amalgm 0.1.245 → 0.1.246

package/runtime/scripts/amalgm-mcp/tests/workspace-reducer.test.js

@@ -21,34 +21,28 @@ fs.writeFileSync(
 );
 
 const { closeLocalDb } = require('../state/db');
-const checkpoint = require('../workspace/checkpoint');
-const { CHECKPOINT_CONTRACT, revisionOf } = checkpoint;
-const { locatorChecksum } = require('../workspace/objects')._test;
+const { CHECKPOINT_CONTRACT, revisionOf } = require('../workspace/checkpoint');
 const {
   advanceIndex,
-  applyHydrationBootstrap,
+  captureIsOnRail,
   hydrateRepo,
   localCardMayMaterialize,
   materializeRepo,
+  parkedForState,
   pathForRepo,
   readRepoState,
-  readOfficialPlan,
-  repairDelayForPass,
   reduceCheckpoint,
   reduceWall,
-  snapshotIsCurrent,
 } = require('../workspace/reducer');
 
 test('a materialized baseline can follow the rail without publishing an echo', () => {
   assert.equal(localCardMayMaterialize(null, {
     published: false,
     reason: 'shared-state-covered',
-    mayMaterialize: true,
   }), true);
   assert.equal(localCardMayMaterialize(null, {
     published: false,
     reason: 'project-not-current',
-    mayMaterialize: true,
   }), true);
   assert.equal(localCardMayMaterialize({ positionVersion: 7 }, null), true);
   assert.equal(localCardMayMaterialize(null, {
@@ -58,10 +52,6 @@ test('a materialized baseline can follow the rail without publishing an echo', (
     published: false,
     reason: 'unchanged',
   }), false);
-  assert.equal(localCardMayMaterialize(null, {
-    published: false,
-    reason: 'future-reason-that-must-not-change-control-flow',
-  }), false);
 });
 
 test('a hydration failure still has a project path before a local card exists', () => {
@@ -69,59 +59,6 @@ test('a hydration failure still has a project path before a local card exists',
   assert.equal(pathForRepo({ path: '/projects/local' }, { path: '/projects/fresh' }), '/projects/local');
 });
 
-test('a reducer cursor belongs only to the rail that created it', () => {
-  const repoKey = 'root:rail-scoped-cursor';
-  const digest = require('crypto').createHash('sha256').update(repoKey).digest('hex').slice(0, 24);
-  const file = path.join(process.env.AMALGM_DIR, 'state', 'repo-reducer', `${digest}.json`);
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, `${JSON.stringify({
-    repoKey,
-    resourceId: 'shr_old_project_rail',
-    appliedThrough: 2764,
-  })}\n`);
-
-  assert.equal(readRepoState(repoKey, 'shr_old_project_rail').appliedThrough, 2764);
-  assert.equal(readRepoState(repoKey, 'shr_new_project_rail'), null);
-});
-
-test('a received cursor cannot advance past the exact local project snapshot', () => {
-  assert.equal(snapshotIsCurrent(51, 51), true);
-  assert.equal(snapshotIsCurrent(51, 50), false);
-  assert.equal(snapshotIsCurrent(51, 52), false);
-  assert.equal(snapshotIsCurrent(null, 0), false);
-});
-
-test('an acknowledged event cannot hydrate an empty folder before its sealed snapshot arrives', () => {
-  const target = path.join(tempRoot, 'hydrate-before-seal');
-  const resourceId = '018f0000-0000-7000-8000-000000000020';
-  const snapshot = path.join(tempRoot, 'snapshot-before-seal.json');
-  fs.mkdirSync(target, { recursive: true });
-  fs.writeFileSync(snapshot, JSON.stringify({
-    schemaVersion: 2,
-    project: resourceId,
-    version: 0,
-    card: null,
-    checkpoint: null,
-  }));
-
-  const outcome = readOfficialPlan(
-    'root:snapshot-gate',
-    { file: snapshot, resourceId },
-    {
-      publicationStatus: () => ({ receivedThrough: 1 }),
-      readWall: () => [],
-    },
-  );
-
-  assert.deepEqual(outcome, {
-    state: 'waiting',
-    reason: 'official-snapshot-behind',
-    receivedThrough: 1,
-    snapshotThrough: 0,
-  });
-  assert.deepEqual(fs.readdirSync(target), []);
-});
-
 test.after(() => {
   closeLocalDb();
   fs.rmSync(tempRoot, { recursive: true, force: true });
@@ -136,11 +73,6 @@ async function git(cwd, ...args) {
   return stdout;
 }
 
-async function gitPath(cwd, relativePath) {
-  const value = (await git(cwd, 'rev-parse', '--git-path', relativePath)).trim();
-  return path.isAbsolute(value) ? value : path.resolve(cwd, value);
-}
-
 async function makeRepo(name) {
   const repo = path.join(tempRoot, name);
   fs.mkdirSync(repo, { recursive: true });
@@ -183,7 +115,7 @@ function transition(machine, version, baseOid, from, to) {
 
 function card(repo, oid, version) {
   return {
-    card: 'repo-card@3',
+    card: 'repo-card@2',
     path: repo,
     replica: 'rpl_local',
     machine: 'machine-local',
@@ -198,72 +130,14 @@ function card(repo, oid, version) {
   };
 }
 
-let trackedProjectNumber = 100;
-
-async function observedCard(base) {
-  const headOid = (await git(base.path, 'rev-parse', 'HEAD')).trim();
-  const branch = (await git(base.path, 'branch', '--show-current')).trim() || null;
-  const refs = (await git(
-    base.path,
-    'for-each-ref',
-    '--format=%(refname:short) %(objectname)',
-    'refs/heads',
-  )).trim().split('\n').filter(Boolean).map((line) => {
-    const split = line.lastIndexOf(' ');
-    return {
-      name: line.slice(0, split),
-      oid: line.slice(split + 1),
-      objects: { kind: 'local' },
-    };
-  });
-  return {
-    ...base,
-    head: { branch, oid: headOid, detached: branch === null },
-    objects: { kind: 'local' },
-    refs,
-  };
-}
-
-async function establishTrackedBaseline(repo, oid, name) {
-  trackedProjectNumber += 1;
-  const resourceId = `018f0000-0000-7000-8000-${String(trackedProjectNumber).padStart(12, '0')}`;
-  const project = require('../workspace/wall').bindProject(
-    resourceId,
-    '11111111-1111-4111-8111-111111111111',
-    repo,
-  );
-  const localCard = await observedCard({
-    ...card(repo, oid, 1),
-    replica: `rpl_${name}`,
-  });
-  const baseline = {
-    repoKey: project.repoKey,
-    card: localCard,
-    transitions: [],
-    branches: localCard.refs.map((ref) => ({ ...ref, version: 1 })),
-  };
-  assert.equal((await materializeRepo(localCard, baseline, 1)).state, 'in-sync');
-  return { project, repoKey: project.repoKey, localCard, baseline };
-}
-
-function reducerStateFile(repoKey) {
-  const digest = require('crypto').createHash('sha256').update(repoKey).digest('hex').slice(0, 24);
-  return path.join(process.env.AMALGM_DIR, 'state', 'repo-reducer', `${digest}.json`);
-}
-
-async function captureTrackedIntent(project, localCard) {
-  const current = await observedCard(localCard);
-  const captured = await checkpoint.captureIntentForCard(project, current);
-  assert.equal(captured.state, 'captured');
-  return current;
-}
-
 test('wall reduction chooses one rail winner and orders checkpoint transitions by rail', () => {
   const oldCard = card('/old', 'a'.repeat(40), 4);
   oldCard.checkpoints = [transition('machine-a', 9, oldCard.head.oid, '', 'a')];
   const newCard = card('/new', 'b'.repeat(40), 7);
   const later = transition('machine-b', 11, newCard.head.oid, 'b', 'c');
+  later.parked = [{ oid: 'd'.repeat(40) }];
   const earlier = transition('machine-b', 8, newCard.head.oid, '', 'b');
+  earlier.parked = [{ oid: 'c'.repeat(40) }];
   newCard.checkpoints = [later, earlier];
   const plans = reduceWall([
     { machine: 'machine-a', cards: [oldCard] },
@@ -272,50 +146,139 @@ test('wall reduction chooses one rail winner and orders checkpoint transitions b
   const plan = plans.get('root:test');
   assert.equal(plan.card.positionVersion, 7);
   assert.deepEqual(plan.transitions.map((item) => item.version), [8, 11]);
+  assert.deepEqual(plan.parked.map((item) => [item.oid, item.version]), [
+    ['c'.repeat(40), 8],
+    ['d'.repeat(40), 11],
+  ]);
+});
+
+test('a checkpoint base replaces covered history and keeps only newer mutations', async () => {
+  const { repo, oid } = await makeRepo('checkpoint-base');
+  const patchA = await patchFor(repo, { 'a.txt': 'a1\n' });
+  const patchAB = await patchFor(repo, { 'a.txt': 'a1\n', 'b.txt': 'b1\n' });
+  const current = card(repo, oid, 1);
+  current.checkpointBase = {
+    checkpoint: CHECKPOINT_CONTRACT,
+    baseOid: oid,
+    branch: 'main',
+    through: 4,
+    value: value(oid, patchA),
+  };
+  current.checkpoints = [
+    transition('machine-a', 2, oid, '', patchA),
+    transition('machine-a', 5, oid, patchA, patchAB),
+  ];
+  const plan = reduceWall([{ machine: 'machine-a', cards: [current] }]).get('root:test');
+  assert.equal(plan.checkpointBase.through, 4);
+  assert.deepEqual(plan.transitions.map((entry) => entry.version), [5]);
+  const reduced = await reduceCheckpoint(current, plan);
+  assert.equal(reduced.state, 'ready');
+  assert.equal(reduced.checkpointRevision, revisionOf(oid, patchAB, ''));
 });
 
-test('copies of one numbered card reduce to the copy with ready objects', () => {
+test('an unfinished checkpoint base cannot replace the last complete base', () => {
   const oid = 'a'.repeat(40);
-  const mutationId = 'mut_same_card_01';
-  const pending = card('/pending', oid, 7);
-  pending.replica = 'rpl_pending';
-  pending.positionMutationId = mutationId;
-  pending.objects = { kind: 'pending' };
-  pending.branches = [{
-    name: 'feature',
+  const complete = card('/complete', oid, 1);
+  complete.checkpointBase = {
+    checkpoint: CHECKPOINT_CONTRACT,
+    baseOid: oid,
+    branch: 'main',
+    through: 4,
+    value: value(oid, 'complete-patch'),
+  };
+  complete.checkpoints = [
+    transition('machine-a', 5, oid, 'complete-patch', 'later-patch'),
+  ];
+
+  const unfinished = card('/unfinished', oid, 1);
+  unfinished.checkpointBase = {
+    checkpoint: CHECKPOINT_CONTRACT,
+    baseOid: oid,
+    branch: 'main',
+    through: 6,
+    value: {
+      revision: 'b'.repeat(64),
+      payload: {
+        kind: 'pending',
+        contract: 'opaque-chunks@1',
+        checksum: 'c'.repeat(64),
+      },
+    },
+  };
+
+  const plan = reduceWall([
+    { machine: 'machine-a', cards: [complete] },
+    { machine: 'machine-b', cards: [unfinished] },
+  ]).get('root:test');
+
+  assert.equal(plan.checkpointBase.through, 4);
+  assert.equal(plan.checkpointBaseConflict, false);
+  assert.deepEqual(plan.transitions.map((entry) => entry.version), [5]);
+});
+
+test('different snapshots claiming the same rail position stop instead of choosing a winner', () => {
+  const oid = 'a'.repeat(40);
+  const first = card('/first', oid, 1);
+  first.checkpointBase = {
+    checkpoint: CHECKPOINT_CONTRACT,
+    baseOid: oid,
+    branch: 'main',
+    through: 4,
+    value: value(oid, 'patch-a'),
+  };
+  const second = card('/second', oid, 1);
+  second.checkpointBase = {
+    checkpoint: CHECKPOINT_CONTRACT,
+    baseOid: oid,
+    branch: 'main',
+    through: 4,
+    value: value(oid, 'patch-b'),
+  };
+  const plan = reduceWall([
+    { machine: 'machine-a', cards: [first] },
+    { machine: 'machine-b', cards: [second] },
+  ]).get('root:test');
+  assert.equal(plan.checkpointBase, null);
+  assert.equal(plan.checkpointBaseConflict, true);
+});
+
+test('a ready parked bundle never regresses to pending', () => {
+  const oid = 'c'.repeat(40);
+  const ready = card('/ready', 'a'.repeat(40), 1);
+  const readyCheckpoint = transition('machine-ready', 2, ready.head.oid, '', '');
+  readyCheckpoint.parked = [{
     oid,
-    mutationId,
-    version: 7,
-    objects: { kind: 'pending' },
+    ref: `refs/amalgm/parked/${oid}`,
+    objects: { kind: 'bundle', checksum: 'd'.repeat(64) },
   }];
+  ready.checkpoints = [readyCheckpoint];
 
-  const ready = card('/ready', oid, 7);
-  ready.replica = 'rpl_ready';
-  ready.positionMutationId = mutationId;
-  ready.objects = { kind: 'bundle', checksum: 'b'.repeat(64) };
-  ready.branches = [{
-    name: 'feature',
+  const pending = card('/pending', ready.head.oid, 3);
+  const pendingCheckpoint = transition('machine-pending', 4, pending.head.oid, '', '');
+  pendingCheckpoint.parked = [{
     oid,
-    mutationId,
-    version: 7,
-    objects: { kind: 'bundle', checksum: 'b'.repeat(64) },
+    ref: `refs/amalgm/parked/${oid}`,
+    objects: { kind: 'pending' },
   }];
+  pending.checkpoints = [pendingCheckpoint];
 
-  for (const entries of [
-    [
-      { machine: 'machine-pending', cards: [pending] },
-      { machine: 'machine-ready', cards: [ready] },
-    ],
-    [
-      { machine: 'machine-ready', cards: [ready] },
-      { machine: 'machine-pending', cards: [pending] },
-    ],
-  ]) {
-    const plan = reduceWall(entries).get('root:test');
-    assert.equal(plan.card.positionVersion, 7);
-    assert.equal(plan.card.objects.kind, 'bundle');
-    assert.equal(plan.branches.find((ref) => ref.name === 'feature').objects.kind, 'bundle');
-  }
+  const plan = reduceWall([
+    { machine: 'machine-ready', cards: [ready] },
+    { machine: 'machine-pending', cards: [pending] },
+  ]).get('root:test');
+  assert.equal(plan.parked.length, 1);
+  assert.equal(plan.parked[0].objects.kind, 'bundle');
+});
+
+test('an unpublished local parked commit stays active until the rail records it', () => {
+  const oid = 'f'.repeat(40);
+  const local = { oid, objects: { kind: 'bundle', checksum: 'local' } };
+  assert.deepEqual(parkedForState([local], [], []), [local]);
+  assert.deepEqual(parkedForState([local], [{ ...local, version: 7 }], []), [{
+    ...local,
+    version: 7,
+  }]);
+  assert.deepEqual(parkedForState([{ ...local, version: 7 }], [], []), []);
 });
 
 test('a stale lower rail card cannot roll back a newer branch and commit', () => {
@@ -344,102 +307,29 @@ test('checkpoint reduction reads only the current rail contract', () => {
   assert.deepEqual(plan.transitions.map((item) => item.version), [3]);
 });
 
-test('an official checkpoint with a pending payload is terminal corruption', async () => {
+test('an old pending payload does not block the later complete checkpoint transition', async () => {
   const { repo, oid } = await makeRepo('pending-payload');
   const diff = await patchFor(repo, { 'a.txt': 'a1\n' });
   const pending = transition('machine-a', 2, oid, '', '');
   pending.from = {
     revision: 'a'.repeat(64),
-    payload: { kind: 'pending', contract: 'opaque-chunks@2', checksum: 'b'.repeat(64) },
+    payload: { kind: 'pending', contract: 'opaque-chunks@1', checksum: 'b'.repeat(64) },
   };
   pending.to = pending.from;
   const complete = transition('machine-a', 3, oid, '', diff);
-  await assert.rejects(
-    reduceCheckpoint(
-      { path: repo },
-      { card: card(repo, oid, 1), transitions: [pending, complete] },
-    ),
-    /official checkpoint is payload-pending/,
-  );
-});
-
-test('hydration reimports official objects when its checkout is replaced before recovery', async () => {
-  const { repo: source, oid } = await makeRepo('hydrate-replaced-source');
-  const bundle = path.join(tempRoot, 'hydrate-replaced.bundle');
-  await git(source, 'bundle', 'create', bundle, 'main');
-  const bytes = fs.readFileSync(bundle);
-  const digest = require('crypto').createHash('sha256').update(bytes).digest('hex');
-  const locatorChunks = [{ sha256: digest, bytes: bytes.length }];
-  const chunks = path.join(process.env.AMALGM_DIR, 'state', 'repo-objects', 'chunks');
-  fs.mkdirSync(chunks, { recursive: true });
-  fs.writeFileSync(path.join(chunks, `${digest}.bin`), bytes);
-
-  const target = path.join(tempRoot, 'hydrate-replaced-target');
-  fs.mkdirSync(target, { recursive: true });
-  const resourceId = '018f0000-0000-7000-8000-000000000022';
-  const project = { path: target, resourceId };
-  const winning = card('/remote', oid, 1);
-  winning.objects = {
-    kind: 'bundle',
-    contract: 'git-bundle-chunks@2',
-    resourceId,
-    oid,
-    ref: `refs/amalgm/exports/${oid}`,
-    checksum: locatorChecksum(locatorChunks),
-    bytes: bytes.length,
-    chunks: locatorChunks,
-  };
-  const plan = {
-    repoKey: `code-folder:${resourceId}`,
-    card: winning,
-    branches: [],
-    transitions: [],
-  };
-  require('../workspace/wall').bindProject(
-    resourceId,
-    '11111111-1111-4111-8111-111111111111',
-    target,
+  const reduced = await reduceCheckpoint(
+    { path: repo },
+    { card: card(repo, oid, 1), transitions: [pending, complete] },
   );
-
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  let interrupt = true;
-  transitions.updateBranchRefs = async (...args) => {
-    await updateBranchRefs(...args);
-    if (interrupt) {
-      interrupt = false;
-      throw new Error('simulated process death before hydration execution');
-    }
-  };
-  try {
-    await assert.rejects(
-      hydrateRepo(project, plan),
-      /simulated process death before hydration execution/,
-    );
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-  assert.equal(readRepoState(plan.repoKey, resourceId).hydrating.contract, 'repo-hydrate@5');
-
-  const displaced = `${target}.displaced`;
-  fs.renameSync(target, displaced);
-  fs.mkdirSync(target);
-
-  const result = await hydrateRepo(project, plan);
-  assert.equal(result.state, 'hydrated', JSON.stringify(result));
-  assert.equal((await git(target, 'rev-parse', 'HEAD')).trim(), oid);
-  await git(target, 'cat-file', '-e', 'HEAD^{commit}');
-  await git(target, 'status', '--porcelain=v2', '--branch');
-  await git(target, 'fsck', '--connectivity-only', '--no-dangling');
-  assert.equal(readRepoState(plan.repoKey, resourceId).materialized, true);
+  assert.equal(reduced.state, 'ready');
+  assert.match(reduced.indexDiff, /a1/);
 });
 
-test('hydration preserves unknown files and a branch committed while recovery was down', async () => {
+test('an empty project folder hydrates from the winning card bundle without cloning', async () => {
   const sourceRepo = await makeRepo('hydrate-source');
   const source = sourceRepo.repo;
   fs.mkdirSync(path.join(source, '.amalgam', 'context'), { recursive: true });
   fs.writeFileSync(path.join(source, '.amalgam', 'context', 'notes.md'), 'committed note\n');
-  fs.symlinkSync('notes.md', path.join(source, '.amalgam', 'context', 'current.md'));
   await git(source, 'add', '.');
   await git(source, 'commit', '-m', 'track project memory');
   const oid = (await git(source, 'rev-parse', 'HEAD')).trim();
@@ -447,7 +337,6 @@ test('hydration preserves unknown files and a branch committed while recovery wa
   await git(source, 'bundle', 'create', bundle, 'main');
   const bytes = fs.readFileSync(bundle);
   const digest = require('crypto').createHash('sha256').update(bytes).digest('hex');
-  const locatorChunks = [{ sha256: digest, bytes: bytes.length }];
   const chunks = path.join(process.env.AMALGM_DIR, 'state', 'repo-objects', 'chunks');
   fs.mkdirSync(chunks, { recursive: true });
   fs.writeFileSync(path.join(chunks, `${digest}.bin`), bytes);
@@ -455,350 +344,29 @@ test('hydration preserves unknown files and a branch committed while recovery wa
   const target = path.join(tempRoot, 'hydrate-target');
   fs.mkdirSync(path.join(target, '.amalgam', 'context'), { recursive: true });
   fs.writeFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'local note\n');
-  fs.symlinkSync('notes.md', path.join(target, '.amalgam', 'context', 'current.md'));
   const winning = card('/remote', oid, 1);
   winning.repo.remote = 'https://example.com/org/repo';
   winning.objects = {
     kind: 'bundle',
-    contract: 'git-bundle-chunks@2',
+    contract: 'git-bundle-chunks@1',
     resourceId: 'shr_hydrationProof123456',
     oid,
     ref: `refs/amalgm/exports/${oid}`,
-    checksum: locatorChecksum(locatorChunks),
+    checksum: digest,
     bytes: bytes.length,
-    chunks: locatorChunks,
+    chunks: [{ sha256: digest, bytes: bytes.length }],
   };
 
-  const resourceId = '018f0000-0000-7000-8000-000000000021';
-  winning.objects.resourceId = resourceId;
-  const repoKey = `code-folder:${resourceId}`;
-  const project = { path: target, resourceId };
-  const plan = {
-    repoKey,
-    card: winning,
-    branches: [{ name: 'secondary', oid, version: 1 }],
-    transitions: [],
-  };
-  require('../workspace/wall').bindProject(
-    project.resourceId,
-    '11111111-1111-4111-8111-111111111111',
-    target,
-  );
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  let interruptBootstrap = true;
-  transitions.updateBranchRefs = async (...args) => {
-    await updateBranchRefs(...args);
-    if (interruptBootstrap) {
-      interruptBootstrap = false;
-      assert.equal(
-        transitions.gitMetadataReceiptCrossed(
-          target,
-          args[2],
-          'index',
-        ),
-        true,
-        'the bootstrap index receipt survives until hydration execution is sealed',
-      );
-      throw new Error('simulated process death during hydration');
-    }
-  };
-  try {
-    await assert.rejects(
-      hydrateRepo(project, plan),
-      /simulated process death/,
-    );
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-  assert.equal(fs.readFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'utf8'), 'local note\n');
-  const interrupted = readRepoState(repoKey, project.resourceId);
-  assert.equal(interrupted.hydrating.contract, 'repo-hydrate@5');
-  assert.equal(
-    transitions.gitMetadataReceiptCrossed(
-      target,
-      interrupted.hydrating.operationId,
-      'index',
-    ),
-    true,
-  );
-  assert.equal(interrupted.materialized, false);
-  assert.equal(
-    require('../workspace/intent').readOwnedIntent(
-      require('../workspace/wall').projectForResource(project.resourceId),
-    ),
-    null,
-    'the process died after the WAL and partial Git movement but before intent existed',
+  const result = await hydrateRepo(
+    { path: target },
+    { repoKey: 'https://example.com/org/repo', card: winning, transitions: [] },
   );
+  assert.equal(result.state, 'hydrated');
   assert.equal((await git(target, 'rev-parse', 'HEAD')).trim(), oid);
-  await git(target, 'switch', '-c', 'feature');
-  fs.writeFileSync(path.join(target, 'feature-commit.txt'), 'committed while down\n');
-  await git(target, 'add', 'feature-commit.txt');
-  await git(target, 'commit', '-m', 'feature committed while hydration was down');
-  const featureOid = (await git(target, 'rev-parse', 'HEAD')).trim();
-  fs.writeFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'edited while down\n');
-  fs.writeFileSync(path.join(target, 'downtime.txt'), 'created while down\n');
-
-  const releaseBranchReceipt = transitions.releaseBranchReceipt;
-  let interruptBootstrapCleanup = true;
-  transitions.releaseBranchReceipt = async (...args) => {
-    const result = await releaseBranchReceipt(...args);
-    if (interruptBootstrapCleanup) {
-      interruptBootstrapCleanup = false;
-      throw new Error('simulated process death after hydration bootstrap cleanup');
-    }
-    return result;
-  };
-  try {
-    await assert.rejects(
-      materializeRepo({
-        ...winning,
-        path: target,
-        replica: 'rpl_hydration_recovery',
-      }, plan, 1),
-      /simulated process death after hydration bootstrap cleanup/,
-    );
-  } finally {
-    transitions.releaseBranchReceipt = releaseBranchReceipt;
-  }
-  const cleanupInterrupted = readRepoState(repoKey, project.resourceId);
-  assert.equal(
-    cleanupInterrupted.hydrating.bootstrapSealed,
-    true,
-    'execution is durably sealed before bootstrap provenance is released',
-  );
-  assert.equal(cleanupInterrupted.hydrating.bootstrapReleased, undefined);
-  await git(target, 'branch', '-D', 'secondary');
-
-  const result = await materializeRepo({
-    ...winning,
-    path: target,
-    replica: 'rpl_hydration_recovery',
-  }, plan, 1);
-  assert.equal(result.state, 'hydrated', JSON.stringify(result));
-  assert.equal((await git(target, 'rev-parse', 'HEAD')).trim(), featureOid);
-  assert.equal((await git(target, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
-  assert.equal((await git(target, 'rev-parse', 'refs/heads/feature')).trim(), featureOid);
-  assert.equal((await git(target, 'rev-parse', 'refs/heads/main')).trim(), oid);
-  await assert.rejects(
-    git(target, 'rev-parse', '--verify', 'refs/heads/secondary'),
-    /Needed a single revision|unknown revision|not a valid object name/,
-    'a local deletion after bootstrap cleanup remains overlay on restart',
-  );
-  assert.equal(fs.readFileSync(path.join(target, 'feature-commit.txt'), 'utf8'), 'committed while down\n');
+  assert.equal((await git(target, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
   assert.equal(fs.readFileSync(path.join(target, 'a.txt'), 'utf8'), 'a0\n');
-  assert.equal(fs.readFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'utf8'), 'edited while down\n');
-  assert.equal(fs.readlinkSync(path.join(target, '.amalgam', 'context', 'current.md')), 'notes.md');
-  assert.equal(fs.readFileSync(path.join(target, 'downtime.txt'), 'utf8'), 'created while down\n');
+  assert.equal(fs.readFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'utf8'), 'local note\n');
   assert.match(await git(target, 'status', '--porcelain=v1'), /\.amalgam\/context\/notes\.md/);
-  assert.equal(readRepoState(repoKey, project.resourceId).hydrating, undefined);
-  assert.equal(readRepoState(repoKey, project.resourceId).materialized, true);
-  assert.equal(
-    transitions.gitMetadataReceiptCrossed(
-      target,
-      interrupted.hydrating.operationId,
-      'index',
-    ),
-    false,
-  );
-  assert.equal(
-    require('../workspace/intent').readOwnedIntent(
-      require('../workspace/wall').projectForResource(project.resourceId),
-    )?.base?.through,
-    1,
-    'unknown hydration bytes become durable intent over the official target',
-  );
-
-  const hydratedCard = await require('../workspace/card').buildRepoCard(target);
-  const hydrationIntent = require('../workspace/intent').readOwnedIntent(
-    require('../workspace/wall').projectForResource(project.resourceId),
-  );
-  assert.equal(readRepoState(repoKey, project.resourceId).replica, hydratedCard.replica);
-  for (const tree of [
-    hydrationIntent.base.indexTree,
-    hydrationIntent.base.worktreeTree,
-    hydrationIntent.local.indexTree,
-    hydrationIntent.local.worktreeTree,
-  ]) {
-    assert.equal(await require('../workspace/merge').hasTree(target, tree), true);
-  }
-  const settled = await materializeRepo(hydratedCard, plan, 1);
-  assert.equal(settled.state, 'in-sync', JSON.stringify(settled));
-  assert.equal(
-    require('../workspace/intent').readOwnedIntent(
-      require('../workspace/wall').projectForResource(project.resourceId),
-    )?.semanticDigest,
-    hydrationIntent.semanticDigest,
-    're-entry retains ownership of the bytes captured after the hydration WAL',
-  );
-  assert.equal(
-    fs.readFileSync(path.join(target, '.amalgam', 'context', 'notes.md'), 'utf8'),
-    'edited while down\n',
-    'a later reducer pass cannot overwrite the captured collision',
-  );
-  assert.equal(fs.readFileSync(path.join(target, 'downtime.txt'), 'utf8'), 'created while down\n');
-});
-
-test('hydration bootstrap preserves a branch-only write after ref crossing and before HEAD attachment', async () => {
-  const source = await makeRepo('hydrate-branch-only-source');
-  const localOid = source.oid;
-  fs.writeFileSync(path.join(source.repo, 'official.txt'), 'official\n');
-  await git(source.repo, 'add', 'official.txt');
-  await git(source.repo, 'commit', '-m', 'official');
-  const officialOid = (await git(source.repo, 'rev-parse', 'HEAD')).trim();
-  const target = path.join(tempRoot, 'hydrate-branch-only-target');
-  fs.mkdirSync(target);
-  await git(target, 'init', '-b', 'main');
-  await git(target, 'fetch', source.repo, 'main');
-  const operationId = '7'.repeat(64);
-  const hydrating = {
-    operationId,
-    bootstrap: {
-      source: {
-        head: { branch: 'main', oid: null },
-        branches: [],
-      },
-      target: {
-        head: { branch: 'feature', oid: officialOid },
-        branches: [{ name: 'feature', oid: officialOid }],
-      },
-    },
-  };
-  const transitions = require('../workspace/transition');
-  await transitions.ensureEmptyIndex(target, operationId);
-  await transitions.updateBranchRefs(target, [
-    { branch: 'feature', expectedOid: null, oid: officialOid },
-  ], operationId);
-  await git(target, 'update-ref', 'refs/heads/feature', localOid, officialOid);
-
-  const result = await applyHydrationBootstrap(target, hydrating);
-  assert.deepEqual(result, { state: 'ready' });
-  assert.equal((await git(target, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
-  assert.equal((await git(target, 'rev-parse', 'HEAD')).trim(), localOid);
-  assert.equal((await git(target, 'rev-parse', 'refs/heads/feature')).trim(), localOid);
-});
-
-test('hydration bootstrap leaves a racing same-branch commit for execution reconciliation', async () => {
-  const { repo, oid: sourceOid } = await makeRepo('hydrate-head-sealed-source');
-  await git(repo, 'switch', '--detach', sourceOid);
-  fs.writeFileSync(path.join(repo, 'official.txt'), 'official\n');
-  await git(repo, 'add', 'official.txt');
-  await git(repo, 'commit', '-m', 'official');
-  const officialOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '-C', 'main', sourceOid);
-
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  let localOid = null;
-  transitions.updateBranchRefs = async (...args) => {
-    const result = await updateBranchRefs(...args);
-    fs.writeFileSync(path.join(repo, 'racing-local.txt'), 'local commit\n');
-    await git(repo, 'add', 'racing-local.txt');
-    await git(repo, 'commit', '-m', 'local commit during hydration apply');
-    localOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-    return result;
-  };
-  let result;
-  try {
-    result = await applyHydrationBootstrap(repo, {
-      operationId: '6'.repeat(64),
-      bootstrap: {
-        source: {
-          head: { branch: 'main', oid: sourceOid },
-          branches: [{ name: 'main', oid: sourceOid }],
-        },
-        target: {
-          head: { branch: 'main', oid: officialOid },
-          branches: [{ name: 'main', oid: officialOid }],
-        },
-      },
-    });
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-
-  assert.deepEqual(result, { state: 'ready' });
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), localOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'racing-local.txt'), 'utf8'), 'local commit\n');
-});
-
-test('index movement rejects an overlapping mode change made after the sealed tree', async () => {
-  const { repo } = await makeRepo('index-mode-after-seal');
-  const sourceTree = (await git(repo, 'write-tree')).trim();
-  await git(repo, 'rm', '--cached', 'a.txt');
-  const targetTree = (await git(repo, 'write-tree')).trim();
-  await git(repo, 'reset', '--mixed', 'HEAD');
-  await git(repo, 'update-index', '--chmod=+x', 'a.txt');
-  assert.match(await git(repo, 'ls-files', '--stage', '--', 'a.txt'), /^100755 /);
-
-  const result = await advanceIndex(
-    repo,
-    sourceTree,
-    targetTree,
-    '5'.repeat(64),
-  );
-
-  assert.deepEqual(result, {
-    state: 'waiting',
-    reason: 'local-index-moving',
-    moved: false,
-  });
-  assert.match(
-    await git(repo, 'ls-files', '--stage', '--', 'a.txt'),
-    /^100755 /,
-    'a patch derived from the sealed regular-file tree cannot delete the later executable entry',
-  );
-});
-
-test('ordinary index and HEAD lock contention remain bounded reducer waits', async () => {
-  const indexRepo = await makeRepo('retryable-index-lock');
-  const sourceTree = (await git(indexRepo.repo, 'write-tree')).trim();
-  fs.writeFileSync(path.join(indexRepo.repo, 'a.txt'), 'target\n');
-  await git(indexRepo.repo, 'add', 'a.txt');
-  const targetTree = (await git(indexRepo.repo, 'write-tree')).trim();
-  await git(indexRepo.repo, 'reset', '--mixed', 'HEAD');
-  const indexFile = await gitPath(indexRepo.repo, 'index');
-  fs.writeFileSync(`${indexFile}.lock`, 'user-owned lock\n');
-  const indexResult = await advanceIndex(
-    indexRepo.repo,
-    sourceTree,
-    targetTree,
-    '8'.repeat(64),
-  );
-  assert.deepEqual(indexResult, {
-    state: 'waiting',
-    reason: 'local-index-moving',
-    moved: false,
-  });
-  fs.rmSync(`${indexFile}.lock`);
-
-  const headRepo = await makeRepo('retryable-head-lock');
-  await git(headRepo.repo, 'branch', 'feature', headRepo.oid);
-  const headFile = await gitPath(headRepo.repo, 'HEAD');
-  fs.writeFileSync(`${headFile}.lock`, 'user-owned lock\n');
-  const headResult = await applyHydrationBootstrap(headRepo.repo, {
-    operationId: '9'.repeat(64),
-    bootstrap: {
-      source: {
-        head: { branch: 'main', oid: headRepo.oid },
-        branches: [
-          { name: 'feature', oid: headRepo.oid },
-          { name: 'main', oid: headRepo.oid },
-        ],
-      },
-      target: {
-        head: { branch: 'feature', oid: headRepo.oid },
-        branches: [
-          { name: 'feature', oid: headRepo.oid },
-          { name: 'main', oid: headRepo.oid },
-        ],
-      },
-    },
-  });
-  assert.deepEqual(headResult, { state: 'waiting', reason: 'local-head-moving' });
-  fs.rmSync(`${headFile}.lock`);
-  assert.equal(repairDelayForPass([indexResult, headResult]), 1000);
 });
 
 test('branch refs reduce per name; an absent stale list cannot delete another writer branch', () => {
@@ -876,13 +444,11 @@ test('one materializer converges to the reduced checkpoint and later removes a r
   const { repo, oid } = await makeRepo('materialize');
   const patchA = await patchFor(repo, { 'a.txt': 'a1\n' });
   const patchB = await patchFor(repo, { 'b.txt': 'b1\n' });
-  const tracked = await establishTrackedBaseline(repo, oid, 'materialize');
-  const { localCard, repoKey } = tracked;
+  const localCard = card(repo, oid, 1);
 
   const first = {
-    repoKey,
+    repoKey: 'root:test',
     card: localCard,
-    branches: tracked.baseline.branches,
     transitions: [
       transition('machine-a', 2, oid, '', patchA),
       transition('machine-b', 3, oid, patchA, `${patchA}${patchB}`),
@@ -890,15 +456,14 @@ test('one materializer converges to the reduced checkpoint and later removes a r
   };
   const applied = await materializeRepo(localCard, first, 3);
   assert.equal(applied.state, 'in-sync');
-  assert.equal(readRepoState(repoKey, tracked.project.resourceId).appliedThrough, 3);
+  assert.equal(readRepoState('root:test').appliedThrough, 3);
   assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a1\n');
   assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'b1\n');
 
-  const combined = readRepoState(repoKey, tracked.project.resourceId).indexDiff;
+  const combined = readRepoState('root:test').indexDiff;
   const second = {
-    repoKey,
+    repoKey: 'root:test',
     card: localCard,
-    branches: tracked.baseline.branches,
     transitions: [
       transition('machine-b', 3, oid, patchA, combined),
       transition('machine-a', 4, oid, combined, patchB),
@@ -906,65 +471,17 @@ test('one materializer converges to the reduced checkpoint and later removes a r
   };
   const reverted = await materializeRepo(localCard, second, 4);
   assert.equal(reverted.state, 'in-sync');
-  assert.equal(readRepoState(repoKey, tracked.project.resourceId).appliedThrough, 4);
+  assert.equal(readRepoState('root:test').appliedThrough, 4);
   assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a0\n');
   assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'b1\n');
 });
 
-test('a linked worktree verifies its cursor and releases every apply receipt', async () => {
-  const { repo, oid } = await makeRepo('linked-materialize-main');
-  const linked = path.join(tempRoot, 'linked-materialize-worktree');
-  await git(repo, 'worktree', 'add', '-b', 'linked-materialize', linked, oid);
-  const officialPatch = await patchFor(linked, { 'a.txt': 'official linked\n' });
-  const tracked = await establishTrackedBaseline(
-    linked,
-    oid,
-    'linked_materialize',
-  );
-  const plan = {
-    ...tracked.baseline,
-    transitions: [
-      transition('machine-remote', 2, oid, '', officialPatch),
-    ],
-  };
-
-  const outcome = await materializeRepo(tracked.localCard, plan, 2);
-  assert.equal(outcome.state, 'in-sync', outcome.reason);
-  assert.equal(fs.readFileSync(path.join(linked, 'a.txt'), 'utf8'), 'official linked\n');
-  assert.equal(
-    readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough,
-    2,
-  );
-  assert.equal(
-    fs.readdirSync(linked).some((name) => /^\.amalgm-apply-/.test(name)),
-    false,
-  );
-  assert.doesNotMatch(
-    await git(linked, 'ls-files', '--others', '--exclude-standard'),
-    /\.amalgm-apply-/,
-  );
-  const metadataReceipts = path.join(
-    path.dirname(await gitPath(linked, 'index')),
-    'amalgm-metadata-apply',
-  );
-  assert.equal(
-    fs.existsSync(metadataReceipts)
-      && fs.readdirSync(metadataReceipts).some((name) => name.endsWith('.json')),
-    false,
-  );
-  assert.equal(
-    (await git(linked, 'for-each-ref', '--format=%(refname)', 'refs/amalgm/apply')).trim(),
-    '',
-  );
-});
-
 test('a mode-only checkpoint makes the peer working file executable', async () => {
   const { repo, oid } = await makeRepo('materialize-mode');
   fs.chmodSync(path.join(repo, 'a.txt'), 0o755);
   const modePatch = await git(repo, 'diff', 'HEAD', '--binary', '--full-index');
   await git(repo, 'reset', '--hard', 'HEAD');
-  const tracked = await establishTrackedBaseline(repo, oid, 'materialize_mode');
-  const { localCard, repoKey } = tracked;
+  const localCard = card(repo, oid, 1);
   const clean = { revision: null, indexDiff: '', worktreeDiff: '' };
   const executable = {
     revision: revisionOf(oid, '', modePatch),
@@ -972,9 +489,8 @@ test('a mode-only checkpoint makes the peer working file executable', async () =
     worktreeDiff: modePatch,
   };
   const plan = {
-    repoKey,
+    repoKey: 'root:test',
     card: localCard,
-    branches: tracked.baseline.branches,
     transitions: [{
       checkpoint: CHECKPOINT_CONTRACT,
       machine: 'machine-remote',
@@ -995,16 +511,14 @@ test('a mode-only checkpoint makes the peer working file executable', async () =
   assert.equal(await git(repo, 'diff', '--cached', '--binary', '--full-index'), '');
 });
 
-test('once local work is on the rail, a later checkpoint replaces it exactly without echoing', async () => {
-  const { repo, oid } = await makeRepo('materialize-later-wins');
+test('once local work is on the rail, a checkpoint conflict materializes exactly without echoing', async () => {
+  const { repo, oid } = await makeRepo('materialize-conflict');
   const localPatch = await patchFor(repo, { 'a.txt': 'local answer\n' });
   const remotePatch = await patchFor(repo, { 'a.txt': 'remote answer\n' });
   const localTransition = transition('machine-local', 2, oid, '', localPatch);
-  const tracked = await establishTrackedBaseline(repo, oid, 'materialize_later_wins');
   const plan = {
-    repoKey: tracked.repoKey,
-    card: tracked.localCard,
-    branches: tracked.baseline.branches,
+    repoKey: 'root:test',
+    card: card(repo, oid, 1),
     transitions: [
       localTransition,
       transition('machine-remote', 3, oid, '', remotePatch),
@@ -1013,24 +527,20 @@ test('once local work is on the rail, a later checkpoint replaces it exactly wit
 
   fs.writeFileSync(path.join(repo, 'a.txt'), 'local answer\n');
   await git(repo, 'add', 'a.txt');
-  const localCard = await captureTrackedIntent(tracked.project, tracked.localCard);
-  const intents = require('../workspace/intent');
-  const reserved = intents.reservePublication(
-    tracked.project,
-    intents.readIntent(tracked.project),
-  );
-  intents.markPublicationFolded(
-    tracked.project,
-    reserved.publication.mutationId,
-    2,
-  );
+  assert.equal(captureIsOnRail(plan, {
+    baseOid: oid,
+    indexDiff: localPatch,
+    worktreeDiff: '',
+  }), true);
 
-  const outcome = await materializeRepo(localCard, plan, 3);
-  assert.equal(outcome.state, 'in-sync');
+  const outcome = await materializeRepo(plan.card, plan);
+  assert.equal(outcome.state, 'conflict');
   const first = fs.readFileSync(path.join(repo, 'a.txt'), 'utf8');
-  assert.equal(first, 'remote answer\n');
+  assert.match(first, /local answer/);
+  assert.match(first, /remote answer/);
+  assert.match(first, /<<<<<<< current/);
 
-  await materializeRepo(localCard, plan, 3);
+  await materializeRepo(plan.card, plan);
   assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), first);
 });
 
@@ -1039,8 +549,9 @@ test('a writer publishing again cannot erase its earlier uncommitted work', asyn
   const patchA = await patchFor(repo, { 'a.txt': 'a1\n' });
   const patchAB = await patchFor(repo, { 'a.txt': 'a1\n', 'b.txt': 'b1\n' });
   const patchABC = await patchFor(repo, {
-    'a.txt': 'a2\n',
+    'a.txt': 'a1\n',
     'b.txt': 'b1\n',
+    'c.txt': 'c1\n',
   });
   const machineA = card('/machine-a', oid, 1);
   machineA.machine = 'machine-a';
@@ -1059,88 +570,126 @@ test('a writer publishing again cannot erase its earlier uncommitted work', asyn
     { machine: 'machine-b', cards: [machineB] },
   ]).get('root:test');
   assert.deepEqual(plan.transitions.map((item) => item.version), [2, 3, 4]);
-  const tracked = await establishTrackedBaseline(repo, oid, 'checkpoint_history');
-  plan.repoKey = tracked.repoKey;
-  plan.card = tracked.localCard;
-  plan.branches = tracked.baseline.branches;
 
-  const outcome = await materializeRepo(tracked.localCard, plan, 4);
+  const outcome = await materializeRepo(card(repo, oid, 1), plan);
   assert.equal(outcome.state, 'in-sync');
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a2\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a1\n');
   assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'b1\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'c.txt'), 'utf8'), 'c1\n');
 });
 
-test('without verified provenance a later official card cannot overwrite unknown local bytes', async () => {
-  const rootCommit = 'unrelated-card-history';
-  const repoKey = `root:${rootCommit}`;
-  const { repo, oid: oldOid } = await makeRepo(rootCommit);
-  await git(repo, 'switch', '--orphan', 'winner');
-  fs.rmSync(path.join(repo, 'a.txt'), { force: true });
-  fs.rmSync(path.join(repo, 'b.txt'), { force: true });
-  fs.writeFileSync(path.join(repo, 'official.txt'), 'later official history\n');
-  await git(repo, 'add', '-A');
-  await git(repo, 'commit', '-m', 'unrelated official root');
-  const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', 'main');
-  fs.writeFileSync(path.join(repo, 'local.txt'), 'pending local bytes\n');
+test('a losing commit is parked, the winning card lands exactly, and losing work becomes uncommitted', async () => {
+  const { repo, oid: baseOid } = await makeRepo('simultaneous-commit');
+  fs.writeFileSync(path.join(repo, 'local-commit.txt'), 'losing commit work\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'local losing commit');
+  const losingOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  fs.writeFileSync(path.join(repo, 'local-dirty.txt'), 'also uncommitted\n');
 
-  const localCard = {
-    ...card(repo, oldOid, 1),
-    repo: { rootCommit, remote: null },
-  };
-  const targetCard = {
+  await git(repo, 'switch', '--detach', baseOid);
+  fs.writeFileSync(path.join(repo, 'winner.txt'), 'winning commit work\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'remote winning commit');
+  const winningOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  await git(repo, 'switch', '-C', 'main', losingOid);
+
+  const localCard = card(repo, losingOid, 1);
+  const winningCard = {
     ...localCard,
-    head: { branch: 'main', oid: targetOid, detached: false },
+    head: { branch: 'main', oid: winningOid, detached: false },
     positionVersion: 2,
-    positionMutationId: 'mut_unrelated_card',
+    positionMutationId: 'mut_card_winner_0001',
   };
   const outcome = await materializeRepo(localCard, {
-    repoKey,
-    card: targetCard,
+    repoKey: 'root:test',
+    card: winningCard,
     transitions: [],
-    branches: [{ name: 'main', oid: targetOid, version: 2 }],
-  }, 2);
-
-  assert.deepEqual(outcome, { state: 'waiting', reason: 'unknown-local-state' });
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), oldOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'local.txt'), 'utf8'), 'pending local bytes\n');
-  assert.equal(fs.existsSync(path.join(repo, 'official.txt')), false);
-});
+    parked: [],
+  });
 
-test('missing provenance never authorizes replacing a clean unnumbered commit', async () => {
-  const { repo, oid } = await makeRepo('unknown-clean-commit');
-  const tracked = await establishTrackedBaseline(repo, oid, 'unknown_clean_commit');
-  fs.rmSync(reducerStateFile(tracked.repoKey), { force: true });
+  assert.equal(outcome.state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), winningOid);
+  assert.equal((await git(repo, 'rev-parse', `refs/amalgm/parked/${losingOid}`)).trim(), losingOid);
+  assert.equal(fs.readFileSync(path.join(repo, 'winner.txt'), 'utf8'), 'winning commit work\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'local-commit.txt'), 'utf8'), 'losing commit work\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'local-dirty.txt'), 'utf8'), 'also uncommitted\n');
+  assert.equal((await git(repo, 'status', '--porcelain')).trim().length > 0, true);
+  assert.deepEqual(readRepoState('root:test').parked.map((entry) => entry.oid), [losingOid]);
+
+  const sharedParked = readRepoState('root:test').parked.map((entry) => ({
+    ...entry,
+    version: 2,
+  }));
+  await materializeRepo(card(repo, winningOid, 2), {
+    repoKey: 'root:test',
+    card: winningCard,
+    transitions: [],
+    parked: sharedParked,
+  });
 
-  fs.writeFileSync(path.join(repo, 'local-commit.txt'), 'not on the rail\n');
-  await git(repo, 'add', 'local-commit.txt');
-  await git(repo, 'commit', '-m', 'local unnumbered commit');
-  const localOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  const current = await observedCard(tracked.localCard);
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'fold parked work');
+  const foldedOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  const foldedCard = card(repo, foldedOid, 3);
+  const folded = await materializeRepo(foldedCard, {
+    repoKey: 'root:test',
+    card: foldedCard,
+    transitions: [],
+    parked: [],
+  });
 
-  assert.deepEqual(
-    await materializeRepo(current, tracked.baseline, 1),
-    { state: 'waiting', reason: 'unknown-local-state' },
+  assert.equal(folded.state, 'in-sync');
+  assert.deepEqual(readRepoState('root:test').parked, []);
+  await assert.rejects(
+    git(repo, 'rev-parse', '--verify', `refs/amalgm/parked/${losingOid}`),
   );
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'local-commit.txt'), 'utf8'), 'not on the rail\n');
 });
 
-test('missing provenance never authorizes replacing a branch-only local change', async () => {
-  const { repo, oid } = await makeRepo('unknown-local-branch');
-  const tracked = await establishTrackedBaseline(repo, oid, 'unknown_local_branch');
-  fs.rmSync(reducerStateFile(tracked.repoKey), { force: true });
+test('rail-parked peer commits become one staged checkpoint on every machine', async () => {
+  const { repo, oid: baseOid } = await makeRepo('peer-parked-commits');
 
-  await git(repo, 'branch', 'local-only');
-  const current = await observedCard(tracked.localCard);
+  await git(repo, 'switch', '-c', 'winner');
+  fs.writeFileSync(path.join(repo, 'winner.txt'), 'winning card\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'winning card');
+  const winningOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+
+  await git(repo, 'switch', '-C', 'loser-a', baseOid);
+  fs.writeFileSync(path.join(repo, 'loser-a.txt'), 'first losing commit\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'first losing commit');
+  const losingAOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+
+  await git(repo, 'switch', '-C', 'loser-b', baseOid);
+  fs.writeFileSync(path.join(repo, 'loser-b.txt'), 'second losing commit\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'second losing commit');
+  const losingBOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+
+  await git(repo, 'switch', '-C', 'main', winningOid);
+  const winningCard = card(repo, winningOid, 4);
+  const outcome = await materializeRepo(winningCard, {
+    repoKey: 'root:test',
+    card: winningCard,
+    transitions: [],
+    parked: [
+      { oid: losingAOid, version: 2 },
+      { oid: losingBOid, version: 3 },
+    ],
+  });
+
+  assert.equal(outcome.state, 'in-sync');
+  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), winningOid);
   assert.deepEqual(
-    await materializeRepo(current, tracked.baseline, 1),
-    { state: 'waiting', reason: 'unknown-local-state' },
+    (await git(repo, 'diff', '--cached', '--name-only')).trim().split('\n'),
+    ['loser-a.txt', 'loser-b.txt'],
   );
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/local-only')).trim(), oid);
+  assert.equal((await git(repo, 'diff', '--name-only')).trim(), '');
+  assert.equal(fs.readFileSync(path.join(repo, 'loser-a.txt'), 'utf8'), 'first losing commit\n');
+  assert.equal(fs.readFileSync(path.join(repo, 'loser-b.txt'), 'utf8'), 'second losing commit\n');
 });
 
-test('a local commit made after the verified card snapshot is never overwritten', async () => {
+test('a local commit made after the verified card snapshot is never parked or overwritten', async () => {
   const { repo, oid: baseOid } = await makeRepo('card-snapshot-race');
   const verifiedCard = card(repo, baseOid, 1);
 
@@ -1165,321 +714,30 @@ test('a local commit made after the verified card snapshot is never overwritten'
       positionMutationId: 'mut_card_snapshot_race',
     },
     transitions: [],
+    parked: [],
   });
 
   assert.equal(outcome.state, 'waiting');
-  assert.equal(outcome.reason, 'unknown-local-state');
+  assert.equal(outcome.reason, 'local-card-changed-after-verification');
   assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), lateLocalOid);
+  await assert.rejects(
+    git(repo, 'rev-parse', `refs/amalgm/parked/${lateLocalOid}`),
+  );
 });
 
-test('a local file write racing ordered apply waits, retries, and remains pending', async () => {
-  const { repo, oid } = await makeRepo('checkpoint-local-writer-race');
-  const tracked = await establishTrackedBaseline(repo, oid, 'checkpoint_local_writer_race');
-  const { localCard, baseline } = tracked;
-
-  const inbound = await patchFor(repo, { 'a.txt': 'official inbound\n' });
-  const plan = {
-    ...baseline,
-    transitions: [transition('machine-remote', 2, oid, '', inbound)],
-  };
-  const transitions = require('../workspace/transition');
-  const applyFiles = transitions.applyFiles;
-  let raced = false;
-  transitions.applyFiles = async (...args) => {
-    if (!raced) {
-      raced = true;
-      fs.writeFileSync(path.join(repo, 'a.txt'), 'pending local writer\n');
-    }
-    return applyFiles(...args);
-  };
-  let first;
-  try {
-    first = await materializeRepo(localCard, plan, 2);
-  } finally {
-    transitions.applyFiles = applyFiles;
-  }
-
-  assert.deepEqual(first, { state: 'waiting', reason: 'local-state-moving' });
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'pending local writer\n');
-  assert.equal(readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough, 1);
-
-  const recovered = await materializeRepo(localCard, plan, 2);
-  assert.equal(recovered.state, 'in-sync', JSON.stringify(recovered));
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'pending local writer\n');
-  const state = readRepoState(tracked.repoKey, tracked.project.resourceId);
-  assert.equal(state.appliedThrough, 2);
-  assert.equal(Object.hasOwn(state, 'pendingCheckpoint'), false);
-  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
-});
-
-test('restart resumes a card apply before advancing and preserves downtime writes', async () => {
-  const { repo, oid: baseOid } = await makeRepo('crash-safe-card-apply');
-  await git(repo, 'switch', '-c', 'incoming');
-  fs.writeFileSync(path.join(repo, 'remote.txt'), 'official target\n');
-  await git(repo, 'add', 'remote.txt');
-  await git(repo, 'commit', '-m', 'official target');
-  const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '-C', 'main', baseOid);
-  const tracked = await establishTrackedBaseline(repo, baseOid, 'crash_safe_card_apply');
-
-  fs.writeFileSync(path.join(repo, 'a.txt'), 'staged before crash\n');
-  await git(repo, 'add', 'a.txt');
-  fs.writeFileSync(path.join(repo, 'b.txt'), 'working before crash\n');
-  fs.writeFileSync(path.join(repo, 'local.txt'), 'untracked before crash\n');
-
-  const repoKey = tracked.repoKey;
-  const localCard = {
-    ...await captureTrackedIntent(tracked.project, tracked.localCard),
-    repo: { rootCommit: 'crash-safe-card-apply', remote: null },
-  };
-  const targetCard = {
-    ...localCard,
-    head: { branch: 'main', oid: targetOid, detached: false },
-    positionVersion: 2,
-    positionMutationId: 'mut_crash_safe_card',
-  };
-  const plan = {
-    repoKey,
-    card: targetCard,
-    transitions: [],
-    branches: [{ name: 'main', oid: targetOid, version: 2 }],
-  };
-
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  transitions.updateBranchRefs = async (...args) => {
-    await updateBranchRefs(...args);
-    throw new Error('simulated process death after HEAD movement');
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(localCard, plan, 2),
-      /simulated process death/,
-    );
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), targetOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'staged before crash\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'working before crash\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'local.txt'), 'utf8'), 'untracked before crash\n');
-  assert.equal(fs.existsSync(path.join(repo, 'remote.txt')), false);
-  assert.equal(readRepoState(repoKey, tracked.project.resourceId).appliedThrough, 1);
-  assert.equal(readRepoState(repoKey, tracked.project.resourceId).applying.contract, 'repo-apply@4');
-
-  fs.writeFileSync(path.join(repo, 'b.txt'), 'written while reducer was down\n');
-  fs.writeFileSync(path.join(repo, 'downtime.txt'), 'new while reducer was down\n');
-
-  const recovered = await materializeRepo({
-    ...localCard,
-    head: { branch: 'main', oid: targetOid, detached: false },
-    positionVersion: 2,
-    repo: { rootCommit: 'crash-safe-card-apply', remote: null },
-  }, plan, 2);
-  assert.equal(recovered.state, 'in-sync', JSON.stringify(recovered));
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), targetOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'remote.txt'), 'utf8'), 'official target\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'staged before crash\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'written while reducer was down\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'local.txt'), 'utf8'), 'untracked before crash\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'downtime.txt'), 'utf8'), 'new while reducer was down\n');
-  assert.match(await git(repo, 'diff', '--cached', '--name-only'), /a\.txt/);
-  assert.equal(readRepoState(repoKey, tracked.project.resourceId).appliedThrough, 2);
-  assert.equal(readRepoState(repoKey, tracked.project.resourceId).applying, undefined);
-});
-
-test('card apply replay is idempotent after file and index boundaries', async () => {
-  for (const boundary of ['files', 'index']) {
-    const rootCommit = `card-boundary-${boundary}`;
-    const repoKey = `root:${rootCommit}`;
-    const { repo, oid: baseOid } = await makeRepo(rootCommit);
-    await git(repo, 'switch', '-c', 'incoming');
-    fs.writeFileSync(path.join(repo, 'remote.txt'), `official ${boundary}\n`);
-    await git(repo, 'add', 'remote.txt');
-    await git(repo, 'commit', '-m', `official ${boundary}`);
-    const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-    await git(repo, 'switch', '-C', 'main', baseOid);
-    const tracked = await establishTrackedBaseline(repo, baseOid, `card_boundary_${boundary}`);
-    fs.writeFileSync(path.join(repo, 'a.txt'), `staged ${boundary}\n`);
-    await git(repo, 'add', 'a.txt');
-    fs.writeFileSync(path.join(repo, 'b.txt'), `working ${boundary}\n`);
-
-    const localCard = {
-      ...await captureTrackedIntent(tracked.project, tracked.localCard),
-      repo: { rootCommit, remote: null },
-    };
-    const targetCard = {
-      ...localCard,
-      head: { branch: 'main', oid: targetOid, detached: false },
-      positionVersion: 2,
-      positionMutationId: `mut_card_boundary_${boundary}`,
-    };
-    const plan = {
-      repoKey: tracked.repoKey,
-      card: targetCard,
-      transitions: [],
-      branches: [{ name: 'main', oid: targetOid, version: 2 }],
-    };
-
-    const transitions = require('../workspace/transition');
-    const mergeModule = require('../workspace/merge');
-    const original = boundary === 'files'
-      ? mergeModule.advance
-      : transitions.applyIndexPatch;
-    let tripped = false;
-    if (boundary === 'files') {
-      mergeModule.advance = async (...args) => {
-        const result = await original(...args);
-        if (!tripped && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
-          tripped = true;
-          throw new Error('simulated process death after files');
-        }
-        return result;
-      };
-    } else {
-      transitions.applyIndexPatch = async (...args) => {
-        const result = await original(...args);
-        if (!tripped) {
-          tripped = true;
-          throw new Error('simulated process death after index');
-        }
-        return result;
-      };
-    }
-    try {
-      await assert.rejects(
-        materializeRepo(localCard, plan, 2),
-        /simulated process death/,
-      );
-    } finally {
-      if (boundary === 'files') mergeModule.advance = original;
-      else transitions.applyIndexPatch = original;
-    }
-
-    assert.equal(
-      readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough,
-      1,
-    );
-    fs.writeFileSync(path.join(repo, 'b.txt'), `downtime ${boundary}\n`);
-    const recovered = await materializeRepo({
-      ...localCard,
-      head: { branch: 'main', oid: targetOid, detached: false },
-      positionVersion: 2,
-      repo: { rootCommit, remote: null },
-    }, plan, 2);
-    assert.equal(recovered.state, 'in-sync');
-    assert.equal(fs.readFileSync(path.join(repo, 'remote.txt'), 'utf8'), `official ${boundary}\n`);
-    assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), `staged ${boundary}\n`);
-    assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), `downtime ${boundary}\n`);
-    assert.equal(readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough, 2);
-    assert.equal(readRepoState(tracked.repoKey, tracked.project.resourceId).applying, undefined);
-  }
-});
-
-test('a downtime commit stays pending while recovery finishes N before newer N+1', async () => {
-  const rootCommit = 'card-recovery-newer-rail';
-  const repoKey = `root:${rootCommit}`;
-  const { repo, oid: baseOid } = await makeRepo(rootCommit);
-  await git(repo, 'switch', '-c', 'incoming');
-  fs.writeFileSync(path.join(repo, 'official-n.txt'), 'official N\n');
-  await git(repo, 'add', 'official-n.txt');
-  await git(repo, 'commit', '-m', 'official N');
-  const targetN = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  fs.writeFileSync(path.join(repo, 'official-n-plus-one.txt'), 'official N+1\n');
-  await git(repo, 'add', 'official-n-plus-one.txt');
-  await git(repo, 'commit', '-m', 'official N+1');
-  const targetN1 = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '-C', 'main', baseOid);
-  const tracked = await establishTrackedBaseline(repo, baseOid, 'card_recovery_newer_rail');
-  fs.writeFileSync(path.join(repo, 'before-crash.txt'), 'local before crash\n');
-
-  const localCard = {
-    ...await captureTrackedIntent(tracked.project, tracked.localCard),
-    repo: { rootCommit, remote: null },
-  };
-  const cardN = {
-    ...localCard,
-    head: { branch: 'main', oid: targetN, detached: false },
-    positionVersion: 2,
-    positionMutationId: 'mut_card_recovery_n',
-  };
-  const planN = {
-    repoKey: tracked.repoKey,
-    card: cardN,
-    transitions: [],
-    branches: [{ name: 'main', oid: targetN, version: 2 }],
-  };
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  transitions.updateBranchRefs = async (...args) => {
-    await updateBranchRefs(...args);
-    throw new Error('simulated process death before N finished');
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(localCard, planN, 2),
-      /simulated process death/,
-    );
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-
-  fs.writeFileSync(path.join(repo, 'downtime-commit.txt'), 'committed while down\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'local commit while reducer is down');
-  const pendingOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-
-  const cardN1 = {
-    ...cardN,
-    head: { branch: 'main', oid: targetN1, detached: false },
-    positionVersion: 3,
-    positionMutationId: 'mut_card_recovery_n_plus_one',
-  };
-  const latest = {
-    repoKey: tracked.repoKey,
-    card: cardN1,
-    transitions: [],
-    branches: [{ name: 'main', oid: targetN1, version: 3 }],
-  };
-  const recovered = await materializeRepo({
-    ...localCard,
-    head: { branch: 'main', oid: pendingOid, detached: false },
-    positionVersion: null,
-    positionMutationId: null,
-  }, latest, 3);
-
-  assert.equal(recovered.state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), pendingOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'downtime-commit.txt'), 'utf8'), 'committed while down\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'before-crash.txt'), 'utf8'), 'local before crash\n');
-  assert.equal(
-    fs.readFileSync(path.join(repo, 'official-n-plus-one.txt'), 'utf8'),
-    'official N+1\n',
-  );
-  const state = readRepoState(tracked.repoKey, tracked.project.resourceId);
-  assert.equal(state.appliedThrough, 3);
-  assert.equal(Object.hasOwn(state, 'pendingCard'), false);
-  assert.equal(
-    require('../workspace/intent').readOwnedIntent(tracked.project).local.card.head.oid,
-    pendingOid,
-  );
-  assert.equal(state.applying, undefined);
-});
-
-test('a pending descendant commit catches up without becoming a losing commit', async () => {
-  const { repo, oid: baseOid } = await makeRepo('pending-descendant-card');
-  const firstPatch = await patchFor(repo, { 'a.txt': 'before commit\n' });
-  const secondPatch = await patchFor(repo, {
-    'a.txt': 'before commit\n',
-    'b.txt': 'after commit\n',
-  });
-  const tracked = await establishTrackedBaseline(repo, baseOid, 'pending_descendant_card');
-  const winningCard = tracked.localCard;
-  const before = {
-    repoKey: tracked.repoKey,
-    card: winningCard,
-    transitions: [transition('machine-peer', 2, baseOid, '', firstPatch)],
+test('a pending descendant commit catches up without becoming a losing commit', async () => {
+  const { repo, oid: baseOid } = await makeRepo('pending-descendant-card');
+  const firstPatch = await patchFor(repo, { 'a.txt': 'before commit\n' });
+  const secondPatch = await patchFor(repo, {
+    'a.txt': 'before commit\n',
+    'b.txt': 'after commit\n',
+  });
+  const winningCard = card(repo, baseOid, 1);
+  const before = {
+    repoKey: 'root:test',
+    card: winningCard,
+    transitions: [transition('machine-peer', 2, baseOid, '', firstPatch)],
+    parked: [],
   };
 
   await materializeRepo(winningCard, before, 2);
@@ -1487,7 +745,7 @@ test('a pending descendant commit catches up without becoming a losing commit',
   await git(repo, 'commit', '-m', 'local pending card');
   const pendingOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
 
-  const pendingCard = await captureTrackedIntent(tracked.project, winningCard);
+  const pendingCard = card(repo, pendingOid, null);
   const caughtUp = await materializeRepo(pendingCard, {
     ...before,
     transitions: [
@@ -1503,55 +761,13 @@ test('a pending descendant commit catches up without becoming a losing commit',
   const staged = (await git(repo, 'diff', '--cached', '--name-only')).trim();
   const status = (await git(repo, 'status', '--short')).trim();
   assert.equal(staged, 'b.txt', status);
-  const state = readRepoState(tracked.repoKey, tracked.project.resourceId);
-  assert.equal(state.baseOid, baseOid);
-  assert.equal(state.appliedThrough, 3);
-  assert.equal(
-    require('../workspace/intent').readOwnedIntent(tracked.project).local.card.head.oid,
-    pendingOid,
+  await assert.rejects(
+    git(repo, 'rev-parse', `refs/amalgm/parked/${pendingOid}`),
   );
-});
-
-test('a pending divergent commit is local intent, not a losing numbered card', async () => {
-  const { repo, oid: baseOid } = await makeRepo('pending-divergent-card');
-  const tracked = await establishTrackedBaseline(repo, baseOid, 'pending_divergent_card');
-  const { repoKey, localCard: baseCard } = tracked;
-
-  await git(repo, 'switch', '-c', 'peer', baseOid);
-  fs.writeFileSync(path.join(repo, 'peer.txt'), 'peer\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'peer card');
-  const peerOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-
-  await git(repo, 'switch', '-C', 'main', baseOid);
-  fs.writeFileSync(path.join(repo, 'local.txt'), 'local\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'local card while behind');
-  const localOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  const localCard = await captureTrackedIntent(tracked.project, baseCard);
-  const birthMutationId = require('../workspace/intent')
-    .readOwnedIntent(tracked.project).birthMutationId;
-  const outcome = await materializeRepo(localCard, {
-    repoKey,
-    card: {
-      ...baseCard,
-      head: { branch: 'main', oid: peerOid, detached: false },
-      positionVersion: 2,
-      positionMutationId: 'mut_peer_card_0001',
-    },
-    transitions: [],
-    branches: [{ name: 'main', oid: peerOid, version: 2 }],
-  }, 2);
-
-  assert.equal(outcome.state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'local.txt'), 'utf8'), 'local\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'peer.txt'), 'utf8'), 'peer\n');
-  const pending = require('../workspace/intent').readOwnedIntent(tracked.project);
-  assert.equal(pending.local.card.head.branch, 'main');
-  assert.equal(pending.local.card.head.oid, localOid);
-  assert.equal(pending.base.through, 2);
-  assert.equal(pending.birthMutationId, birthMutationId);
+  const state = readRepoState('root:test');
+  assert.equal(state.baseOid, pendingOid);
+  assert.equal(state.appliedThrough, 3);
+  assert.equal(state.cardVersion, null);
 });
 
 test('an empty index advance cannot overwrite a commit that just finished', async () => {
@@ -1569,27 +785,22 @@ test('an empty index advance cannot overwrite a commit that just finished', asyn
   assert.equal((await git(repo, 'status', '--porcelain')).trim(), '');
 });
 
-test('an index advance stops before touching unrelated work staged after its seal', async () => {
+test('an index advance preserves unrelated work staged by another writer', async () => {
   const { repo } = await makeRepo('index-writers');
-  const operation = '8'.repeat(64);
   const observedIndex = (await git(repo, 'write-tree')).trim();
   const peerPatch = await patchFor(repo, { 'b.txt': 'peer\n' });
   const peerTree = await require('../workspace/merge').treeOfPatch(repo, 'HEAD', peerPatch);
 
   fs.writeFileSync(path.join(repo, 'a.txt'), 'local\n');
   await git(repo, 'add', 'a.txt');
-  const outcome = await advanceIndex(repo, observedIndex, peerTree, operation);
+  const outcome = await advanceIndex(repo, observedIndex, peerTree);
 
-  assert.deepEqual(outcome, {
-    state: 'waiting',
-    reason: 'local-index-moving',
-    moved: false,
-  });
+  assert.deepEqual(outcome, { state: 'ready', moved: true });
   const staged = await git(repo, 'diff', '--cached', '--name-only');
-  assert.deepEqual(staged.trim().split('\n'), ['a.txt']);
+  assert.deepEqual(staged.trim().split('\n').sort(), ['a.txt', 'b.txt']);
 });
 
-test('a new card includes checkpoint work already on the rail instead of replaying it as local work', async () => {
+test('a new card folds checkpoint work already on the rail instead of replaying it as local work', async () => {
   const { repo, oid: baseOid } = await makeRepo('card-folds-shared-checkpoint');
   const sharedPatch = await patchFor(repo, { 'a.txt': 'shared checkpoint\n' });
 
@@ -1600,18 +811,16 @@ test('a new card includes checkpoint work already on the rail instead of replayi
   const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
   await git(repo, 'switch', 'main');
 
-  const tracked = await establishTrackedBaseline(repo, baseOid, 'card_folds_shared_checkpoint');
-  const oldCard = tracked.localCard;
+  const oldCard = card(repo, baseOid, 1);
   await materializeRepo(oldCard, {
-    repoKey: tracked.repoKey,
+    repoKey: 'root:test',
     card: oldCard,
     transitions: [transition('machine-remote', 2, baseOid, '', sharedPatch)],
-    branches: tracked.baseline.branches,
-  }, 2);
+  });
   assert.notEqual((await git(repo, 'status', '--porcelain')).trim(), '');
 
   const outcome = await materializeRepo(oldCard, {
-    repoKey: tracked.repoKey,
+    repoKey: 'root:test',
     card: {
       ...oldCard,
       head: { branch: 'main', oid: targetOid, detached: false },
@@ -1619,14 +828,14 @@ test('a new card includes checkpoint work already on the rail instead of replayi
       positionMutationId: 'mut_card_shared_fold',
     },
     transitions: [],
-    branches: [{ name: 'main', oid: targetOid, version: 3 }],
-  }, 3);
-  assert.equal(outcome.state, 'in-sync', outcome.reason);
+    parked: [],
+  });
+  assert.equal(outcome.state, 'in-sync');
   assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), targetOid);
   assert.equal((await git(repo, 'status', '--porcelain')).trim(), '');
 });
 
-test('checkpoint then commit advances through the same card movement and unrelated local work stays', async () => {
+test('checkpoint then commit folds through the same card movement and unrelated local work stays', async () => {
   const { repo, oid: baseOid } = await makeRepo('checkpoint-commit-fold');
   await git(repo, 'switch', '-c', 'target');
   fs.writeFileSync(path.join(repo, 'shared.txt'), 'already checkpointed\n');
@@ -1634,13 +843,12 @@ test('checkpoint then commit advances through the same card movement and unrelat
   await git(repo, 'commit', '-m', 'commit checkpointed work');
   const targetOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
   await git(repo, 'switch', '-C', 'main', baseOid);
-  const tracked = await establishTrackedBaseline(repo, baseOid, 'checkpoint_commit_fold');
 
   fs.writeFileSync(path.join(repo, 'shared.txt'), 'already checkpointed\n');
   fs.writeFileSync(path.join(repo, 'local-only.txt'), 'keep me dirty\n');
-  const localCard = await captureTrackedIntent(tracked.project, tracked.localCard);
+  const localCard = card(repo, baseOid, 1);
   const outcome = await materializeRepo(localCard, {
-    repoKey: tracked.repoKey,
+    repoKey: 'root:test',
     card: {
       ...localCard,
       head: { branch: 'main', oid: targetOid, detached: false },
@@ -1648,10 +856,11 @@ test('checkpoint then commit advances through the same card movement and unrelat
       positionMutationId: 'mut_card_fold_00001',
     },
     transitions: [],
+    parked: [],
     branches: [{ name: 'main', oid: targetOid, version: 2 }],
   });
 
-  assert.equal(outcome.state, 'in-sync', outcome.reason);
+  assert.equal(outcome.state, 'in-sync');
   assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), targetOid);
   assert.equal(fs.readFileSync(path.join(repo, 'shared.txt'), 'utf8'), 'already checkpointed\n');
   assert.equal(fs.readFileSync(path.join(repo, 'local-only.txt'), 'utf8'), 'keep me dirty\n');
@@ -1668,18 +877,18 @@ test('the materializer creates, moves, and deletes branch refs without checking
   await git(repo, 'switch', 'main');
   await git(repo, 'branch', '-D', 'feature');
 
-  const tracked = await establishTrackedBaseline(repo, oid, 'branches');
-  const { localCard, repoKey } = tracked;
+  const localCard = card(repo, oid, 1);
   const createdPlan = {
-    repoKey,
+    repoKey: 'root:test',
     card: localCard,
     transitions: [],
+    parked: [],
     branches: [
       { name: 'main', oid, version: 1 },
       { name: 'feature', oid: featureOid, version: 2 },
     ],
   };
-  await materializeRepo(localCard, createdPlan, 2);
+  await materializeRepo(localCard, createdPlan);
   assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureOid);
   assert.equal((await git(repo, 'branch', '--show-current')).trim(), 'main');
 
@@ -1689,81 +898,11 @@ test('the materializer creates, moves, and deletes branch refs without checking
       { name: 'main', oid, version: 1 },
       { name: 'feature', oid: null, version: 3 },
     ],
-  }, 3);
+  });
   await assert.rejects(() => git(repo, 'rev-parse', 'refs/heads/feature'));
   assert.equal((await git(repo, 'branch', '--show-current')).trim(), 'main');
 });
 
-test('an official branch without a complete object source is terminal corruption', async () => {
-  const { repo, oid } = await makeRepo('branch-event-waits');
-  const peer = path.join(tempRoot, 'branch-event-waits-peer');
-  await git(tempRoot, 'clone', '--quiet', repo, peer);
-  await git(peer, 'switch', '-c', 'feature');
-  fs.writeFileSync(path.join(peer, 'feature.txt'), 'feature\n');
-  await git(peer, 'add', '.');
-  await git(peer, 'commit', '-m', 'feature');
-  const featureOid = (await git(peer, 'rev-parse', 'HEAD')).trim();
-
-  const tracked = await establishTrackedBaseline(repo, oid, 'branch_event_waits');
-  const { repoKey, localCard } = tracked;
-  const plan = {
-    repoKey,
-    card: localCard,
-    transitions: [],
-    branches: [
-      { name: 'main', oid, version: 1 },
-      { name: 'feature', oid: featureOid, version: 2 },
-    ],
-  };
-
-  await assert.rejects(
-    materializeRepo(localCard, plan, 2),
-    /official branch feature has no complete bundle/,
-  );
-  assert.equal(readRepoState(repoKey).appliedThrough, 1);
-  await assert.rejects(() => git(repo, 'rev-parse', 'refs/heads/feature'));
-
-  await git(repo, 'fetch', '--quiet', peer, 'feature:refs/amalgm-test/feature');
-  const applied = await materializeRepo(localCard, plan, 2);
-  assert.equal(applied.state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureOid);
-  assert.equal(readRepoState(repoKey).appliedThrough, 2);
-});
-
-test('a malformed earlier checkpoint prevents a later ready branch from applying', async () => {
-  const { repo, oid } = await makeRepo('checkpoint-before-branch');
-  await git(repo, 'switch', '-c', 'feature');
-  fs.writeFileSync(path.join(repo, 'feature.txt'), 'feature\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'feature');
-  const featureOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', 'main');
-  await git(repo, 'branch', '-D', 'feature');
-
-  const missing = transition('machine-peer', 2, oid, '', '');
-  missing.from = {
-    revision: 'a'.repeat(64),
-    payload: { kind: 'pending', contract: 'opaque-chunks@2', checksum: 'b'.repeat(64) },
-  };
-  missing.to = missing.from;
-  const repoKey = 'root:checkpoint-before-branch';
-  const localCard = card(repo, oid, 1);
-  await assert.rejects(
-    materializeRepo(localCard, {
-      repoKey,
-      card: localCard,
-      transitions: [missing],
-      branches: [
-        { name: 'main', oid, version: 1 },
-        { name: 'feature', oid: featureOid, version: 3 },
-      ],
-    }, 3),
-    /official checkpoint is payload-pending/,
-  );
-  await assert.rejects(() => git(repo, 'rev-parse', 'refs/heads/feature'));
-  assert.equal(readRepoState(repoKey), null);
-});
-
 test('an unpublished local branch delete is not restored while catching up', async () => {
   const { repo, oid } = await makeRepo('pending-branch-delete');
   await git(repo, 'switch', '-c', 'feature');
@@ -1774,162 +913,27 @@ test('an unpublished local branch delete is not restored while catching up', asy
   await git(repo, 'switch', 'main');
   await git(repo, 'branch', '-D', 'feature');
 
-  const tracked = await establishTrackedBaseline(repo, oid, 'pending_branch_delete');
-  const localCard = tracked.localCard;
+  const localCard = card(repo, oid, 1);
   const plan = {
-    repoKey: tracked.repoKey,
+    repoKey: 'root:pending-branch-delete',
     card: localCard,
     transitions: [],
+    parked: [],
     branches: [
       { name: 'main', oid, version: 1 },
       { name: 'feature', oid: featureOid, version: 2 },
     ],
   };
-  await materializeRepo(localCard, plan, 2);
+  await materializeRepo(localCard, plan);
   assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureOid);
 
   await git(repo, 'branch', '-D', 'feature');
-  const deletedCard = await captureTrackedIntent(tracked.project, localCard);
-  await materializeRepo(deletedCard, plan, 2);
+  await materializeRepo(localCard, plan);
 
   await assert.rejects(() => git(repo, 'rev-parse', 'refs/heads/feature'));
   assert.equal((await git(repo, 'branch', '--show-current')).trim(), 'main');
 });
 
-test('an acknowledged old branch yields to the later official branch and only then advances', async () => {
-  const { repo, oid: baseOid } = await makeRepo('acknowledged-branch-yields');
-  await git(repo, 'switch', '-c', 'value-a');
-  fs.writeFileSync(path.join(repo, 'value.txt'), 'A\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'value A');
-  const oidA = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '-C', 'value-b', baseOid);
-  fs.writeFileSync(path.join(repo, 'value.txt'), 'B\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'value B');
-  const oidB = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', 'main');
-  await git(repo, 'branch', '-D', 'value-a', 'value-b');
-
-  const tracked = await establishTrackedBaseline(repo, baseOid, 'acknowledged_branch_yields');
-  const { repoKey, localCard } = tracked;
-  const officialA = {
-    name: 'storm/rebase',
-    oid: oidA,
-    version: 162,
-    mutationId: 'mut_branch_value_a',
-  };
-  const first = {
-    repoKey,
-    card: localCard,
-    transitions: [],
-    branches: [
-      { name: 'main', oid: baseOid, version: 1 },
-      officialA,
-    ],
-  };
-  assert.equal((await materializeRepo(localCard, first, 162)).state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/storm/rebase')).trim(), oidA);
-
-  const officialB = {
-    name: 'storm/rebase',
-    oid: oidB,
-    version: 168,
-    mutationId: 'mut_branch_value_b',
-  };
-  const later = {
-    ...first,
-    branches: [
-      { name: 'main', oid: baseOid, version: 1 },
-      officialB,
-    ],
-  };
-  const applied = await materializeRepo(localCard, later, 172);
-  assert.equal(applied.state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/storm/rebase')).trim(), oidB);
-  const state = readRepoState(repoKey);
-  assert.equal(state.appliedThrough, 172);
-  assert.equal(Object.hasOwn(state, 'pendingRefs'), false);
-  assert.equal(state.materialized, true);
-  assert.equal(state.expectedPhysicalDigest, state.observedPhysicalDigest);
-
-  const afterRestart = await materializeRepo(localCard, later, 172);
-  assert.equal(afterRestart.state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/storm/rebase')).trim(), oidB);
-});
-
-test('a durable branch intent survives catch-up, then yields after ownership ends', async () => {
-  const { repo, oid: baseOid } = await makeRepo('explicit-pending-branch');
-  const commits = {};
-  for (const valueName of ['a', 'b', 'c', 'd']) {
-    await git(repo, 'switch', '-C', `value-${valueName}`, baseOid);
-    fs.writeFileSync(path.join(repo, 'value.txt'), `${valueName}\n`);
-    await git(repo, 'add', '.');
-    await git(repo, 'commit', '-m', `value ${valueName}`);
-    commits[valueName] = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  }
-  await git(repo, 'switch', 'main');
-  await git(repo, 'branch', '-D', 'value-a', 'value-b', 'value-c', 'value-d');
-
-  const tracked = await establishTrackedBaseline(repo, baseOid, 'explicit_pending_branch');
-  const { repoKey, localCard } = tracked;
-  const ref = (oid, version, machine) => ({
-    name: 'feature',
-    oid,
-    version,
-    mutationId: `mut_${machine}_${version}`,
-  });
-  const officialA = ref(commits.a, 10, 'local');
-  const planA = {
-    repoKey,
-    card: localCard,
-    transitions: [],
-    branches: [
-      { name: 'main', oid: baseOid, version: 1 },
-      officialA,
-    ],
-  };
-  await materializeRepo(localCard, planA, 10);
-  await git(repo, 'update-ref', 'refs/heads/feature', commits.c);
-  const intentCard = await captureTrackedIntent(tracked.project, localCard);
-
-  const officialB = ref(commits.b, 11, 'remote');
-  const planB = {
-    ...planA,
-    branches: [
-      { name: 'main', oid: baseOid, version: 1 },
-      officialB,
-    ],
-  };
-  assert.equal((await materializeRepo(intentCard, planB, 11)).state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), commits.c);
-  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
-
-  const acknowledgedC = ref(commits.c, 12, 'local');
-  const planC = {
-    ...planB,
-    branches: [
-      { name: 'main', oid: baseOid, version: 1 },
-      acknowledgedC,
-    ],
-  };
-  assert.equal((await materializeRepo(localCard, planC, 12)).state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), commits.c);
-  require('../workspace/intent').clearIntent(tracked.project);
-
-  const officialD = ref(commits.d, 13, 'remote');
-  const planD = {
-    ...planC,
-    branches: [
-      { name: 'main', oid: baseOid, version: 1 },
-      officialD,
-    ],
-  };
-  assert.equal((await materializeRepo(localCard, planD, 13)).state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), commits.d);
-  assert.equal(Object.hasOwn(readRepoState(repoKey), 'pendingRefs'), false);
-});
-
 test('a card branch switch follows branch and OID together and leaves the old branch unchanged', async () => {
   const { repo, oid: mainOid } = await makeRepo('card-branch-switch');
   await git(repo, 'checkout', '-b', 'feature');
@@ -1939,13 +943,12 @@ test('a card branch switch follows branch and OID together and leaves the old br
   const featureOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
   await git(repo, 'checkout', 'main');
 
-  const tracked = await establishTrackedBaseline(repo, mainOid, 'card_branch_switch');
-  const local = tracked.localCard;
+  const local = card(repo, mainOid, 1);
   const winning = card('/peer', featureOid, 2);
   winning.head.branch = 'feature';
   winning.objects = { kind: 'local' };
   const outcome = await materializeRepo(local, {
-    repoKey: tracked.repoKey,
+    repoKey: 'root:test',
     card: winning,
     transitions: [],
     branches: [
@@ -1963,14 +966,13 @@ test('a card branch switch follows branch and OID together and leaves the old br
 test('a branch-only card change at the same commit still switches the exact branch', async () => {
   const { repo, oid } = await makeRepo('same-oid-branch-switch');
   await git(repo, 'branch', 'feature');
-  const tracked = await establishTrackedBaseline(repo, oid, 'same_oid_branch_switch');
-  const local = tracked.localCard;
+  const local = card(repo, oid, 1);
   const winning = card('/peer', oid, 2);
   winning.head.branch = 'feature';
   winning.objects = { kind: 'local' };
 
   const outcome = await materializeRepo(local, {
-    repoKey: tracked.repoKey,
+    repoKey: 'root:test',
     card: winning,
     transitions: [],
     branches: [
@@ -1982,907 +984,3 @@ test('a branch-only card change at the same commit still switches the exact bran
   assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
   assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), oid);
 });
-
-async function makePostRefHeadSwitchPlan(rootCommit) {
-  const { repo, oid: sourceOid } = await makeRepo(rootCommit);
-  await git(repo, 'switch', '--detach', sourceOid);
-  fs.writeFileSync(path.join(repo, 'main-target.txt'), 'main target\n');
-  await git(repo, 'add', 'main-target.txt');
-  await git(repo, 'commit', '-m', 'main target');
-  const mainTarget = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '--detach', sourceOid);
-  fs.writeFileSync(path.join(repo, 'feature-target.txt'), 'feature target\n');
-  await git(repo, 'add', 'feature-target.txt');
-  await git(repo, 'commit', '-m', 'feature target');
-  const featureTarget = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '-C', 'main', sourceOid);
-  const tracked = await establishTrackedBaseline(
-    repo,
-    sourceOid,
-    rootCommit.replaceAll('-', '_'),
-  );
-  const winning = {
-    ...tracked.localCard,
-    head: { branch: 'feature', oid: featureTarget, detached: false },
-    positionVersion: 2,
-    positionMutationId: 'mut_post_ref_head_switch',
-  };
-  const plan = {
-    repoKey: tracked.repoKey,
-    card: winning,
-    transitions: [],
-    branches: [
-      {
-        name: 'main',
-        oid: mainTarget,
-        version: 2,
-        mutationId: 'mut_post_ref_main_move',
-      },
-      {
-        name: 'feature',
-        oid: featureTarget,
-        version: 2,
-        mutationId: 'mut_post_ref_feature',
-      },
-    ],
-  };
-  return {
-    repo,
-    sourceOid,
-    mainTarget,
-    featureTarget,
-    tracked,
-    plan,
-  };
-}
-
-test('a branch switch derives HEAD from the sealed post-ref plan when the old branch also moves', async () => {
-  const {
-    repo,
-    mainTarget,
-    featureTarget,
-    tracked,
-    plan,
-  } = await makePostRefHeadSwitchPlan('post-ref-head-switch');
-  const result = await materializeRepo(tracked.localCard, plan, 2);
-  assert.equal(result.state, 'in-sync', result.reason);
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), featureTarget);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), mainTarget);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureTarget);
-  assert.equal(require('../workspace/intent').readOwnedIntent(tracked.project), null);
-});
-
-test('restart recognizes a sealed post-ref HEAD before finishing the branch switch', async () => {
-  const {
-    repo,
-    mainTarget,
-    featureTarget,
-    tracked,
-    plan,
-  } = await makePostRefHeadSwitchPlan('post-ref-head-switch-restart');
-  const transitions = require('../workspace/transition');
-  const moveHeadToCard = transitions.moveHeadToCard;
-  let crashed = false;
-  transitions.moveHeadToCard = async (...args) => {
-    if (!crashed) {
-      crashed = true;
-      assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
-      assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), mainTarget);
-      assert.equal(
-        (await git(repo, 'rev-parse', 'refs/heads/feature')).trim(),
-        featureTarget,
-      );
-      throw new Error('simulated process death after ref batch before HEAD');
-    }
-    return moveHeadToCard(...args);
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death after ref batch before HEAD/,
-    );
-  } finally {
-    transitions.moveHeadToCard = moveHeadToCard;
-  }
-
-  assert.equal(readRepoState(
-    tracked.repoKey,
-    tracked.project.resourceId,
-  ).appliedThrough, 1);
-  const recovered = await materializeRepo(
-    await observedCard(tracked.localCard),
-    plan,
-    2,
-  );
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), featureTarget);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), mainTarget);
-  assert.equal(require('../workspace/intent').readOwnedIntent(tracked.project), null);
-});
-
-test('a source-branch return after the ref receipt remains local during HEAD recovery', async () => {
-  const {
-    repo,
-    sourceOid,
-    mainTarget,
-    tracked,
-    plan,
-  } = await makePostRefHeadSwitchPlan('post-ref-head-switch-aba');
-  const transitions = require('../workspace/transition');
-  const moveHeadToCard = transitions.moveHeadToCard;
-  transitions.moveHeadToCard = async () => {
-    assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), mainTarget);
-    throw new Error('simulated process death before post-ref HEAD attachment');
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death before post-ref HEAD attachment/,
-    );
-  } finally {
-    transitions.moveHeadToCard = moveHeadToCard;
-  }
-
-  await git(repo, 'update-ref', 'refs/heads/main', sourceOid, mainTarget);
-  const recovered = await materializeRepo(
-    await observedCard(tracked.localCard),
-    plan,
-    2,
-  );
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
-  assert.equal(readRepoState(
-    tracked.repoKey,
-    tracked.project.resourceId,
-  ).appliedThrough, 2);
-  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
-});
-
-async function makeCheckedBranchDeletePlan(rootCommit) {
-  const { repo, oid: sourceOid } = await makeRepo(rootCommit);
-  await git(repo, 'switch', '--detach', sourceOid);
-  fs.writeFileSync(path.join(repo, 'feature-target.txt'), 'feature target\n');
-  await git(repo, 'add', 'feature-target.txt');
-  await git(repo, 'commit', '-m', 'feature target');
-  const featureTarget = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '-C', 'main', sourceOid);
-  const tracked = await establishTrackedBaseline(
-    repo,
-    sourceOid,
-    rootCommit.replaceAll('-', '_'),
-  );
-  const winning = {
-    ...tracked.localCard,
-    head: { branch: 'feature', oid: featureTarget, detached: false },
-    positionVersion: 2,
-    positionMutationId: `mut_${rootCommit.replaceAll('-', '_')}`,
-  };
-  return {
-    repo,
-    sourceOid,
-    featureTarget,
-    tracked,
-    plan: {
-      repoKey: tracked.repoKey,
-      card: winning,
-      transitions: [],
-      branches: [{
-        name: 'feature',
-        oid: featureTarget,
-        version: 2,
-        mutationId: `mut_${rootCommit.replaceAll('-', '_')}_feature`,
-      }],
-    },
-  };
-}
-
-test('checked branch deletion waits until HEAD can survive a crash', async () => {
-  const {
-    repo,
-    sourceOid,
-    featureTarget,
-    tracked,
-    plan,
-  } = await makeCheckedBranchDeletePlan('checked-delete-before-head');
-  const transitions = require('../workspace/transition');
-  const moveHeadToCard = transitions.moveHeadToCard;
-  transitions.moveHeadToCard = async () => {
-    assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
-    assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
-    assert.equal(
-      (await git(repo, 'rev-parse', 'refs/heads/main')).trim(),
-      sourceOid,
-      'the checked source ref still exists before HEAD attachment',
-    );
-    throw new Error('simulated process death before checked branch deletion');
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death before checked branch deletion/,
-    );
-  } finally {
-    transitions.moveHeadToCard = moveHeadToCard;
-  }
-
-  const recovered = await materializeRepo(
-    await observedCard(tracked.localCard),
-    plan,
-    2,
-  );
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), featureTarget);
-  await assert.rejects(
-    git(repo, 'rev-parse', '--verify', 'refs/heads/main'),
-    /Needed a single revision|unknown revision|not a valid object name/,
-  );
-  assert.equal(require('../workspace/intent').readOwnedIntent(tracked.project), null);
-});
-
-test('a source ref moved during deferred deletion remains local', async () => {
-  const {
-    repo,
-    sourceOid,
-    tracked,
-    plan,
-  } = await makeCheckedBranchDeletePlan('checked-delete-local-race');
-  const localOid = (
-    await git(repo, 'commit-tree', `${sourceOid}^{tree}`, '-p', sourceOid, '-m', 'local ref')
-  ).trim();
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  let raced = false;
-  transitions.updateBranchRefs = async (root, changes, operation) => {
-    if (
-      !raced
-      && changes.some((change) => (
-        change.branch === 'main'
-        && change.expectedOid === sourceOid
-        && change.oid === null
-      ))
-    ) {
-      raced = true;
-      await git(repo, 'update-ref', 'refs/heads/main', localOid, sourceOid);
-    }
-    return updateBranchRefs(root, changes, operation);
-  };
-  let interrupted;
-  try {
-    interrupted = await materializeRepo(tracked.localCard, plan, 2);
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-  assert.deepEqual(interrupted, {
-    state: 'waiting',
-    reason: 'local-refs-moving',
-  });
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), localOid);
-
-  const recovered = await materializeRepo(
-    await observedCard(tracked.localCard),
-    plan,
-    2,
-  );
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), localOid);
-  assert.equal(readRepoState(
-    tracked.repoKey,
-    tracked.project.resourceId,
-  ).appliedThrough, 2);
-  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
-});
-
-test('a HEAD return before deferred deletion stays attached across restart', async () => {
-  const {
-    repo,
-    sourceOid,
-    featureTarget,
-    tracked,
-    plan,
-  } = await makeCheckedBranchDeletePlan('checked-delete-head-return');
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  let raced = false;
-  transitions.updateBranchRefs = async (root, changes, operation) => {
-    if (
-      !raced
-      && changes.some((change) => (
-        change.branch === 'main'
-        && change.expectedOid === sourceOid
-        && change.oid === null
-      ))
-    ) {
-      raced = true;
-      await git(repo, 'symbolic-ref', 'HEAD', 'refs/heads/main');
-    }
-    return updateBranchRefs(root, changes, operation);
-  };
-  let interrupted;
-  try {
-    interrupted = await materializeRepo(tracked.localCard, plan, 2);
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-  assert.equal(raced, true);
-  assert.deepEqual(interrupted, {
-    state: 'waiting',
-    reason: 'local-refs-moving',
-  });
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), sourceOid);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureTarget);
-
-  let recovered;
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    recovered = await materializeRepo(tracked.localCard, plan, 2);
-    if (recovered.state === 'in-sync') break;
-    assert.equal(recovered.state, 'waiting', recovered.reason);
-    assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
-    assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
-  }
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), sourceOid);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), featureTarget);
-  assert.equal(readRepoState(
-    tracked.repoKey,
-    tracked.project.resourceId,
-  ).appliedThrough, 2);
-  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
-});
-
-test('restart finishes a branch-only official apply before a newer branch event', async () => {
-  const rootCommit = 'branch-only-recovery-newer-rail';
-  const repoKey = `root:${rootCommit}`;
-  const { repo, oid: baseOid } = await makeRepo(rootCommit);
-  const branchOids = {};
-  for (const name of ['a', 'b']) {
-    await git(repo, 'switch', '-C', `source-${name}`, baseOid);
-    fs.writeFileSync(path.join(repo, 'branch-value.txt'), `${name}\n`);
-    await git(repo, 'add', 'branch-value.txt');
-    await git(repo, 'commit', '-m', `branch value ${name}`);
-    branchOids[name] = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  }
-  await git(repo, 'switch', 'main');
-  await git(repo, 'branch', '-D', 'source-a', 'source-b');
-
-  const localCard = {
-    ...card(repo, baseOid, 1),
-    repo: { rootCommit, remote: null },
-  };
-  const baseline = {
-    repoKey,
-    card: localCard,
-    transitions: [],
-    branches: [{ name: 'main', oid: baseOid, version: 1 }],
-  };
-  assert.equal((await materializeRepo(localCard, baseline, 1)).state, 'in-sync');
-
-  const officialA = {
-    name: 'feature',
-    oid: branchOids.a,
-    version: 2,
-    mutationId: 'mut_branch_only_a',
-  };
-  const planN = {
-    ...baseline,
-    branches: [...baseline.branches, officialA],
-  };
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  let crashed = false;
-  transitions.updateBranchRefs = async (...args) => {
-    const result = await updateBranchRefs(...args);
-    if (!crashed) {
-      crashed = true;
-      throw new Error('simulated process death after branch-only apply');
-    }
-    return result;
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(localCard, planN, 2),
-      /simulated process death/,
-    );
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), branchOids.a);
-  assert.equal(readRepoState(repoKey).appliedThrough, 1);
-  assert.equal(readRepoState(repoKey).applying?.through, 2);
-
-  const officialB = {
-    name: 'feature',
-    oid: branchOids.b,
-    version: 3,
-    mutationId: 'mut_branch_only_b',
-  };
-  const latest = {
-    ...baseline,
-    branches: [...baseline.branches, officialB],
-  };
-  const recovered = await materializeRepo(localCard, latest, 3);
-  assert.equal(recovered.state, 'in-sync');
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), branchOids.b);
-  assert.equal(readRepoState(repoKey).appliedThrough, 3);
-  assert.equal(readRepoState(repoKey).applying, undefined);
-});
-
-test('restart finishes a checkpoint-only official apply before a newer checkpoint event', async () => {
-  const rootCommit = 'checkpoint-only-recovery-newer-rail';
-  const repoKey = `root:${rootCommit}`;
-  const { repo, oid: baseOid } = await makeRepo(rootCommit);
-  const patchN = await patchFor(repo, { 'a.txt': 'official N\n' });
-  const patchN1 = await patchFor(repo, {
-    'a.txt': 'official N\n',
-    'b.txt': 'official N+1\n',
-  });
-  const localCard = {
-    ...card(repo, baseOid, 1),
-    repo: { rootCommit, remote: null },
-  };
-  const baseline = {
-    repoKey,
-    card: localCard,
-    transitions: [],
-    branches: [{ name: 'main', oid: baseOid, version: 1 }],
-  };
-  assert.equal((await materializeRepo(localCard, baseline, 1)).state, 'in-sync');
-
-  const operationN = transition('machine-remote', 2, baseOid, '', patchN);
-  const planN = { ...baseline, transitions: [operationN] };
-  const mergeModule = require('../workspace/merge');
-  const advance = mergeModule.advance;
-  let crashed = false;
-  mergeModule.advance = async (...args) => {
-    const result = await advance(...args);
-    if (!crashed && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
-      crashed = true;
-      throw new Error('simulated process death after checkpoint-only apply');
-    }
-    return result;
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(localCard, planN, 2),
-      /simulated process death/,
-    );
-  } finally {
-    mergeModule.advance = advance;
-  }
-
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official N\n');
-  assert.equal(readRepoState(repoKey).appliedThrough, 1);
-  assert.equal(readRepoState(repoKey).applying?.through, 2);
-
-  const operationN1 = transition('machine-remote', 3, baseOid, patchN, patchN1);
-  const latest = { ...baseline, transitions: [operationN, operationN1] };
-  const recoveryLabels = [];
-  mergeModule.advance = async (...args) => {
-    recoveryLabels.push(args[3]?.label);
-    return advance(...args);
-  };
-  let recovered;
-  try {
-    recovered = await materializeRepo(localCard, latest, 3);
-  } finally {
-    mergeModule.advance = advance;
-  }
-
-  assert.equal(recovered.state, 'in-sync');
-  assert.equal(recoveryLabels.filter(Boolean).length, 2);
-  assert.equal(new Set(recoveryLabels.filter(Boolean)).size, 2);
-  assert.equal(
-    recoveryLabels.filter(Boolean).every((label) => /^[0-9a-f]{64}$/.test(label)),
-    true,
-  );
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official N\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'official N+1\n');
-  assert.equal(readRepoState(repoKey).appliedThrough, 3);
-  assert.equal(readRepoState(repoKey).applying, undefined);
-});
-
-test('recovery HEAD movement cannot bless and overwrite a commit made after sealed observation', async () => {
-  const { repo, oid: sourceOid } = await makeRepo('recovery-head-sealed-source');
-  const tracked = await establishTrackedBaseline(repo, sourceOid, 'recovery_head_sealed_source');
-  await git(repo, 'switch', '--detach', sourceOid);
-  fs.writeFileSync(path.join(repo, 'official.txt'), 'official commit\n');
-  await git(repo, 'add', 'official.txt');
-  await git(repo, 'commit', '-m', 'official commit');
-  const officialOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'switch', '-C', 'main', sourceOid);
-  const winning = {
-    ...tracked.localCard,
-    head: { branch: 'main', oid: officialOid, detached: false },
-    positionVersion: 2,
-    positionMutationId: 'mut_recovery_head_sealed',
-  };
-  const plan = {
-    repoKey: tracked.repoKey,
-    card: winning,
-    transitions: [],
-    branches: [{
-      name: 'main',
-      oid: officialOid,
-      version: 2,
-      mutationId: 'mut_recovery_main_sealed',
-    }],
-  };
-
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  let interruptBeforeRefs = true;
-  transitions.updateBranchRefs = async (...args) => {
-    if (interruptBeforeRefs) {
-      interruptBeforeRefs = false;
-      throw new Error('simulated process death before ref apply');
-    }
-    return updateBranchRefs(...args);
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death before ref apply/,
-    );
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-  assert.equal(readRepoState(tracked.repoKey).applying?.through, 2);
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), sourceOid);
-
-  let localOid = null;
-  transitions.updateBranchRefs = async (...args) => {
-    const result = await updateBranchRefs(...args);
-    fs.writeFileSync(path.join(repo, 'racing-commit.txt'), 'local survives\n');
-    await git(repo, 'add', 'racing-commit.txt');
-    await git(repo, 'commit', '-m', 'local commit after sealed observation');
-    localOid = (await git(repo, 'rev-parse', 'HEAD')).trim();
-    return result;
-  };
-  let raced;
-  try {
-    raced = await materializeRepo(tracked.localCard, plan, 2);
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-  assert.deepEqual(raced, {
-    state: 'waiting',
-    reason: 'local-index-moving',
-    moved: false,
-  });
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/main')).trim(), localOid);
-  assert.equal(fs.readFileSync(path.join(repo, 'racing-commit.txt'), 'utf8'), 'local survives\n');
-
-  const recovered = await materializeRepo(
-    await observedCard(tracked.localCard),
-    plan,
-    2,
-  );
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), localOid);
-  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
-});
-
-test('recovery index movement preserves a staged file written after sealed observation', async () => {
-  const { repo, oid } = await makeRepo('recovery-index-sealed-source');
-  const tracked = await establishTrackedBaseline(repo, oid, 'recovery_index_sealed_source');
-  const officialPatch = await patchFor(repo, { 'a.txt': 'official staged value\n' });
-  const plan = {
-    ...tracked.baseline,
-    transitions: [transition('machine-remote', 2, oid, '', officialPatch)],
-  };
-  const mergeModule = require('../workspace/merge');
-  const advance = mergeModule.advance;
-  let interruptBeforeWorktree = true;
-  mergeModule.advance = async (...args) => {
-    if (interruptBeforeWorktree && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
-      interruptBeforeWorktree = false;
-      throw new Error('simulated process death before worktree apply');
-    }
-    return advance(...args);
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death before worktree apply/,
-    );
-  } finally {
-    mergeModule.advance = advance;
-  }
-  assert.equal(readRepoState(tracked.repoKey).applying?.through, 2);
-
-  let stagedDuringRecovery = false;
-  mergeModule.advance = async (...args) => {
-    const result = await advance(...args);
-    if (!stagedDuringRecovery && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
-      stagedDuringRecovery = true;
-      fs.writeFileSync(path.join(repo, 'racing-staged.txt'), 'staged survives\n');
-      await git(repo, 'add', 'racing-staged.txt');
-    }
-    return result;
-  };
-  let raced;
-  try {
-    raced = await materializeRepo(tracked.localCard, plan, 2);
-  } finally {
-    mergeModule.advance = advance;
-  }
-  assert.deepEqual(raced, {
-    state: 'waiting',
-    reason: 'local-index-moving',
-    moved: false,
-  });
-  assert.match(await git(repo, 'diff', '--cached', '--', 'racing-staged.txt'), /staged survives/);
-
-  const recovered = await materializeRepo(
-    await observedCard(tracked.localCard),
-    plan,
-    2,
-  );
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.match(await git(repo, 'diff', '--cached', '--', 'racing-staged.txt'), /staged survives/);
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official staged value\n');
-  assert.ok(require('../workspace/intent').readOwnedIntent(tracked.project));
-});
-
-test('a byte-identical index refresh before apply is not an official crossing receipt', async () => {
-  const { repo, oid } = await makeRepo('index-refresh-is-not-crossing');
-  const tracked = await establishTrackedBaseline(repo, oid, 'index_refresh_not_crossing');
-  const officialPatch = await patchFor(repo, { 'a.txt': 'official index target\n' });
-  const plan = {
-    ...tracked.baseline,
-    transitions: [transition('machine-remote', 2, oid, '', officialPatch)],
-  };
-  const transitions = require('../workspace/transition');
-  const applyIndexPatch = transitions.applyIndexPatch;
-  const index = await gitPath(repo, 'index');
-  const before = fs.statSync(index, { bigint: true });
-  let crashed = false;
-  transitions.applyIndexPatch = async (...args) => {
-    if (!crashed) {
-      crashed = true;
-      const replacement = `${index}.semantic-refresh`;
-      fs.writeFileSync(replacement, fs.readFileSync(index));
-      fs.renameSync(replacement, index);
-      throw new Error('simulated process death before index apply');
-    }
-    return applyIndexPatch(...args);
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death before index apply/,
-    );
-  } finally {
-    transitions.applyIndexPatch = applyIndexPatch;
-  }
-  const after = fs.statSync(index, { bigint: true });
-  assert.notEqual(after.ino, before.ino);
-  assert.equal(readRepoState(tracked.repoKey).appliedThrough, 1);
-
-  const recovered = await materializeRepo(tracked.localCard, plan, 2);
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official index target\n');
-  assert.match(await git(repo, 'diff', '--cached'), /official index target/);
-  assert.equal(
-    require('../workspace/intent').readOwnedIntent(tracked.project),
-    null,
-  );
-});
-
-test('a byte-identical HEAD refresh before apply is not an official crossing receipt', async () => {
-  const { repo, oid } = await makeRepo('head-refresh-is-not-crossing');
-  await git(repo, 'branch', 'feature', oid);
-  const tracked = await establishTrackedBaseline(repo, oid, 'head_refresh_not_crossing');
-  const winning = {
-    ...tracked.localCard,
-    head: { branch: 'feature', oid, detached: false },
-    positionVersion: 2,
-    positionMutationId: 'mut_head_refresh_target',
-  };
-  const plan = {
-    repoKey: tracked.repoKey,
-    card: winning,
-    transitions: [],
-    branches: [
-      { name: 'main', oid, version: 1, mutationId: 'mut_head_refresh_main' },
-      { name: 'feature', oid, version: 2, mutationId: 'mut_head_refresh_feature' },
-    ],
-  };
-  const transitions = require('../workspace/transition');
-  const moveHeadToCard = transitions.moveHeadToCard;
-  const head = await gitPath(repo, 'HEAD');
-  const before = fs.statSync(head, { bigint: true });
-  let crashed = false;
-  transitions.moveHeadToCard = async (...args) => {
-    if (!crashed) {
-      crashed = true;
-      const replacement = `${head}.semantic-refresh`;
-      fs.writeFileSync(replacement, fs.readFileSync(head));
-      fs.renameSync(replacement, head);
-      throw new Error('simulated process death before HEAD apply');
-    }
-    return moveHeadToCard(...args);
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death before HEAD apply/,
-    );
-  } finally {
-    transitions.moveHeadToCard = moveHeadToCard;
-  }
-  const after = fs.statSync(head, { bigint: true });
-  assert.notEqual(after.ino, before.ino);
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'main');
-
-  const recovered = await materializeRepo(
-    await observedCard(tracked.localCard),
-    plan,
-    2,
-  );
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
-  assert.equal(
-    require('../workspace/intent').readOwnedIntent(tracked.project),
-    null,
-  );
-});
-
-test('a same-value file revert after apply remains successor intent on recovery', async () => {
-  const { repo, oid } = await makeRepo('checkpoint-aba-revert');
-  const tracked = await establishTrackedBaseline(repo, oid, 'checkpoint_aba_revert');
-  const officialPatch = await patchFor(repo, { 'a.txt': 'official target\n' });
-  const plan = {
-    ...tracked.baseline,
-    transitions: [transition('machine-remote', 2, oid, '', officialPatch)],
-  };
-  const mergeModule = require('../workspace/merge');
-  const advance = mergeModule.advance;
-  let crashed = false;
-  mergeModule.advance = async (...args) => {
-    const result = await advance(...args);
-    if (!crashed && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
-      crashed = true;
-      throw new Error('simulated process death after file target');
-    }
-    return result;
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death after file target/,
-    );
-  } finally {
-    mergeModule.advance = advance;
-  }
-
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'official target\n');
-  fs.writeFileSync(path.join(repo, 'a.txt'), 'a0\n');
-  const recovered = await materializeRepo(tracked.localCard, plan, 2);
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'a0\n');
-  assert.equal(
-    readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough,
-    2,
-  );
-  const successor = require('../workspace/intent').readOwnedIntent(tracked.project);
-  assert.ok(successor);
-  assert.equal(successor.base.through, 2);
-});
-
-test('deleting an official create after apply remains successor intent on recovery', async () => {
-  const { repo, oid } = await makeRepo('checkpoint-create-delete');
-  const tracked = await establishTrackedBaseline(repo, oid, 'checkpoint_create_delete');
-  fs.writeFileSync(path.join(repo, 'official.txt'), 'official target\n');
-  await git(repo, 'add', 'official.txt');
-  const officialPatch = await git(repo, 'diff', '--cached', 'HEAD', '--binary', '--full-index');
-  await git(repo, 'reset', '--hard', 'HEAD');
-  const plan = {
-    ...tracked.baseline,
-    transitions: [transition('machine-remote', 2, oid, '', officialPatch)],
-  };
-  const mergeModule = require('../workspace/merge');
-  const advance = mergeModule.advance;
-  let crashed = false;
-  mergeModule.advance = async (...args) => {
-    const result = await advance(...args);
-    if (!crashed && /^[0-9a-f]{64}$/.test(args[3]?.label || '')) {
-      crashed = true;
-      throw new Error('simulated process death after official create');
-    }
-    return result;
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death after official create/,
-    );
-  } finally {
-    mergeModule.advance = advance;
-  }
-
-  assert.equal(fs.readFileSync(path.join(repo, 'official.txt'), 'utf8'), 'official target\n');
-  fs.unlinkSync(path.join(repo, 'official.txt'));
-  const recovered = await materializeRepo(tracked.localCard, plan, 2);
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal(fs.existsSync(path.join(repo, 'official.txt')), false);
-  assert.equal(
-    readRepoState(tracked.repoKey, tracked.project.resourceId).appliedThrough,
-    2,
-  );
-  const successor = require('../workspace/intent').readOwnedIntent(tracked.project);
-  assert.ok(successor);
-  assert.equal(successor.base.through, 2);
-});
-
-test('a checked-out branch reverted after apply remains successor intent on recovery', async () => {
-  const { repo, oid: baseOid } = await makeRepo('branch-aba-revert');
-  await git(repo, 'switch', '-c', 'feature');
-  fs.writeFileSync(path.join(repo, 'feature.txt'), 'A\n');
-  await git(repo, 'add', 'feature.txt');
-  await git(repo, 'commit', '-m', 'feature A');
-  const oidA = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  fs.writeFileSync(path.join(repo, 'feature.txt'), 'B\n');
-  await git(repo, 'add', 'feature.txt');
-  await git(repo, 'commit', '-m', 'feature B');
-  const oidB = (await git(repo, 'rev-parse', 'HEAD')).trim();
-  await git(repo, 'reset', '--hard', oidA);
-  const tracked = await establishTrackedBaseline(repo, oidA, 'branch_aba_revert');
-  const plan = {
-    repoKey: tracked.repoKey,
-    card: {
-      ...tracked.localCard,
-      head: { branch: 'feature', oid: oidB, detached: false },
-      positionVersion: 2,
-      positionMutationId: 'mut_branch_aba_target',
-    },
-    transitions: [],
-    branches: [
-      { name: 'main', oid: baseOid, version: 1 },
-      { name: 'feature', oid: oidB, version: 2 },
-    ],
-  };
-  const transitions = require('../workspace/transition');
-  const updateBranchRefs = transitions.updateBranchRefs;
-  let crashed = false;
-  transitions.updateBranchRefs = async (...args) => {
-    const result = await updateBranchRefs(...args);
-    if (!crashed) {
-      crashed = true;
-      throw new Error('simulated process death after branch target');
-    }
-    return result;
-  };
-  try {
-    await assert.rejects(
-      materializeRepo(tracked.localCard, plan, 2),
-      /simulated process death after branch target/,
-    );
-  } finally {
-    transitions.updateBranchRefs = updateBranchRefs;
-  }
-
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), oidB);
-  await git(repo, 'update-ref', 'refs/heads/feature', oidA, oidB);
-  const recovered = await materializeRepo(
-    await observedCard(tracked.localCard),
-    plan,
-    2,
-  );
-  assert.equal(recovered.state, 'in-sync', recovered.reason);
-  assert.equal((await git(repo, 'symbolic-ref', '--short', 'HEAD')).trim(), 'feature');
-  assert.equal((await git(repo, 'rev-parse', 'HEAD')).trim(), oidA);
-  assert.equal((await git(repo, 'rev-parse', 'refs/heads/feature')).trim(), oidA);
-  const successor = require('../workspace/intent').readOwnedIntent(tracked.project);
-  assert.ok(successor);
-  assert.equal(successor.base.through, 2);
-});