `Prepared ${kind}`,
+      source: 'computer',
+    });
+    enrollWorkspace(workspace.id);
+    const parentId = nodeForPath(folder).node.id;
+    const nodeId = uuidV7();
+    let raced = false;
+    commitTreeOperation({
+      kind: 'tree.create',
+      workspaceId: workspace.id,
+      nodeId,
+      parentId,
+      nodeKind: kind,
+      name: `${kind}-${index}`,
+      ...(kind === 'symlink' ? { symlinkTarget: 'target.txt' } : {}),
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationCreatePrepared() {
+          if (raced) return;
+          raced = true;
+          fs.renameSync(folder, movedFolder);
+        },
+      },
+    });
+    const finalPath = path.join(movedFolder, `${kind}-${index}`);
+    assert.equal(fs.lstatSync(finalPath).isSymbolicLink(), kind === 'symlink');
+    assert.equal(nodeForPath(finalPath).node.id, nodeId);
+    assert.equal(openLocalDb().prepare(`
+      SELECT COUNT(*) AS count
+      FROM workspace_tree_operation_materializations
+      WHERE resource_id = ?
+    `).get(workspace.id).count, 0);
+  }
+});
+
+test('same-path folder replacement retires the old UUID and births a new one', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'folder-replacement');
+  const folder = path.join(root, 'A');
+  fs.mkdirSync(folder, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Folder replacement',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const oldId = nodeForPath(folder).node.id;
+  fs.rmdirSync(folder);
+  fs.mkdirSync(folder);
+  const observed = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(
+    observed.operations.map((operation) => operation.kind),
+    ['tree.trash', 'tree.create'],
+  );
+  const replacement = nodeForPath(folder).node;
+  assert.notEqual(replacement.id, oldId);
+  const old = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+  }).find((node) => node.id === oldId);
+  assert.ok(old.trashedAt);
+});
+
+test('an atomic same-path file save refreshes its binding before a later rename', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'atomic-file-binding-refresh',
+  );
+  const originalPath = path.join(root, 'a.txt');
+  const replacementPath = path.join(root, '.replacement.txt');
+  const renamedPath = path.join(root, 'b.txt');
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(originalPath, 'original bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Atomic file binding refresh',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const original = nodeForPath(originalPath).node;
+
+  fs.writeFileSync(replacementPath, 'replacement bytes\n');
+  fs.renameSync(replacementPath, originalPath);
+  const replacementIdentity = fs.lstatSync(originalPath);
+  const replacement = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(replacement.operations, []);
+  const rebound = nodeForPath(originalPath).node;
+  assert.equal(rebound.id, original.id);
+  assert.equal(rebound.deviceId, String(replacementIdentity.dev));
+  assert.equal(rebound.inode, String(replacementIdentity.ino));
+
+  fs.renameSync(originalPath, renamedPath);
+  const renamed = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(
+    renamed.operations.map((operation) => operation.kind),
+    ['tree.rename'],
+  );
+  assert.equal(nodeForPath(renamedPath).node.id, original.id);
+  assert.equal(fs.readFileSync(renamedPath, 'utf8'), 'replacement bytes\n');
+  const old = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+  }).find((node) => node.id === original.id);
+  assert.equal(old.trashedAt, null);
+});
+
+test('enrollment holds hardlink aliases before two UUIDs can claim one inode', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'initial-hardlink-alias',
+  );
+  const originalPath = path.join(root, 'a.txt');
+  const aliasPath = path.join(root, 'b.txt');
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(originalPath, 'one inode\n');
+  fs.linkSync(originalPath, aliasPath);
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Initial hardlink alias',
+    source: 'computer',
+  });
+
+  const held = enrollWorkspace(workspace.id);
+  assert.equal(held.skipped, 'ambiguous-physical-alias');
+  assert.deepEqual(held.held, [{
+    reason: 'ambiguous-physical-alias',
+    paths: ['a.txt', 'b.txt'],
+  }]);
+  assert.equal(listWorkspaceNodes(workspace.id).length, 1);
+  assert.equal(nodeForPath(originalPath), null);
+  assert.equal(nodeForPath(aliasPath), null);
+
+  fs.unlinkSync(aliasPath);
+  const enrolled = enrollWorkspace(workspace.id);
+  assert.equal(enrolled.skipped, undefined);
+  assert.equal(nodeForPath(originalPath).node.id, enrolled.nodes.find(
+    (node) => node.relativePath === 'a.txt',
+  ).id);
+  assert.equal(nodeForPath(aliasPath), null);
+});
+
+test('registration returns the durable observation hold for initial hardlinks', async () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'registered-hardlink-alias',
+  );
+  const originalPath = path.join(root, 'a.txt');
+  const aliasPath = path.join(root, 'b.txt');
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(originalPath, 'one registered inode\n');
+  fs.linkSync(originalPath, aliasPath);
+  let response = null;
+
+  await handleProjectRegister({ path: root }, (status, body) => {
+    response = { status, body };
+  });
+
+  assert.equal(response.status, 200);
+  assert.equal(response.body.workspace.treeObservation.state, 'held');
+  assert.deepEqual(
+    response.body.tree.observation.holds.map((hold) => ({
+      reason: hold.reason,
+      paths: hold.paths,
+    })),
+    [{
+      reason: 'ambiguous-physical-alias',
+      paths: ['a.txt', 'b.txt'],
+    }],
+  );
+});
+
+test('observation holds new hardlink aliases while unrelated files still get births', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'observed-hardlink-alias',
+  );
+  const originalPath = path.join(root, 'a.txt');
+  const aliasPath = path.join(root, 'b.txt');
+  const unrelatedPath = path.join(root, 'c.txt');
+  fs.mkdirSync(root, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Observed hardlink alias',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+
+  fs.writeFileSync(originalPath, 'one unknown inode\n');
+  fs.linkSync(originalPath, aliasPath);
+  fs.writeFileSync(unrelatedPath, 'independent bytes\n');
+  const observed = reconcileWorkspaceTree(workspace.id);
+
+  assert.deepEqual(observed.held, [{
+    nodeId: null,
+    paths: ['a.txt', 'b.txt'],
+    reason: 'ambiguous-physical-alias',
+  }]);
+  assert.equal(nodeForPath(originalPath), null);
+  assert.equal(nodeForPath(aliasPath), null);
+  const unrelatedId = nodeForPath(unrelatedPath)?.node.id;
+  assert.ok(unrelatedId);
+  assert.deepEqual(
+    observed.operations.map((operation) => operation.kind),
+    ['tree.create'],
+  );
+
+  fs.unlinkSync(aliasPath);
+  const resolved = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(resolved.held, []);
+  assert.ok(nodeForPath(originalPath)?.node.id);
+  assert.equal(nodeForPath(aliasPath), null);
+  assert.equal(nodeForPath(unrelatedPath)?.node.id, unrelatedId);
+});
+
+test('the recurring observer durably surfaces and clears physical alias holds', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'recurring-hardlink-alias',
+  );
+  const originalPath = path.join(root, 'a.txt');
+  const aliasPath = path.join(root, 'b.txt');
+  const unrelatedPath = path.join(root, 'c.txt');
+  fs.mkdirSync(root, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Recurring hardlink alias',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+
+  fs.writeFileSync(originalPath, 'one unresolved inode\n');
+  fs.linkSync(originalPath, aliasPath);
+  fs.writeFileSync(unrelatedPath, 'ordinary local work\n');
+  reconcileRegisteredWorkspaceTrees();
+
+  const held = listWorkspaces().find((entry) => entry.id === workspace.id);
+  assert.equal(held.treeObservation.state, 'held');
+  assert.deepEqual(
+    held.treeObservation.holds.map((entry) => ({
+      reason: entry.reason,
+      paths: entry.paths,
+    })),
+    [{
+      reason: 'ambiguous-physical-alias',
+      paths: ['a.txt', 'b.txt'],
+    }],
+  );
+  assert.ok(nodeForPath(unrelatedPath)?.node.id);
+  assert.equal(nodeForPath(originalPath), null);
+  assert.equal(nodeForPath(aliasPath), null);
+  const event = openLocalDb().prepare(`
+    SELECT value_json
+    FROM event_log
+    WHERE resource = 'workspaces' AND id = ?
+      AND source = 'workspace-tree:observation-hold'
+    ORDER BY seq DESC
+    LIMIT 1
+  `).get(workspace.id);
+  assert.equal(JSON.parse(event.value_json).treeObservation.state, 'held');
+  const holdEventCount = openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM event_log
+    WHERE id = ? AND source = 'workspace-tree:observation-hold'
+  `).get(workspace.id).count;
+  reconcileRegisteredWorkspaceTrees();
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM event_log
+    WHERE id = ? AND source = 'workspace-tree:observation-hold'
+  `).get(workspace.id).count, holdEventCount);
+  assert.equal(
+    reconcileWorkspaceTree(workspace.id, { maxNodes: 0 }).skipped,
+    'node_limit',
+  );
+  assert.equal(
+    listWorkspaces().find((entry) => entry.id === workspace.id).treeObservation.state,
+    'held',
+  );
+
+  closeLocalDb();
+  assert.equal(
+    listWorkspaces().find((entry) => entry.id === workspace.id).treeObservation.state,
+    'held',
+  );
+
+  fs.unlinkSync(aliasPath);
+  reconcileRegisteredWorkspaceTrees();
+  const resolved = listWorkspaces().find((entry) => entry.id === workspace.id);
+  assert.equal(resolved.treeObservation, null);
+  assert.ok(nodeForPath(originalPath)?.node.id);
+  assert.equal(nodeForPath(aliasPath), null);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_observation_holds
+    WHERE workspace_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('repeat enrollment cannot absorb or clear a permission-held disk birth', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'permission-held-repeat-enrollment',
+  );
+  const target = path.join(root, 'local.txt');
+  fs.mkdirSync(root, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Permission-held repeat enrollment',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+
+  const identity = require('../workspace/identity');
+  const previousUserId = identity.userId;
+  const memberId = 'member-permission-held-repeat-enrollment';
+  openLocalDb().prepare(`
+    INSERT INTO workspace_node_permissions(workspace_id, node_id, user_id, role)
+    VALUES (?, ?, ?, 'viewer')
+  `).run(workspace.id, workspace.id, memberId);
+  identity.userId = () => memberId;
+  try {
+    fs.writeFileSync(target, 'held local bytes\n');
+    const first = reconcileWorkspaceTree(workspace.id);
+    assert.deepEqual(first.operations, []);
+    assert.equal(first.held[0].reason, 'forbidden');
+    assert.deepEqual(first.held[0].paths, ['local.txt']);
+    assert.equal(nodeForPath(target), null);
+
+    const repeated = enrollWorkspace(workspace.id);
+    assert.deepEqual(repeated.operations, []);
+    assert.equal(repeated.held[0].reason, 'forbidden');
+    assert.equal(nodeForPath(target), null);
+    assert.equal(
+      listWorkspaces().find((entry) => entry.id === workspace.id)
+        .treeObservation.holds[0].reason,
+      'forbidden',
+    );
+    assert.equal(openLocalDb().prepare(`
+      SELECT COUNT(*) AS count
+      FROM mutation_journal
+      WHERE local_resource = ? AND operation_kind = 'tree.create'
+    `).get(`workspace-tree:${workspace.id}`).count, 0);
+
+    openLocalDb().prepare(`
+      UPDATE workspace_node_permissions SET role = 'editor'
+      WHERE workspace_id = ? AND node_id = ? AND user_id = ?
+    `).run(workspace.id, workspace.id, memberId);
+    const resolved = enrollWorkspace(workspace.id);
+    assert.deepEqual(
+      resolved.operations.map((operation) => operation.kind),
+      ['tree.create'],
+    );
+    assert.ok(nodeForPath(target)?.node.id);
+    assert.equal(
+      listWorkspaces().find((entry) => entry.id === workspace.id)
+        .treeObservation,
+      null,
+    );
+  } finally {
+    identity.userId = previousUserId;
+  }
+});
+
+test('legacy duplicate inode owners remain one durable contradictory hold', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'legacy-duplicate-inode-owners',
+  );
+  const survivingPath = path.join(root, 'a.txt');
+  const removedAliasPath = path.join(root, 'b.txt');
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(survivingPath, 'legacy shared inode\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Legacy duplicate inode owners',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const first = nodeForPath(survivingPath).node;
+  const secondId = uuidV7();
+  const now = new Date().toISOString();
+  fs.linkSync(survivingPath, removedAliasPath);
+  openLocalDb().prepare(`
+    INSERT INTO workspace_nodes (
+      id, workspace_id, parent_id, kind, name, relative_path,
+      symlink_target, device_id, inode, created_at, updated_at
+    ) VALUES (?, ?, ?, 'file', 'b.txt', 'b.txt', NULL, ?, ?, ?, ?)
+  `).run(
+    secondId,
+    workspace.id,
+    workspace.id,
+    first.deviceId,
+    first.inode,
+    now,
+    now,
+  );
+  fs.unlinkSync(removedAliasPath);
+
+  const observed = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(observed.operations, []);
+  assert.deepEqual(
+    observed.held.map((hold) => ({
+      nodeId: hold.nodeId,
+      reason: hold.reason,
+      paths: hold.paths,
+    })).sort((left, right) => left.nodeId.localeCompare(right.nodeId)),
+    [first.id, secondId].sort().map((nodeId) => ({
+      nodeId,
+      reason: 'ambiguous-physical-ownership',
+      paths: ['a.txt'],
+    })),
+  );
+  assert.equal(
+    listWorkspaces().find((entry) => entry.id === workspace.id)
+      .treeObservation.holds.length,
+    2,
+  );
+  assert.equal(
+    listWorkspaceNodes(workspace.id).filter(
+      (node) => node.id === first.id || node.id === secondId,
+    ).length,
+    2,
+    'contradictory legacy ownership is held instead of guessed from a name',
+  );
+});
+
+test('a replaced destination parent applies the original move before its local trash', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'causal-parent-replacement');
+  const folder = path.join(root, 'D');
+  const source = path.join(root, 'x.txt');
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(source, 'causal parent bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Causal parent replacement',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const oldFolderId = nodeForPath(folder).node.id;
+  const fileId = nodeForPath(source).node.id;
+  commitTreeOperation({
+    kind: 'tree.move',
+    workspaceId: workspace.id,
+    nodeId: fileId,
+    parentId: oldFolderId,
+    name: 'x.txt',
+  }, {
+    role: 'owner',
+    testHooks: {
+      afterOperationPlan() {
+        fs.rmdirSync(folder);
+        fs.mkdirSync(folder);
+      },
+    },
+  });
+  assert.equal(fs.existsSync(source), false);
+  assert.deepEqual(fs.readdirSync(folder), []);
+  assert.notEqual(nodeForPath(folder).node.id, oldFolderId);
+  const oldFolderTrash = trashPath(workspace.id, oldFolderId, workspace.path);
+  assert.equal(
+    fs.readFileSync(path.join(oldFolderTrash, 'x.txt'), 'utf8'),
+    'causal parent bytes\n',
+  );
+  const rows = listWorkspaceNodes(workspace.id, { includeTrashed: true });
+  assert.ok(rows.find((node) => node.id === oldFolderId).trashedAt);
+  assert.ok(rows.find((node) => node.id === fileId).trashedAt);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('a child keeps its UUID when only its same-path parent is replaced', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'same-path-parent-child-survivor',
+  );
+  const folder = path.join(root, 'A');
+  const heldFolder = path.join(root, 'held-A');
+  const file = path.join(folder, 'x.txt');
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(file, 'surviving child bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Same-path parent child survivor',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const oldFolderId = nodeForPath(folder).node.id;
+  const fileId = nodeForPath(file).node.id;
+
+  fs.renameSync(folder, heldFolder);
+  fs.mkdirSync(folder);
+  fs.renameSync(path.join(heldFolder, 'x.txt'), file);
+  fs.rmdirSync(heldFolder);
+
+  reconcileWorkspaceTree(workspace.id);
+  const replacementFolder = nodeForPath(folder).node;
+  const survivingFile = nodeForPath(file).node;
+  assert.notEqual(replacementFolder.id, oldFolderId);
+  assert.equal(survivingFile.id, fileId);
+  assert.equal(survivingFile.parentId, replacementFolder.id);
+  assert.equal(fs.readFileSync(file, 'utf8'), 'surviving child bytes\n');
+  const rows = listWorkspaceNodes(workspace.id, { includeTrashed: true });
+  assert.ok(rows.find((node) => node.id === oldFolderId).trashedAt);
+  assert.equal(rows.find((node) => node.id === fileId).trashedAt, null);
+});
+
+test('a surviving folder preserves kept children while classifying its changed members', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'same-path-parent-folder-survivor',
+  );
+  const folder = path.join(root, 'A');
+  const heldFolder = path.join(root, 'held-A');
+  const nested = path.join(folder, 'B');
+  fs.mkdirSync(nested, { recursive: true });
+  fs.writeFileSync(path.join(nested, 'keep.txt'), 'keep bytes\n');
+  fs.writeFileSync(path.join(nested, 'gone.txt'), 'gone bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Same-path parent folder survivor',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const oldFolderId = nodeForPath(folder).node.id;
+  const nestedId = nodeForPath(nested).node.id;
+  const keepId = nodeForPath(path.join(nested, 'keep.txt')).node.id;
+  const goneId = nodeForPath(path.join(nested, 'gone.txt')).node.id;
+
+  fs.renameSync(folder, heldFolder);
+  fs.unlinkSync(path.join(heldFolder, 'B', 'gone.txt'));
+  fs.writeFileSync(path.join(heldFolder, 'B', 'new.txt'), 'new bytes\n');
+  fs.mkdirSync(folder);
+  fs.renameSync(path.join(heldFolder, 'B'), nested);
+  fs.rmdirSync(heldFolder);
+
+  reconcileWorkspaceTree(workspace.id);
+  const replacementFolder = nodeForPath(folder).node;
+  assert.notEqual(replacementFolder.id, oldFolderId);
+  assert.equal(nodeForPath(nested).node.id, nestedId);
+  assert.equal(nodeForPath(nested).node.parentId, replacementFolder.id);
+  assert.equal(nodeForPath(path.join(nested, 'keep.txt')).node.id, keepId);
+  const newNode = nodeForPath(path.join(nested, 'new.txt')).node;
+  assert.notEqual(newNode.id, goneId);
+  assert.equal(fs.readFileSync(path.join(nested, 'new.txt'), 'utf8'), 'new bytes\n');
+  const rows = listWorkspaceNodes(workspace.id, { includeTrashed: true });
+  assert.ok(rows.find((node) => node.id === goneId).trashedAt);
+  assert.equal(rows.find((node) => node.id === nestedId).trashedAt, null);
+  assert.equal(rows.find((node) => node.id === keepId).trashedAt, null);
+});
+
+test('ambiguous hardlink names hold a parent replacement until one path wins', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'same-path-parent-hardlink-survivor',
+  );
+  const folder = path.join(root, 'A');
+  const heldFolder = path.join(root, 'held-A');
+  const file = path.join(folder, 'x.txt');
+  const alias = path.join(folder, 'y.txt');
+  const sibling = path.join(folder, 'z.txt');
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(file, 'ambiguous child bytes\n');
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Same-path parent hardlink survivor',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const oldFolderId = nodeForPath(folder).node.id;
+  const fileId = nodeForPath(file).node.id;
+
+  fs.renameSync(folder, heldFolder);
+  fs.mkdirSync(folder);
+  fs.renameSync(path.join(heldFolder, 'x.txt'), file);
+  fs.linkSync(file, alias);
+  fs.writeFileSync(sibling, 'new sibling bytes\n');
+  fs.rmdirSync(heldFolder);
+
+  const ambiguous = reconcileWorkspaceTree(workspace.id);
+  assert.deepEqual(ambiguous.operations, []);
+  assert.ok(ambiguous.held.some((entry) => (
+    entry.nodeId === fileId
+    && entry.reason === 'ambiguous-physical-alias'
+  )));
+  assert.equal(nodeForPath(folder).node.id, oldFolderId);
+  assert.equal(nodeForPath(file).node.id, fileId);
+  assert.equal(nodeForPath(alias), null);
+  assert.equal(nodeForPath(sibling), null);
+
+  fs.unlinkSync(alias);
+  reconcileWorkspaceTree(workspace.id);
+  const replacementFolderId = nodeForPath(folder).node.id;
+  assert.notEqual(replacementFolderId, oldFolderId);
+  assert.equal(nodeForPath(file).node.id, fileId);
+  assert.equal(nodeForPath(alias), null);
+  assert.equal(nodeForPath(sibling).node.parentId, replacementFolderId);
+  assert.equal(fs.readFileSync(file, 'utf8'), 'ambiguous child bytes\n');
+  assert.equal(fs.readFileSync(sibling, 'utf8'), 'new sibling bytes\n');
+});
+
+test('restart finishes a prepared create cancellation before replanning', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'prepared-create-cancellation-restart',
+  );
+  const folder = path.join(root, 'A');
+  const movedFolder = path.join(root, 'C');
+  fs.mkdirSync(folder, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Prepared create cancellation restart',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const parentId = nodeForPath(folder).node.id;
+  const nodeId = uuidV7();
+  let parentMoved = false;
+  assert.throws(
+    () => commitTreeOperation({
+      kind: 'tree.create',
+      workspaceId: workspace.id,
+      nodeId,
+      parentId,
+      nodeKind: 'file',
+      name: 'recovered.txt',
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationCreatePrepared() {
+          if (parentMoved) return;
+          parentMoved = true;
+          fs.renameSync(folder, movedFolder);
+        },
+        afterOperationCreateCancellationStage() {
+          throw new Error('simulated crash during create cancellation');
+        },
+      },
+    }),
+    /simulated crash during create cancellation/,
+  );
+  fs.renameSync(movedFolder, folder);
+  recoverAllTreePlans();
+  const recovered = path.join(folder, 'recovered.txt');
+  assert.equal(fs.existsSync(recovered), true);
+  assert.equal(nodeForPath(recovered).node.id, nodeId);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('restart births a retained cancellation occupant before replacing its plan', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'prepared-create-retained-occupant',
+  );
+  const folder = path.join(root, 'A');
+  const movedFolder = path.join(root, 'C');
+  const target = path.join(movedFolder, 'recovered.txt');
+  fs.mkdirSync(folder, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Prepared create retained occupant',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const parentId = nodeForPath(folder).node.id;
+  const nodeId = uuidV7();
+  let parentMoved = false;
+  assert.throws(
+    () => commitTreeOperation({
+      kind: 'tree.create',
+      workspaceId: workspace.id,
+      nodeId,
+      parentId,
+      nodeKind: 'file',
+      name: 'recovered.txt',
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationCreatePrepared() {
+          if (parentMoved) return;
+          parentMoved = true;
+          fs.renameSync(folder, movedFolder);
+          fs.mkdirSync(target);
+          fs.writeFileSync(path.join(target, 'writer.txt'), 'retained writer bytes\n');
+        },
+        afterOperationCancellationOutputReceipt(outputs) {
+          assert.ok(outputs.some((output) => (
+            output.path === target
+            && output.provenance === 'independent-occupant'
+          )));
+          throw new Error('simulated crash after cancellation output receipt');
+        },
+      },
+    }),
+    /simulated crash after cancellation output receipt/,
+  );
+  const held = treeMaterialization.getOperation(
+    workspace.id,
+    openLocalDb().prepare(`
+      SELECT mutation_id AS mutationId
+      FROM workspace_tree_operation_materializations
+      WHERE resource_id = ?
+    `).get(workspace.id).mutationId,
+  );
+  assert.ok(held.plan.retainedOutputs.some((output) => output.path === target));
+  assert.equal(nodeForPath(target), null);
+
+  recoverAllTreePlans();
+
+  const writerPaths = fs.readdirSync(root, { recursive: true })
+    .map((entry) => path.join(root, String(entry)))
+    .filter((entry) => path.basename(entry) === 'writer.txt');
+  assert.equal(writerPaths.length, 1);
+  assert.equal(fs.readFileSync(writerPaths[0], 'utf8'), 'retained writer bytes\n');
+  const occupant = nodeForPath(path.dirname(writerPaths[0])).node;
+  assert.equal(occupant.kind, 'folder');
+  assert.notEqual(occupant.id, nodeId);
+  const superseded = listWorkspaceNodes(
+    workspace.id,
+    { includeTrashed: true },
+  ).find((node) => node.id === nodeId);
+  assert.equal(superseded.kind, 'file');
+  assert.ok(superseded.trashedAt);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('cancelled create receipts keep their UUID with the surviving carrier', () => {
+  for (const occupied of [false, true]) {
+    const root = path.join(
+      process.env.AMALGM_WORKSPACES_DIR,
+      `prepared-create-carrier-${occupied ? 'occupied' : 'open'}`,
+    );
+    const folder = path.join(root, 'A');
+    const movedFolder = path.join(root, 'C');
+    const target = path.join(movedFolder, 'recovered.txt');
+    fs.mkdirSync(folder, { recursive: true });
+    const workspace = upsertWorkspace({
+      path: root,
+      name: `Prepared create carrier ${occupied ? 'occupied' : 'open'}`,
+      source: 'computer',
+    });
+    enrollWorkspace(workspace.id);
+    const parentId = nodeForPath(folder).node.id;
+    const nodeId = uuidV7();
+    assert.throws(
+      () => commitTreeOperation({
+        kind: 'tree.create',
+        workspaceId: workspace.id,
+        nodeId,
+        parentId,
+        nodeKind: 'file',
+        name: 'recovered.txt',
+      }, {
+        role: 'owner',
+        testHooks: {
+          afterOperationCreatePrepared(_action, prepared) {
+            fs.writeFileSync(prepared, 'receipt-owned writer bytes\n');
+            fs.renameSync(folder, movedFolder);
+            if (occupied) {
+              fs.mkdirSync(target);
+              fs.writeFileSync(
+                path.join(target, 'independent.txt'),
+                'independent bytes\n',
+              );
+            }
+          },
+          afterOperationCancellationOutputReceipt() {
+            throw new Error('simulated crash after carried cancellation receipt');
+          },
+        },
+      }),
+      /simulated crash after carried cancellation receipt/,
+    );
+    const row = openLocalDb().prepare(`
+      SELECT mutation_id AS mutationId, plan_json AS planJson
+      FROM workspace_tree_operation_materializations
+      WHERE resource_id = ?
+    `).get(workspace.id);
+    const durablePlan = JSON.parse(row.planJson);
+    assert.equal(durablePlan.carriedCreates[0].nodeId, nodeId);
+    assert.equal(
+      durablePlan.carriedCreateDeletions?.some(
+        (binding) => binding.nodeId === nodeId,
+      ) || false,
+      false,
+    );
+
+    recoverAllTreePlans();
+
+    if (!occupied) {
+      assert.equal(fs.readFileSync(target, 'utf8'), 'receipt-owned writer bytes\n');
+      assert.equal(nodeForPath(target).node.id, nodeId);
+    } else {
+      const occupant = nodeForPath(target).node;
+      assert.equal(occupant.kind, 'folder');
+      assert.notEqual(occupant.id, nodeId);
+      const sidecar = fs.readdirSync(movedFolder).find((name) => (
+        name.startsWith('recovered.amalgm-retained-')
+        && name.endsWith('.txt')
+      ));
+      assert.ok(sidecar);
+      const sidecarPath = path.join(movedFolder, sidecar);
+      assert.equal(
+        fs.readFileSync(sidecarPath, 'utf8'),
+        'receipt-owned writer bytes\n',
+      );
+      assert.equal(nodeForPath(sidecarPath).node.id, nodeId);
+    }
+    assert.equal(treeMaterialization.getOperation(
+      workspace.id,
+      row.mutationId,
+    ), null);
+  }
+});
+
+test('prepared cleanup captures a same-path save after retained births', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'prepared-post-birth-save',
+  );
+  const folder = path.join(root, 'A');
+  const movedFolder = path.join(root, 'C');
+  const target = path.join(movedFolder, 'recovered.txt');
+  fs.mkdirSync(folder, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Prepared post-birth save',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const parentId = nodeForPath(folder).node.id;
+  const nodeId = uuidV7();
+  assert.throws(
+    () => commitTreeOperation({
+      kind: 'tree.create',
+      workspaceId: workspace.id,
+      nodeId,
+      parentId,
+      nodeKind: 'file',
+      name: 'recovered.txt',
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationCreatePrepared(_action, prepared) {
+          fs.writeFileSync(prepared, 'first retained bytes\n');
+          fs.renameSync(folder, movedFolder);
+        },
+        afterOperationCancellationOutputReceipt() {
+          throw new Error('simulated crash before retained birth');
+        },
+      },
+    }),
+    /simulated crash before retained birth/,
+  );
+
+  let replaced = false;
+  let crashedAfterSettle = false;
+  assert.throws(
+    () => recoverAllTreePlans({
+      testHooks: {
+        afterRetainedBindingReconcile(outputs) {
+          if (replaced) return;
+          const carried = outputs.find((output) => (
+            output.provenance === 'carried-source'
+            && output.ownerNodeId === nodeId
+          ));
+          assert.ok(carried);
+          const replacement = `${carried.path}.replacement`;
+          fs.writeFileSync(replacement, 'later same-path save\n');
+          fs.renameSync(replacement, carried.path);
+          replaced = true;
+        },
+        afterRetainedBindingSettle() {
+          if (crashedAfterSettle) return;
+          crashedAfterSettle = true;
+          throw new Error('simulated crash after retained binding settlement');
+        },
+      },
+    }),
+    /simulated crash after retained binding settlement/,
+  );
+  const retainedPlan = openLocalDb().prepare(`
+    SELECT plan_json AS planJson
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id);
+  assert.equal(JSON.parse(retainedPlan.planJson).retainedOutputsAdopted, true);
+
+  recoverAllTreePlans();
+
+  assert.equal(replaced, true);
+  assert.equal(fs.readFileSync(target, 'utf8'), 'later same-path save\n');
+  assert.equal(nodeForPath(target).node.id, nodeId);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+test('prepared cleanup durably replays a folder successor after settlement crash', () => {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    'prepared-folder-successor-crash',
+  );
+  const folder = path.join(root, 'A');
+  const movedFolder = path.join(root, 'C');
+  fs.mkdirSync(folder, { recursive: true });
+  const workspace = upsertWorkspace({
+    path: root,
+    name: 'Prepared folder successor crash',
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const parentId = nodeForPath(folder).node.id;
+  const nodeId = uuidV7();
+  assert.throws(
+    () => commitTreeOperation({
+      kind: 'tree.create',
+      workspaceId: workspace.id,
+      nodeId,
+      parentId,
+      nodeKind: 'folder',
+      name: 'recovered',
+    }, {
+      role: 'owner',
+      testHooks: {
+        afterOperationCreatePrepared(_action, prepared) {
+          fs.writeFileSync(path.join(prepared, 'original.txt'), 'original\n');
+          fs.renameSync(folder, movedFolder);
+        },
+        afterOperationCancellationOutputReceipt() {
+          throw new Error('simulated crash before retained folder birth');
+        },
+      },
+    }),
+    /simulated crash before retained folder birth/,
+  );
+
+  let originalPath = null;
+  let successorPath = null;
+  assert.throws(
+    () => recoverAllTreePlans({
+      testHooks: {
+        afterRetainedBindingReconcile(outputs) {
+          if (successorPath) return;
+          const carried = outputs.find((output) => (
+            output.provenance === 'carried-source'
+            && output.ownerNodeId === nodeId
+            && output.sourceRelativePath === ''
+            && output.identity.kind === 'folder'
+          ));
+          assert.ok(carried);
+          successorPath = carried.path;
+          originalPath = `${carried.path}-moved`;
+          fs.renameSync(carried.path, originalPath);
+          fs.mkdirSync(carried.path);
+          fs.writeFileSync(
+            path.join(carried.path, 'replacement.txt'),
+            'replacement\n',
+          );
+        },
+        afterRetainedBindingSettle() {
+          throw new Error('simulated crash after retained folder settlement');
+        },
+      },
+    }),
+    /simulated crash after retained folder settlement/,
+  );
+
+  assert.ok(openLocalDb().prepare(`
+    SELECT 1 AS present
+    FROM workspace_tree_operation_successors
+    WHERE resource_id = ?
+    LIMIT 1
+  `).get(workspace.id));
+  recoverAllTreePlans();
+
+  assert.equal(
+    fs.readFileSync(path.join(originalPath, 'original.txt'), 'utf8'),
+    'original\n',
+  );
+  assert.equal(
+    fs.readFileSync(path.join(successorPath, 'replacement.txt'), 'utf8'),
+    'replacement\n',
+  );
+  assert.equal(nodeForPath(originalPath).node.id, nodeId);
+  assert.notEqual(nodeForPath(successorPath).node.id, nodeId);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_successors
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM workspace_tree_operation_materializations
+    WHERE resource_id = ?
+  `).get(workspace.id).count, 0);
+});
+
+function relocatedCreatedParentFixture(label) {
+  const root = path.join(
+    process.env.AMALGM_WORKSPACES_DIR,
+    label,
+  );
+  const originalParent = path.join(root, 'P');
+  const relocatedParent = path.join(root, 'Q');
+  fs.mkdirSync(root);
+  const workspace = upsertWorkspace({
+    path: root,
+    name: label,
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const beforeNodes = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+  });
+  const parentId = uuidV7();
+  const childId = uuidV7();
+  const now = new Date().toISOString();
+  const parentNode = {
+    id: parentId,
+    workspaceId: workspace.id,
+    parentId: workspace.id,
+    kind: 'folder',
+    name: 'P',
+    symlinkTarget: null,
+    trashedAt: null,
+    purgedAt: null,
+    createdAt: now,
+    updatedAt: now,
+  };
+  const childNode = {
+    id: childId,
+    workspaceId: workspace.id,
+    parentId,
+    kind: 'file',
+    name: 'child.txt',
+    symlinkTarget: null,
+    trashedAt: null,
+    purgedAt: null,
+    createdAt: now,
+    updatedAt: now,
+  };
+  const rootIdentity = treeMaterialization.identity(root, { deep: false });
+  const mutationId = `mut_${label.replaceAll('-', '_')}`;
+  const plan = {
+    contract: 'workspace-tree-operation-materialization@1',
+    resourceId: workspace.id,
+    mutationId,
+    channelId: `resource:${workspace.id}`,
+    version: 1,
+    authorityEpoch: 1,
+    rootPath: root,
+    rootIdentity,
+    controlRoots: [],
+    rollbackBindings: [],
+    operation: {
+      kind: 'tree.create',
+      workspaceId: workspace.id,
+      nodeId: parentId,
+      parentId: workspace.id,
+      nodeKind: 'folder',
+      name: 'P',
+      createdAt: now,
+    },
+    beforeNodes,
+    afterNodes: [...beforeNodes, parentNode, childNode],
+    officialAfterNodes: null,
+    actions: [
+      {
+        type: 'create',
+        nodeId: parentId,
+        target: originalParent,
+        targetParentNodeId: workspace.id,
+        targetParentIdentity: rootIdentity,
+        kind: 'folder',
+        symlinkTarget: null,
+      },
+      {
+        type: 'create',
+        nodeId: childId,
+        target: path.join(originalParent, 'child.txt'),
+        targetParentNodeId: parentId,
+        targetParentIdentity: null,
+        kind: 'file',
+        symlinkTarget: null,
+      },
+    ],
+    event: {
+      resource: `workspace-tree:${workspace.id}`,
+      op: 'update',
+      id: parentId,
+      patch: {},
+      sharedResourceId: workspace.id,
+      source: 'workspace-tree:test',
+    },
+    sourceRaceCaptured: true,
+  };
+  return {
+    childId,
+    mutationId,
+    originalParent,
+    parentId,
+    plan,
+    relocatedParent,
+    workspace,
+  };
+}
+
+function createdSiblingFilesFixture(label) {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, label);
+  const firstPath = path.join(root, 'first.txt');
+  const triggerPath = path.join(root, 'trigger.txt');
+  fs.mkdirSync(root);
+  const workspace = upsertWorkspace({
+    path: root,
+    name: label,
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const beforeNodes = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+  });
+  const firstId = uuidV7();
+  const triggerId = uuidV7();
+  const now = new Date().toISOString();
+  const node = (id, name) => ({
+    id,
+    workspaceId: workspace.id,
+    parentId: workspace.id,
+    kind: 'file',
+    name,
+    symlinkTarget: null,
+    trashedAt: null,
+    purgedAt: null,
+    createdAt: now,
+    updatedAt: now,
+  });
+  const rootIdentity = treeMaterialization.identity(root, { deep: false });
+  const mutationId = `mut_${label.replaceAll('-', '_')}`;
+  return {
+    firstId,
+    firstPath,
+    mutationId,
+    plan: {
+      contract: 'workspace-tree-operation-materialization@1',
+      resourceId: workspace.id,
+      mutationId,
+      channelId: `resource:${workspace.id}`,
+      version: 1,
+      authorityEpoch: 1,
+      rootPath: root,
+      rootIdentity,
+      controlRoots: [],
+      rollbackBindings: [],
+      operation: {
+        kind: 'tree.create',
+        workspaceId: workspace.id,
+        nodeId: firstId,
+        parentId: workspace.id,
+        nodeKind: 'file',
+        name: 'first.txt',
+        createdAt: now,
+      },
+      beforeNodes,
+      afterNodes: [
+        ...beforeNodes,
+        node(firstId, 'first.txt'),
+        node(triggerId, 'trigger.txt'),
+      ],
+      officialAfterNodes: null,
+      actions: [
+        {
+          type: 'create',
+          nodeId: firstId,
+          target: firstPath,
+          targetParentNodeId: workspace.id,
+          targetParentIdentity: rootIdentity,
+          kind: 'file',
+          symlinkTarget: null,
+        },
+        {
+          type: 'create',
+          nodeId: triggerId,
+          target: triggerPath,
+          targetParentNodeId: workspace.id,
+          targetParentIdentity: rootIdentity,
+          kind: 'file',
+          symlinkTarget: null,
+        },
+      ],
+      event: {
+        resource: `workspace-tree:${workspace.id}`,
+        op: 'update',
+        id: firstId,
+        patch: {},
+        sharedResourceId: workspace.id,
+        source: 'workspace-tree:test',
+      },
+      sourceRaceCaptured: true,
+    },
+    root,
+    triggerId,
+    triggerPath,
+    workspace,
+  };
+}
+
+function multipleRelocatedParentsFixture(label, parentCount = 2) {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, label);
+  fs.mkdirSync(root);
+  const workspace = upsertWorkspace({
+    path: root,
+    name: label,
+    source: 'computer',
+  });
+  enrollWorkspace(workspace.id);
+  const beforeNodes = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+  });
+  const parentIds = Array.from({ length: parentCount }, () => uuidV7());
+  const [firstId, secondId, thirdId = null] = parentIds;
+  const childId = uuidV7();
+  const now = new Date().toISOString();
+  const node = (id, parentId, kind, name) => ({
+    id,
+    workspaceId: workspace.id,
+    parentId,
+    kind,
+    name,
+    symlinkTarget: null,
+    trashedAt: null,
+    purgedAt: null,
+    createdAt: now,
+    updatedAt: now,
+  });
+  const rootIdentity = treeMaterialization.identity(root, { deep: false });
+  const mutationId = `mut_${label.replaceAll('-', '_')}`;
+  const target = (name) => path.join(root, name);
+  return {
+    childId,
+    firstId,
+    mutationId,
+    plan: {
+      contract: 'workspace-tree-operation-materialization@1',
+      resourceId: workspace.id,
+      mutationId,
+      channelId: `resource:${workspace.id}`,
+      version: 1,
+      authorityEpoch: 1,
+      rootPath: root,
+      rootIdentity,
+      controlRoots: [],
+      rollbackBindings: [],
+      operation: {
+        kind: 'tree.create',
+        workspaceId: workspace.id,
+        nodeId: firstId,
+        parentId: workspace.id,
+        nodeKind: 'folder',
+        name: 'P1',
+        createdAt: now,
+      },
+      beforeNodes,
+      afterNodes: [
+        ...beforeNodes,
+        ...parentIds.map((id, index) => (
+          node(id, workspace.id, 'folder', `P${index + 1}`)
+        )),
+        node(childId, secondId, 'file', 'child.txt'),
+      ],
+      officialAfterNodes: null,
+      actions: [
+        ...parentIds.map((id, index) => ({
+          type: 'create',
+          nodeId: id,
+          target: target(`P${index + 1}`),
+          targetParentNodeId: workspace.id,
+          targetParentIdentity: rootIdentity,
+          kind: 'folder',
+          symlinkTarget: null,
+        })),
+        {
+          type: 'create',
+          nodeId: childId,
+          target: path.join(target('P2'), 'child.txt'),
+          targetParentNodeId: secondId,
+          targetParentIdentity: null,
+          kind: 'file',
+          symlinkTarget: null,
+        },
+      ],
+      event: {
+        resource: `workspace-tree:${workspace.id}`,
+        op: 'update',
+        id: firstId,
+        patch: {},
+        sharedResourceId: workspace.id,
+        source: 'workspace-tree:test',
+      },
+      sourceRaceCaptured: true,
+    },
+    parentIds,
+    root,
+    secondId,
+    thirdId,
+    workspace,
+  };
+}
+
+test('restart finds a receipt-owned create that moved before parent validation', () => {
+  const {
+    childId,
+    mutationId,
+    originalParent,
+    parentId,
+    plan,
+    relocatedParent,
+    workspace,
+  } = relocatedCreatedParentFixture('relocated-create-before-validation');
+  let held = treeMaterialization.insertOperation(plan);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCreatePrepared(action) {
+        if (
+          action.nodeId === childId
+          && fs.existsSync(originalParent)
+        ) {
+          fs.renameSync(originalParent, relocatedParent);
+          throw new Error('simulated crash immediately after parent relocation');
+        }
+      },
+    }),
+    /simulated crash immediately after parent relocation/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.equal(held.plan.carriedCreates, undefined);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCarriedCreateCapture() {
+        throw new Error('recovery found relocated parent receipt');
+      },
+    }),
+    /recovery found relocated parent receipt/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.equal(held.plan.carriedCreates[0].nodeId, parentId);
+  assert.equal(held.plan.carriedCreates[0].path, relocatedParent);
+
+  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
+  projectStoredTreeOperation(held, openLocalDb());
+  held = treeMaterialization.markOperationCommitted(held);
+  finishTreeOperationPlan(held, openLocalDb());
+  assert.equal(nodeForPath(relocatedParent).node.id, parentId);
+  assert.equal(
+    nodeForPath(path.join(relocatedParent, 'child.txt')).node.id,
+    childId,
+  );
+});
+
+test('restart preserves deletion of a plan-created parent before child validation', () => {
+  const {
+    childId,
+    mutationId,
+    originalParent,
+    parentId,
+    plan,
+    workspace,
+  } = relocatedCreatedParentFixture('deleted-create-before-validation');
+  let held = treeMaterialization.insertOperation(plan);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCreatePrepared(action) {
+        if (
+          action.nodeId === childId
+          && fs.existsSync(originalParent)
+        ) {
+          fs.rmSync(originalParent, { recursive: true });
+          throw new Error('simulated crash immediately after parent deletion');
+        }
+      },
+    }),
+    /simulated crash immediately after parent deletion/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.equal(held.plan.carriedCreateDeletions, undefined);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCarriedCreateDeletionCapture() {
+        throw new Error('recovery captured deleted parent receipt');
+      },
+    }),
+    /recovery captured deleted parent receipt/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.equal(held.plan.carriedCreateDeletions[0].nodeId, parentId);
+
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterCarriedSuccessorBirth(operations) {
+        assert.deepEqual(
+          operations.map((operation) => operation.kind),
+          ['tree.trash'],
+        );
+        throw new Error('simulated crash after carried trash birth');
+      },
+    }),
+    /simulated crash after carried trash birth/,
+  );
+  const afterTrashBirth = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+    includeMissing: true,
+    includePurged: true,
+  });
+  assert.ok(
+    afterTrashBirth.find((node) => node.id === parentId)?.trashedAt,
+    JSON.stringify(afterTrashBirth),
+  );
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+      AND operation_kind = 'tree.trash'
+      AND json_extract(operation_json, '$.nodeId') = ?
+  `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
+  projectStoredTreeOperation(held, openLocalDb());
+  assert.equal(fs.existsSync(originalParent), false);
+  const nodes = listWorkspaceNodes(workspace.id, {
+    includeTrashed: true,
+  });
+  assert.ok(nodes.find((node) => node.id === parentId)?.trashedAt);
+  assert.ok(nodes.find((node) => node.id === childId)?.trashedAt);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+      AND operation_kind = 'tree.trash'
+      AND json_extract(operation_json, '$.nodeId') = ?
+  `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
+  held = treeMaterialization.markOperationCommitted(held);
+  finishTreeOperationPlan(held, openLocalDb());
+});
+
+test('restart gives a replacement of a plan-created folder a fresh UUID', () => {
+  const {
+    childId,
+    mutationId,
+    originalParent,
+    parentId,
+    plan,
+    workspace,
+  } = relocatedCreatedParentFixture('replaced-create-before-validation');
+  const replacementFile = path.join(originalParent, 'local.txt');
+  let held = treeMaterialization.insertOperation(plan);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCreatePrepared(action) {
+        if (
+          action.nodeId === childId
+          && fs.existsSync(originalParent)
+        ) {
+          fs.rmSync(originalParent, { recursive: true });
+          fs.mkdirSync(originalParent);
+          fs.writeFileSync(replacementFile, 'local replacement\n');
+          throw new Error('simulated crash after created-folder replacement');
+        }
+      },
+    }),
+    /simulated crash after created-folder replacement/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCarriedCreateDeletionCapture() {
+        throw new Error('recovery classified replaced created folder');
+      },
+    }),
+    /recovery classified replaced created folder/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
+  projectStoredTreeOperation(held, openLocalDb());
+
+  const replacement = nodeForPath(originalParent).node;
+  assert.notEqual(replacement.id, parentId);
+  assert.equal(fs.readFileSync(replacementFile, 'utf8'), 'local replacement\n');
+  assert.equal(nodeForPath(replacementFile).node.parentId, replacement.id);
+  const nodes = listWorkspaceNodes(workspace.id, { includeTrashed: true });
+  assert.ok(nodes.find((node) => node.id === parentId)?.trashedAt);
+  assert.ok(nodes.find((node) => node.id === childId)?.trashedAt);
+  held = treeMaterialization.markOperationCommitted(held);
+  finishTreeOperationPlan(held, openLocalDb());
+});
+
+test('restart keeps a same-path file successor on its plan-created UUID', () => {
+  const {
+    firstId,
+    firstPath,
+    mutationId,
+    plan,
+    root,
+    triggerId,
+    triggerPath,
+    workspace,
+  } = createdSiblingFilesFixture('replaced-created-file');
+  let held = treeMaterialization.insertOperation(plan);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCreatePrepared(action) {
+        if (action.nodeId === triggerId && fs.existsSync(firstPath)) {
+          const successor = path.join(root, 'successor.tmp');
+          fs.writeFileSync(successor, 'newer local bytes\n');
+          fs.renameSync(successor, firstPath);
+          throw new Error('simulated crash after created-file replacement');
+        }
+      },
+    }),
+    /simulated crash after created-file replacement/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCarriedCreateCapture(bindings) {
+        assert.equal(bindings.find((binding) => binding.nodeId === firstId)?.path, firstPath);
+        throw new Error('recovery captured same-path file successor');
+      },
+    }),
+    /recovery captured same-path file successor/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  const latestSuccessor = path.join(root, 'latest-successor.tmp');
+  fs.writeFileSync(latestSuccessor, 'latest local bytes\n');
+  fs.renameSync(latestSuccessor, firstPath);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterCarriedCreateRefresh(bindings) {
+        assert.equal(
+          bindings.find((binding) => binding.nodeId === firstId)?.identity.ino,
+          treeMaterialization.identity(firstPath, { deep: false }).ino,
+        );
+        throw new Error('simulated crash after carried file refresh');
+      },
+    }),
+    /simulated crash after carried file refresh/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
+  projectStoredTreeOperation(held, openLocalDb());
+
+  assert.equal(nodeForPath(firstPath).node.id, firstId);
+  assert.equal(nodeForPath(triggerPath).node.id, triggerId);
+  assert.equal(fs.readFileSync(firstPath, 'utf8'), 'latest local bytes\n');
+  assert.equal(docs.openDoc(firstPath).resource, `doc:${firstId}`);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+      AND json_extract(operation_json, '$.nodeId') = ?
+      AND operation_kind IN ('tree.create', 'tree.trash')
+  `).get(`workspace-tree:${workspace.id}`, firstId).count, 0);
+  held = treeMaterialization.markOperationCommitted(held);
+  finishTreeOperationPlan(held, openLocalDb());
+});
+
+test('multiple carried successors keep durable sequence IDs across path reordering', () => {
+  const {
+    childId,
+    firstId,
+    mutationId,
+    plan,
+    root,
+    secondId,
+    workspace,
+  } = multipleRelocatedParentsFixture('multiple-carried-successors');
+  const pathFor = (name) => path.join(root, name);
+  let held = treeMaterialization.insertOperation(plan);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCreatePrepared(action) {
+        if (
+          action.nodeId === childId
+          && fs.existsSync(pathFor('P1'))
+          && fs.existsSync(pathFor('P2'))
+        ) {
+          fs.renameSync(pathFor('P1'), pathFor('Q1'));
+          fs.renameSync(pathFor('P2'), pathFor('Q2'));
+        }
+      },
+      afterOperationCarriedCreateCapture(bindings) {
+        assert.equal(bindings.length, 2);
+        throw new Error('simulated crash after two carried creates');
+      },
+    }),
+    /simulated crash after two carried creates/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterCarriedSuccessorBirth(operations) {
+        assert.deepEqual(
+          operations.map((operation) => operation.kind),
+          ['tree.rename', 'tree.rename'],
+        );
+        throw new Error('simulated crash after two successor births');
+      },
+    }),
+    /simulated crash after two successor births/,
+  );
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ? AND operation_kind = 'tree.rename'
+  `).get(`workspace-tree:${workspace.id}`).count, 2);
+
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  fs.renameSync(pathFor('Q1'), pathFor('Z'));
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterCarriedSuccessorBirth(operations) {
+        assert.deepEqual(
+          operations.map((operation) => operation.name),
+          ['Q1', 'Q2', 'Z'],
+        );
+        throw new Error('simulated crash after reordered successor birth');
+      },
+    }),
+    /simulated crash after reordered successor birth/,
+  );
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ? AND operation_kind = 'tree.rename'
+  `).get(`workspace-tree:${workspace.id}`).count, 3);
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ?
+      AND operation_kind = 'tree.rename'
+      AND json_extract(operation_json, '$.nodeId') = ?
+  `).get(`workspace-tree:${workspace.id}`, secondId).count, 1);
+
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
+  projectStoredTreeOperation(held, openLocalDb());
+  assert.equal(nodeForPath(pathFor('Z')).node.id, firstId);
+  assert.equal(nodeForPath(pathFor('Q2')).node.id, secondId);
+  assert.equal(
+    nodeForPath(path.join(pathFor('Q2'), 'child.txt')).node.id,
+    childId,
+  );
+  held = treeMaterialization.markOperationCommitted(held);
+  finishTreeOperationPlan(held, openLocalDb());
+});
+
+test('a two-node carried path swap is planned durably before its births', () => {
+  const {
+    childId,
+    firstId,
+    mutationId,
+    plan,
+    root,
+    secondId,
+    workspace,
+  } = multipleRelocatedParentsFixture('two-node-carried-swap');
+  const pathFor = (name) => path.join(root, name);
+  let held = treeMaterialization.insertOperation(plan);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCreatePrepared(action) {
+        if (
+          action.nodeId === childId
+          && fs.existsSync(pathFor('P1'))
+          && fs.existsSync(pathFor('P2'))
+        ) {
+          fs.renameSync(pathFor('P1'), pathFor('swap.tmp'));
+          fs.renameSync(pathFor('P2'), pathFor('P1'));
+          fs.renameSync(pathFor('swap.tmp'), pathFor('P2'));
+        }
+      },
+      afterOperationCarriedCreateCapture(bindings) {
+        assert.equal(bindings.length, 2);
+        throw new Error('simulated crash after swapped creates were captured');
+      },
+    }),
+    /simulated crash after swapped creates were captured/,
+  );
+
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterCarriedSuccessorPlan(operations) {
+        assert.equal(operations.length, 4);
+        assert.equal(
+          operations.filter((operation) => (
+            operation.name?.startsWith('amalgm-relocation-')
+          )).length,
+          2,
+        );
+        assert.deepEqual(
+          operations.slice(-2).map((operation) => operation.name),
+          ['P1', 'P2'],
+        );
+        throw new Error('simulated crash after durable swap plan');
+      },
+    }),
+    /simulated crash after durable swap plan/,
+  );
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ? AND operation_kind = 'tree.rename'
+  `).get(`workspace-tree:${workspace.id}`).count, 0);
+
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
+  projectStoredTreeOperation(held, openLocalDb());
+  assert.equal(nodeForPath(pathFor('P1')).node.id, secondId);
+  assert.equal(nodeForPath(pathFor('P2')).node.id, firstId);
+  assert.equal(
+    nodeForPath(path.join(pathFor('P1'), 'child.txt')).node.id,
+    childId,
+  );
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ? AND operation_kind = 'tree.rename'
+  `).get(`workspace-tree:${workspace.id}`).count, 4);
+  held = treeMaterialization.markOperationCommitted(held);
+  finishTreeOperationPlan(held, openLocalDb());
+});
+
+test('a three-node carried path cycle converges as one durable permutation', () => {
+  const {
+    childId,
+    firstId,
+    mutationId,
+    plan,
+    root,
+    secondId,
+    thirdId,
+    workspace,
+  } = multipleRelocatedParentsFixture('three-node-carried-cycle', 3);
+  const pathFor = (name) => path.join(root, name);
+  let held = treeMaterialization.insertOperation(plan);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCreatePrepared(action) {
+        if (
+          action.nodeId === childId
+          && ['P1', 'P2', 'P3'].every((name) => fs.existsSync(pathFor(name)))
+        ) {
+          fs.renameSync(pathFor('P1'), pathFor('cycle.tmp'));
+          fs.renameSync(pathFor('P3'), pathFor('P1'));
+          fs.renameSync(pathFor('P2'), pathFor('P3'));
+          fs.renameSync(pathFor('cycle.tmp'), pathFor('P2'));
+        }
+      },
+      afterOperationCarriedCreateCapture(bindings) {
+        assert.equal(bindings.length, 3);
+        throw new Error('simulated crash after cyclic creates were captured');
+      },
+    }),
+    /simulated crash after cyclic creates were captured/,
+  );
+
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterCarriedSuccessorBirth(operations) {
+        assert.equal(operations.length, 6);
+        assert.equal(
+          operations.filter((operation) => (
+            operation.name?.startsWith('amalgm-relocation-')
+          )).length,
+          3,
+        );
+        throw new Error('simulated crash after cyclic successor births');
+      },
+    }),
+    /simulated crash after cyclic successor births/,
+  );
+
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
+  projectStoredTreeOperation(held, openLocalDb());
+  assert.equal(nodeForPath(pathFor('P1')).node.id, thirdId);
+  assert.equal(nodeForPath(pathFor('P2')).node.id, firstId);
+  assert.equal(nodeForPath(pathFor('P3')).node.id, secondId);
+  assert.equal(
+    nodeForPath(path.join(pathFor('P3'), 'child.txt')).node.id,
+    childId,
+  );
+  assert.equal(openLocalDb().prepare(`
+    SELECT COUNT(*) AS count
+    FROM mutation_journal
+    WHERE local_resource = ? AND operation_kind = 'tree.rename'
+  `).get(`workspace-tree:${workspace.id}`).count, 6);
+  held = treeMaterialization.markOperationCommitted(held);
+  finishTreeOperationPlan(held, openLocalDb());
+});
+
+test('a relocated plan-created parent preserves its rename-then-delete successor chain', () => {
+  const {
+    childId,
+    mutationId,
+    originalParent,
+    parentId,
+    plan,
+    relocatedParent,
+    workspace,
+  } = relocatedCreatedParentFixture('relocated-created-parent');
+  let held = treeMaterialization.insertOperation(plan);
+  assert.throws(
+    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+      afterOperationCreatePrepared(action) {
+        if (
+          action.nodeId === childId
+          && fs.existsSync(originalParent)
+        ) {
+          fs.renameSync(originalParent, relocatedParent);
+        }
+      },
+      afterOperationCarriedCreateCapture() {
+        throw new Error('simulated crash after carried create capture');
+      },
+    }),
+    /simulated crash after carried create capture/,
+  );
+  held = treeMaterialization.getOperation(workspace.id, mutationId);
+  assert.equal(held.plan.carriedCreates[0].nodeId, parentId);
+  assert.equal(fs.existsSync(relocatedParent), true);
+
+  const identity = require('../workspace/identity');
+  const previousUserId = identity.userId;
+  const memberId = 'member-relocated-created-parent';
+  openLocalDb().prepare(`
+    INSERT INTO workspace_node_permissions(workspace_id, node_id, user_id, role)
+    VALUES (?, ?, ?, 'viewer')
+  `).run(workspace.id, workspace.id, memberId);
+  identity.userId = () => memberId;
+  try {
+    const assertPermissionHeld = () => assert.throws(
+      () => crossTreeOperationWithRaceCapture(held, openLocalDb()),
+      (error) => (
+        error.code === 'WORKSPACE_TREE_RETRY_PENDING'
+        && error.reason === 'forbidden'
+        && error.statusCode === 409
+      ),
+    );
+    assertPermissionHeld();
+    held = treeMaterialization.getOperation(workspace.id, mutationId);
+    assert.equal(held.plan.permissionHold.reason, 'forbidden');
+    assert.equal(held.plan.permissionHold.operations.length, 1);
+    assert.equal(held.plan.permissionHold.operations[0].kind, 'tree.rename');
+    assert.equal(nodeForPath(relocatedParent).node.id, parentId);
+    assert.equal(openLocalDb().prepare(`
+      SELECT COUNT(*) AS count
+      FROM mutation_journal
+      WHERE local_resource = ?
+        AND operation_kind = 'tree.rename'
+        AND json_extract(operation_json, '$.nodeId') = ?
+    `).get(`workspace-tree:${workspace.id}`, parentId).count, 0);
+    assertPermissionHeld();
+    assert.equal(
+      treeMaterialization.listOperations(openLocalDb(), workspace.id).length,
+      1,
+      'permission denial keeps one durable recovery owner',
+    );
+
+    openLocalDb().prepare(`
+      UPDATE workspace_node_permissions SET role = 'editor'
+      WHERE workspace_id = ? AND node_id = ? AND user_id = ?
+    `).run(workspace.id, workspace.id, memberId);
+    assert.throws(
+      () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+        afterCarriedSuccessorBirth() {
+          throw new Error('simulated crash after carried successor birth');
+        },
+      }),
+      /simulated crash after carried successor birth/,
+    );
+    assert.equal(openLocalDb().prepare(`
+      SELECT COUNT(*) AS count
+      FROM mutation_journal
+      WHERE local_resource = ?
+        AND operation_kind = 'tree.rename'
+        AND json_extract(operation_json, '$.nodeId') = ?
+    `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
+
+    held = treeMaterialization.getOperation(workspace.id, mutationId);
+    fs.rmSync(relocatedParent, { recursive: true });
+    assert.throws(
+      () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
+        afterCarriedSuccessorBirth(operations) {
+          assert.deepEqual(
+            operations.map((operation) => operation.kind),
+            ['tree.rename', 'tree.trash'],
+          );
+          throw new Error('simulated crash after carried delete successor birth');
+        },
+      }),
+      /simulated crash after carried delete successor birth/,
+    );
+    held = treeMaterialization.getOperation(workspace.id, mutationId);
+    held = crossTreeOperationWithRaceCapture(held, openLocalDb());
+    projectStoredTreeOperation(held, openLocalDb());
+
+    assert.equal(fs.existsSync(originalParent), false);
+    assert.equal(fs.existsSync(relocatedParent), false);
+    const nodes = listWorkspaceNodes(workspace.id, {
+      includeTrashed: true,
+    });
+    assert.ok(nodes.find((node) => node.id === parentId)?.trashedAt);
+    assert.ok(nodes.find((node) => node.id === childId)?.trashedAt);
+    assert.equal(openLocalDb().prepare(`
+      SELECT COUNT(*) AS count
+      FROM mutation_journal
+      WHERE local_resource = ?
+        AND operation_kind = 'tree.rename'
+        AND json_extract(operation_json, '$.nodeId') = ?
+    `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
+    assert.equal(openLocalDb().prepare(`
+      SELECT COUNT(*) AS count
+      FROM mutation_journal
+      WHERE local_resource = ?
+        AND operation_kind = 'tree.trash'
+        AND json_extract(operation_json, '$.nodeId') = ?
+    `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
+
+    held = treeMaterialization.markOperationCommitted(held);
+    finishTreeOperationPlan(held, openLocalDb());
+  } finally {
+    identity.userId = previousUserId;
+  }
+});