amalgm 0.1.239 → 0.1.241

package/runtime/scripts/amalgm-mcp/tests/workspace-reducer.test.js

@@ -21,28 +21,34 @@ fs.writeFileSync(
 );
 
 const { closeLocalDb } = require('../state/db');
-const { CHECKPOINT_CONTRACT, revisionOf } = require('../workspace/checkpoint');
+const checkpoint = require('../workspace/checkpoint');
+const { CHECKPOINT_CONTRACT, revisionOf } = checkpoint;
+const { locatorChecksum } = require('../workspace/objects')._test;
 const {
   advanceIndex,
-  captureIsOnRail,
+  applyHydrationBootstrap,
   hydrateRepo,
   localCardMayMaterialize,
   materializeRepo,
-  parkedForState,
   pathForRepo,
   readRepoState,
+  readOfficialPlan,
+  repairDelayForPass,
   reduceCheckpoint,
   reduceWall,
+  snapshotIsCurrent,
 } = require('../workspace/reducer');
 
 test('a materialized baseline can follow the rail without publishing an echo', () => {
   assert.equal(localCardMayMaterialize(null, {
     published: false,
     reason: 'shared-state-covered',
+    mayMaterialize: true,
   }), true);
   assert.equal(localCardMayMaterialize(null, {
     published: false,
     reason: 'project-not-current',
+    mayMaterialize: true,
   }), true);
   assert.equal(localCardMayMaterialize({ positionVersion: 7 }, null), true);
   assert.equal(localCardMayMaterialize(null, {
@@ -52,6 +58,10 @@ test('a materialized baseline can follow the rail without publishing an echo', (
     published: false,
     reason: 'unchanged',
   }), false);
+  assert.equal(localCardMayMaterialize(null, {
+    published: false,
+    reason: 'future-reason-that-must-not-change-control-flow',
+  }), false);
 });
 
 test('a hydration failure still has a project path before a local card exists', () => {
@@ -74,6 +84,44 @@ test('a reducer cursor belongs only to the rail that created it', () => {
   assert.equal(readRepoState(repoKey, 'shr_new_project_rail'), null);
 });
 
+test('a received cursor cannot advance past the exact local project snapshot', () => {
+  assert.equal(snapshotIsCurrent(51, 51), true);
+  assert.equal(snapshotIsCurrent(51, 50), false);
+  assert.equal(snapshotIsCurrent(51, 52), false);
+  assert.equal(snapshotIsCurrent(null, 0), false);
+});
+
+test('an acknowledged event cannot hydrate an empty folder before its sealed snapshot arrives', () => {
+  const target = path.join(tempRoot, 'hydrate-before-seal');
+  const resourceId = '018f0000-0000-7000-8000-000000000020';
+  const snapshot = path.join(tempRoot, 'snapshot-before-seal.json');
+  fs.mkdirSync(target, { recursive: true });
+  fs.writeFileSync(snapshot, JSON.stringify({
+    schemaVersion: 2,
+    project: resourceId,
+    version: 0,
+    card: null,
+    checkpoint: null,
+  }));
+
+  const outcome = readOfficialPlan(
+    'root:snapshot-gate',
+    { file: snapshot, resourceId },
+    {
+      publicationStatus: () => ({ receivedThrough: 1 }),
+      readWall: () => [],
+    },
+  );
+
+  assert.deepEqual(outcome, {
+    state: 'waiting',
+    reason: 'official-snapshot-behind',
+    receivedThrough: 1,
+    snapshotThrough: 0,
+  });
+  assert.deepEqual(fs.readdirSync(target), []);
+});
+
 test.after(() => {
   closeLocalDb();
   fs.rmSync(tempRoot, { recursive: true, force: true });
@@ -88,6 +136,11 @@ async function git(cwd, ...args) {
   return stdout;
 }
 
+async function gitPath(cwd, relativePath) {
+  const value = (await git(cwd, 'rev-parse', '--git-path', relativePath)).trim();
+  return path.isAbsolute(value) ? value : path.resolve(cwd, value);
+}
+
 async function makeRepo(name) {
   const repo = path.join(tempRoot, name);
   fs.mkdirSync(repo, { recursive: true });
@@ -130,7 +183,7 @@ function transition(machine, version, baseOid, from, to) {
 
 function card(repo, oid, version) {
   return {
-    card: 'repo-card@2',
+    card: 'repo-card@3',
     path: repo,
     replica: 'rpl_local',
     machine: 'machine-local',
@@ -145,14 +198,72 @@ function card(repo, oid, version) {
   };
 }
 
+let trackedProjectNumber = 100;
+
+async function observedCard(base) {
+  const headOid = (await git(base.path, 'rev-parse', 'HEAD')).trim();
+  const branch = (await git(base.path, 'branch', '--show-current')).trim() || null;
+  const refs = (await git(
+    base.path,
+    'for-each-ref',
+    '--format=%(refname:short) %(objectname)',
+    'refs/heads',
+  )).trim().split('\n').filter(Boolean).map((line) => {
+    const split = line.lastIndexOf(' ');
+    return {
+      name: line.slice(0, split),
+      oid: line.slice(split + 1),
+      objects: { kind: 'local' },
+    };
+  });
+  return {
+    ...base,
+    head: { branch, oid: headOid, detached: branch === null },
+    objects: { kind: 'local' },
+    refs,
+  };
+}
+
+async function establishTrackedBaseline(repo, oid, name) {
+  trackedProjectNumber += 1;
+  const resourceId = `018f0000-0000-7000-8000-${String(trackedProjectNumber).padStart(12, '0')}`;
+  const project = require('../workspace/wall').bindProject(
+    resourceId,
+    '11111111-1111-4111-8111-111111111111',
+    repo,
+  );
+  const localCard = await observedCard({
+    ...card(repo, oid, 1),
+    replica: `rpl_${name}`,
+  });
+  const baseline = {
+    repoKey: project.repoKey,
+    card: localCard,
+    transitions: [],
+    branches: localCard.refs.map((ref) => ({ ...ref, version: 1 })),
+  };
+  assert.equal((await materializeRepo(localCard, baseline, 1)).state, 'in-sync');
+  return { project, repoKey: project.repoKey, localCard, baseline };
+}
+
+function reducerStateFile(repoKey) {
+  const digest = require('crypto').createHash('sha256').update(repoKey).digest('hex').slice(0, 24);
+  return path.join(process.env.AMALGM_DIR, 'state', 'repo-reducer', `${digest}.json`);
+}
+
+async function captureTrackedIntent(project, localCard) {
+  const current = await observedCard(localCard);
+  const captured = await checkpoint.captureIntentForCard(project, current);
+  assert.equal(captured.state, 'captured');
+  return current;
+}
+
 test('wall reduction chooses one rail winner and orders checkpoint transitions by rail', () => {
   const oldCard = card('/old', 'a'.repeat(40), 4);
   oldCard.checkpoints = [transition('machine-a', 9, oldCard.head.oid, '', 'a')];
   const newCard = card('/new', 'b'.repeat(40), 7);
   const later = transition('machine-b', 11, newCard.head.oid, 'b', 'c');
-  later.parked = [{ oid: 'd'.repeat(40) }];
   const earlier = transition('machine-b', 8, newCard.head.oid, '', 'b');
-  earlier.parked = [{ oid: 'c'.repeat(40) }];
   newCard.checkpoints = [later, earlier];
   const plans = reduceWall([
     { machine: 'machine-a', cards: [oldCard] },
@@ -161,10 +272,6 @@ test('wall reduction chooses one rail winner and orders checkpoint transitions b
   const plan = plans.get('root:test');
   assert.equal(plan.card.positionVersion, 7);
   assert.deepEqual(plan.transitions.map((item) => item.version), [8, 11]);
-  assert.deepEqual(plan.parked.map((item) => [item.oid, item.version]), [
-    ['c'.repeat(40), 8],
-    ['d'.repeat(40), 11],
-  ]);
 });
 
 test('copies of one numbered card reduce to the copy with ready objects', () => {
@@ -211,135 +318,6 @@ test('copies of one numbered card reduce to the copy with ready objects', () =>
   }
 });
 
-test('a checkpoint base replaces covered history and keeps only newer mutations', async () => {
-  const { repo, oid } = await makeRepo('checkpoint-base');
-  const patchA = await patchFor(repo, { 'a.txt': 'a1\n' });
-  const patchAB = await patchFor(repo, { 'a.txt': 'a1\n', 'b.txt': 'b1\n' });
-  const current = card(repo, oid, 1);
-  current.checkpointBase = {
-    checkpoint: CHECKPOINT_CONTRACT,
-    baseOid: oid,
-    branch: 'main',
-    through: 4,
-    value: value(oid, patchA),
-  };
-  current.checkpoints = [
-    transition('machine-a', 2, oid, '', patchA),
-    transition('machine-a', 5, oid, patchA, patchAB),
-  ];
-  const plan = reduceWall([{ machine: 'machine-a', cards: [current] }]).get('root:test');
-  assert.equal(plan.checkpointBase.through, 4);
-  assert.deepEqual(plan.transitions.map((entry) => entry.version), [5]);
-  const reduced = await reduceCheckpoint(current, plan);
-  assert.equal(reduced.state, 'ready');
-  assert.equal(reduced.checkpointRevision, revisionOf(oid, patchAB, ''));
-});
-
-test('an unfinished checkpoint base cannot replace the last complete base', () => {
-  const oid = 'a'.repeat(40);
-  const complete = card('/complete', oid, 1);
-  complete.checkpointBase = {
-    checkpoint: CHECKPOINT_CONTRACT,
-    baseOid: oid,
-    branch: 'main',
-    through: 4,
-    value: value(oid, 'complete-patch'),
-  };
-  complete.checkpoints = [
-    transition('machine-a', 5, oid, 'complete-patch', 'later-patch'),
-  ];
-
-  const unfinished = card('/unfinished', oid, 1);
-  unfinished.checkpointBase = {
-    checkpoint: CHECKPOINT_CONTRACT,
-    baseOid: oid,
-    branch: 'main',
-    through: 6,
-    value: {
-      revision: 'b'.repeat(64),
-      payload: {
-        kind: 'pending',
-        contract: 'opaque-chunks@1',
-        checksum: 'c'.repeat(64),
-      },
-    },
-  };
-
-  const plan = reduceWall([
-    { machine: 'machine-a', cards: [complete] },
-    { machine: 'machine-b', cards: [unfinished] },
-  ]).get('root:test');
-
-  assert.equal(plan.checkpointBase.through, 4);
-  assert.equal(plan.checkpointBaseConflict, false);
-  assert.deepEqual(plan.transitions.map((entry) => entry.version), [5]);
-});
-
-test('different snapshots claiming the same rail position stop instead of choosing a winner', () => {
-  const oid = 'a'.repeat(40);
-  const first = card('/first', oid, 1);
-  first.checkpointBase = {
-    checkpoint: CHECKPOINT_CONTRACT,
-    baseOid: oid,
-    branch: 'main',
-    through: 4,
-    value: value(oid, 'patch-a'),
-  };
-  const second = card('/second', oid, 1);
-  second.checkpointBase = {
-    checkpoint: CHECKPOINT_CONTRACT,
-    baseOid: oid,
-    branch: 'main',
-    through: 4,
-    value: value(oid, 'patch-b'),
-  };
-  const plan = reduceWall([
-    { machine: 'machine-a', cards: [first] },
-    { machine: 'machine-b', cards: [second] },
-  ]).get('root:test');
-  assert.equal(plan.checkpointBase, null);
-  assert.equal(plan.checkpointBaseConflict, true);
-});
-
-test('a ready parked bundle never regresses to pending', () => {
-  const oid = 'c'.repeat(40);
-  const ready = card('/ready', 'a'.repeat(40), 1);
-  const readyCheckpoint = transition('machine-ready', 2, ready.head.oid, '', '');
-  readyCheckpoint.parked = [{
-    oid,
-    ref: `refs/amalgm/parked/${oid}`,
-    objects: { kind: 'bundle', checksum: 'd'.repeat(64) },
-  }];
-  ready.checkpoints = [readyCheckpoint];
-
-  const pending = card('/pending', ready.head.oid, 3);
-  const pendingCheckpoint = transition('machine-pending', 4, pending.head.oid, '', '');
-  pendingCheckpoint.parked = [{
-    oid,
-    ref: `refs/amalgm/parked/${oid}`,
-    objects: { kind: 'pending' },
-  }];
-  pending.checkpoints = [pendingCheckpoint];
-
-  const plan = reduceWall([
-    { machine: 'machine-ready', cards: [ready] },
-    { machine: 'machine-pending', cards: [pending] },
-  ]).get('root:test');
-  assert.equal(plan.parked.length, 1);
-  assert.equal(plan.parked[0].objects.kind, 'bundle');
-});
-
-test('an unpublished local parked commit stays active until the rail records it', () => {
-  const oid = 'f'.repeat(40);
-  const local = { oid, objects: { kind: 'bundle', checksum: 'local' } };
-  assert.deepEqual(parkedForState([local], [], []), [local]);
-  assert.deepEqual(parkedForState([local], [{ ...local, version: 7 }], []), [{
-    ...local,
-    version: 7,
-  }]);
-  assert.deepEqual(parkedForState([{ ...local, version: 7 }], [], []), []);
-});
-
 test('a stale lower rail card cannot roll back a newer branch and commit', () => {
   const newer = card('/newer', 'b'.repeat(40), 12);
   newer.head.branch = 'feature';
@@ -366,25 +344,26 @@ test('checkpoint reduction reads only the current rail contract', () => {
   assert.deepEqual(plan.transitions.map((item) => item.version), [3]);
 });
 
-test('an old pending payload does not block the later complete checkpoint transition', async () => {
+test('an official checkpoint with a pending payload is terminal corruption', async () => {
   const { repo, oid } = await makeRepo('pending-payload');
   const diff = await patchFor(repo, { 'a.txt': 'a1\n' });
   const pending = transition('machine-a', 2, oid, '', '');
   pending.from = {
     revision: 'a'.repeat(64),
-    payload: { kind: 'pending', contract: 'opaque-chunks@1', checksum: 'b'.repeat(64) },
+    payload: { kind: 'pending', contract: 'opaque-chunks@2', checksum: 'b'.repeat(64) },
   };
   pending.to = pending.from;
   const complete = transition('machine-a', 3, oid, '', diff);
-  const reduced = await reduceCheckpoint(
-    { path: repo },
-    { card: card(repo, oid, 1), transitions: [pending, complete] },
+  await assert.rejects(
+    reduceCheckpoint(
+      { path: repo },
+      { card: card(repo, oid, 1), transitions: [pending, complete] },
+    ),
+    /official checkpoint is payload-pending/,
   );
-  assert.equal(reduced.state, 'ready');
-  assert.match(reduced.indexDiff, /a1/);
 });
 
-test('an empty project folder hydrates from the winning card bundle without cloning', async () => {
+test('hydration preserves unknown files and a branch committed while recovery was down', async () => {
   const sourceRepo = await makeRepo('hydrate-source');
   const source = sourceRepo.repo;
   fs.mkdirSync(path.join(source, '.amalgam', 'context'), { recursive: true });
@@ -397,6 +376,7 @@ test('an empty project folder hydrates from the winning card bundle without clon
   await git(source, 'bundle', 'create', bundle, 'main');
   const bytes = fs.readFileSync(bundle);
   const digest = require('crypto').createHash('sha256').update(bytes).digest('hex');
+  const locatorChunks = [{ sha256: digest, bytes: bytes.length }];
   const chunks = path.join(process.env.AMALGM_DIR, 'state', 'repo-objects', 'chunks');
   fs.mkdirSync(chunks, { recursive: true });
   fs.writeFileSync(path.join(chunks, `${digest}.bin`), bytes);
@@ -409,26 +389,345 @@ test('an empty project folder hydrates from the winning card bundle without clon
   winning.repo.remote = 'https://example.com/org/repo';
   winning.objects = {
     kind: 'bundle',
-    contract: 'git-bundle-chunks@1',
+    contract: 'git-bundle-chunks@2',
     resourceId: 'shr_hydrationProof123456',
     oid,
     ref: `refs/amalgm/exports/${oid}`,
-    checksum: digest,
+    checksum: locatorChecksum(locatorChunks),
     bytes: bytes.length,
-    chunks: [{ sha256: digest, bytes: bytes.length }],
+    chunks: locatorChunks,
   };
 
-  const result = await hydrateRepo(
-    { path: target },
-    { repoKey: 'https://example.com/org/repo', card: winning, transitions: [] },
+  const resourceId = '018f0000-0000-7000-8000-000000000021';
+  winning.objects.resourceId = resourceId;
+  const repoKey = `code-folder:${resourceId}`;
+  const project = { path: target, resourceId };
+  const plan = {
+    repoKey,
+    card: winning,
+    branches: [{ name: 'secondary', oid, version: 1 }],
+    transitions: [],
+  };
+  require('../workspace/wall').bindProject(
+    project.resourceId,
+    '11111111-1111-4111-8111-111111111111',
+    target,
+  );
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  let interruptBootstrap = true;
+  transitions.updateBranchRefs = async (...args) => {
+    await updateBranchRefs(...args);
+    if (interruptBootstrap) {
+      interruptBootstrap = false;
+      assert.equal(
+        transitions.gitMetadataReceiptCrossed(
+          target,
+          args[2],
+          'index',
+        ),
+        true,
+        'the bootstrap index receipt survives until hydration execution is sealed',
+      );
+      throw new Error('simulated process death during hydration');
+    }
+  };
+  try {
+    await assert.rejects(
+      hydrateRepo(project, plan),
+      /simulated process death/,
+    );
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+  assert.equal(fs.readFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'utf8'), 'local note\n');
+  const interrupted = readRepoState(repoKey, project.resourceId);
+  assert.equal(interrupted.hydrating.contract, 'repo-hydrate@5');
+  assert.equal(
+    transitions.gitMetadataReceiptCrossed(
+      target,
+      interrupted.hydrating.operationId,
+      'index',
+    ),
+    true,
+  );
+  assert.equal(interrupted.materialized, false);
+  assert.equal(
+    require('../workspace/intent').readOwnedIntent(
+      require('../workspace/wall').projectForResource(project.resourceId),
+    ),
+    null,
+    'the process died after the WAL and partial Git movement but before intent existed',
   );
-  assert.equal(result.state, 'hydrated');
   assert.equal((await git(target, 'rev-parse', 'HEAD')).trim(), oid);
-  assert.equal((await git(target, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
+  await git(target, 'switch', '-c', 'feature');
+  fs.writeFileSync(path.join(target, 'feature-commit.txt'), 'committed while down\n');
+  await git(target, 'add', 'feature-commit.txt');
+  await git(target, 'commit', '-m', 'feature committed while hydration was down');
+  const featureOid = (await git(target, 'rev-parse', 'HEAD')).trim();
+  fs.writeFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'edited while down\n');
+  fs.writeFileSync(path.join(target, 'downtime.txt'), 'created while down\n');
+
+  const releaseBranchReceipt = transitions.releaseBranchReceipt;
+  let interruptBootstrapCleanup = true;
+  transitions.releaseBranchReceipt = async (...args) => {
+    const result = await releaseBranchReceipt(...args);
+    if (interruptBootstrapCleanup) {
+      interruptBootstrapCleanup = false;
+      throw new Error('simulated process death after hydration bootstrap cleanup');
+    }
+    return result;
+  };
+  try {
+    await assert.rejects(
+      materializeRepo({
+        ...winning,
+        path: target,
+        replica: 'rpl_hydration_recovery',
+      }, plan, 1),
+      /simulated process death after hydration bootstrap cleanup/,
+    );
+  } finally {
+    transitions.releaseBranchReceipt = releaseBranchReceipt;
+  }
+  const cleanupInterrupted = readRepoState(repoKey, project.resourceId);
+  assert.equal(
+    cleanupInterrupted.hydrating.bootstrapSealed,
+    true,
+    'execution is durably sealed before bootstrap provenance is released',
+  );
+  assert.equal(cleanupInterrupted.hydrating.bootstrapReleased, undefined);
+  await git(target, 'branch', '-D', 'secondary');
+
+  const result = await materializeRepo({
+    ...winning,
+    path: target,
+    replica: 'rpl_hydration_recovery',
+  }, plan, 1);
+  assert.equal(result.state, 'hydrated', JSON.stringify(result));
+  assert.equal((await git(target, 'rev-parse', 'HEAD')).trim(), featureOid);
+  assert.equal((await git(target, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
+  assert.equal((await git(target, 'rev-parse', 'refs/heads/feature')).trim(), featureOid);
+  assert.equal((await git(target, 'rev-parse', 'refs/heads/main')).trim(), oid);
+  await assert.rejects(
+    git(target, 'rev-parse', '--verify', 'refs/heads/secondary'),
+    /Needed a single revision|unknown revision|not a valid object name/,
+    'a local deletion after bootstrap cleanup remains overlay on restart',
+  );
+  assert.equal(fs.readFileSync(path.join(target, 'feature-commit.txt'), 'utf8'), 'committed while down\n');
   assert.equal(fs.readFileSync(path.join(target, 'a.txt'), 'utf8'), 'a0\n');
-  assert.equal(fs.readFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'utf8'), 'local note\n');
+  assert.equal(fs.readFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'utf8'), 'edited while down\n');
   assert.equal(fs.readlinkSync(path.join(target, '.amalgam', 'context', 'current.md')), 'notes.md');
+  assert.equal(fs.readFileSync(path.join(target, 'downtime.txt'), 'utf8'), 'created while down\n');
   assert.match(await git(target, 'status', '--porcelain=v1'), /\.amalgam\/context\/notes\.md/);
+  assert.equal(readRepoState(repoKey, project.resourceId).hydrating, undefined);
+  assert.equal(readRepoState(repoKey, project.resourceId).materialized, true);
+  assert.equal(
+    transitions.gitMetadataReceiptCrossed(
+      target,
+      interrupted.hydrating.operationId,
+      'index',
+    ),
+    false,
+  );
+  assert.equal(
+    require('../workspace/intent').readOwnedIntent(
+      require('../workspace/wall').projectForResource(project.resourceId),
+    )?.base?.through,
+    1,
+    'unknown hydration bytes become durable intent over the official target',
+  );
+
+  const hydratedCard = await require('../workspace/card').buildRepoCard(target);
+  const hydrationIntent = require('../workspace/intent').readOwnedIntent(
+    require('../workspace/wall').projectForResource(project.resourceId),
+  );
+  assert.equal(readRepoState(repoKey, project.resourceId).replica, hydratedCard.replica);
+  for (const tree of [
+    hydrationIntent.base.indexTree,
+    hydrationIntent.base.worktreeTree,
+    hydrationIntent.local.indexTree,
+    hydrationIntent.local.worktreeTree,
+  ]) {
+    assert.equal(await require('../workspace/merge').hasTree(target, tree), true);
+  }
+  const settled = await materializeRepo(hydratedCard, plan, 1);
+  assert.equal(settled.state, 'in-sync', JSON.stringify(settled));
+  assert.equal(
+    require('../workspace/intent').readOwnedIntent(
+      require('../workspace/wall').projectForResource(project.resourceId),
+    )?.semanticDigest,
+    hydrationIntent.semanticDigest,
+    're-entry retains ownership of the bytes captured after the hydration WAL',
+  );
+  assert.equal(
+    fs.readFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'utf8'),
+    'edited while down\n',
+    'a later reducer pass cannot overwrite the captured collision',
+  );
+  assert.equal(fs.readFileSync(path.join(target, 'downtime.txt'), 'utf8'), 'created while down\n');
+});
+
+test('hydration bootstrap preserves a branch-only write after ref crossing and before HEAD attachment', async () => {
+  const source = await makeRepo('hydrate-branch-only-source');
+  const localOid = source.oid;
+  fs.writeFileSync(path.join(source.repo, 'official.txt'), 'official\n');
+  await git(source.repo, 'add', 'official.txt');
+  await git(source.repo, 'commit', '-m', 'official');
+  const officialOid = (await git(source.repo, 'rev-parse', 'HEAD')).trim();
+  const target = path.join(tempRoot, 'hydrate-branch-only-target');
+  fs.mkdirSync(target);
+  await git(target, 'init', '-b', 'main');
+  await git(target, 'fetch', source.repo, 'main');
+  const operationId = '7'.repeat(64);
+  const hydrating = {
+    operationId,
+    bootstrap: {
+      source: {
+        head: { branch: 'main', oid: null },
+        branches: [],
+      },
+      target: {
+        head: { branch: 'feature', oid: officialOid },
+        branches: [{ name: 'feature', oid: officialOid }],
+      },
+    },
+  };
+  const transitions = require('../workspace/transition');
+  await transitions.ensureEmptyIndex(target, operationId);
+  await transitions.updateBranchRefs(target, [
+    { branch: 'feature', expectedOid: null, oid: officialOid },
+  ], operationId);
+  await git(target, 'update-ref', 'refs/heads/feature', localOid, officialOid);
+
+  const result = await applyHydrationBootstrap(target, hydrating);
+  assert.deepEqual(result, { state: 'ready' });
+  assert.equal((await git(target, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
+  assert.equal((await git(target, 'rev-parse', 'HEAD')).trim(), localOid);
+  assert.equal((await git(target, 'rev-parse', 'refs/heads/feature')).trim(), localOid);
+});
+
+test('hydration bootstrap leaves a racing same-branch commit for execution reconciliation', async () => {
+  const { repo, oid: sourceOid } = await makeRepo('hydrate-head-sealed-source');
+  await git(repo, 'switch', '--detach', sourceOid);
+  fs.writeFileSync(path.join(repo, 'official.txt'), 'official\n');
+  await git(repo, 'add', 'official.txt');
+  await git(repo, 'commit', '-m', 'official');
+  const officialOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '-C', 'main', sourceOid);
+
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  let localOid = null;
+  transitions.updateBranchRefs = async (...args) => {
+    const result = await updateBranchRefs(...args);
+    fs.writeFileSync(path.join(repo, 'racing-local.txt'), 'local commit\n');
+    await git(repo, 'add', 'racing-local.txt');
+    await git(repo, 'commit', '-m', 'local commit during hydration apply');
+    localOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+    return result;
+  };
+  let result;
+  try {
+    result = await applyHydrationBootstrap(repo, {
+      operationId: '6'.repeat(64),
+      bootstrap: {
+        source: {
+          head: { branch: 'main', oid: sourceOid },
+          branches: [{ name: 'main', oid: sourceOid }],
+        },
+        target: {
+          head: { branch: 'main', oid: officialOid },
+          branches: [{ name: 'main', oid: officialOid }],
+        },
+      },
+    });
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+
+  assert.deepEqual(result, { state: 'ready' });
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), localOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'racing-local.txt'), 'utf8'), 'local commit\n');
+});
+
+test('index movement rejects an overlapping mode change made after the sealed tree', async () => {
+  const { repo } = await makeRepo('index-mode-after-seal');
+  const sourceTree = (await git(repo, 'write-tree')).trim();
+  await git(repo, 'rm', '--cached', 'a.txt');
+  const targetTree = (await git(repo, 'write-tree')).trim();
+  await git(repo, 'reset', '--mixed', 'HEAD');
+  await git(repo, 'update-index', '--chmod=+x', 'a.txt');
+  assert.match(await git(repo, 'ls-files', '--stage', '--', 'a.txt'), /^100755 /);
+
+  const result = await advanceIndex(
+    repo,
+    sourceTree,
+    targetTree,
+    '5'.repeat(64),
+  );
+
+  assert.deepEqual(result, {
+    state: 'waiting',
+    reason: 'local-index-moving',
+    moved: false,
+  });
+  assert.match(
+    await git(repo, 'ls-files', '--stage', '--', 'a.txt'),
+    /^100755 /,
+    'a patch derived from the sealed regular-file tree cannot delete the later executable entry',
+  );
+});
+
+test('ordinary index and HEAD lock contention remain bounded reducer waits', async () => {
+  const indexRepo = await makeRepo('retryable-index-lock');
+  const sourceTree = (await git(indexRepo.repo, 'write-tree')).trim();
+  fs.writeFileSync(path.join(indexRepo.repo, 'a.txt'), 'target\n');
+  await git(indexRepo.repo, 'add', 'a.txt');
+  const targetTree = (await git(indexRepo.repo, 'write-tree')).trim();
+  await git(indexRepo.repo, 'reset', '--mixed', 'HEAD');
+  const indexFile = await gitPath(indexRepo.repo, 'index');
+  fs.writeFileSync(`${indexFile}.lock`, 'user-owned lock\n');
+  const indexResult = await advanceIndex(
+    indexRepo.repo,
+    sourceTree,
+    targetTree,
+    '8'.repeat(64),
+  );
+  assert.deepEqual(indexResult, {
+    state: 'waiting',
+    reason: 'local-index-moving',
+    moved: false,
+  });
+  fs.rmSync(`${indexFile}.lock`);
+
+  const headRepo = await makeRepo('retryable-head-lock');
+  await git(headRepo.repo, 'branch', 'feature', headRepo.oid);
+  const headFile = await gitPath(headRepo.repo, 'HEAD');
+  fs.writeFileSync(`${headFile}.lock`, 'user-owned lock\n');
+  const headResult = await applyHydrationBootstrap(headRepo.repo, {
+    operationId: '9'.repeat(64),
+    bootstrap: {
+      source: {
+        head: { branch: 'main', oid: headRepo.oid },
+        branches: [
+          { name: 'feature', oid: headRepo.oid },
+          { name: 'main', oid: headRepo.oid },
+        ],
+      },
+      target: {
+        head: { branch: 'feature', oid: headRepo.oid },
+        branches: [
+          { name: 'feature', oid: headRepo.oid },
+          { name: 'main', oid: headRepo.oid },
+        ],
+      },
+    },
+  });
+  assert.deepEqual(headResult, { state: 'waiting', reason: 'local-head-moving' });
+  fs.rmSync(`${headFile}.lock`);
+  assert.equal(repairDelayForPass([indexResult, headResult]), 1000);
 });
 
 test('branch refs reduce per name; an absent stale list cannot delete another writer branch', () => {
@@ -506,11 +805,13 @@ test('one materializer converges to the reduced checkpoint and later removes a r
   const { repo, oid } = await makeRepo('materialize');
   const patchA = await patchFor(repo, { 'a.txt': 'a1\n' });
   const patchB = await patchFor(repo, { 'b.txt': 'b1\n' });
-  const localCard = card(repo, oid, 1);
+  const tracked = await establishTrackedBaseline(repo, oid, 'materialize');
+  const { localCard, repoKey } = tracked;
 
   const first = {
-    repoKey: 'root:test',
+    repoKey,
     card: localCard,
+    branches: tracked.baseline.branches,
     transitions: [
       transition('machine-a', 2, oid, '', patchA),
       transition('machine-b', 3, oid, patchA, `${patchA}${patchB}`),
@@ -518,14 +819,15 @@ test('one materializer converges to the reduced checkpoint and later removes a r
   };
   const applied = await materializeRepo(localCard, first, 3);
   assert.equal(applied.state, 'in-sync');
-  assert.equal(readRepoState('root:test').appliedThrough, 3);
+  assert.equal(readRepoState(repoKey, tracked.project.resourceId).appliedThrough, 3);
   assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a1\n');
   assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'b1\n');
 
-  const combined = readRepoState('root:test').indexDiff;
+  const combined = readRepoState(repoKey, tracked.project.resourceId).indexDiff;
   const second = {
-    repoKey: 'root:test',
+    repoKey,
     card: localCard,
+    branches: tracked.baseline.branches,
     transitions: [
       transition('machine-b', 3, oid, patchA, combined),
       transition('machine-a', 4, oid, combined, patchB),
@@ -533,17 +835,65 @@ test('one materializer converges to the reduced checkpoint and later removes a r
   };
   const reverted = await materializeRepo(localCard, second, 4);
   assert.equal(reverted.state, 'in-sync');
-  assert.equal(readRepoState('root:test').appliedThrough, 4);
+  assert.equal(readRepoState(repoKey, tracked.project.resourceId).appliedThrough, 4);
   assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a0\n');
   assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'b1\n');
 });
 
+test('a linked worktree verifies its cursor and releases every apply receipt', async () => {
+  const { repo, oid } = await makeRepo('linked-materialize-main');
+  const linked = path.join(tempRoot, 'linked-materialize-worktree');
+  await git(repo, 'worktree', 'add', '-b', 'linked-materialize', linked, oid);
+  const officialPatch = await patchFor(linked, { 'a.txt': 'official linked\n' });
+  const tracked = await establishTrackedBaseline(
+    linked,
+    oid,
+    'linked_materialize',
+  );
+  const plan = {
+    ...tracked.baseline,
+    transitions: [
+      transition('machine-remote', 2, oid, '', officialPatch),
+    ],
+  };
+
+  const outcome = await materializeRepo(tracked.localCard, plan, 2);
+  assert.equal(outcome.state, 'in-sync', outcome.reason);
+  assert.equal(fs.readFileSync(path.join(linked, 'a.txt'), 'utf8'), 'official linked\n');
+  assert.equal(
+    readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough,
+    2,
+  );
+  assert.equal(
+    fs.readdirSync(linked).some((name) => /^\.amalgm-apply-/.test(name)),
+    false,
+  );
+  assert.doesNotMatch(
+    await git(linked, 'ls-files', '--others', '--exclude-standard'),
+    /\.amalgm-apply-/,
+  );
+  const metadataReceipts = path.join(
+    path.dirname(await gitPath(linked, 'index')),
+    'amalgm-metadata-apply',
+  );
+  assert.equal(
+    fs.existsSync(metadataReceipts)
+      && fs.readdirSync(metadataReceipts).some((name) => name.endsWith('.json')),
+    false,
+  );
+  assert.equal(
+    (await git(linked, 'for-each-ref', '--format=%(refname)', 'refs/amalgm/apply')).trim(),
+    '',
+  );
+});
+
 test('a mode-only checkpoint makes the peer working file executable', async () => {
   const { repo, oid } = await makeRepo('materialize-mode');
   fs.chmodSync(path.join(repo, 'a.txt'), 0o755);
   const modePatch = await git(repo, 'diff', 'HEAD', '--binary', '--full-index');
   await git(repo, 'reset', '--hard', 'HEAD');
-  const localCard = card(repo, oid, 1);
+  const tracked = await establishTrackedBaseline(repo, oid, 'materialize_mode');
+  const { localCard, repoKey } = tracked;
   const clean = { revision: null, indexDiff: '', worktreeDiff: '' };
   const executable = {
     revision: revisionOf(oid, '', modePatch),
@@ -551,8 +901,9 @@ test('a mode-only checkpoint makes the peer working file executable', async () =
     worktreeDiff: modePatch,
   };
   const plan = {
-    repoKey: 'root:test',
+    repoKey,
     card: localCard,
+    branches: tracked.baseline.branches,
     transitions: [{
       checkpoint: CHECKPOINT_CONTRACT,
       machine: 'machine-remote',
@@ -578,9 +929,11 @@ test('once local work is on the rail, a later checkpoint replaces it exactly wit
   const localPatch = await patchFor(repo, { 'a.txt': 'local answer\n' });
   const remotePatch = await patchFor(repo, { 'a.txt': 'remote answer\n' });
   const localTransition = transition('machine-local', 2, oid, '', localPatch);
+  const tracked = await establishTrackedBaseline(repo, oid, 'materialize_later_wins');
   const plan = {
-    repoKey: 'root:test',
-    card: card(repo, oid, 1),
+    repoKey: tracked.repoKey,
+    card: tracked.localCard,
+    branches: tracked.baseline.branches,
     transitions: [
       localTransition,
       transition('machine-remote', 3, oid, '', remotePatch),
@@ -589,59 +942,34 @@ test('once local work is on the rail, a later checkpoint replaces it exactly wit
 
   fs.writeFileSync(path.join(repo, 'a.txt'), 'local answer\n');
   await git(repo, 'add', 'a.txt');
-  assert.equal(captureIsOnRail(plan, {
-    baseOid: oid,
-    indexDiff: localPatch,
-    worktreeDiff: '',
-  }), true);
+  const localCard = await captureTrackedIntent(tracked.project, tracked.localCard);
+  const intents = require('../workspace/intent');
+  const reserved = intents.reservePublication(
+    tracked.project,
+    intents.readIntent(tracked.project),
+  );
+  intents.markPublicationFolded(
+    tracked.project,
+    reserved.publication.mutationId,
+    2,
+  );
 
-  const outcome = await materializeRepo(plan.card, plan);
+  const outcome = await materializeRepo(localCard, plan, 3);
   assert.equal(outcome.state, 'in-sync');
   const first = fs.readFileSync(path.join(repo, 'a.txt'), 'utf8');
   assert.equal(first, 'remote answer\n');
 
-  await materializeRepo(plan.card, plan);
+  await materializeRepo(localCard, plan, 3);
   assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), first);
 });
 
-test('a snapshot cannot hide that local work was already numbered', async () => {
-  const { repo, oid } = await makeRepo('materialize-snapshot-ack');
-  const localPatch = await patchFor(repo, { 'a.txt': 'local answer\n' });
-  const remotePatch = await patchFor(repo, { 'a.txt': 'remote answer\n' });
-  const localTransition = transition('machine-local', 2, oid, '', localPatch);
-  const plan = {
-    repoKey: 'root:test',
-    card: card(repo, oid, 1),
-    checkpointBase: {
-      through: 2,
-      baseOid: oid,
-      branch: 'main',
-      value: localTransition.to,
-    },
-    transitions: [transition('machine-remote', 3, oid, localPatch, remotePatch)],
-  };
-  const captured = {
-    baseOid: oid,
-    indexDiff: localPatch,
-    worktreeDiff: '',
-  };
-
-  assert.equal(captureIsOnRail(plan, captured, 'machine-local'), false);
-  assert.equal(captureIsOnRail(plan, captured, 'machine-local', {
-    ...localTransition,
-    mutationId: 'mut_local_numbered',
-    version: 2,
-  }), true);
-});
-
 test('a writer publishing again cannot erase its earlier uncommitted work', async () => {
   const { repo, oid } = await makeRepo('checkpoint-history');
   const patchA = await patchFor(repo, { 'a.txt': 'a1\n' });
   const patchAB = await patchFor(repo, { 'a.txt': 'a1\n', 'b.txt': 'b1\n' });
   const patchABC = await patchFor(repo, {
-    'a.txt': 'a1\n',
+    'a.txt': 'a2\n',
     'b.txt': 'b1\n',
-    'c.txt': 'c1\n',
   });
   const machineA = card('/machine-a', oid, 1);
   machineA.machine = 'machine-a';
@@ -660,176 +988,88 @@ test('a writer publishing again cannot erase its earlier uncommitted work', asyn
     { machine: 'machine-b', cards: [machineB] },
   ]).get('root:test');
   assert.deepEqual(plan.transitions.map((item) => item.version), [2, 3, 4]);
+  const tracked = await establishTrackedBaseline(repo, oid, 'checkpoint_history');
+  plan.repoKey = tracked.repoKey;
+  plan.card = tracked.localCard;
+  plan.branches = tracked.baseline.branches;
 
-  const outcome = await materializeRepo(card(repo, oid, 1), plan);
+  const outcome = await materializeRepo(tracked.localCard, plan, 4);
   assert.equal(outcome.state, 'in-sync');
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a1\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a2\n');
   assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'b1\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'c.txt'), 'utf8'), 'c1\n');
 });
 
-test('a losing commit is archived, the winning card lands exactly, and later dirty work stays', async () => {
-  const { repo, oid: baseOid } = await makeRepo('simultaneous-commit');
-  fs.writeFileSync(path.join(repo, 'local-commit.txt'), 'losing commit work\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'local losing commit');
-  const losingOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-
-  await git(repo, 'switch', '--detach', baseOid);
-  fs.writeFileSync(path.join(repo, 'winner.txt'), 'winning commit work\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'remote winning commit');
-  const winningOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '-C', 'main', losingOid);
-  fs.writeFileSync(path.join(repo, 'local-dirty.txt'), 'also uncommitted\n');
+test('without verified provenance a later official card cannot overwrite unknown local bytes', async () => {
+  const rootCommit = 'unrelated-card-history';
+  const repoKey = `root:${rootCommit}`;
+  const { repo, oid: oldOid } = await makeRepo(rootCommit);
+  await git(repo, 'switch', '--orphan', 'winner');
+  fs.rmSync(path.join(repo, 'a.txt'), { force: true });
+  fs.rmSync(path.join(repo, 'b.txt'), { force: true });
+  fs.writeFileSync(path.join(repo, 'official.txt'), 'later official history\n');
+  await git(repo, 'add', '-A');
+  await git(repo, 'commit', '-m', 'unrelated official root');
+  const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', 'main');
+  fs.writeFileSync(path.join(repo, 'local.txt'), 'pending local bytes\n');
 
-  const localCard = card(repo, losingOid, 1);
-  const winningCard = {
+  const localCard = {
+    ...card(repo, oldOid, 1),
+    repo: { rootCommit, remote: null },
+  };
+  const targetCard = {
     ...localCard,
-    head: { branch: 'main', oid: winningOid, detached: false },
+    head: { branch: 'main', oid: targetOid, detached: false },
     positionVersion: 2,
-    positionMutationId: 'mut_card_winner_0001',
+    positionMutationId: 'mut_unrelated_card',
   };
   const outcome = await materializeRepo(localCard, {
-    repoKey: 'root:test',
-    card: winningCard,
-    transitions: [],
-    parked: [],
-  });
-
-  assert.equal(outcome.state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), winningOid);
-  assert.equal((await git(repo, 'rev-parse', `refs/amalgm/parked/${losingOid}`)).trim(), losingOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'winner.txt'), 'utf8'), 'winning commit work\n');
-  assert.equal(fs.existsSync(path.join(repo, 'local-commit.txt')), false);
-  assert.equal(fs.readFileSync(path.join(repo, 'local-dirty.txt'), 'utf8'), 'also uncommitted\n');
-  assert.equal((await git(repo, 'status', '--porcelain')).trim().length > 0, true);
-  assert.deepEqual(readRepoState('root:test').parked.map((entry) => entry.oid), [losingOid]);
-
-  const sharedParked = readRepoState('root:test').parked.map((entry) => ({
-    ...entry,
-    version: 2,
-  }));
-  await materializeRepo(card(repo, winningOid, 2), {
-    repoKey: 'root:test',
-    card: winningCard,
-    transitions: [],
-    parked: sharedParked,
-  });
-  assert.equal(fs.existsSync(path.join(repo, 'local-commit.txt')), false);
-  assert.equal(fs.readFileSync(path.join(repo, 'local-dirty.txt'), 'utf8'), 'also uncommitted\n');
-
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'commit later dirty work');
-  const nextOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  const nextCard = card(repo, nextOid, 3);
-  const advanced = await materializeRepo(nextCard, {
-    repoKey: 'root:test',
-    card: nextCard,
-    transitions: [],
-    parked: [],
-  });
-
-  assert.equal(advanced.state, 'in-sync');
-  assert.deepEqual(readRepoState('root:test').parked, []);
-  await assert.rejects(
-    git(repo, 'rev-parse', '--verify', `refs/amalgm/parked/${losingOid}`),
-  );
-});
-
-test('rail-parked peer commits are archived without changing the winning card tree', async () => {
-  const { repo, oid: baseOid } = await makeRepo('peer-parked-commits');
-
-  await git(repo, 'switch', '-c', 'winner');
-  fs.writeFileSync(path.join(repo, 'winner.txt'), 'winning card\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'winning card');
-  const winningOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-
-  await git(repo, 'switch', '-C', 'loser-a', baseOid);
-  fs.writeFileSync(path.join(repo, 'loser-a.txt'), 'first losing commit\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'first losing commit');
-  const losingAOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-
-  await git(repo, 'switch', '-C', 'loser-b', baseOid);
-  fs.writeFileSync(path.join(repo, 'loser-b.txt'), 'second losing commit\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'second losing commit');
-  const losingBOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-
-  await git(repo, 'switch', '-C', 'main', winningOid);
-  const winningCard = card(repo, winningOid, 4);
-  const outcome = await materializeRepo(winningCard, {
-    repoKey: 'root:test',
-    card: winningCard,
+    repoKey,
+    card: targetCard,
     transitions: [],
-    parked: [
-      { oid: losingAOid, version: 2 },
-      { oid: losingBOid, version: 3 },
-    ],
-  });
+    branches: [{ name: 'main', oid: targetOid, version: 2 }],
+  }, 2);
 
-  assert.equal(outcome.state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), winningOid);
-  assert.equal((await git(repo, 'diff', '--cached', '--name-only')).trim(), '');
-  assert.equal((await git(repo, 'diff', '--name-only')).trim(), '');
-  assert.equal(fs.existsSync(path.join(repo, 'loser-a.txt')), false);
-  assert.equal(fs.existsSync(path.join(repo, 'loser-b.txt')), false);
-  assert.equal((await git(repo, 'rev-parse', `refs/amalgm/parked/${losingAOid}`)).trim(), losingAOid);
-  assert.equal((await git(repo, 'rev-parse', `refs/amalgm/parked/${losingBOid}`)).trim(), losingBOid);
+  assert.deepEqual(outcome, { state: 'waiting', reason: 'unknown-local-state' });
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), oldOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'local.txt'), 'utf8'), 'pending local bytes\n');
+  assert.equal(fs.existsSync(path.join(repo, 'official.txt')), false);
 });
 
-test('a local losing commit stays pending while a peer parked bundle is missing', async () => {
-  const { repo, oid: baseOid } = await makeRepo('parked-while-peer-bundle-waits');
-
-  await git(repo, 'switch', '-c', 'winner');
-  fs.writeFileSync(path.join(repo, 'winner.txt'), 'winning card\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'winning card');
-  const winningOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-
-  await git(repo, 'switch', '-C', 'main', baseOid);
-  fs.writeFileSync(path.join(repo, 'local-loser.txt'), 'local losing commit\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'local losing commit');
-  const losingOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+test('missing provenance never authorizes replacing a clean unnumbered commit', async () => {
+  const { repo, oid } = await makeRepo('unknown-clean-commit');
+  const tracked = await establishTrackedBaseline(repo, oid, 'unknown_clean_commit');
+  fs.rmSync(reducerStateFile(tracked.repoKey), { force: true });
 
-  const localCard = card(repo, losingOid, 1);
-  const winningCard = {
-    ...localCard,
-    head: { branch: 'main', oid: winningOid, detached: false },
-    positionVersion: 2,
-    positionMutationId: 'mut_card_winner_waiting',
-  };
-  const peerOid = 'f'.repeat(40);
-  const plan = {
-    repoKey: 'root:test',
-    card: winningCard,
-    transitions: [],
-    parked: [{ oid: peerOid, version: 3 }],
-  };
+  fs.writeFileSync(path.join(repo, 'local-commit.txt'), 'not on the rail\n');
+  await git(repo, 'add', 'local-commit.txt');
+  await git(repo, 'commit', '-m', 'local unnumbered commit');
+  const localOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  const current = await observedCard(tracked.localCard);
 
-  const first = await materializeRepo(localCard, plan, 3);
-  assert.equal(first.state, 'waiting');
-  assert.equal(first.reason, 'parked-objects-missing');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), winningOid);
-  assert.equal((await git(repo, 'rev-parse', `refs/amalgm/parked/${losingOid}`)).trim(), losingOid);
   assert.deepEqual(
-    readRepoState('root:test').parked.map((entry) => entry.oid).sort(),
-    [losingOid, peerOid].sort(),
+    await materializeRepo(current, tracked.baseline, 1),
+    { state: 'waiting', reason: 'unknown-local-state' },
   );
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'local-commit.txt'), 'utf8'), 'not on the rail\n');
+});
 
-  const second = await materializeRepo(card(repo, winningOid, 2), plan, 3);
-  assert.equal(second.state, 'waiting');
-  assert.equal((await git(repo, 'rev-parse', `refs/amalgm/parked/${losingOid}`)).trim(), losingOid);
+test('missing provenance never authorizes replacing a branch-only local change', async () => {
+  const { repo, oid } = await makeRepo('unknown-local-branch');
+  const tracked = await establishTrackedBaseline(repo, oid, 'unknown_local_branch');
+  fs.rmSync(reducerStateFile(tracked.repoKey), { force: true });
+
+  await git(repo, 'branch', 'local-only');
+  const current = await observedCard(tracked.localCard);
   assert.deepEqual(
-    readRepoState('root:test').parked.map((entry) => entry.oid).sort(),
-    [losingOid, peerOid].sort(),
+    await materializeRepo(current, tracked.baseline, 1),
+    { state: 'waiting', reason: 'unknown-local-state' },
   );
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/local-only')).trim(), oid);
 });
 
-test('a local commit made after the verified card snapshot is never parked or overwritten', async () => {
+test('a local commit made after the verified card snapshot is never overwritten', async () => {
   const { repo, oid: baseOid } = await makeRepo('card-snapshot-race');
   const verifiedCard = card(repo, baseOid, 1);
 
@@ -854,30 +1094,321 @@ test('a local commit made after the verified card snapshot is never parked or ov
       positionMutationId: 'mut_card_snapshot_race',
     },
     transitions: [],
-    parked: [],
   });
 
   assert.equal(outcome.state, 'waiting');
-  assert.equal(outcome.reason, 'local-card-changed-after-verification');
+  assert.equal(outcome.reason, 'unknown-local-state');
   assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), lateLocalOid);
-  await assert.rejects(
-    git(repo, 'rev-parse', `refs/amalgm/parked/${lateLocalOid}`),
-  );
 });
 
-test('a pending descendant commit catches up without becoming a losing commit', async () => {
+test('a local file write racing ordered apply waits, retries, and remains pending', async () => {
+  const { repo, oid } = await makeRepo('checkpoint-local-writer-race');
+  const tracked = await establishTrackedBaseline(repo, oid, 'checkpoint_local_writer_race');
+  const { localCard, baseline } = tracked;
+
+  const inbound = await patchFor(repo, { 'a.txt': 'official inbound\n' });
+  const plan = {
+    ...baseline,
+    transitions: [transition('machine-remote', 2, oid, '', inbound)],
+  };
+  const transitions = require('../workspace/transition');
+  const applyFiles = transitions.applyFiles;
+  let raced = false;
+  transitions.applyFiles = async (...args) => {
+    if (!raced) {
+      raced = true;
+      fs.writeFileSync(path.join(repo, 'a.txt'), 'pending local writer\n');
+    }
+    return applyFiles(...args);
+  };
+  let first;
+  try {
+    first = await materializeRepo(localCard, plan, 2);
+  } finally {
+    transitions.applyFiles = applyFiles;
+  }
+
+  assert.deepEqual(first, { state: 'waiting', reason: 'local-state-moving' });
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'pending local writer\n');
+  assert.equal(readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough, 1);
+
+  const recovered = await materializeRepo(localCard, plan, 2);
+  assert.equal(recovered.state, 'in-sync', JSON.stringify(recovered));
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'pending local writer\n');
+  const state = readRepoState(tracked.repoKey, tracked.project.resourceId);
+  assert.equal(state.appliedThrough, 2);
+  assert.equal(Object.hasOwn(state, 'pendingCheckpoint'), false);
+  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
+});
+
+test('restart resumes a card apply before advancing and preserves downtime writes', async () => {
+  const { repo, oid: baseOid } = await makeRepo('crash-safe-card-apply');
+  await git(repo, 'switch', '-c', 'incoming');
+  fs.writeFileSync(path.join(repo, 'remote.txt'), 'official target\n');
+  await git(repo, 'add', 'remote.txt');
+  await git(repo, 'commit', '-m', 'official target');
+  const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '-C', 'main', baseOid);
+  const tracked = await establishTrackedBaseline(repo, baseOid, 'crash_safe_card_apply');
+
+  fs.writeFileSync(path.join(repo, 'a.txt'), 'staged before crash\n');
+  await git(repo, 'add', 'a.txt');
+  fs.writeFileSync(path.join(repo, 'b.txt'), 'working before crash\n');
+  fs.writeFileSync(path.join(repo, 'local.txt'), 'untracked before crash\n');
+
+  const repoKey = tracked.repoKey;
+  const localCard = {
+    ...await captureTrackedIntent(tracked.project, tracked.localCard),
+    repo: { rootCommit: 'crash-safe-card-apply', remote: null },
+  };
+  const targetCard = {
+    ...localCard,
+    head: { branch: 'main', oid: targetOid, detached: false },
+    positionVersion: 2,
+    positionMutationId: 'mut_crash_safe_card',
+  };
+  const plan = {
+    repoKey,
+    card: targetCard,
+    transitions: [],
+    branches: [{ name: 'main', oid: targetOid, version: 2 }],
+  };
+
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  transitions.updateBranchRefs = async (...args) => {
+    await updateBranchRefs(...args);
+    throw new Error('simulated process death after HEAD movement');
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(localCard, plan, 2),
+      /simulated process death/,
+    );
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), targetOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'staged before crash\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'working before crash\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'local.txt'), 'utf8'), 'untracked before crash\n');
+  assert.equal(fs.existsSync(path.join(repo, 'remote.txt')), false);
+  assert.equal(readRepoState(repoKey, tracked.project.resourceId).appliedThrough, 1);
+  assert.equal(readRepoState(repoKey, tracked.project.resourceId).applying.contract, 'repo-apply@4');
+
+  fs.writeFileSync(path.join(repo, 'b.txt'), 'written while reducer was down\n');
+  fs.writeFileSync(path.join(repo, 'downtime.txt'), 'new while reducer was down\n');
+
+  const recovered = await materializeRepo({
+    ...localCard,
+    head: { branch: 'main', oid: targetOid, detached: false },
+    positionVersion: 2,
+    repo: { rootCommit: 'crash-safe-card-apply', remote: null },
+  }, plan, 2);
+  assert.equal(recovered.state, 'in-sync', JSON.stringify(recovered));
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), targetOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'remote.txt'), 'utf8'), 'official target\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'staged before crash\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'written while reducer was down\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'local.txt'), 'utf8'), 'untracked before crash\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'downtime.txt'), 'utf8'), 'new while reducer was down\n');
+  assert.match(await git(repo, 'diff', '--cached', '--name-only'), /a\.txt/);
+  assert.equal(readRepoState(repoKey, tracked.project.resourceId).appliedThrough, 2);
+  assert.equal(readRepoState(repoKey, tracked.project.resourceId).applying, undefined);
+});
+
+test('card apply replay is idempotent after file and index boundaries', async () => {
+  for (const boundary of ['files', 'index']) {
+    const rootCommit = `card-boundary-${boundary}`;
+    const repoKey = `root:${rootCommit}`;
+    const { repo, oid: baseOid } = await makeRepo(rootCommit);
+    await git(repo, 'switch', '-c', 'incoming');
+    fs.writeFileSync(path.join(repo, 'remote.txt'), `official ${boundary}\n`);
+    await git(repo, 'add', 'remote.txt');
+    await git(repo, 'commit', '-m', `official ${boundary}`);
+    const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+    await git(repo, 'switch', '-C', 'main', baseOid);
+    const tracked = await establishTrackedBaseline(repo, baseOid, `card_boundary_${boundary}`);
+    fs.writeFileSync(path.join(repo, 'a.txt'), `staged ${boundary}\n`);
+    await git(repo, 'add', 'a.txt');
+    fs.writeFileSync(path.join(repo, 'b.txt'), `working ${boundary}\n`);
+
+    const localCard = {
+      ...await captureTrackedIntent(tracked.project, tracked.localCard),
+      repo: { rootCommit, remote: null },
+    };
+    const targetCard = {
+      ...localCard,
+      head: { branch: 'main', oid: targetOid, detached: false },
+      positionVersion: 2,
+      positionMutationId: `mut_card_boundary_${boundary}`,
+    };
+    const plan = {
+      repoKey: tracked.repoKey,
+      card: targetCard,
+      transitions: [],
+      branches: [{ name: 'main', oid: targetOid, version: 2 }],
+    };
+
+    const transitions = require('../workspace/transition');
+    const mergeModule = require('../workspace/merge');
+    const original = boundary === 'files'
+      ? mergeModule.advance
+      : transitions.applyIndexPatch;
+    let tripped = false;
+    if (boundary === 'files') {
+      mergeModule.advance = async (...args) => {
+        const result = await original(...args);
+        if (!tripped && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
+          tripped = true;
+          throw new Error('simulated process death after files');
+        }
+        return result;
+      };
+    } else {
+      transitions.applyIndexPatch = async (...args) => {
+        const result = await original(...args);
+        if (!tripped) {
+          tripped = true;
+          throw new Error('simulated process death after index');
+        }
+        return result;
+      };
+    }
+    try {
+      await assert.rejects(
+        materializeRepo(localCard, plan, 2),
+        /simulated process death/,
+      );
+    } finally {
+      if (boundary === 'files') mergeModule.advance = original;
+      else transitions.applyIndexPatch = original;
+    }
+
+    assert.equal(
+      readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough,
+      1,
+    );
+    fs.writeFileSync(path.join(repo, 'b.txt'), `downtime ${boundary}\n`);
+    const recovered = await materializeRepo({
+      ...localCard,
+      head: { branch: 'main', oid: targetOid, detached: false },
+      positionVersion: 2,
+      repo: { rootCommit, remote: null },
+    }, plan, 2);
+    assert.equal(recovered.state, 'in-sync');
+    assert.equal(fs.readFileSync(path.join(repo, 'remote.txt'), 'utf8'), `official ${boundary}\n`);
+    assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), `staged ${boundary}\n`);
+    assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), `downtime ${boundary}\n`);
+    assert.equal(readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough, 2);
+    assert.equal(readRepoState(tracked.repoKey, tracked.project.resourceId).applying, undefined);
+  }
+});
+
+test('a downtime commit stays pending while recovery finishes N before newer N+1', async () => {
+  const rootCommit = 'card-recovery-newer-rail';
+  const repoKey = `root:${rootCommit}`;
+  const { repo, oid: baseOid } = await makeRepo(rootCommit);
+  await git(repo, 'switch', '-c', 'incoming');
+  fs.writeFileSync(path.join(repo, 'official-n.txt'), 'official N\n');
+  await git(repo, 'add', 'official-n.txt');
+  await git(repo, 'commit', '-m', 'official N');
+  const targetN = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  fs.writeFileSync(path.join(repo, 'official-n-plus-one.txt'), 'official N+1\n');
+  await git(repo, 'add', 'official-n-plus-one.txt');
+  await git(repo, 'commit', '-m', 'official N+1');
+  const targetN1 = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '-C', 'main', baseOid);
+  const tracked = await establishTrackedBaseline(repo, baseOid, 'card_recovery_newer_rail');
+  fs.writeFileSync(path.join(repo, 'before-crash.txt'), 'local before crash\n');
+
+  const localCard = {
+    ...await captureTrackedIntent(tracked.project, tracked.localCard),
+    repo: { rootCommit, remote: null },
+  };
+  const cardN = {
+    ...localCard,
+    head: { branch: 'main', oid: targetN, detached: false },
+    positionVersion: 2,
+    positionMutationId: 'mut_card_recovery_n',
+  };
+  const planN = {
+    repoKey: tracked.repoKey,
+    card: cardN,
+    transitions: [],
+    branches: [{ name: 'main', oid: targetN, version: 2 }],
+  };
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  transitions.updateBranchRefs = async (...args) => {
+    await updateBranchRefs(...args);
+    throw new Error('simulated process death before N finished');
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(localCard, planN, 2),
+      /simulated process death/,
+    );
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+
+  fs.writeFileSync(path.join(repo, 'downtime-commit.txt'), 'committed while down\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'local commit while reducer is down');
+  const pendingOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+
+  const cardN1 = {
+    ...cardN,
+    head: { branch: 'main', oid: targetN1, detached: false },
+    positionVersion: 3,
+    positionMutationId: 'mut_card_recovery_n_plus_one',
+  };
+  const latest = {
+    repoKey: tracked.repoKey,
+    card: cardN1,
+    transitions: [],
+    branches: [{ name: 'main', oid: targetN1, version: 3 }],
+  };
+  const recovered = await materializeRepo({
+    ...localCard,
+    head: { branch: 'main', oid: pendingOid, detached: false },
+    positionVersion: null,
+    positionMutationId: null,
+  }, latest, 3);
+
+  assert.equal(recovered.state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), pendingOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'downtime-commit.txt'), 'utf8'), 'committed while down\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'before-crash.txt'), 'utf8'), 'local before crash\n');
+  assert.equal(
+    fs.readFileSync(path.join(repo, 'official-n-plus-one.txt'), 'utf8'),
+    'official N+1\n',
+  );
+  const state = readRepoState(tracked.repoKey, tracked.project.resourceId);
+  assert.equal(state.appliedThrough, 3);
+  assert.equal(Object.hasOwn(state, 'pendingCard'), false);
+  assert.equal(
+    require('../workspace/intent').readOwnedIntent(tracked.project).local.card.head.oid,
+    pendingOid,
+  );
+  assert.equal(state.applying, undefined);
+});
+
+test('a pending descendant commit catches up without becoming a losing commit', async () => {
   const { repo, oid: baseOid } = await makeRepo('pending-descendant-card');
   const firstPatch = await patchFor(repo, { 'a.txt': 'before commit\n' });
   const secondPatch = await patchFor(repo, {
     'a.txt': 'before commit\n',
     'b.txt': 'after commit\n',
   });
-  const winningCard = card(repo, baseOid, 1);
+  const tracked = await establishTrackedBaseline(repo, baseOid, 'pending_descendant_card');
+  const winningCard = tracked.localCard;
   const before = {
-    repoKey: 'root:test',
+    repoKey: tracked.repoKey,
     card: winningCard,
     transitions: [transition('machine-peer', 2, baseOid, '', firstPatch)],
-    parked: [],
   };
 
   await materializeRepo(winningCard, before, 2);
@@ -885,7 +1416,7 @@ test('a pending descendant commit catches up without becoming a losing commit',
   await git(repo, 'commit', '-m', 'local pending card');
   const pendingOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
 
-  const pendingCard = card(repo, pendingOid, null);
+  const pendingCard = await captureTrackedIntent(tracked.project, winningCard);
   const caughtUp = await materializeRepo(pendingCard, {
     ...before,
     transitions: [
@@ -901,13 +1432,55 @@ test('a pending descendant commit catches up without becoming a losing commit',
   const staged = (await git(repo, 'diff', '--cached', '--name-only')).trim();
   const status = (await git(repo, 'status', '--short')).trim();
   assert.equal(staged, 'b.txt', status);
-  await assert.rejects(
-    git(repo, 'rev-parse', `refs/amalgm/parked/${pendingOid}`),
-  );
-  const state = readRepoState('root:test');
-  assert.equal(state.baseOid, pendingOid);
+  const state = readRepoState(tracked.repoKey, tracked.project.resourceId);
+  assert.equal(state.baseOid, baseOid);
   assert.equal(state.appliedThrough, 3);
-  assert.equal(state.cardVersion, null);
+  assert.equal(
+    require('../workspace/intent').readOwnedIntent(tracked.project).local.card.head.oid,
+    pendingOid,
+  );
+});
+
+test('a pending divergent commit is local intent, not a losing numbered card', async () => {
+  const { repo, oid: baseOid } = await makeRepo('pending-divergent-card');
+  const tracked = await establishTrackedBaseline(repo, baseOid, 'pending_divergent_card');
+  const { repoKey, localCard: baseCard } = tracked;
+
+  await git(repo, 'switch', '-c', 'peer', baseOid);
+  fs.writeFileSync(path.join(repo, 'peer.txt'), 'peer\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'peer card');
+  const peerOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+
+  await git(repo, 'switch', '-C', 'main', baseOid);
+  fs.writeFileSync(path.join(repo, 'local.txt'), 'local\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'local card while behind');
+  const localOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  const localCard = await captureTrackedIntent(tracked.project, baseCard);
+  const birthMutationId = require('../workspace/intent')
+    .readOwnedIntent(tracked.project).birthMutationId;
+  const outcome = await materializeRepo(localCard, {
+    repoKey,
+    card: {
+      ...baseCard,
+      head: { branch: 'main', oid: peerOid, detached: false },
+      positionVersion: 2,
+      positionMutationId: 'mut_peer_card_0001',
+    },
+    transitions: [],
+    branches: [{ name: 'main', oid: peerOid, version: 2 }],
+  }, 2);
+
+  assert.equal(outcome.state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'local.txt'), 'utf8'), 'local\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'peer.txt'), 'utf8'), 'peer\n');
+  const pending = require('../workspace/intent').readOwnedIntent(tracked.project);
+  assert.equal(pending.local.card.head.branch, 'main');
+  assert.equal(pending.local.card.head.oid, localOid);
+  assert.equal(pending.base.through, 2);
+  assert.equal(pending.birthMutationId, birthMutationId);
 });
 
 test('an empty index advance cannot overwrite a commit that just finished', async () => {
@@ -925,19 +1498,24 @@ test('an empty index advance cannot overwrite a commit that just finished', asyn
   assert.equal((await git(repo, 'status', '--porcelain')).trim(), '');
 });
 
-test('an index advance preserves unrelated work staged by another writer', async () => {
+test('an index advance stops before touching unrelated work staged after its seal', async () => {
   const { repo } = await makeRepo('index-writers');
+  const operation = '8'.repeat(64);
   const observedIndex = (await git(repo, 'write-tree')).trim();
   const peerPatch = await patchFor(repo, { 'b.txt': 'peer\n' });
   const peerTree = await require('../workspace/merge').treeOfPatch(repo, 'HEAD', peerPatch);
 
   fs.writeFileSync(path.join(repo, 'a.txt'), 'local\n');
   await git(repo, 'add', 'a.txt');
-  const outcome = await advanceIndex(repo, observedIndex, peerTree);
+  const outcome = await advanceIndex(repo, observedIndex, peerTree, operation);
 
-  assert.deepEqual(outcome, { state: 'ready', moved: true });
+  assert.deepEqual(outcome, {
+    state: 'waiting',
+    reason: 'local-index-moving',
+    moved: false,
+  });
   const staged = await git(repo, 'diff', '--cached', '--name-only');
-  assert.deepEqual(staged.trim().split('\n').sort(), ['a.txt', 'b.txt']);
+  assert.deepEqual(staged.trim().split('\n'), ['a.txt']);
 });
 
 test('a new card includes checkpoint work already on the rail instead of replaying it as local work', async () => {
@@ -951,16 +1529,18 @@ test('a new card includes checkpoint work already on the rail instead of replayi
   const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
   await git(repo, 'switch', 'main');
 
-  const oldCard = card(repo, baseOid, 1);
+  const tracked = await establishTrackedBaseline(repo, baseOid, 'card_folds_shared_checkpoint');
+  const oldCard = tracked.localCard;
   await materializeRepo(oldCard, {
-    repoKey: 'root:test',
+    repoKey: tracked.repoKey,
     card: oldCard,
     transitions: [transition('machine-remote', 2, baseOid, '', sharedPatch)],
-  });
+    branches: tracked.baseline.branches,
+  }, 2);
   assert.notEqual((await git(repo, 'status', '--porcelain')).trim(), '');
 
   const outcome = await materializeRepo(oldCard, {
-    repoKey: 'root:test',
+    repoKey: tracked.repoKey,
     card: {
       ...oldCard,
       head: { branch: 'main', oid: targetOid, detached: false },
@@ -968,9 +1548,9 @@ test('a new card includes checkpoint work already on the rail instead of replayi
       positionMutationId: 'mut_card_shared_fold',
     },
     transitions: [],
-    parked: [],
-  });
-  assert.equal(outcome.state, 'in-sync');
+    branches: [{ name: 'main', oid: targetOid, version: 3 }],
+  }, 3);
+  assert.equal(outcome.state, 'in-sync', outcome.reason);
   assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), targetOid);
   assert.equal((await git(repo, 'status', '--porcelain')).trim(), '');
 });
@@ -983,12 +1563,13 @@ test('checkpoint then commit advances through the same card movement and unrelat
   await git(repo, 'commit', '-m', 'commit checkpointed work');
   const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
   await git(repo, 'switch', '-C', 'main', baseOid);
+  const tracked = await establishTrackedBaseline(repo, baseOid, 'checkpoint_commit_fold');
 
   fs.writeFileSync(path.join(repo, 'shared.txt'), 'already checkpointed\n');
   fs.writeFileSync(path.join(repo, 'local-only.txt'), 'keep me dirty\n');
-  const localCard = card(repo, baseOid, 1);
+  const localCard = await captureTrackedIntent(tracked.project, tracked.localCard);
   const outcome = await materializeRepo(localCard, {
-    repoKey: 'root:test',
+    repoKey: tracked.repoKey,
     card: {
       ...localCard,
       head: { branch: 'main', oid: targetOid, detached: false },
@@ -996,11 +1577,10 @@ test('checkpoint then commit advances through the same card movement and unrelat
       positionMutationId: 'mut_card_fold_00001',
     },
     transitions: [],
-    parked: [],
     branches: [{ name: 'main', oid: targetOid, version: 2 }],
   });
 
-  assert.equal(outcome.state, 'in-sync');
+  assert.equal(outcome.state, 'in-sync', outcome.reason);
   assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), targetOid);
   assert.equal(fs.readFileSync(path.join(repo, 'shared.txt'), 'utf8'), 'already checkpointed\n');
   assert.equal(fs.readFileSync(path.join(repo, 'local-only.txt'), 'utf8'), 'keep me dirty\n');
@@ -1017,18 +1597,18 @@ test('the materializer creates, moves, and deletes branch refs without checking
   await git(repo, 'switch', 'main');
   await git(repo, 'branch', '-D', 'feature');
 
-  const localCard = card(repo, oid, 1);
+  const tracked = await establishTrackedBaseline(repo, oid, 'branches');
+  const { localCard, repoKey } = tracked;
   const createdPlan = {
-    repoKey: 'root:test',
+    repoKey,
     card: localCard,
     transitions: [],
-    parked: [],
     branches: [
       { name: 'main', oid, version: 1 },
       { name: 'feature', oid: featureOid, version: 2 },
     ],
   };
-  await materializeRepo(localCard, createdPlan);
+  await materializeRepo(localCard, createdPlan, 2);
   assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureOid);
   assert.equal((await git(repo, 'branch', '--show-current')).trim(), 'main');
 
@@ -1038,12 +1618,12 @@ test('the materializer creates, moves, and deletes branch refs without checking
       { name: 'main', oid, version: 1 },
       { name: 'feature', oid: null, version: 3 },
     ],
-  });
+  }, 3);
   await assert.rejects(() => git(repo, 'rev-parse', 'refs/heads/feature'));
   assert.equal((await git(repo, 'branch', '--show-current')).trim(), 'main');
 });
 
-test('a branch event is not applied until its commit is available', async () => {
+test('an official branch without a complete object source is terminal corruption', async () => {
   const { repo, oid } = await makeRepo('branch-event-waits');
   const peer = path.join(tempRoot, 'branch-event-waits-peer');
   await git(tempRoot, 'clone', '--quiet', repo, peer);
@@ -1053,25 +1633,23 @@ test('a branch event is not applied until its commit is available', async () =>
   await git(peer, 'commit', '-m', 'feature');
   const featureOid = (await git(peer, 'rev-parse', 'HEAD')).trim();
 
-  const repoKey = 'root:branch-event-waits';
-  const localCard = card(repo, oid, 1);
+  const tracked = await establishTrackedBaseline(repo, oid, 'branch_event_waits');
+  const { repoKey, localCard } = tracked;
   const plan = {
     repoKey,
     card: localCard,
     transitions: [],
-    parked: [],
     branches: [
       { name: 'main', oid, version: 1 },
       { name: 'feature', oid: featureOid, version: 2 },
     ],
   };
 
-  const waiting = await materializeRepo(localCard, plan, 2);
-  assert.deepEqual(waiting, {
-    state: 'waiting',
-    reason: 'branch-objects-missing',
-  });
-  assert.equal(readRepoState(repoKey), null);
+  await assert.rejects(
+    materializeRepo(localCard, plan, 2),
+    /official branch feature has no complete bundle/,
+  );
+  assert.equal(readRepoState(repoKey).appliedThrough, 1);
   await assert.rejects(() => git(repo, 'rev-parse', 'refs/heads/feature'));
 
   await git(repo, 'fetch', '--quiet', peer, 'feature:refs/amalgm-test/feature');
@@ -1081,6 +1659,40 @@ test('a branch event is not applied until its commit is available', async () =>
   assert.equal(readRepoState(repoKey).appliedThrough, 2);
 });
 
+test('a malformed earlier checkpoint prevents a later ready branch from applying', async () => {
+  const { repo, oid } = await makeRepo('checkpoint-before-branch');
+  await git(repo, 'switch', '-c', 'feature');
+  fs.writeFileSync(path.join(repo, 'feature.txt'), 'feature\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'feature');
+  const featureOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', 'main');
+  await git(repo, 'branch', '-D', 'feature');
+
+  const missing = transition('machine-peer', 2, oid, '', '');
+  missing.from = {
+    revision: 'a'.repeat(64),
+    payload: { kind: 'pending', contract: 'opaque-chunks@2', checksum: 'b'.repeat(64) },
+  };
+  missing.to = missing.from;
+  const repoKey = 'root:checkpoint-before-branch';
+  const localCard = card(repo, oid, 1);
+  await assert.rejects(
+    materializeRepo(localCard, {
+      repoKey,
+      card: localCard,
+      transitions: [missing],
+      branches: [
+        { name: 'main', oid, version: 1 },
+        { name: 'feature', oid: featureOid, version: 3 },
+      ],
+    }, 3),
+    /official checkpoint is payload-pending/,
+  );
+  await assert.rejects(() => git(repo, 'rev-parse', 'refs/heads/feature'));
+  assert.equal(readRepoState(repoKey), null);
+});
+
 test('an unpublished local branch delete is not restored while catching up', async () => {
   const { repo, oid } = await makeRepo('pending-branch-delete');
   await git(repo, 'switch', '-c', 'feature');
@@ -1091,27 +1703,162 @@ test('an unpublished local branch delete is not restored while catching up', asy
   await git(repo, 'switch', 'main');
   await git(repo, 'branch', '-D', 'feature');
 
-  const localCard = card(repo, oid, 1);
+  const tracked = await establishTrackedBaseline(repo, oid, 'pending_branch_delete');
+  const localCard = tracked.localCard;
   const plan = {
-    repoKey: 'root:pending-branch-delete',
+    repoKey: tracked.repoKey,
     card: localCard,
     transitions: [],
-    parked: [],
     branches: [
       { name: 'main', oid, version: 1 },
       { name: 'feature', oid: featureOid, version: 2 },
     ],
   };
-  await materializeRepo(localCard, plan);
+  await materializeRepo(localCard, plan, 2);
   assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureOid);
 
   await git(repo, 'branch', '-D', 'feature');
-  await materializeRepo(localCard, plan);
+  const deletedCard = await captureTrackedIntent(tracked.project, localCard);
+  await materializeRepo(deletedCard, plan, 2);
 
   await assert.rejects(() => git(repo, 'rev-parse', 'refs/heads/feature'));
   assert.equal((await git(repo, 'branch', '--show-current')).trim(), 'main');
 });
 
+test('an acknowledged old branch yields to the later official branch and only then advances', async () => {
+  const { repo, oid: baseOid } = await makeRepo('acknowledged-branch-yields');
+  await git(repo, 'switch', '-c', 'value-a');
+  fs.writeFileSync(path.join(repo, 'value.txt'), 'A\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'value A');
+  const oidA = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '-C', 'value-b', baseOid);
+  fs.writeFileSync(path.join(repo, 'value.txt'), 'B\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'value B');
+  const oidB = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', 'main');
+  await git(repo, 'branch', '-D', 'value-a', 'value-b');
+
+  const tracked = await establishTrackedBaseline(repo, baseOid, 'acknowledged_branch_yields');
+  const { repoKey, localCard } = tracked;
+  const officialA = {
+    name: 'storm/rebase',
+    oid: oidA,
+    version: 162,
+    mutationId: 'mut_branch_value_a',
+  };
+  const first = {
+    repoKey,
+    card: localCard,
+    transitions: [],
+    branches: [
+      { name: 'main', oid: baseOid, version: 1 },
+      officialA,
+    ],
+  };
+  assert.equal((await materializeRepo(localCard, first, 162)).state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/storm/rebase')).trim(), oidA);
+
+  const officialB = {
+    name: 'storm/rebase',
+    oid: oidB,
+    version: 168,
+    mutationId: 'mut_branch_value_b',
+  };
+  const later = {
+    ...first,
+    branches: [
+      { name: 'main', oid: baseOid, version: 1 },
+      officialB,
+    ],
+  };
+  const applied = await materializeRepo(localCard, later, 172);
+  assert.equal(applied.state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/storm/rebase')).trim(), oidB);
+  const state = readRepoState(repoKey);
+  assert.equal(state.appliedThrough, 172);
+  assert.equal(Object.hasOwn(state, 'pendingRefs'), false);
+  assert.equal(state.materialized, true);
+  assert.equal(state.expectedPhysicalDigest, state.observedPhysicalDigest);
+
+  const afterRestart = await materializeRepo(localCard, later, 172);
+  assert.equal(afterRestart.state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/storm/rebase')).trim(), oidB);
+});
+
+test('a durable branch intent survives catch-up, then yields after ownership ends', async () => {
+  const { repo, oid: baseOid } = await makeRepo('explicit-pending-branch');
+  const commits = {};
+  for (const valueName of ['a', 'b', 'c', 'd']) {
+    await git(repo, 'switch', '-C', `value-${valueName}`, baseOid);
+    fs.writeFileSync(path.join(repo, 'value.txt'), `${valueName}\n`);
+    await git(repo, 'add', '.');
+    await git(repo, 'commit', '-m', `value ${valueName}`);
+    commits[valueName] = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  }
+  await git(repo, 'switch', 'main');
+  await git(repo, 'branch', '-D', 'value-a', 'value-b', 'value-c', 'value-d');
+
+  const tracked = await establishTrackedBaseline(repo, baseOid, 'explicit_pending_branch');
+  const { repoKey, localCard } = tracked;
+  const ref = (oid, version, machine) => ({
+    name: 'feature',
+    oid,
+    version,
+    mutationId: `mut_${machine}_${version}`,
+  });
+  const officialA = ref(commits.a, 10, 'local');
+  const planA = {
+    repoKey,
+    card: localCard,
+    transitions: [],
+    branches: [
+      { name: 'main', oid: baseOid, version: 1 },
+      officialA,
+    ],
+  };
+  await materializeRepo(localCard, planA, 10);
+  await git(repo, 'update-ref', 'refs/heads/feature', commits.c);
+  const intentCard = await captureTrackedIntent(tracked.project, localCard);
+
+  const officialB = ref(commits.b, 11, 'remote');
+  const planB = {
+    ...planA,
+    branches: [
+      { name: 'main', oid: baseOid, version: 1 },
+      officialB,
+    ],
+  };
+  assert.equal((await materializeRepo(intentCard, planB, 11)).state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), commits.c);
+  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
+
+  const acknowledgedC = ref(commits.c, 12, 'local');
+  const planC = {
+    ...planB,
+    branches: [
+      { name: 'main', oid: baseOid, version: 1 },
+      acknowledgedC,
+    ],
+  };
+  assert.equal((await materializeRepo(localCard, planC, 12)).state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), commits.c);
+  require('../workspace/intent').clearIntent(tracked.project);
+
+  const officialD = ref(commits.d, 13, 'remote');
+  const planD = {
+    ...planC,
+    branches: [
+      { name: 'main', oid: baseOid, version: 1 },
+      officialD,
+    ],
+  };
+  assert.equal((await materializeRepo(localCard, planD, 13)).state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), commits.d);
+  assert.equal(Object.hasOwn(readRepoState(repoKey), 'pendingRefs'), false);
+});
+
 test('a card branch switch follows branch and OID together and leaves the old branch unchanged', async () => {
   const { repo, oid: mainOid } = await makeRepo('card-branch-switch');
   await git(repo, 'checkout', '-b', 'feature');
@@ -1121,12 +1868,13 @@ test('a card branch switch follows branch and OID together and leaves the old br
   const featureOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
   await git(repo, 'checkout', 'main');
 
-  const local = card(repo, mainOid, 1);
+  const tracked = await establishTrackedBaseline(repo, mainOid, 'card_branch_switch');
+  const local = tracked.localCard;
   const winning = card('/peer', featureOid, 2);
   winning.head.branch = 'feature';
   winning.objects = { kind: 'local' };
   const outcome = await materializeRepo(local, {
-    repoKey: 'root:test',
+    repoKey: tracked.repoKey,
     card: winning,
     transitions: [],
     branches: [
@@ -1144,13 +1892,14 @@ test('a card branch switch follows branch and OID together and leaves the old br
 test('a branch-only card change at the same commit still switches the exact branch', async () => {
   const { repo, oid } = await makeRepo('same-oid-branch-switch');
   await git(repo, 'branch', 'feature');
-  const local = card(repo, oid, 1);
+  const tracked = await establishTrackedBaseline(repo, oid, 'same_oid_branch_switch');
+  const local = tracked.localCard;
   const winning = card('/peer', oid, 2);
   winning.head.branch = 'feature';
   winning.objects = { kind: 'local' };
 
   const outcome = await materializeRepo(local, {
-    repoKey: 'root:test',
+    repoKey: tracked.repoKey,
     card: winning,
     transitions: [],
     branches: [
@@ -1162,3 +1911,907 @@ test('a branch-only card change at the same commit still switches the exact bran
   assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
   assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), oid);
 });
+
+async function makePostRefHeadSwitchPlan(rootCommit) {
+  const { repo, oid: sourceOid } = await makeRepo(rootCommit);
+  await git(repo, 'switch', '--detach', sourceOid);
+  fs.writeFileSync(path.join(repo, 'main-target.txt'), 'main target\n');
+  await git(repo, 'add', 'main-target.txt');
+  await git(repo, 'commit', '-m', 'main target');
+  const mainTarget = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '--detach', sourceOid);
+  fs.writeFileSync(path.join(repo, 'feature-target.txt'), 'feature target\n');
+  await git(repo, 'add', 'feature-target.txt');
+  await git(repo, 'commit', '-m', 'feature target');
+  const featureTarget = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '-C', 'main', sourceOid);
+  const tracked = await establishTrackedBaseline(
+    repo,
+    sourceOid,
+    rootCommit.replaceAll('-', '_'),
+  );
+  const winning = {
+    ...tracked.localCard,
+    head: { branch: 'feature', oid: featureTarget, detached: false },
+    positionVersion: 2,
+    positionMutationId: 'mut_post_ref_head_switch',
+  };
+  const plan = {
+    repoKey: tracked.repoKey,
+    card: winning,
+    transitions: [],
+    branches: [
+      {
+        name: 'main',
+        oid: mainTarget,
+        version: 2,
+        mutationId: 'mut_post_ref_main_move',
+      },
+      {
+        name: 'feature',
+        oid: featureTarget,
+        version: 2,
+        mutationId: 'mut_post_ref_feature',
+      },
+    ],
+  };
+  return {
+    repo,
+    sourceOid,
+    mainTarget,
+    featureTarget,
+    tracked,
+    plan,
+  };
+}
+
+test('a branch switch derives HEAD from the sealed post-ref plan when the old branch also moves', async () => {
+  const {
+    repo,
+    mainTarget,
+    featureTarget,
+    tracked,
+    plan,
+  } = await makePostRefHeadSwitchPlan('post-ref-head-switch');
+  const result = await materializeRepo(tracked.localCard, plan, 2);
+  assert.equal(result.state, 'in-sync', result.reason);
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), featureTarget);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), mainTarget);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureTarget);
+  assert.equal(require('../workspace/intent').readOwnedIntent(tracked.project), null);
+});
+
+test('restart recognizes a sealed post-ref HEAD before finishing the branch switch', async () => {
+  const {
+    repo,
+    mainTarget,
+    featureTarget,
+    tracked,
+    plan,
+  } = await makePostRefHeadSwitchPlan('post-ref-head-switch-restart');
+  const transitions = require('../workspace/transition');
+  const moveHeadToCard = transitions.moveHeadToCard;
+  let crashed = false;
+  transitions.moveHeadToCard = async (...args) => {
+    if (!crashed) {
+      crashed = true;
+      assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
+      assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), mainTarget);
+      assert.equal(
+        (await git(repo, 'rev-parse', 'refs/heads/feature')).trim(),
+        featureTarget,
+      );
+      throw new Error('simulated process death after ref batch before HEAD');
+    }
+    return moveHeadToCard(...args);
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death after ref batch before HEAD/,
+    );
+  } finally {
+    transitions.moveHeadToCard = moveHeadToCard;
+  }
+
+  assert.equal(readRepoState(
+    tracked.repoKey,
+    tracked.project.resourceId,
+  ).appliedThrough, 1);
+  const recovered = await materializeRepo(
+    await observedCard(tracked.localCard),
+    plan,
+    2,
+  );
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), featureTarget);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), mainTarget);
+  assert.equal(require('../workspace/intent').readOwnedIntent(tracked.project), null);
+});
+
+test('a source-branch return after the ref receipt remains local during HEAD recovery', async () => {
+  const {
+    repo,
+    sourceOid,
+    mainTarget,
+    tracked,
+    plan,
+  } = await makePostRefHeadSwitchPlan('post-ref-head-switch-aba');
+  const transitions = require('../workspace/transition');
+  const moveHeadToCard = transitions.moveHeadToCard;
+  transitions.moveHeadToCard = async () => {
+    assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), mainTarget);
+    throw new Error('simulated process death before post-ref HEAD attachment');
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death before post-ref HEAD attachment/,
+    );
+  } finally {
+    transitions.moveHeadToCard = moveHeadToCard;
+  }
+
+  await git(repo, 'update-ref', 'refs/heads/main', sourceOid, mainTarget);
+  const recovered = await materializeRepo(
+    await observedCard(tracked.localCard),
+    plan,
+    2,
+  );
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
+  assert.equal(readRepoState(
+    tracked.repoKey,
+    tracked.project.resourceId,
+  ).appliedThrough, 2);
+  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
+});
+
+async function makeCheckedBranchDeletePlan(rootCommit) {
+  const { repo, oid: sourceOid } = await makeRepo(rootCommit);
+  await git(repo, 'switch', '--detach', sourceOid);
+  fs.writeFileSync(path.join(repo, 'feature-target.txt'), 'feature target\n');
+  await git(repo, 'add', 'feature-target.txt');
+  await git(repo, 'commit', '-m', 'feature target');
+  const featureTarget = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '-C', 'main', sourceOid);
+  const tracked = await establishTrackedBaseline(
+    repo,
+    sourceOid,
+    rootCommit.replaceAll('-', '_'),
+  );
+  const winning = {
+    ...tracked.localCard,
+    head: { branch: 'feature', oid: featureTarget, detached: false },
+    positionVersion: 2,
+    positionMutationId: `mut_${rootCommit.replaceAll('-', '_')}`,
+  };
+  return {
+    repo,
+    sourceOid,
+    featureTarget,
+    tracked,
+    plan: {
+      repoKey: tracked.repoKey,
+      card: winning,
+      transitions: [],
+      branches: [{
+        name: 'feature',
+        oid: featureTarget,
+        version: 2,
+        mutationId: `mut_${rootCommit.replaceAll('-', '_')}_feature`,
+      }],
+    },
+  };
+}
+
+test('checked branch deletion waits until HEAD can survive a crash', async () => {
+  const {
+    repo,
+    sourceOid,
+    featureTarget,
+    tracked,
+    plan,
+  } = await makeCheckedBranchDeletePlan('checked-delete-before-head');
+  const transitions = require('../workspace/transition');
+  const moveHeadToCard = transitions.moveHeadToCard;
+  transitions.moveHeadToCard = async () => {
+    assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
+    assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
+    assert.equal(
+      (await git(repo, 'rev-parse', 'refs/heads/main')).trim(),
+      sourceOid,
+      'the checked source ref still exists before HEAD attachment',
+    );
+    throw new Error('simulated process death before checked branch deletion');
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death before checked branch deletion/,
+    );
+  } finally {
+    transitions.moveHeadToCard = moveHeadToCard;
+  }
+
+  const recovered = await materializeRepo(
+    await observedCard(tracked.localCard),
+    plan,
+    2,
+  );
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), featureTarget);
+  await assert.rejects(
+    git(repo, 'rev-parse', '--verify', 'refs/heads/main'),
+    /Needed a single revision|unknown revision|not a valid object name/,
+  );
+  assert.equal(require('../workspace/intent').readOwnedIntent(tracked.project), null);
+});
+
+test('a source ref moved during deferred deletion remains local', async () => {
+  const {
+    repo,
+    sourceOid,
+    tracked,
+    plan,
+  } = await makeCheckedBranchDeletePlan('checked-delete-local-race');
+  const localOid = (
+    await git(repo, 'commit-tree', `${sourceOid}^{tree}`, '-p', sourceOid, '-m', 'local ref')
+  ).trim();
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  let raced = false;
+  transitions.updateBranchRefs = async (root, changes, operation) => {
+    if (
+      !raced
+      && changes.some((change) => (
+        change.branch === 'main'
+        && change.expectedOid === sourceOid
+        && change.oid === null
+      ))
+    ) {
+      raced = true;
+      await git(repo, 'update-ref', 'refs/heads/main', localOid, sourceOid);
+    }
+    return updateBranchRefs(root, changes, operation);
+  };
+  let interrupted;
+  try {
+    interrupted = await materializeRepo(tracked.localCard, plan, 2);
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+  assert.deepEqual(interrupted, {
+    state: 'waiting',
+    reason: 'local-refs-moving',
+  });
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), localOid);
+
+  const recovered = await materializeRepo(
+    await observedCard(tracked.localCard),
+    plan,
+    2,
+  );
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), localOid);
+  assert.equal(readRepoState(
+    tracked.repoKey,
+    tracked.project.resourceId,
+  ).appliedThrough, 2);
+  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
+});
+
+test('a HEAD return before deferred deletion stays attached across restart', async () => {
+  const {
+    repo,
+    sourceOid,
+    featureTarget,
+    tracked,
+    plan,
+  } = await makeCheckedBranchDeletePlan('checked-delete-head-return');
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  let raced = false;
+  transitions.updateBranchRefs = async (root, changes, operation) => {
+    if (
+      !raced
+      && changes.some((change) => (
+        change.branch === 'main'
+        && change.expectedOid === sourceOid
+        && change.oid === null
+      ))
+    ) {
+      raced = true;
+      await git(repo, 'symbolic-ref', 'HEAD', 'refs/heads/main');
+    }
+    return updateBranchRefs(root, changes, operation);
+  };
+  let interrupted;
+  try {
+    interrupted = await materializeRepo(tracked.localCard, plan, 2);
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+  assert.equal(raced, true);
+  assert.deepEqual(interrupted, {
+    state: 'waiting',
+    reason: 'local-refs-moving',
+  });
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), sourceOid);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureTarget);
+
+  let recovered;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    recovered = await materializeRepo(tracked.localCard, plan, 2);
+    if (recovered.state === 'in-sync') break;
+    assert.equal(recovered.state, 'waiting', recovered.reason);
+    assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
+    assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
+  }
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), sourceOid);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureTarget);
+  assert.equal(readRepoState(
+    tracked.repoKey,
+    tracked.project.resourceId,
+  ).appliedThrough, 2);
+  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
+});
+
+test('restart finishes a branch-only official apply before a newer branch event', async () => {
+  const rootCommit = 'branch-only-recovery-newer-rail';
+  const repoKey = `root:${rootCommit}`;
+  const { repo, oid: baseOid } = await makeRepo(rootCommit);
+  const branchOids = {};
+  for (const name of ['a', 'b']) {
+    await git(repo, 'switch', '-C', `source-${name}`, baseOid);
+    fs.writeFileSync(path.join(repo, 'branch-value.txt'), `${name}\n`);
+    await git(repo, 'add', 'branch-value.txt');
+    await git(repo, 'commit', '-m', `branch value ${name}`);
+    branchOids[name] = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  }
+  await git(repo, 'switch', 'main');
+  await git(repo, 'branch', '-D', 'source-a', 'source-b');
+
+  const localCard = {
+    ...card(repo, baseOid, 1),
+    repo: { rootCommit, remote: null },
+  };
+  const baseline = {
+    repoKey,
+    card: localCard,
+    transitions: [],
+    branches: [{ name: 'main', oid: baseOid, version: 1 }],
+  };
+  assert.equal((await materializeRepo(localCard, baseline, 1)).state, 'in-sync');
+
+  const officialA = {
+    name: 'feature',
+    oid: branchOids.a,
+    version: 2,
+    mutationId: 'mut_branch_only_a',
+  };
+  const planN = {
+    ...baseline,
+    branches: [...baseline.branches, officialA],
+  };
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  let crashed = false;
+  transitions.updateBranchRefs = async (...args) => {
+    const result = await updateBranchRefs(...args);
+    if (!crashed) {
+      crashed = true;
+      throw new Error('simulated process death after branch-only apply');
+    }
+    return result;
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(localCard, planN, 2),
+      /simulated process death/,
+    );
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), branchOids.a);
+  assert.equal(readRepoState(repoKey).appliedThrough, 1);
+  assert.equal(readRepoState(repoKey).applying?.through, 2);
+
+  const officialB = {
+    name: 'feature',
+    oid: branchOids.b,
+    version: 3,
+    mutationId: 'mut_branch_only_b',
+  };
+  const latest = {
+    ...baseline,
+    branches: [...baseline.branches, officialB],
+  };
+  const recovered = await materializeRepo(localCard, latest, 3);
+  assert.equal(recovered.state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), branchOids.b);
+  assert.equal(readRepoState(repoKey).appliedThrough, 3);
+  assert.equal(readRepoState(repoKey).applying, undefined);
+});
+
+test('restart finishes a checkpoint-only official apply before a newer checkpoint event', async () => {
+  const rootCommit = 'checkpoint-only-recovery-newer-rail';
+  const repoKey = `root:${rootCommit}`;
+  const { repo, oid: baseOid } = await makeRepo(rootCommit);
+  const patchN = await patchFor(repo, { 'a.txt': 'official N\n' });
+  const patchN1 = await patchFor(repo, {
+    'a.txt': 'official N\n',
+    'b.txt': 'official N+1\n',
+  });
+  const localCard = {
+    ...card(repo, baseOid, 1),
+    repo: { rootCommit, remote: null },
+  };
+  const baseline = {
+    repoKey,
+    card: localCard,
+    transitions: [],
+    branches: [{ name: 'main', oid: baseOid, version: 1 }],
+  };
+  assert.equal((await materializeRepo(localCard, baseline, 1)).state, 'in-sync');
+
+  const operationN = transition('machine-remote', 2, baseOid, '', patchN);
+  const planN = { ...baseline, transitions: [operationN] };
+  const mergeModule = require('../workspace/merge');
+  const advance = mergeModule.advance;
+  let crashed = false;
+  mergeModule.advance = async (...args) => {
+    const result = await advance(...args);
+    if (!crashed && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
+      crashed = true;
+      throw new Error('simulated process death after checkpoint-only apply');
+    }
+    return result;
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(localCard, planN, 2),
+      /simulated process death/,
+    );
+  } finally {
+    mergeModule.advance = advance;
+  }
+
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official N\n');
+  assert.equal(readRepoState(repoKey).appliedThrough, 1);
+  assert.equal(readRepoState(repoKey).applying?.through, 2);
+
+  const operationN1 = transition('machine-remote', 3, baseOid, patchN, patchN1);
+  const latest = { ...baseline, transitions: [operationN, operationN1] };
+  const recoveryLabels = [];
+  mergeModule.advance = async (...args) => {
+    recoveryLabels.push(args[3]?.label);
+    return advance(...args);
+  };
+  let recovered;
+  try {
+    recovered = await materializeRepo(localCard, latest, 3);
+  } finally {
+    mergeModule.advance = advance;
+  }
+
+  assert.equal(recovered.state, 'in-sync');
+  assert.equal(recoveryLabels.filter(Boolean).length, 2);
+  assert.equal(new Set(recoveryLabels.filter(Boolean)).size, 2);
+  assert.equal(
+    recoveryLabels.filter(Boolean).every((label) => /^[0-9a-f]{64}$/.test(label)),
+    true,
+  );
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official N\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'official N+1\n');
+  assert.equal(readRepoState(repoKey).appliedThrough, 3);
+  assert.equal(readRepoState(repoKey).applying, undefined);
+});
+
+test('recovery HEAD movement cannot bless and overwrite a commit made after sealed observation', async () => {
+  const { repo, oid: sourceOid } = await makeRepo('recovery-head-sealed-source');
+  const tracked = await establishTrackedBaseline(repo, sourceOid, 'recovery_head_sealed_source');
+  await git(repo, 'switch', '--detach', sourceOid);
+  fs.writeFileSync(path.join(repo, 'official.txt'), 'official commit\n');
+  await git(repo, 'add', 'official.txt');
+  await git(repo, 'commit', '-m', 'official commit');
+  const officialOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '-C', 'main', sourceOid);
+  const winning = {
+    ...tracked.localCard,
+    head: { branch: 'main', oid: officialOid, detached: false },
+    positionVersion: 2,
+    positionMutationId: 'mut_recovery_head_sealed',
+  };
+  const plan = {
+    repoKey: tracked.repoKey,
+    card: winning,
+    transitions: [],
+    branches: [{
+      name: 'main',
+      oid: officialOid,
+      version: 2,
+      mutationId: 'mut_recovery_main_sealed',
+    }],
+  };
+
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  let interruptBeforeRefs = true;
+  transitions.updateBranchRefs = async (...args) => {
+    if (interruptBeforeRefs) {
+      interruptBeforeRefs = false;
+      throw new Error('simulated process death before ref apply');
+    }
+    return updateBranchRefs(...args);
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death before ref apply/,
+    );
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+  assert.equal(readRepoState(tracked.repoKey).applying?.through, 2);
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
+
+  let localOid = null;
+  transitions.updateBranchRefs = async (...args) => {
+    const result = await updateBranchRefs(...args);
+    fs.writeFileSync(path.join(repo, 'racing-commit.txt'), 'local survives\n');
+    await git(repo, 'add', 'racing-commit.txt');
+    await git(repo, 'commit', '-m', 'local commit after sealed observation');
+    localOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+    return result;
+  };
+  let raced;
+  try {
+    raced = await materializeRepo(tracked.localCard, plan, 2);
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+  assert.deepEqual(raced, {
+    state: 'waiting',
+    reason: 'local-index-moving',
+    moved: false,
+  });
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), localOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'racing-commit.txt'), 'utf8'), 'local survives\n');
+
+  const recovered = await materializeRepo(
+    await observedCard(tracked.localCard),
+    plan,
+    2,
+  );
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
+  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
+});
+
+test('recovery index movement preserves a staged file written after sealed observation', async () => {
+  const { repo, oid } = await makeRepo('recovery-index-sealed-source');
+  const tracked = await establishTrackedBaseline(repo, oid, 'recovery_index_sealed_source');
+  const officialPatch = await patchFor(repo, { 'a.txt': 'official staged value\n' });
+  const plan = {
+    ...tracked.baseline,
+    transitions: [transition('machine-remote', 2, oid, '', officialPatch)],
+  };
+  const mergeModule = require('../workspace/merge');
+  const advance = mergeModule.advance;
+  let interruptBeforeWorktree = true;
+  mergeModule.advance = async (...args) => {
+    if (interruptBeforeWorktree && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
+      interruptBeforeWorktree = false;
+      throw new Error('simulated process death before worktree apply');
+    }
+    return advance(...args);
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death before worktree apply/,
+    );
+  } finally {
+    mergeModule.advance = advance;
+  }
+  assert.equal(readRepoState(tracked.repoKey).applying?.through, 2);
+
+  let stagedDuringRecovery = false;
+  mergeModule.advance = async (...args) => {
+    const result = await advance(...args);
+    if (!stagedDuringRecovery && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
+      stagedDuringRecovery = true;
+      fs.writeFileSync(path.join(repo, 'racing-staged.txt'), 'staged survives\n');
+      await git(repo, 'add', 'racing-staged.txt');
+    }
+    return result;
+  };
+  let raced;
+  try {
+    raced = await materializeRepo(tracked.localCard, plan, 2);
+  } finally {
+    mergeModule.advance = advance;
+  }
+  assert.deepEqual(raced, {
+    state: 'waiting',
+    reason: 'local-index-moving',
+    moved: false,
+  });
+  assert.match(await git(repo, 'diff', '--cached', '--', 'racing-staged.txt'), /staged survives/);
+
+  const recovered = await materializeRepo(
+    await observedCard(tracked.localCard),
+    plan,
+    2,
+  );
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.match(await git(repo, 'diff', '--cached', '--', 'racing-staged.txt'), /staged survives/);
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official staged value\n');
+  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
+});
+
+test('a byte-identical index refresh before apply is not an official crossing receipt', async () => {
+  const { repo, oid } = await makeRepo('index-refresh-is-not-crossing');
+  const tracked = await establishTrackedBaseline(repo, oid, 'index_refresh_not_crossing');
+  const officialPatch = await patchFor(repo, { 'a.txt': 'official index target\n' });
+  const plan = {
+    ...tracked.baseline,
+    transitions: [transition('machine-remote', 2, oid, '', officialPatch)],
+  };
+  const transitions = require('../workspace/transition');
+  const applyIndexPatch = transitions.applyIndexPatch;
+  const index = await gitPath(repo, 'index');
+  const before = fs.statSync(index, { bigint: true });
+  let crashed = false;
+  transitions.applyIndexPatch = async (...args) => {
+    if (!crashed) {
+      crashed = true;
+      const replacement = `${index}.semantic-refresh`;
+      fs.writeFileSync(replacement, fs.readFileSync(index));
+      fs.renameSync(replacement, index);
+      throw new Error('simulated process death before index apply');
+    }
+    return applyIndexPatch(...args);
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death before index apply/,
+    );
+  } finally {
+    transitions.applyIndexPatch = applyIndexPatch;
+  }
+  const after = fs.statSync(index, { bigint: true });
+  assert.notEqual(after.ino, before.ino);
+  assert.equal(readRepoState(tracked.repoKey).appliedThrough, 1);
+
+  const recovered = await materializeRepo(tracked.localCard, plan, 2);
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official index target\n');
+  assert.match(await git(repo, 'diff', '--cached'), /official index target/);
+  assert.equal(
+    require('../workspace/intent').readOwnedIntent(tracked.project),
+    null,
+  );
+});
+
+test('a byte-identical HEAD refresh before apply is not an official crossing receipt', async () => {
+  const { repo, oid } = await makeRepo('head-refresh-is-not-crossing');
+  await git(repo, 'branch', 'feature', oid);
+  const tracked = await establishTrackedBaseline(repo, oid, 'head_refresh_not_crossing');
+  const winning = {
+    ...tracked.localCard,
+    head: { branch: 'feature', oid, detached: false },
+    positionVersion: 2,
+    positionMutationId: 'mut_head_refresh_target',
+  };
+  const plan = {
+    repoKey: tracked.repoKey,
+    card: winning,
+    transitions: [],
+    branches: [
+      { name: 'main', oid, version: 1, mutationId: 'mut_head_refresh_main' },
+      { name: 'feature', oid, version: 2, mutationId: 'mut_head_refresh_feature' },
+    ],
+  };
+  const transitions = require('../workspace/transition');
+  const moveHeadToCard = transitions.moveHeadToCard;
+  const head = await gitPath(repo, 'HEAD');
+  const before = fs.statSync(head, { bigint: true });
+  let crashed = false;
+  transitions.moveHeadToCard = async (...args) => {
+    if (!crashed) {
+      crashed = true;
+      const replacement = `${head}.semantic-refresh`;
+      fs.writeFileSync(replacement, fs.readFileSync(head));
+      fs.renameSync(replacement, head);
+      throw new Error('simulated process death before HEAD apply');
+    }
+    return moveHeadToCard(...args);
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death before HEAD apply/,
+    );
+  } finally {
+    transitions.moveHeadToCard = moveHeadToCard;
+  }
+  const after = fs.statSync(head, { bigint: true });
+  assert.notEqual(after.ino, before.ino);
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
+
+  const recovered = await materializeRepo(
+    await observedCard(tracked.localCard),
+    plan,
+    2,
+  );
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
+  assert.equal(
+    require('../workspace/intent').readOwnedIntent(tracked.project),
+    null,
+  );
+});
+
+test('a same-value file revert after apply remains successor intent on recovery', async () => {
+  const { repo, oid } = await makeRepo('checkpoint-aba-revert');
+  const tracked = await establishTrackedBaseline(repo, oid, 'checkpoint_aba_revert');
+  const officialPatch = await patchFor(repo, { 'a.txt': 'official target\n' });
+  const plan = {
+    ...tracked.baseline,
+    transitions: [transition('machine-remote', 2, oid, '', officialPatch)],
+  };
+  const mergeModule = require('../workspace/merge');
+  const advance = mergeModule.advance;
+  let crashed = false;
+  mergeModule.advance = async (...args) => {
+    const result = await advance(...args);
+    if (!crashed && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
+      crashed = true;
+      throw new Error('simulated process death after file target');
+    }
+    return result;
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death after file target/,
+    );
+  } finally {
+    mergeModule.advance = advance;
+  }
+
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official target\n');
+  fs.writeFileSync(path.join(repo, 'a.txt'), 'a0\n');
+  const recovered = await materializeRepo(tracked.localCard, plan, 2);
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a0\n');
+  assert.equal(
+    readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough,
+    2,
+  );
+  const successor = require('../workspace/intent').readOwnedIntent(tracked.project);
+  assert.ok(successor);
+  assert.equal(successor.base.through, 2);
+});
+
+test('deleting an official create after apply remains successor intent on recovery', async () => {
+  const { repo, oid } = await makeRepo('checkpoint-create-delete');
+  const tracked = await establishTrackedBaseline(repo, oid, 'checkpoint_create_delete');
+  fs.writeFileSync(path.join(repo, 'official.txt'), 'official target\n');
+  await git(repo, 'add', 'official.txt');
+  const officialPatch = await git(repo, 'diff', '--cached', 'HEAD', '--binary', '--full-index');
+  await git(repo, 'reset', '--hard', 'HEAD');
+  const plan = {
+    ...tracked.baseline,
+    transitions: [transition('machine-remote', 2, oid, '', officialPatch)],
+  };
+  const mergeModule = require('../workspace/merge');
+  const advance = mergeModule.advance;
+  let crashed = false;
+  mergeModule.advance = async (...args) => {
+    const result = await advance(...args);
+    if (!crashed && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
+      crashed = true;
+      throw new Error('simulated process death after official create');
+    }
+    return result;
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death after official create/,
+    );
+  } finally {
+    mergeModule.advance = advance;
+  }
+
+  assert.equal(fs.readFileSync(path.join(repo, 'official.txt'), 'utf8'), 'official target\n');
+  fs.unlinkSync(path.join(repo, 'official.txt'));
+  const recovered = await materializeRepo(tracked.localCard, plan, 2);
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal(fs.existsSync(path.join(repo, 'official.txt')), false);
+  assert.equal(
+    readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough,
+    2,
+  );
+  const successor = require('../workspace/intent').readOwnedIntent(tracked.project);
+  assert.ok(successor);
+  assert.equal(successor.base.through, 2);
+});
+
+test('a checked-out branch reverted after apply remains successor intent on recovery', async () => {
+  const { repo, oid: baseOid } = await makeRepo('branch-aba-revert');
+  await git(repo, 'switch', '-c', 'feature');
+  fs.writeFileSync(path.join(repo, 'feature.txt'), 'A\n');
+  await git(repo, 'add', 'feature.txt');
+  await git(repo, 'commit', '-m', 'feature A');
+  const oidA = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  fs.writeFileSync(path.join(repo, 'feature.txt'), 'B\n');
+  await git(repo, 'add', 'feature.txt');
+  await git(repo, 'commit', '-m', 'feature B');
+  const oidB = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'reset', '--hard', oidA);
+  const tracked = await establishTrackedBaseline(repo, oidA, 'branch_aba_revert');
+  const plan = {
+    repoKey: tracked.repoKey,
+    card: {
+      ...tracked.localCard,
+      head: { branch: 'feature', oid: oidB, detached: false },
+      positionVersion: 2,
+      positionMutationId: 'mut_branch_aba_target',
+    },
+    transitions: [],
+    branches: [
+      { name: 'main', oid: baseOid, version: 1 },
+      { name: 'feature', oid: oidB, version: 2 },
+    ],
+  };
+  const transitions = require('../workspace/transition');
+  const updateBranchRefs = transitions.updateBranchRefs;
+  let crashed = false;
+  transitions.updateBranchRefs = async (...args) => {
+    const result = await updateBranchRefs(...args);
+    if (!crashed) {
+      crashed = true;
+      throw new Error('simulated process death after branch target');
+    }
+    return result;
+  };
+  try {
+    await assert.rejects(
+      materializeRepo(tracked.localCard, plan, 2),
+      /simulated process death after branch target/,
+    );
+  } finally {
+    transitions.updateBranchRefs = updateBranchRefs;
+  }
+
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), oidB);
+  await git(repo, 'update-ref', 'refs/heads/feature', oidA, oidB);
+  const recovered = await materializeRepo(
+    await observedCard(tracked.localCard),
+    plan,
+    2,
+  );
+  assert.equal(recovered.state, 'in-sync', recovered.reason);
+  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), oidA);
+  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), oidA);
+  const successor = require('../workspace/intent').readOwnedIntent(tracked.project);
+  assert.ok(successor);
+  assert.equal(successor.base.through, 2);
+});