amalgm 0.1.245 → 0.1.246

package/runtime/scripts/amalgm-mcp/tests/workspace-tree-store.test.js

@@ -5,7 +5,6 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { spawn } = require('child_process');
 
 const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-workspace-tree-test-'));
 process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
@@ -13,14 +12,10 @@ process.env.AMALGM_WORKSPACES_DIR = path.join(tempRoot, 'workspaces');
 process.env.AMALGM_COMPUTER_ID = 'computer-tree-test';
 fs.mkdirSync(process.env.AMALGM_WORKSPACES_DIR, { recursive: true });
 
-const {
-  backfillWorkspaceTrashComponents,
-  closeLocalDb,
-  openLocalDb,
-} = require('../state/db');
+const { closeLocalDb, openLocalDb } = require('../state/db');
 const docs = require('../state/docs');
 const { handleProjectRegister, handleTreeList } = require('../workspace/rest');
-const { listWorkspaces, upsertWorkspace } = require('../workspace/store');
+const { upsertWorkspace } = require('../workspace/store');
 const {
   commitPathCreate,
   commitPathRename,
@@ -29,18 +24,9 @@ const {
   enrollRegisteredWorkspaces,
   listWorkspaceNodes,
   nodeForPath,
-  reconcileRegisteredWorkspaceTrees,
   reconcileWorkspaceTree,
 } = require('../workspace/tree-store');
-const {
-  crossTreeOperationWithRaceCapture,
-  finishTreeOperationPlan,
-  projectStoredTreeOperation,
-  recoverAllTreePlans,
-} = require('../workspace/tree-cloud');
-const treeMaterialization = require('../workspace/tree-materialization');
-const { isUuidV7, uuidV7 } = require('../workspace/tree/identity');
-const { trashPath } = require('../workspace/tree/local-state');
+const { isUuidV7 } = require('../workspace/tree/identity');
 
 test.after(() => {
   docs.closeAllDocs();
@@ -84,7 +70,7 @@ test('enrollment gives every node a UUID and open docs keep one resource through
   assert.equal(state.node_id, beforeNode.id);
 });
 
-test('bounded discovery may skip a large tree but recurring reconciliation repairs it uncapped', () => {
+test('bounded automatic tree passes skip large workspaces without blocking explicit enrollment', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'bounded-observer');
   fs.mkdirSync(root, { recursive: true });
   fs.writeFileSync(path.join(root, 'one.txt'), 'one\n');
@@ -92,15 +78,7 @@ test('bounded discovery may skip a large tree but recurring reconciliation repai
   const workspace = upsertWorkspace({ path: root, name: 'Bounded observer', source: 'computer' });
 
   const boundedEnrollment = enrollWorkspace(workspace.id, { maxNodes: 1 });
-  assert.equal(
-    boundedEnrollment.skipped,
-    'workspace-root-enrollment-pending',
-  );
-  assert.equal(boundedEnrollment.state, 'held');
-  assert.ok(listWorkspaces().find((item) => item.id === workspace.id)
-    .treeObservation.holds.some((hold) => (
-      hold.reason === 'workspace-root-enrollment-pending'
-    )));
+  assert.equal(boundedEnrollment.skipped, 'node_limit');
   assert.equal(listWorkspaceNodes(workspace.id).length, 1, 'bounded scan must not persist a partial tree');
 
   const explicitEnrollment = enrollWorkspace(workspace.id);
@@ -109,156 +87,7 @@ test('bounded discovery may skip a large tree but recurring reconciliation repai
   fs.writeFileSync(path.join(root, 'three.txt'), 'three\n');
   const boundedReconcile = reconcileWorkspaceTree(workspace.id, { maxNodes: 1 });
   assert.equal(boundedReconcile.skipped, 'node_limit');
-  assert.equal(nodeForPath(path.join(root, 'three.txt')), null, 'an optional bounded pass may skip the oversized tree');
-
-  reconcileRegisteredWorkspaceTrees();
-  assert.ok(
-    nodeForPath(path.join(root, 'three.txt')),
-    'the recurring correctness pass has no permanent size blind spot',
-  );
-});
-
-test('an unbound large root remains baseline state until one uncapped enrollment', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'large-baseline-enrollment',
-  );
-  fs.mkdirSync(root, { recursive: true });
-  for (let index = 0; index < 2_001; index += 1) {
-    fs.writeFileSync(path.join(root, `file-${index}.txt`), `${index}\n`);
-  }
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Large baseline enrollment',
-    source: 'computer',
-  });
-  const held = enrollRegisteredWorkspaces({
-    database: openLocalDb(),
-    maxNodes: 2_000,
-  }).find((result) => result.workspaceId === workspace.id);
-  assert.equal(held.state, 'held');
-  assert.equal(held.skipped, 'workspace-root-enrollment-pending');
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-  `).get(`workspace-tree:${workspace.id}`).count, 0);
-
-  const [enrolled] = reconcileRegisteredWorkspaceTrees({
-    database: openLocalDb(),
-  }).filter((result) => result.workspaceId === workspace.id);
-  assert.equal(enrolled.state, 'ready');
-  assert.equal(listWorkspaceNodes(workspace.id).length, 2_002);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-  `).get(`workspace-tree:${workspace.id}`).count, 0);
-
-  fs.writeFileSync(path.join(root, 'after-baseline.txt'), 'new\n');
-  const observed = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(observed.operations.map((operation) => operation.kind), [
-    'tree.create',
-  ]);
-});
-
-test('a missing or replaced workspace root holds without lending its UUID', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'durable-root-binding',
-  );
-  const movedRoot = `${root}-moved`;
-  const originalFile = path.join(root, 'original.txt');
-  fs.mkdirSync(root, { recursive: true });
-  fs.writeFileSync(originalFile, 'original\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Durable root binding',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const originalId = nodeForPath(originalFile).node.id;
-  const journalCount = () => openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-  `).get(`workspace-tree:${workspace.id}`).count;
-  const before = journalCount();
-
-  fs.renameSync(root, movedRoot);
-  assert.throws(() => commitTreeOperation({
-    kind: 'tree.rename',
-    workspaceId: workspace.id,
-    nodeId: originalId,
-    name: 'renamed.txt',
-  }), (error) => error?.code === 'WORKSPACE_TREE_ROOT_UNVERIFIED');
-  assert.ok(listWorkspaces().find((item) => item.id === workspace.id)
-    .treeObservation.holds.some((hold) => (
-      hold.reason === 'workspace-root-missing'
-    )));
-  const missing = reconcileWorkspaceTree(workspace.id);
-  assert.equal(missing.skipped, 'workspace-root-missing');
-  assert.equal(missing.state, 'held');
-  assert.equal(journalCount(), before);
-
-  fs.mkdirSync(root);
-  fs.writeFileSync(path.join(root, 'unrelated.txt'), 'unrelated\n');
-  const replaced = reconcileWorkspaceTree(workspace.id);
-  assert.equal(replaced.skipped, 'workspace-root-replaced');
-  assert.equal(replaced.state, 'held');
-  assert.equal(nodeForPath(path.join(root, 'unrelated.txt')), null);
-  assert.equal(journalCount(), before);
-  assert.equal(
-    listWorkspaces().find((item) => item.id === workspace.id).status,
-    'held',
-  );
-
-  fs.rmSync(root, { recursive: true });
-  fs.renameSync(movedRoot, root);
-  const restored = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(restored.operations, []);
-  assert.equal(nodeForPath(originalFile).node.id, originalId);
-  assert.equal(journalCount(), before);
-  assert.equal(
-    listWorkspaces().find((item) => item.id === workspace.id).treeObservation,
-    null,
-  );
-});
-
-test('an observed symlink escape is held before it can enter the mutation rail', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'observed-symlink-escape',
-  );
-  fs.mkdirSync(root, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Observed symlink escape',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const link = path.join(root, 'outside');
-  fs.symlinkSync('../../outside', link);
-
-  const held = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(held.operations, []);
-  assert.ok(held.held.some((item) => (
-    item.reason === 'symlink-escapes-workspace'
-    && item.paths.includes('outside')
-  )));
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-  `).get(`workspace-tree:${workspace.id}`).count, 0);
-  assert.equal(nodeForPath(link), null);
-
-  fs.unlinkSync(link);
-  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
-  assert.equal(
-    listWorkspaces().find((item) => item.id === workspace.id).treeObservation,
-    null,
-  );
+  assert.equal(nodeForPath(path.join(root, 'three.txt')), null, 'automatic reconciliation skips the oversized tree');
 });
 
 test('first-update enrollment assigns UUIDs to existing files and ignores nested noise', async () => {
@@ -333,13 +162,6 @@ test('a git checkout never becomes per-file workspace operations', () => {
   const enrolled = enrollWorkspace(workspace.id);
   assert.equal(enrolled.skipped, 'git-owned');
   assert.equal(listWorkspaceNodes(workspace.id).length, 1);
-  const boundRoot = openLocalDb().prepare(`
-    SELECT device_id, inode
-    FROM workspace_nodes
-    WHERE workspace_id = ? AND id = ?
-  `).get(workspace.id, workspace.id);
-  assert.ok(boundRoot.device_id);
-  assert.ok(boundRoot.inode);
 
   fs.writeFileSync(path.join(root, 'more.txt'), 'more\n');
   const reconciled = reconcileWorkspaceTree(workspace.id);
@@ -350,25 +172,6 @@ test('a git checkout never becomes per-file workspace operations', () => {
       .get(`workspace-tree:${workspace.id}`).count,
     0,
   );
-
-  const originalRoot = `${root}-original`;
-  fs.renameSync(root, originalRoot);
-  fs.mkdirSync(path.join(root, '.git'), { recursive: true });
-  const unrelated = path.join(root, 'unrelated.txt');
-  fs.writeFileSync(unrelated, 'unrelated\n');
-  assert.equal(nodeForPath(unrelated), null);
-  assert.ok(listWorkspaces().find((item) => item.id === workspace.id)
-    .treeObservation.holds.some((hold) => (
-      hold.reason === 'workspace-root-replaced'
-    )));
-
-  fs.rmSync(root, { recursive: true });
-  fs.renameSync(originalRoot, root);
-  assert.equal(reconcileWorkspaceTree(workspace.id).skipped, 'git-owned');
-  assert.equal(
-    listWorkspaces().find((item) => item.id === workspace.id).treeObservation,
-    null,
-  );
 });
 
 test('trash is editor-class while permanent removal is owner-only', () => {
@@ -415,285 +218,7 @@ test('direct shell creates and renames enter the same UUID tree journal', () =>
   assert.deepEqual(rows.map((row) => row.operation_kind), ['tree.create', 'tree.rename']);
 });
 
-test('a failed physical identity fence rolls back its UUID projection', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'identity-fence-rollback',
-  );
-  const target = path.join(root, 'adopted.txt');
-  const retained = path.join(root, 'retained.txt');
-  fs.mkdirSync(root);
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Identity fence rollback',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  fs.writeFileSync(target, 'receipt-owned bytes\n');
-  const identity = fs.lstatSync(target);
-  const nodeId = uuidV7();
-  const mutationId = `mut_${'identityfencerollback'.padEnd(32, '0')}`;
-  const changedAt = new Date().toISOString();
-  const operation = {
-    kind: 'tree.create',
-    workspaceId: workspace.id,
-    nodeId,
-    parentId: workspace.id,
-    nodeKind: 'file',
-    name: path.basename(target),
-    createdAt: changedAt,
-    changedAt,
-  };
-
-  assert.throws(
-    () => commitTreeOperation(operation, {
-      role: 'owner',
-      mutationId,
-      diskAlreadyApplied: true,
-      expectedDiskIdentity: {
-        path: target,
-        kind: 'file',
-        deviceId: String(identity.dev),
-        inode: String(identity.ino),
-      },
-      testHooks: {
-        afterOperationDatabaseProjectionBeforeIdentityFence() {
-          fs.renameSync(target, retained);
-          fs.writeFileSync(target, 'same-kind replacement\n');
-        },
-      },
-    }),
-    (error) => error?.code === 'WORKSPACE_TREE_PHYSICAL_BINDING_CHANGED',
-  );
-
-  assert.equal(
-    openLocalDb().prepare(`
-      SELECT COUNT(*) AS count
-      FROM workspace_nodes
-      WHERE workspace_id = ? AND id = ?
-    `).get(workspace.id, nodeId).count,
-    0,
-    'the rejected replacement never keeps the adopted UUID',
-  );
-  assert.notEqual(nodeForPath(target)?.node.id, nodeId);
-
-  fs.unlinkSync(target);
-  fs.renameSync(retained, target);
-  commitTreeOperation(operation, {
-    role: 'owner',
-    mutationId,
-    diskAlreadyApplied: true,
-    expectedDiskIdentity: {
-      path: target,
-      kind: 'file',
-      deviceId: String(identity.dev),
-      inode: String(identity.ino),
-    },
-  });
-  assert.equal(nodeForPath(target).node.id, nodeId);
-});
-
-test('operation receipts keep endpoint resemblance independent', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'receipt-not-resemblance');
-  fs.mkdirSync(root);
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Receipt not resemblance',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-
-  const createdId = uuidV7();
-  const createdPath = path.join(root, 'created.txt');
-  commitTreeOperation({
-    kind: 'tree.create',
-    workspaceId: workspace.id,
-    nodeId: createdId,
-    parentId: workspace.id,
-    nodeKind: 'file',
-    name: 'created.txt',
-  }, {
-    role: 'owner',
-    testHooks: {
-      afterOperationPlan() {
-        fs.writeFileSync(createdPath, '');
-      },
-    },
-  });
-  assert.equal(nodeForPath(createdPath).node.id, createdId);
-  const retainedCreate = fs.readdirSync(root)
-    .find((name) => name.startsWith('created.amalgm-retained-'));
-  assert.ok(retainedCreate);
-  reconcileWorkspaceTree(workspace.id);
-  const retainedCreateNode = nodeForPath(path.join(root, retainedCreate)).node;
-  assert.notEqual(retainedCreateNode.id, createdId);
-
-  const source = path.join(root, 'before.txt');
-  const destination = path.join(root, 'after.txt');
-  fs.writeFileSync(source, 'same inode and bytes\n');
-  reconcileWorkspaceTree(workspace.id);
-  const movedId = nodeForPath(source).node.id;
-  commitTreeOperation({
-    kind: 'tree.rename',
-    workspaceId: workspace.id,
-    nodeId: movedId,
-    name: 'after.txt',
-  }, {
-    role: 'owner',
-    testHooks: {
-      afterOperationPlan() {
-        fs.renameSync(source, destination);
-      },
-    },
-  });
-  assert.equal(fs.existsSync(source), false);
-  assert.equal(nodeForPath(destination).node.id, movedId);
-});
-
-test('a target-parent symlink swap cannot send a tree move outside its workspace', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'parent-symlink-race');
-  const outside = path.join(tempRoot, 'parent-symlink-outside');
-  const source = path.join(root, 'source.txt');
-  const folder = path.join(root, 'A');
-  const heldFolder = path.join(root, 'A-held');
-  fs.mkdirSync(folder, { recursive: true });
-  fs.mkdirSync(outside);
-  fs.writeFileSync(source, 'source bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Parent symlink race',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const sourceId = nodeForPath(source).node.id;
-  const folderId = nodeForPath(folder).node.id;
-
-  assert.throws(
-    () => commitTreeOperation({
-      kind: 'tree.move',
-      workspaceId: workspace.id,
-      nodeId: sourceId,
-      parentId: folderId,
-      name: 'source.txt',
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationPlan() {
-          fs.renameSync(folder, heldFolder);
-          fs.symlinkSync(outside, folder, 'dir');
-        },
-      },
-    }),
-    (error) => (
-      error?.code === 'WORKSPACE_TREE_RETRY_PENDING'
-      && error.reason === 'symlink-escapes-workspace'
-    ),
-  );
-
-  assert.deepEqual(fs.readdirSync(outside), []);
-  assert.ok(listWorkspaces().find((item) => item.id === workspace.id)
-    .treeObservation.holds.some((hold) => (
-      hold.reason === 'symlink-escapes-workspace'
-    )));
-  fs.unlinkSync(folder);
-  recoverAllTreePlans();
-  assert.equal(
-    fs.readFileSync(path.join(heldFolder, 'source.txt'), 'utf8'),
-    'source bytes\n',
-  );
-  assert.equal(nodeForPath(path.join(heldFolder, 'source.txt')).node.id, sourceId);
-  assert.equal(nodeForPath(heldFolder).node.id, folderId);
-});
-
-test('a both-retained source race is captured with every value visible', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'source-both-retained');
-  const source = path.join(root, 'source.txt');
-  const movedOriginal = path.join(root, 'moved-original.txt');
-  fs.mkdirSync(root);
-  fs.writeFileSync(source, 'original source\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Source both retained',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const sourceId = nodeForPath(source).node.id;
-  let child;
-  commitTreeOperation({
-    kind: 'tree.rename',
-    workspaceId: workspace.id,
-    nodeId: sourceId,
-    name: 'official-name.txt',
-  }, {
-    role: 'owner',
-    testHooks: {
-      afterOperationPlan() {
-        child = spawn(process.execPath, [
-          '-e',
-          'const fs=require("fs");'
-            + `setTimeout(()=>{`
-            + `fs.renameSync(${JSON.stringify(source)},${JSON.stringify(movedOriginal)});`
-            + `fs.writeFileSync(${JSON.stringify(source)},"first replacement\\n");`
-            + '},250);'
-            + `setTimeout(()=>{`
-            + `fs.writeFileSync(${JSON.stringify(source)},"second replacement\\n");`
-            + '},900);',
-        ], { stdio: 'ignore' });
-      },
-      operationStageRename: {
-        pauseBeforeInstall: 600,
-        pauseAfterTreeMove: 600,
-      },
-    },
-  });
-  child?.unref();
-  assert.equal(fs.readFileSync(movedOriginal, 'utf8'), 'original source\n');
-  assert.equal(fs.readFileSync(source, 'utf8'), 'second replacement\n');
-  const retained = fs.readdirSync(root)
-    .find((name) => name.startsWith('source.amalgm-retained-'));
-  assert.ok(retained);
-  assert.equal(fs.readFileSync(path.join(root, retained), 'utf8'), 'first replacement\n');
-  assert.equal(nodeForPath(movedOriginal).node.id, sourceId);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('a killed native stage resumes from its durable pre-rename receipt', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'killed-tree-stage');
-  const source = path.join(root, 'source.txt');
-  const target = path.join(root, 'target.txt');
-  fs.mkdirSync(root);
-  fs.writeFileSync(source, 'survives kill\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Killed tree stage',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const sourceId = nodeForPath(source).node.id;
-  assert.throws(
-    () => commitTreeOperation({
-      kind: 'tree.rename',
-      workspaceId: workspace.id,
-      nodeId: sourceId,
-      name: 'target.txt',
-    }, {
-      role: 'owner',
-      testHooks: {
-        operationStageRename: { crashAfterTreeMove: true },
-      },
-    }),
-    /native file transaction failed/,
-  );
-  recoverAllTreePlans();
-  assert.equal(fs.readFileSync(target, 'utf8'), 'survives kill\n');
-  assert.equal(nodeForPath(target).node.id, sourceId);
-});
-
-test('a deleted node never lends its UUID to a recreated path with a recycled inode', () => {
+test('a missing node never lends its UUID to a recreated path with a recycled inode', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'inode-reuse');
   const target = path.join(root, 'note.md');
   fs.mkdirSync(root);
@@ -704,9 +229,9 @@ test('a deleted node never lends its UUID to a recreated path with a recycled in
 
   fs.unlinkSync(target);
   enrollWorkspace(workspace.id);
-  const deleted = listWorkspaceNodes(workspace.id, { includeTrashed: true })
+  const missing = listWorkspaceNodes(workspace.id, { includeMissing: true })
     .find((node) => node.id === original.id);
-  assert.ok(deleted.trashedAt);
+  assert.ok(missing.missingAt);
 
   fs.writeFileSync(target, 'replacement identity\n');
   const replacementStats = fs.lstatSync(target);
@@ -719,11 +244,11 @@ test('a deleted node never lends its UUID to a recreated path with a recycled in
   const replacement = nodeForPath(target).node;
   assert.notEqual(replacement.id, original.id);
   assert.equal(
-    listWorkspaceNodes(workspace.id, { includeTrashed: true }).some(
-      (node) => node.id === original.id && node.trashedAt,
+    listWorkspaceNodes(workspace.id, { includeMissing: true }).some(
+      (node) => node.id === original.id && node.missingAt,
     ),
     true,
-    'the old identity remains durably trashed',
+    'the old identity remains tombstoned',
   );
 });
 
@@ -751,7 +276,7 @@ test('tree lookup enrolls an existing path on demand before sharing', () => {
   assert.equal(response.body.node.id, firstId, 'repeated sharing preserves identity');
 });
 
-test('moving or restoring a node requires write access at both source and destination', () => {
+test('moving a node requires write access at both source and destination', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'move-authority');
   const sourcePath = path.join(root, 'source');
   const destinationPath = path.join(root, 'destination');
@@ -784,76 +309,25 @@ test('moving or restoring a node requires write access at both source and destin
       workspaceId: workspace.id,
       nodeId: file.id,
       parentId: destination.id,
-    }, {
-      role: 'editor',
     }), /tree destination is forbidden/);
     assert.equal(nodeForPath(filePath).node.id, file.id);
 
-    commitTreeOperation({
-      kind: 'tree.trash',
-      workspaceId: workspace.id,
-      nodeId: file.id,
-    });
-    assert.throws(() => commitTreeOperation({
-      kind: 'tree.restore',
-      workspaceId: workspace.id,
-      nodeId: file.id,
-      parentId: destination.id,
-    }, {
-      role: 'editor',
-    }), /tree destination is forbidden/);
-
     database.prepare(`
       UPDATE workspace_node_permissions SET role = 'editor'
       WHERE node_id = ? AND user_id = ?
     `).run(destination.id, memberId);
     commitTreeOperation({
-      kind: 'tree.restore',
+      kind: 'tree.move',
       workspaceId: workspace.id,
       nodeId: file.id,
       parentId: destination.id,
-    }, { role: 'editor' });
+    });
     assert.equal(nodeForPath(path.join(destinationPath, 'note.md')).node.id, file.id);
   } finally {
     identity.userId = currentUserId;
   }
 });
 
-test('repeat enrollment journals an offline deletion as one durable trash birth', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'offline-deletion');
-  const target = path.join(root, 'gone.txt');
-  fs.mkdirSync(root);
-  fs.writeFileSync(target, 'delete while stopped\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Offline deletion',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const nodeId = nodeForPath(target).node.id;
-
-  fs.unlinkSync(target);
-  const reconciled = enrollWorkspace(workspace.id);
-  assert.equal(reconciled.operations.length, 1);
-  assert.equal(reconciled.operations[0].kind, 'tree.trash');
-  const tombstone = listWorkspaceNodes(workspace.id, {
-    includeMissing: true,
-    includeTrashed: true,
-  }).find((node) => node.id === nodeId);
-  assert.equal(tombstone.missingAt, null);
-  assert.ok(tombstone.trashedAt);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-      AND mutation_origin = 'local'
-      AND operation_kind = 'tree.trash'
-      AND json_extract(operation_json, '$.nodeId') = ?
-  `).get(`workspace-tree:${workspace.id}`, nodeId).count, 1);
-
-  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
-});
-
 test('recursive create enrolls missing parents without overwriting existing disk entries', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'recursive');
   fs.mkdirSync(root);
@@ -874,350 +348,6 @@ test('recursive create enrolls missing parents without overwriting existing disk
   assert.ok(nodeForPath(existing)?.node.id);
 });
 
-test('purge retains a pre-existing writer as a new durable node', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'purge-open-writer');
-  const file = path.join(root, 'draft.txt');
-  fs.mkdirSync(root);
-  fs.writeFileSync(file, 'still being written\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Purge open writer',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const originalId = nodeForPath(file).node.id;
-  const writer = fs.openSync(file, 'r+');
-  try {
-    commitTreeOperation({
-      kind: 'tree.trash',
-      workspaceId: workspace.id,
-      nodeId: originalId,
-    }, { role: 'owner' });
-    commitTreeOperation({
-      kind: 'tree.purge',
-      workspaceId: workspace.id,
-      nodeId: originalId,
-    }, { role: 'owner' });
-    const successor = listWorkspaceNodes(workspace.id)
-      .find((node) => node.id !== workspace.id && node.id !== originalId);
-    const successorPath = path.join(
-      root,
-      ...successor.relativePath.split('/'),
-    );
-    assert.match(successor.name, /^draft\.amalgm-retained-[0-9a-f]{12}\.txt$/);
-    assert.equal(fs.readFileSync(successorPath, 'utf8'), 'still being written\n');
-    assert.equal(isUuidV7(successor.id), true);
-    assert.notEqual(successor.id, originalId);
-    const purged = listWorkspaceNodes(workspace.id, {
-      includeTrashed: true,
-      includePurged: true,
-    }).find((node) => node.id === originalId);
-    assert.ok(purged.purgedAt);
-    const successorMutation = openLocalDb().prepare(`
-      SELECT mutation_state
-      FROM mutation_journal
-      WHERE local_resource = ?
-        AND mutation_origin = 'local'
-        AND operation_kind = 'tree.create'
-      ORDER BY journal_id DESC
-      LIMIT 1
-    `).get(`workspace-tree:${workspace.id}`);
-    assert.equal(successorMutation.mutation_state, 'saved-local');
-  } finally {
-    fs.closeSync(writer);
-  }
-});
-
-test('equal trash timestamps never merge independent physical components', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'equal-trash-time');
-  const folderPath = path.join(root, 'folder');
-  const childPath = path.join(folderPath, 'child.txt');
-  fs.mkdirSync(folderPath, { recursive: true });
-  fs.writeFileSync(childPath, 'independent bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Equal trash timestamp',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const folderId = nodeForPath(folderPath).node.id;
-  const childId = nodeForPath(childPath).node.id;
-  const changedAt = '2026-07-21T12:01:00.000Z';
-  const childTrashPath = trashPath(workspace.id, childId, workspace.path);
-  const folderTrashPath = trashPath(workspace.id, folderId, workspace.path);
-
-  commitTreeOperation({
-    kind: 'tree.trash',
-    workspaceId: workspace.id,
-    nodeId: childId,
-    trashedAt: changedAt,
-  });
-  commitTreeOperation({
-    kind: 'tree.trash',
-    workspaceId: workspace.id,
-    nodeId: folderId,
-    trashedAt: changedAt,
-  });
-  const tombstones = listWorkspaceNodes(workspace.id, { includeTrashed: true });
-  assert.equal(tombstones.find((node) => node.id === childId).trashComponentId, childId);
-  assert.equal(tombstones.find((node) => node.id === folderId).trashComponentId, folderId);
-
-  commitTreeOperation({
-    kind: 'tree.purge',
-    workspaceId: workspace.id,
-    nodeId: folderId,
-  }, { role: 'owner' });
-  assert.equal(fs.existsSync(folderTrashPath), false);
-  assert.equal(fs.existsSync(childTrashPath), false);
-  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
-});
-
-test('purging a writer-held cascaded child gives it a live recovery UUID', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'cascaded-writer-purge');
-  const folderPath = path.join(root, 'folder');
-  const childPath = path.join(folderPath, 'child.txt');
-  fs.mkdirSync(folderPath, { recursive: true });
-  fs.writeFileSync(childPath, 'writer survives\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Cascaded writer purge',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const folderId = nodeForPath(folderPath).node.id;
-  const childId = nodeForPath(childPath).node.id;
-  const writer = fs.openSync(childPath, 'r+');
-  try {
-    commitTreeOperation({
-      kind: 'tree.trash',
-      workspaceId: workspace.id,
-      nodeId: folderId,
-    });
-    commitTreeOperation({
-      kind: 'tree.purge',
-      workspaceId: workspace.id,
-      nodeId: childId,
-    }, { role: 'owner' });
-
-    const successor = listWorkspaceNodes(workspace.id)
-      .find((node) => node.id !== workspace.id && node.id !== folderId);
-    assert.ok(successor);
-    assert.notEqual(successor.id, childId);
-    assert.equal(successor.parentId, workspace.id);
-    assert.match(successor.name, /^child\.amalgm-retained-[0-9a-f]{12}\.txt$/);
-    assert.equal(
-      fs.readFileSync(path.join(root, successor.name), 'utf8'),
-      'writer survives\n',
-    );
-    const oldChild = listWorkspaceNodes(workspace.id, {
-      includeTrashed: true,
-      includePurged: true,
-    }).find((node) => node.id === childId);
-    assert.ok(oldChild.purgedAt);
-    assert.equal(
-      openLocalDb().prepare(
-        'SELECT count(*) AS count FROM workspace_tree_operation_materializations',
-      ).get().count,
-      0,
-    );
-  } finally {
-    fs.closeSync(writer);
-  }
-});
-
-test('an occupied purge recovery name fails closed until both byte sets have durable births', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'purge-recovery-collision');
-  const file = path.join(root, 'draft.txt');
-  fs.mkdirSync(root);
-  fs.writeFileSync(file, 'writer bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Purge recovery collision',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const originalId = nodeForPath(file).node.id;
-  const writer = fs.openSync(file, 'r+');
-  let recoveryTarget = null;
-  try {
-    commitTreeOperation({
-      kind: 'tree.trash',
-      workspaceId: workspace.id,
-      nodeId: originalId,
-    });
-    assert.throws(() => commitTreeOperation({
-      kind: 'tree.purge',
-      workspaceId: workspace.id,
-      nodeId: originalId,
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationPlan(plan) {
-          recoveryTarget = plan.actions.find((action) => action.type === 'remove').retainTarget;
-          fs.writeFileSync(recoveryTarget, 'independent collision\n');
-        },
-      },
-    }), (error) => (
-      error?.code === 'WORKSPACE_TREE_RETRY_PENDING'
-      && error?.reason === 'retained-target-occupied'
-    ));
-
-    assert.equal(fs.readFileSync(recoveryTarget, 'utf8'), 'independent collision\n');
-    assert.ok(nodeForPath(recoveryTarget), 'the racing target receives its own birth');
-    assert.equal(openLocalDb().prepare(`
-      SELECT count(*) AS count
-      FROM workspace_tree_operation_materializations
-      WHERE resource_id = ? AND materialization_state = 'committed'
-    `).get(workspace.id).count, 1);
-
-    fs.unlinkSync(recoveryTarget);
-    recoverAllTreePlans({ database: openLocalDb() });
-    const visible = fs.readdirSync(root).map((name) => path.join(root, name));
-    const retainedPath = visible.find(
-      (candidate) => fs.readFileSync(candidate, 'utf8') === 'writer bytes\n',
-    );
-    assert.ok(retainedPath);
-    const retainedNode = nodeForPath(retainedPath).node;
-    assert.notEqual(retainedNode.id, originalId);
-    assert.equal(openLocalDb().prepare(`
-      SELECT count(*) AS count
-      FROM workspace_tree_operation_materializations
-      WHERE resource_id = ?
-    `).get(workspace.id).count, 0);
-  } finally {
-    fs.closeSync(writer);
-  }
-});
-
-test('purge recovery follows a live parent UUID across restart rename', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'purge-recovery-parent');
-  const parent = path.join(root, 'parent');
-  const movedParent = path.join(root, 'moved-parent');
-  const file = path.join(parent, 'draft.txt');
-  fs.mkdirSync(parent, { recursive: true });
-  fs.writeFileSync(file, 'writer follows parent\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Purge recovery parent',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const parentId = nodeForPath(parent).node.id;
-  const originalId = nodeForPath(file).node.id;
-  const writer = fs.openSync(file, 'r+');
-  try {
-    commitTreeOperation({
-      kind: 'tree.trash',
-      workspaceId: workspace.id,
-      nodeId: originalId,
-    });
-    assert.throws(() => commitTreeOperation({
-      kind: 'tree.purge',
-      workspaceId: workspace.id,
-      nodeId: originalId,
-    }, {
-      role: 'owner',
-      testHooks: { crashAfterOperationCommit: true },
-    }), /simulated workspace tree crash after local operation commit/);
-
-    fs.renameSync(parent, movedParent);
-    fs.mkdirSync(parent);
-    fs.writeFileSync(path.join(parent, 'replacement.txt'), 'replacement parent\n');
-    recoverAllTreePlans({ database: openLocalDb() });
-
-    assert.equal(nodeForPath(movedParent).node.id, parentId);
-    assert.notEqual(nodeForPath(parent).node.id, parentId);
-    const successor = listWorkspaceNodes(workspace.id)
-      .find((node) => (
-        node.parentId === parentId
-        && /^draft\.amalgm-retained-[0-9a-f]{12}\.txt$/.test(node.name)
-      ));
-    assert.ok(successor);
-    assert.equal(successor.parentId, parentId);
-    assert.equal(
-      fs.readFileSync(path.join(movedParent, successor.name), 'utf8'),
-      'writer follows parent\n',
-    );
-    assert.equal(openLocalDb().prepare(`
-      SELECT count(*) AS count
-      FROM workspace_tree_operation_materializations
-      WHERE resource_id = ?
-    `).get(workspace.id).count, 0);
-  } finally {
-    fs.closeSync(writer);
-  }
-});
-
-test('legacy trash migration waits for physical ownership and never guesses from time', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'legacy-trash-provenance');
-  const folderPath = path.join(root, 'folder');
-  const childPath = path.join(folderPath, 'child.txt');
-  fs.mkdirSync(folderPath, { recursive: true });
-  fs.writeFileSync(childPath, 'legacy bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Legacy trash provenance',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const folderId = nodeForPath(folderPath).node.id;
-  const childId = nodeForPath(childPath).node.id;
-  const changedAt = '2026-07-21T12:01:00.000Z';
-  commitTreeOperation({
-    kind: 'tree.trash',
-    workspaceId: workspace.id,
-    nodeId: childId,
-    trashedAt: changedAt,
-  });
-  commitTreeOperation({
-    kind: 'tree.trash',
-    workspaceId: workspace.id,
-    nodeId: folderId,
-    trashedAt: changedAt,
-  });
-
-  const childTrashPath = trashPath(workspace.id, childId, workspace.path);
-  const trashRoot = path.dirname(childTrashPath);
-  const unavailableTrashRoot = `${trashRoot}-unavailable`;
-  fs.renameSync(trashRoot, unavailableTrashRoot);
-  openLocalDb().prepare(`
-    UPDATE workspace_nodes
-    SET trash_component_id = NULL
-    WHERE id IN (?, ?)
-  `).run(folderId, childId);
-  backfillWorkspaceTrashComponents(openLocalDb());
-  let rows = openLocalDb().prepare(`
-    SELECT id, trash_component_id
-    FROM workspace_nodes
-    WHERE id IN (?, ?)
-    ORDER BY id
-  `).all(folderId, childId);
-  assert.equal(rows.every((row) => row.trash_component_id === null), true);
-
-  fs.renameSync(unavailableTrashRoot, trashRoot);
-  backfillWorkspaceTrashComponents(openLocalDb());
-  rows = openLocalDb().prepare(`
-    SELECT id, trash_component_id
-    FROM workspace_nodes
-    WHERE id IN (?, ?)
-  `).all(folderId, childId);
-  assert.equal(rows.find((row) => row.id === folderId).trash_component_id, folderId);
-  assert.equal(rows.find((row) => row.id === childId).trash_component_id, childId);
-
-  openLocalDb().prepare(`
-    UPDATE workspace_nodes
-    SET purged_at = ?, trash_component_id = ?
-    WHERE id = ?
-  `).run(changedAt, childId, childId);
-  backfillWorkspaceTrashComponents(openLocalDb());
-  assert.equal(
-    openLocalDb().prepare(
-      'SELECT trash_component_id FROM workspace_nodes WHERE id = ?',
-    ).get(childId).trash_component_id,
-    null,
-  );
-});
-
 test('parent restore leaves an independently trashed child in its own trash slot', () => {
   const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'trash-cascades');
   const folderPath = path.join(root, 'folder');
@@ -1228,8 +358,8 @@ test('parent restore leaves an independently trashed child in its own trash slot
   enrollWorkspace(workspace.id);
   const folderId = nodeForPath(folderPath).node.id;
   const childId = nodeForPath(childPath).node.id;
-  const childTrashPath = trashPath(workspace.id, childId, workspace.path);
-  const folderTrashPath = trashPath(workspace.id, folderId, workspace.path);
+  const childTrashPath = path.join(process.env.AMALGM_DIR, 'trash', 'workspaces', workspace.id, childId);
+  const folderTrashPath = path.join(process.env.AMALGM_DIR, 'trash', 'workspaces', workspace.id, folderId);
 
   commitTreeOperation({
     kind: 'tree.trash',
@@ -1238,11 +368,6 @@ test('parent restore leaves an independently trashed child in its own trash slot
     trashedAt: '2026-07-21T12:01:00.000Z',
   });
   assert.equal(fs.readFileSync(childTrashPath, 'utf8'), 'child bytes\n');
-  assert.equal(
-    fs.lstatSync(path.dirname(root), { bigint: true }).dev,
-    fs.lstatSync(path.dirname(childTrashPath), { bigint: true }).dev,
-  );
-  assert.equal(childTrashPath.startsWith(`${process.env.AMALGM_DIR}${path.sep}`), false);
   commitTreeOperation({
     kind: 'tree.trash',
     workspaceId: workspace.id,
@@ -1261,2251 +386,3 @@ test('parent restore leaves an independently trashed child in its own trash slot
   assert.equal(fs.existsSync(folderTrashPath), false);
   assert.equal(fs.existsSync(childTrashPath), false);
 });
-
-test('purging a cascaded child removes it from the parent trash carrier permanently', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'cascaded-child-purge');
-  const folderPath = path.join(root, 'folder');
-  const childPath = path.join(folderPath, 'child.txt');
-  fs.mkdirSync(folderPath, { recursive: true });
-  fs.writeFileSync(childPath, 'must stay deleted\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Cascaded child purge',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const folderId = nodeForPath(folderPath).node.id;
-  const childId = nodeForPath(childPath).node.id;
-
-  commitTreeOperation({
-    kind: 'tree.trash',
-    workspaceId: workspace.id,
-    nodeId: folderId,
-  });
-  commitTreeOperation({
-    kind: 'tree.purge',
-    workspaceId: workspace.id,
-    nodeId: childId,
-  }, { role: 'owner' });
-  commitTreeOperation({
-    kind: 'tree.restore',
-    workspaceId: workspace.id,
-    nodeId: folderId,
-  });
-
-  assert.equal(fs.existsSync(folderPath), true);
-  assert.equal(fs.existsSync(childPath), false);
-  const child = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-    includePurged: true,
-  }).find((node) => node.id === childId);
-  assert.ok(child.purgedAt);
-  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
-});
-
-test('renaming a parent ignores duplicate logical paths held only by tombstones', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'tombstone-paths');
-  const folderPath = path.join(root, 'before');
-  const firstPath = path.join(folderPath, 'same.txt');
-  fs.mkdirSync(folderPath, { recursive: true });
-  fs.writeFileSync(firstPath, 'first\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Tombstone paths',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const folderId = nodeForPath(folderPath).node.id;
-  const firstId = nodeForPath(firstPath).node.id;
-  commitTreeOperation({
-    kind: 'tree.trash',
-    workspaceId: workspace.id,
-    nodeId: firstId,
-  });
-
-  fs.writeFileSync(firstPath, 'second\n');
-  commitPathCreate(firstPath, 'file');
-  const secondId = nodeForPath(firstPath).node.id;
-  assert.notEqual(secondId, firstId);
-  commitTreeOperation({
-    kind: 'tree.trash',
-    workspaceId: workspace.id,
-    nodeId: secondId,
-  });
-
-  commitTreeOperation({
-    kind: 'tree.rename',
-    workspaceId: workspace.id,
-    nodeId: folderId,
-    name: 'after',
-  });
-  assert.equal(fs.existsSync(path.join(root, 'after')), true);
-  const tombstones = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-  }).filter((node) => node.name === 'same.txt');
-  assert.equal(tombstones.length, 2);
-  assert.equal(new Set(tombstones.map((node) => node.relativePath)).size, 1);
-});
-
-test('a parent rename after source staging is captured and causally replanned', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'staged-parent-rename');
-  const folder = path.join(root, 'A');
-  const movedFolder = path.join(root, 'C');
-  const source = path.join(folder, 'x.txt');
-  fs.mkdirSync(folder, { recursive: true });
-  fs.writeFileSync(source, 'staged parent bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Staged parent rename',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const fileId = nodeForPath(source).node.id;
-  let raced = false;
-  commitTreeOperation({
-    kind: 'tree.rename',
-    workspaceId: workspace.id,
-    nodeId: fileId,
-    name: 'y.txt',
-  }, {
-    role: 'owner',
-    testHooks: {
-      afterOperationStaging() {
-        if (raced) return;
-        raced = true;
-        fs.renameSync(folder, movedFolder);
-      },
-    },
-  });
-  const finalPath = path.join(movedFolder, 'y.txt');
-  assert.equal(fs.readFileSync(finalPath, 'utf8'), 'staged parent bytes\n');
-  assert.equal(nodeForPath(finalPath).node.id, fileId);
-  assert.deepEqual(reconcileWorkspaceTree(workspace.id).operations, []);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('cancellation births a source occupant before its restore sidecar plan retires', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'cancelled-source-occupant',
-  );
-  const folder = path.join(root, 'A');
-  const movedFolder = path.join(root, 'C');
-  const source = path.join(folder, 'source.txt');
-  const movedSource = path.join(movedFolder, 'source.txt');
-  fs.mkdirSync(folder, { recursive: true });
-  fs.writeFileSync(source, 'official source bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Cancelled source occupant',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const sourceId = nodeForPath(source).node.id;
-  assert.throws(
-    () => commitTreeOperation({
-      kind: 'tree.rename',
-      workspaceId: workspace.id,
-      nodeId: sourceId,
-      name: 'official-name.txt',
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationStaging() {
-          fs.renameSync(folder, movedFolder);
-          fs.writeFileSync(movedSource, 'independent source occupant\n');
-        },
-        afterOperationCancellationOutputReceipt(outputs) {
-          assert.ok(outputs.some((output) => (
-            output.provenance === 'independent-occupant'
-            && output.path.includes('.amalgm-retained-')
-          )));
-          throw new Error('simulated crash after source occupant receipt');
-        },
-      },
-    }),
-    /simulated crash after source occupant receipt/,
-  );
-  const held = openLocalDb().prepare(`
-    SELECT plan_json AS planJson
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id);
-  assert.ok(JSON.parse(held.planJson).retainedOutputs.some((output) => (
-    output.provenance === 'independent-occupant'
-  )));
-
-  recoverAllTreePlans();
-
-  const official = path.join(movedFolder, 'official-name.txt');
-  assert.equal(fs.readFileSync(official, 'utf8'), 'official source bytes\n');
-  assert.equal(nodeForPath(official).node.id, sourceId);
-  const sidecar = fs.readdirSync(movedFolder).find((name) => (
-    name.startsWith('source.amalgm-retained-')
-    && name.endsWith('.txt')
-  ));
-  assert.ok(sidecar);
-  const sidecarPath = path.join(movedFolder, sidecar);
-  assert.equal(
-    fs.readFileSync(sidecarPath, 'utf8'),
-    'independent source occupant\n',
-  );
-  assert.notEqual(nodeForPath(sidecarPath).node.id, sourceId);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('prepared retained hardlinks hold visibly until one physical name wins', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'cancelled-source-hardlink-hold',
-  );
-  const folder = path.join(root, 'A');
-  const movedFolder = path.join(root, 'C');
-  const source = path.join(folder, 'source.txt');
-  const movedSource = path.join(movedFolder, 'source.txt');
-  const alias = path.join(movedFolder, 'alias.txt');
-  fs.mkdirSync(folder, { recursive: true });
-  fs.writeFileSync(source, 'official source bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Cancelled source hardlink hold',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const sourceId = nodeForPath(source).node.id;
-  let linked = false;
-  assert.throws(
-    () => commitTreeOperation({
-      kind: 'tree.rename',
-      workspaceId: workspace.id,
-      nodeId: sourceId,
-      name: 'official-name.txt',
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationStaging() {
-          fs.renameSync(folder, movedFolder);
-          fs.writeFileSync(movedSource, 'independent source occupant\n');
-        },
-        afterOperationCancellationOutputMove(outputs) {
-          if (linked) return;
-          linked = true;
-          const retained = outputs.find(
-            (output) => output.provenance === 'independent-occupant',
-          );
-          fs.linkSync(retained.path, alias);
-          throw new Error('simulated crash after retained hardlink appeared');
-        },
-      },
-    }),
-    /simulated crash after retained hardlink appeared/,
-  );
-
-  assert.throws(
-    () => recoverAllTreePlans(),
-    /ambiguous-physical-alias/,
-  );
-  const heldWorkspace = listWorkspaces().find(
-    (candidate) => candidate.id === workspace.id,
-  );
-  assert.equal(heldWorkspace.treeObservation.state, 'held');
-  assert.ok(heldWorkspace.treeObservation.holds.some((hold) => (
-    hold.reason === 'ambiguous-physical-alias'
-    && hold.paths.some((heldPath) => heldPath.endsWith('alias.txt'))
-  )));
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 1);
-  assert.equal(nodeForPath(alias), null);
-
-  fs.unlinkSync(alias);
-  recoverAllTreePlans();
-
-  const sidecar = fs.readdirSync(movedFolder).find((name) => (
-    name.startsWith('source.amalgm-retained-')
-    && name.endsWith('.txt')
-  ));
-  assert.ok(sidecar);
-  assert.equal(
-    fs.readFileSync(path.join(movedFolder, sidecar), 'utf8'),
-    'independent source occupant\n',
-  );
-  assert.equal(
-    listWorkspaces().find((candidate) => candidate.id === workspace.id)
-      .treeObservation,
-    null,
-  );
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('prepared creates cancel cleanly when their parent moves', () => {
-  for (const [index, kind] of ['file', 'folder', 'symlink'].entries()) {
-    const root = path.join(
-      process.env.AMALGM_WORKSPACES_DIR,
-      `prepared-create-parent-${kind}`,
-    );
-    const folder = path.join(root, 'A');
-    const movedFolder = path.join(root, 'C');
-    fs.mkdirSync(folder, { recursive: true });
-    const workspace = upsertWorkspace({
-      path: root,
-      name: `Prepared ${kind}`,
-      source: 'computer',
-    });
-    enrollWorkspace(workspace.id);
-    const parentId = nodeForPath(folder).node.id;
-    const nodeId = uuidV7();
-    let raced = false;
-    commitTreeOperation({
-      kind: 'tree.create',
-      workspaceId: workspace.id,
-      nodeId,
-      parentId,
-      nodeKind: kind,
-      name: `${kind}-${index}`,
-      ...(kind === 'symlink' ? { symlinkTarget: 'target.txt' } : {}),
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationCreatePrepared() {
-          if (raced) return;
-          raced = true;
-          fs.renameSync(folder, movedFolder);
-        },
-      },
-    });
-    const finalPath = path.join(movedFolder, `${kind}-${index}`);
-    assert.equal(fs.lstatSync(finalPath).isSymbolicLink(), kind === 'symlink');
-    assert.equal(nodeForPath(finalPath).node.id, nodeId);
-    assert.equal(openLocalDb().prepare(`
-      SELECT COUNT(*) AS count
-      FROM workspace_tree_operation_materializations
-      WHERE resource_id = ?
-    `).get(workspace.id).count, 0);
-  }
-});
-
-test('same-path folder replacement retires the old UUID and births a new one', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'folder-replacement');
-  const folder = path.join(root, 'A');
-  fs.mkdirSync(folder, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Folder replacement',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const oldId = nodeForPath(folder).node.id;
-  fs.rmdirSync(folder);
-  fs.mkdirSync(folder);
-  const observed = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(
-    observed.operations.map((operation) => operation.kind),
-    ['tree.trash', 'tree.create'],
-  );
-  const replacement = nodeForPath(folder).node;
-  assert.notEqual(replacement.id, oldId);
-  const old = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-  }).find((node) => node.id === oldId);
-  assert.ok(old.trashedAt);
-});
-
-test('an atomic same-path file save refreshes its binding before a later rename', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'atomic-file-binding-refresh',
-  );
-  const originalPath = path.join(root, 'a.txt');
-  const replacementPath = path.join(root, '.replacement.txt');
-  const renamedPath = path.join(root, 'b.txt');
-  fs.mkdirSync(root, { recursive: true });
-  fs.writeFileSync(originalPath, 'original bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Atomic file binding refresh',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const original = nodeForPath(originalPath).node;
-
-  fs.writeFileSync(replacementPath, 'replacement bytes\n');
-  fs.renameSync(replacementPath, originalPath);
-  const replacementIdentity = fs.lstatSync(originalPath);
-  const replacement = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(replacement.operations, []);
-  const rebound = nodeForPath(originalPath).node;
-  assert.equal(rebound.id, original.id);
-  assert.equal(rebound.deviceId, String(replacementIdentity.dev));
-  assert.equal(rebound.inode, String(replacementIdentity.ino));
-
-  fs.renameSync(originalPath, renamedPath);
-  const renamed = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(
-    renamed.operations.map((operation) => operation.kind),
-    ['tree.rename'],
-  );
-  assert.equal(nodeForPath(renamedPath).node.id, original.id);
-  assert.equal(fs.readFileSync(renamedPath, 'utf8'), 'replacement bytes\n');
-  const old = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-  }).find((node) => node.id === original.id);
-  assert.equal(old.trashedAt, null);
-});
-
-test('enrollment holds hardlink aliases before two UUIDs can claim one inode', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'initial-hardlink-alias',
-  );
-  const originalPath = path.join(root, 'a.txt');
-  const aliasPath = path.join(root, 'b.txt');
-  fs.mkdirSync(root, { recursive: true });
-  fs.writeFileSync(originalPath, 'one inode\n');
-  fs.linkSync(originalPath, aliasPath);
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Initial hardlink alias',
-    source: 'computer',
-  });
-
-  const held = enrollWorkspace(workspace.id);
-  assert.equal(held.skipped, 'ambiguous-physical-alias');
-  assert.deepEqual(held.held, [{
-    reason: 'ambiguous-physical-alias',
-    paths: ['a.txt', 'b.txt'],
-  }]);
-  assert.equal(listWorkspaceNodes(workspace.id).length, 1);
-  assert.equal(nodeForPath(originalPath), null);
-  assert.equal(nodeForPath(aliasPath), null);
-
-  fs.unlinkSync(aliasPath);
-  const enrolled = enrollWorkspace(workspace.id);
-  assert.equal(enrolled.skipped, undefined);
-  assert.equal(nodeForPath(originalPath).node.id, enrolled.nodes.find(
-    (node) => node.relativePath === 'a.txt',
-  ).id);
-  assert.equal(nodeForPath(aliasPath), null);
-});
-
-test('registration returns the durable observation hold for initial hardlinks', async () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'registered-hardlink-alias',
-  );
-  const originalPath = path.join(root, 'a.txt');
-  const aliasPath = path.join(root, 'b.txt');
-  fs.mkdirSync(root, { recursive: true });
-  fs.writeFileSync(originalPath, 'one registered inode\n');
-  fs.linkSync(originalPath, aliasPath);
-  let response = null;
-
-  await handleProjectRegister({ path: root }, (status, body) => {
-    response = { status, body };
-  });
-
-  assert.equal(response.status, 200);
-  assert.equal(response.body.workspace.treeObservation.state, 'held');
-  assert.deepEqual(
-    response.body.tree.observation.holds.map((hold) => ({
-      reason: hold.reason,
-      paths: hold.paths,
-    })),
-    [{
-      reason: 'ambiguous-physical-alias',
-      paths: ['a.txt', 'b.txt'],
-    }],
-  );
-});
-
-test('observation holds new hardlink aliases while unrelated files still get births', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'observed-hardlink-alias',
-  );
-  const originalPath = path.join(root, 'a.txt');
-  const aliasPath = path.join(root, 'b.txt');
-  const unrelatedPath = path.join(root, 'c.txt');
-  fs.mkdirSync(root, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Observed hardlink alias',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-
-  fs.writeFileSync(originalPath, 'one unknown inode\n');
-  fs.linkSync(originalPath, aliasPath);
-  fs.writeFileSync(unrelatedPath, 'independent bytes\n');
-  const observed = reconcileWorkspaceTree(workspace.id);
-
-  assert.deepEqual(observed.held, [{
-    nodeId: null,
-    paths: ['a.txt', 'b.txt'],
-    reason: 'ambiguous-physical-alias',
-  }]);
-  assert.equal(nodeForPath(originalPath), null);
-  assert.equal(nodeForPath(aliasPath), null);
-  const unrelatedId = nodeForPath(unrelatedPath)?.node.id;
-  assert.ok(unrelatedId);
-  assert.deepEqual(
-    observed.operations.map((operation) => operation.kind),
-    ['tree.create'],
-  );
-
-  fs.unlinkSync(aliasPath);
-  const resolved = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(resolved.held, []);
-  assert.ok(nodeForPath(originalPath)?.node.id);
-  assert.equal(nodeForPath(aliasPath), null);
-  assert.equal(nodeForPath(unrelatedPath)?.node.id, unrelatedId);
-});
-
-test('the recurring observer durably surfaces and clears physical alias holds', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'recurring-hardlink-alias',
-  );
-  const originalPath = path.join(root, 'a.txt');
-  const aliasPath = path.join(root, 'b.txt');
-  const unrelatedPath = path.join(root, 'c.txt');
-  fs.mkdirSync(root, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Recurring hardlink alias',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-
-  fs.writeFileSync(originalPath, 'one unresolved inode\n');
-  fs.linkSync(originalPath, aliasPath);
-  fs.writeFileSync(unrelatedPath, 'ordinary local work\n');
-  reconcileRegisteredWorkspaceTrees();
-
-  const held = listWorkspaces().find((entry) => entry.id === workspace.id);
-  assert.equal(held.treeObservation.state, 'held');
-  assert.deepEqual(
-    held.treeObservation.holds.map((entry) => ({
-      reason: entry.reason,
-      paths: entry.paths,
-    })),
-    [{
-      reason: 'ambiguous-physical-alias',
-      paths: ['a.txt', 'b.txt'],
-    }],
-  );
-  assert.ok(nodeForPath(unrelatedPath)?.node.id);
-  assert.equal(nodeForPath(originalPath), null);
-  assert.equal(nodeForPath(aliasPath), null);
-  const event = openLocalDb().prepare(`
-    SELECT value_json
-    FROM event_log
-    WHERE resource = 'workspaces' AND id = ?
-      AND source = 'workspace-tree:observation-hold'
-    ORDER BY seq DESC
-    LIMIT 1
-  `).get(workspace.id);
-  assert.equal(JSON.parse(event.value_json).treeObservation.state, 'held');
-  const holdEventCount = openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM event_log
-    WHERE id = ? AND source = 'workspace-tree:observation-hold'
-  `).get(workspace.id).count;
-  reconcileRegisteredWorkspaceTrees();
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM event_log
-    WHERE id = ? AND source = 'workspace-tree:observation-hold'
-  `).get(workspace.id).count, holdEventCount);
-  assert.equal(
-    reconcileWorkspaceTree(workspace.id, { maxNodes: 0 }).skipped,
-    'node_limit',
-  );
-  assert.equal(
-    listWorkspaces().find((entry) => entry.id === workspace.id).treeObservation.state,
-    'held',
-  );
-
-  closeLocalDb();
-  assert.equal(
-    listWorkspaces().find((entry) => entry.id === workspace.id).treeObservation.state,
-    'held',
-  );
-
-  fs.unlinkSync(aliasPath);
-  reconcileRegisteredWorkspaceTrees();
-  const resolved = listWorkspaces().find((entry) => entry.id === workspace.id);
-  assert.equal(resolved.treeObservation, null);
-  assert.ok(nodeForPath(originalPath)?.node.id);
-  assert.equal(nodeForPath(aliasPath), null);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_observation_holds
-    WHERE workspace_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('repeat enrollment cannot absorb or clear a permission-held disk birth', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'permission-held-repeat-enrollment',
-  );
-  const target = path.join(root, 'local.txt');
-  fs.mkdirSync(root, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Permission-held repeat enrollment',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-
-  const identity = require('../workspace/identity');
-  const previousUserId = identity.userId;
-  const memberId = 'member-permission-held-repeat-enrollment';
-  openLocalDb().prepare(`
-    INSERT INTO workspace_node_permissions(workspace_id, node_id, user_id, role)
-    VALUES (?, ?, ?, 'viewer')
-  `).run(workspace.id, workspace.id, memberId);
-  identity.userId = () => memberId;
-  try {
-    fs.writeFileSync(target, 'held local bytes\n');
-    const first = reconcileWorkspaceTree(workspace.id);
-    assert.deepEqual(first.operations, []);
-    assert.equal(first.held[0].reason, 'forbidden');
-    assert.deepEqual(first.held[0].paths, ['local.txt']);
-    assert.equal(nodeForPath(target), null);
-
-    const repeated = enrollWorkspace(workspace.id);
-    assert.deepEqual(repeated.operations, []);
-    assert.equal(repeated.held[0].reason, 'forbidden');
-    assert.equal(nodeForPath(target), null);
-    assert.equal(
-      listWorkspaces().find((entry) => entry.id === workspace.id)
-        .treeObservation.holds[0].reason,
-      'forbidden',
-    );
-    assert.equal(openLocalDb().prepare(`
-      SELECT COUNT(*) AS count
-      FROM mutation_journal
-      WHERE local_resource = ? AND operation_kind = 'tree.create'
-    `).get(`workspace-tree:${workspace.id}`).count, 0);
-
-    openLocalDb().prepare(`
-      UPDATE workspace_node_permissions SET role = 'editor'
-      WHERE workspace_id = ? AND node_id = ? AND user_id = ?
-    `).run(workspace.id, workspace.id, memberId);
-    const resolved = enrollWorkspace(workspace.id);
-    assert.deepEqual(
-      resolved.operations.map((operation) => operation.kind),
-      ['tree.create'],
-    );
-    assert.ok(nodeForPath(target)?.node.id);
-    assert.equal(
-      listWorkspaces().find((entry) => entry.id === workspace.id)
-        .treeObservation,
-      null,
-    );
-  } finally {
-    identity.userId = previousUserId;
-  }
-});
-
-test('legacy duplicate inode owners remain one durable contradictory hold', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'legacy-duplicate-inode-owners',
-  );
-  const survivingPath = path.join(root, 'a.txt');
-  const removedAliasPath = path.join(root, 'b.txt');
-  fs.mkdirSync(root, { recursive: true });
-  fs.writeFileSync(survivingPath, 'legacy shared inode\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Legacy duplicate inode owners',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const first = nodeForPath(survivingPath).node;
-  const secondId = uuidV7();
-  const now = new Date().toISOString();
-  fs.linkSync(survivingPath, removedAliasPath);
-  openLocalDb().prepare(`
-    INSERT INTO workspace_nodes (
-      id, workspace_id, parent_id, kind, name, relative_path,
-      symlink_target, device_id, inode, created_at, updated_at
-    ) VALUES (?, ?, ?, 'file', 'b.txt', 'b.txt', NULL, ?, ?, ?, ?)
-  `).run(
-    secondId,
-    workspace.id,
-    workspace.id,
-    first.deviceId,
-    first.inode,
-    now,
-    now,
-  );
-  fs.unlinkSync(removedAliasPath);
-
-  const observed = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(observed.operations, []);
-  assert.deepEqual(
-    observed.held.map((hold) => ({
-      nodeId: hold.nodeId,
-      reason: hold.reason,
-      paths: hold.paths,
-    })).sort((left, right) => left.nodeId.localeCompare(right.nodeId)),
-    [first.id, secondId].sort().map((nodeId) => ({
-      nodeId,
-      reason: 'ambiguous-physical-ownership',
-      paths: ['a.txt'],
-    })),
-  );
-  assert.equal(
-    listWorkspaces().find((entry) => entry.id === workspace.id)
-      .treeObservation.holds.length,
-    2,
-  );
-  assert.equal(
-    listWorkspaceNodes(workspace.id).filter(
-      (node) => node.id === first.id || node.id === secondId,
-    ).length,
-    2,
-    'contradictory legacy ownership is held instead of guessed from a name',
-  );
-});
-
-test('a replaced destination parent applies the original move before its local trash', () => {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'causal-parent-replacement');
-  const folder = path.join(root, 'D');
-  const source = path.join(root, 'x.txt');
-  fs.mkdirSync(folder, { recursive: true });
-  fs.writeFileSync(source, 'causal parent bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Causal parent replacement',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const oldFolderId = nodeForPath(folder).node.id;
-  const fileId = nodeForPath(source).node.id;
-  commitTreeOperation({
-    kind: 'tree.move',
-    workspaceId: workspace.id,
-    nodeId: fileId,
-    parentId: oldFolderId,
-    name: 'x.txt',
-  }, {
-    role: 'owner',
-    testHooks: {
-      afterOperationPlan() {
-        fs.rmdirSync(folder);
-        fs.mkdirSync(folder);
-      },
-    },
-  });
-  assert.equal(fs.existsSync(source), false);
-  assert.deepEqual(fs.readdirSync(folder), []);
-  assert.notEqual(nodeForPath(folder).node.id, oldFolderId);
-  const oldFolderTrash = trashPath(workspace.id, oldFolderId, workspace.path);
-  assert.equal(
-    fs.readFileSync(path.join(oldFolderTrash, 'x.txt'), 'utf8'),
-    'causal parent bytes\n',
-  );
-  const rows = listWorkspaceNodes(workspace.id, { includeTrashed: true });
-  assert.ok(rows.find((node) => node.id === oldFolderId).trashedAt);
-  assert.ok(rows.find((node) => node.id === fileId).trashedAt);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('a child keeps its UUID when only its same-path parent is replaced', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'same-path-parent-child-survivor',
-  );
-  const folder = path.join(root, 'A');
-  const heldFolder = path.join(root, 'held-A');
-  const file = path.join(folder, 'x.txt');
-  fs.mkdirSync(folder, { recursive: true });
-  fs.writeFileSync(file, 'surviving child bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Same-path parent child survivor',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const oldFolderId = nodeForPath(folder).node.id;
-  const fileId = nodeForPath(file).node.id;
-
-  fs.renameSync(folder, heldFolder);
-  fs.mkdirSync(folder);
-  fs.renameSync(path.join(heldFolder, 'x.txt'), file);
-  fs.rmdirSync(heldFolder);
-
-  reconcileWorkspaceTree(workspace.id);
-  const replacementFolder = nodeForPath(folder).node;
-  const survivingFile = nodeForPath(file).node;
-  assert.notEqual(replacementFolder.id, oldFolderId);
-  assert.equal(survivingFile.id, fileId);
-  assert.equal(survivingFile.parentId, replacementFolder.id);
-  assert.equal(fs.readFileSync(file, 'utf8'), 'surviving child bytes\n');
-  const rows = listWorkspaceNodes(workspace.id, { includeTrashed: true });
-  assert.ok(rows.find((node) => node.id === oldFolderId).trashedAt);
-  assert.equal(rows.find((node) => node.id === fileId).trashedAt, null);
-});
-
-test('a surviving folder preserves kept children while classifying its changed members', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'same-path-parent-folder-survivor',
-  );
-  const folder = path.join(root, 'A');
-  const heldFolder = path.join(root, 'held-A');
-  const nested = path.join(folder, 'B');
-  fs.mkdirSync(nested, { recursive: true });
-  fs.writeFileSync(path.join(nested, 'keep.txt'), 'keep bytes\n');
-  fs.writeFileSync(path.join(nested, 'gone.txt'), 'gone bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Same-path parent folder survivor',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const oldFolderId = nodeForPath(folder).node.id;
-  const nestedId = nodeForPath(nested).node.id;
-  const keepId = nodeForPath(path.join(nested, 'keep.txt')).node.id;
-  const goneId = nodeForPath(path.join(nested, 'gone.txt')).node.id;
-
-  fs.renameSync(folder, heldFolder);
-  fs.unlinkSync(path.join(heldFolder, 'B', 'gone.txt'));
-  fs.writeFileSync(path.join(heldFolder, 'B', 'new.txt'), 'new bytes\n');
-  fs.mkdirSync(folder);
-  fs.renameSync(path.join(heldFolder, 'B'), nested);
-  fs.rmdirSync(heldFolder);
-
-  reconcileWorkspaceTree(workspace.id);
-  const replacementFolder = nodeForPath(folder).node;
-  assert.notEqual(replacementFolder.id, oldFolderId);
-  assert.equal(nodeForPath(nested).node.id, nestedId);
-  assert.equal(nodeForPath(nested).node.parentId, replacementFolder.id);
-  assert.equal(nodeForPath(path.join(nested, 'keep.txt')).node.id, keepId);
-  const newNode = nodeForPath(path.join(nested, 'new.txt')).node;
-  assert.notEqual(newNode.id, goneId);
-  assert.equal(fs.readFileSync(path.join(nested, 'new.txt'), 'utf8'), 'new bytes\n');
-  const rows = listWorkspaceNodes(workspace.id, { includeTrashed: true });
-  assert.ok(rows.find((node) => node.id === goneId).trashedAt);
-  assert.equal(rows.find((node) => node.id === nestedId).trashedAt, null);
-  assert.equal(rows.find((node) => node.id === keepId).trashedAt, null);
-});
-
-test('ambiguous hardlink names hold a parent replacement until one path wins', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'same-path-parent-hardlink-survivor',
-  );
-  const folder = path.join(root, 'A');
-  const heldFolder = path.join(root, 'held-A');
-  const file = path.join(folder, 'x.txt');
-  const alias = path.join(folder, 'y.txt');
-  const sibling = path.join(folder, 'z.txt');
-  fs.mkdirSync(folder, { recursive: true });
-  fs.writeFileSync(file, 'ambiguous child bytes\n');
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Same-path parent hardlink survivor',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const oldFolderId = nodeForPath(folder).node.id;
-  const fileId = nodeForPath(file).node.id;
-
-  fs.renameSync(folder, heldFolder);
-  fs.mkdirSync(folder);
-  fs.renameSync(path.join(heldFolder, 'x.txt'), file);
-  fs.linkSync(file, alias);
-  fs.writeFileSync(sibling, 'new sibling bytes\n');
-  fs.rmdirSync(heldFolder);
-
-  const ambiguous = reconcileWorkspaceTree(workspace.id);
-  assert.deepEqual(ambiguous.operations, []);
-  assert.ok(ambiguous.held.some((entry) => (
-    entry.nodeId === fileId
-    && entry.reason === 'ambiguous-physical-alias'
-  )));
-  assert.equal(nodeForPath(folder).node.id, oldFolderId);
-  assert.equal(nodeForPath(file).node.id, fileId);
-  assert.equal(nodeForPath(alias), null);
-  assert.equal(nodeForPath(sibling), null);
-
-  fs.unlinkSync(alias);
-  reconcileWorkspaceTree(workspace.id);
-  const replacementFolderId = nodeForPath(folder).node.id;
-  assert.notEqual(replacementFolderId, oldFolderId);
-  assert.equal(nodeForPath(file).node.id, fileId);
-  assert.equal(nodeForPath(alias), null);
-  assert.equal(nodeForPath(sibling).node.parentId, replacementFolderId);
-  assert.equal(fs.readFileSync(file, 'utf8'), 'ambiguous child bytes\n');
-  assert.equal(fs.readFileSync(sibling, 'utf8'), 'new sibling bytes\n');
-});
-
-test('restart finishes a prepared create cancellation before replanning', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'prepared-create-cancellation-restart',
-  );
-  const folder = path.join(root, 'A');
-  const movedFolder = path.join(root, 'C');
-  fs.mkdirSync(folder, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Prepared create cancellation restart',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const parentId = nodeForPath(folder).node.id;
-  const nodeId = uuidV7();
-  let parentMoved = false;
-  assert.throws(
-    () => commitTreeOperation({
-      kind: 'tree.create',
-      workspaceId: workspace.id,
-      nodeId,
-      parentId,
-      nodeKind: 'file',
-      name: 'recovered.txt',
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationCreatePrepared() {
-          if (parentMoved) return;
-          parentMoved = true;
-          fs.renameSync(folder, movedFolder);
-        },
-        afterOperationCreateCancellationStage() {
-          throw new Error('simulated crash during create cancellation');
-        },
-      },
-    }),
-    /simulated crash during create cancellation/,
-  );
-  fs.renameSync(movedFolder, folder);
-  recoverAllTreePlans();
-  const recovered = path.join(folder, 'recovered.txt');
-  assert.equal(fs.existsSync(recovered), true);
-  assert.equal(nodeForPath(recovered).node.id, nodeId);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('restart births a retained cancellation occupant before replacing its plan', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'prepared-create-retained-occupant',
-  );
-  const folder = path.join(root, 'A');
-  const movedFolder = path.join(root, 'C');
-  const target = path.join(movedFolder, 'recovered.txt');
-  fs.mkdirSync(folder, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Prepared create retained occupant',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const parentId = nodeForPath(folder).node.id;
-  const nodeId = uuidV7();
-  let parentMoved = false;
-  assert.throws(
-    () => commitTreeOperation({
-      kind: 'tree.create',
-      workspaceId: workspace.id,
-      nodeId,
-      parentId,
-      nodeKind: 'file',
-      name: 'recovered.txt',
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationCreatePrepared() {
-          if (parentMoved) return;
-          parentMoved = true;
-          fs.renameSync(folder, movedFolder);
-          fs.mkdirSync(target);
-          fs.writeFileSync(path.join(target, 'writer.txt'), 'retained writer bytes\n');
-        },
-        afterOperationCancellationOutputReceipt(outputs) {
-          assert.ok(outputs.some((output) => (
-            output.path === target
-            && output.provenance === 'independent-occupant'
-          )));
-          throw new Error('simulated crash after cancellation output receipt');
-        },
-      },
-    }),
-    /simulated crash after cancellation output receipt/,
-  );
-  const held = treeMaterialization.getOperation(
-    workspace.id,
-    openLocalDb().prepare(`
-      SELECT mutation_id AS mutationId
-      FROM workspace_tree_operation_materializations
-      WHERE resource_id = ?
-    `).get(workspace.id).mutationId,
-  );
-  assert.ok(held.plan.retainedOutputs.some((output) => output.path === target));
-  assert.equal(nodeForPath(target), null);
-
-  recoverAllTreePlans();
-
-  const writerPaths = fs.readdirSync(root, { recursive: true })
-    .map((entry) => path.join(root, String(entry)))
-    .filter((entry) => path.basename(entry) === 'writer.txt');
-  assert.equal(writerPaths.length, 1);
-  assert.equal(fs.readFileSync(writerPaths[0], 'utf8'), 'retained writer bytes\n');
-  const occupant = nodeForPath(path.dirname(writerPaths[0])).node;
-  assert.equal(occupant.kind, 'folder');
-  assert.notEqual(occupant.id, nodeId);
-  const superseded = listWorkspaceNodes(
-    workspace.id,
-    { includeTrashed: true },
-  ).find((node) => node.id === nodeId);
-  assert.equal(superseded.kind, 'file');
-  assert.ok(superseded.trashedAt);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('cancelled create receipts keep their UUID with the surviving carrier', () => {
-  for (const occupied of [false, true]) {
-    const root = path.join(
-      process.env.AMALGM_WORKSPACES_DIR,
-      `prepared-create-carrier-${occupied ? 'occupied' : 'open'}`,
-    );
-    const folder = path.join(root, 'A');
-    const movedFolder = path.join(root, 'C');
-    const target = path.join(movedFolder, 'recovered.txt');
-    fs.mkdirSync(folder, { recursive: true });
-    const workspace = upsertWorkspace({
-      path: root,
-      name: `Prepared create carrier ${occupied ? 'occupied' : 'open'}`,
-      source: 'computer',
-    });
-    enrollWorkspace(workspace.id);
-    const parentId = nodeForPath(folder).node.id;
-    const nodeId = uuidV7();
-    assert.throws(
-      () => commitTreeOperation({
-        kind: 'tree.create',
-        workspaceId: workspace.id,
-        nodeId,
-        parentId,
-        nodeKind: 'file',
-        name: 'recovered.txt',
-      }, {
-        role: 'owner',
-        testHooks: {
-          afterOperationCreatePrepared(_action, prepared) {
-            fs.writeFileSync(prepared, 'receipt-owned writer bytes\n');
-            fs.renameSync(folder, movedFolder);
-            if (occupied) {
-              fs.mkdirSync(target);
-              fs.writeFileSync(
-                path.join(target, 'independent.txt'),
-                'independent bytes\n',
-              );
-            }
-          },
-          afterOperationCancellationOutputReceipt() {
-            throw new Error('simulated crash after carried cancellation receipt');
-          },
-        },
-      }),
-      /simulated crash after carried cancellation receipt/,
-    );
-    const row = openLocalDb().prepare(`
-      SELECT mutation_id AS mutationId, plan_json AS planJson
-      FROM workspace_tree_operation_materializations
-      WHERE resource_id = ?
-    `).get(workspace.id);
-    const durablePlan = JSON.parse(row.planJson);
-    assert.equal(durablePlan.carriedCreates[0].nodeId, nodeId);
-    assert.equal(
-      durablePlan.carriedCreateDeletions?.some(
-        (binding) => binding.nodeId === nodeId,
-      ) || false,
-      false,
-    );
-
-    recoverAllTreePlans();
-
-    if (!occupied) {
-      assert.equal(fs.readFileSync(target, 'utf8'), 'receipt-owned writer bytes\n');
-      assert.equal(nodeForPath(target).node.id, nodeId);
-    } else {
-      const occupant = nodeForPath(target).node;
-      assert.equal(occupant.kind, 'folder');
-      assert.notEqual(occupant.id, nodeId);
-      const sidecar = fs.readdirSync(movedFolder).find((name) => (
-        name.startsWith('recovered.amalgm-retained-')
-        && name.endsWith('.txt')
-      ));
-      assert.ok(sidecar);
-      const sidecarPath = path.join(movedFolder, sidecar);
-      assert.equal(
-        fs.readFileSync(sidecarPath, 'utf8'),
-        'receipt-owned writer bytes\n',
-      );
-      assert.equal(nodeForPath(sidecarPath).node.id, nodeId);
-    }
-    assert.equal(treeMaterialization.getOperation(
-      workspace.id,
-      row.mutationId,
-    ), null);
-  }
-});
-
-test('prepared cleanup captures a same-path save after retained births', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'prepared-post-birth-save',
-  );
-  const folder = path.join(root, 'A');
-  const movedFolder = path.join(root, 'C');
-  const target = path.join(movedFolder, 'recovered.txt');
-  fs.mkdirSync(folder, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Prepared post-birth save',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const parentId = nodeForPath(folder).node.id;
-  const nodeId = uuidV7();
-  assert.throws(
-    () => commitTreeOperation({
-      kind: 'tree.create',
-      workspaceId: workspace.id,
-      nodeId,
-      parentId,
-      nodeKind: 'file',
-      name: 'recovered.txt',
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationCreatePrepared(_action, prepared) {
-          fs.writeFileSync(prepared, 'first retained bytes\n');
-          fs.renameSync(folder, movedFolder);
-        },
-        afterOperationCancellationOutputReceipt() {
-          throw new Error('simulated crash before retained birth');
-        },
-      },
-    }),
-    /simulated crash before retained birth/,
-  );
-
-  let replaced = false;
-  let crashedAfterSettle = false;
-  assert.throws(
-    () => recoverAllTreePlans({
-      testHooks: {
-        afterRetainedBindingReconcile(outputs) {
-          if (replaced) return;
-          const carried = outputs.find((output) => (
-            output.provenance === 'carried-source'
-            && output.ownerNodeId === nodeId
-          ));
-          assert.ok(carried);
-          const replacement = `${carried.path}.replacement`;
-          fs.writeFileSync(replacement, 'later same-path save\n');
-          fs.renameSync(replacement, carried.path);
-          replaced = true;
-        },
-        afterRetainedBindingSettle() {
-          if (crashedAfterSettle) return;
-          crashedAfterSettle = true;
-          throw new Error('simulated crash after retained binding settlement');
-        },
-      },
-    }),
-    /simulated crash after retained binding settlement/,
-  );
-  const retainedPlan = openLocalDb().prepare(`
-    SELECT plan_json AS planJson
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id);
-  assert.equal(JSON.parse(retainedPlan.planJson).retainedOutputsAdopted, true);
-
-  recoverAllTreePlans();
-
-  assert.equal(replaced, true);
-  assert.equal(fs.readFileSync(target, 'utf8'), 'later same-path save\n');
-  assert.equal(nodeForPath(target).node.id, nodeId);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-test('prepared cleanup durably replays a folder successor after settlement crash', () => {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    'prepared-folder-successor-crash',
-  );
-  const folder = path.join(root, 'A');
-  const movedFolder = path.join(root, 'C');
-  fs.mkdirSync(folder, { recursive: true });
-  const workspace = upsertWorkspace({
-    path: root,
-    name: 'Prepared folder successor crash',
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const parentId = nodeForPath(folder).node.id;
-  const nodeId = uuidV7();
-  assert.throws(
-    () => commitTreeOperation({
-      kind: 'tree.create',
-      workspaceId: workspace.id,
-      nodeId,
-      parentId,
-      nodeKind: 'folder',
-      name: 'recovered',
-    }, {
-      role: 'owner',
-      testHooks: {
-        afterOperationCreatePrepared(_action, prepared) {
-          fs.writeFileSync(path.join(prepared, 'original.txt'), 'original\n');
-          fs.renameSync(folder, movedFolder);
-        },
-        afterOperationCancellationOutputReceipt() {
-          throw new Error('simulated crash before retained folder birth');
-        },
-      },
-    }),
-    /simulated crash before retained folder birth/,
-  );
-
-  let originalPath = null;
-  let successorPath = null;
-  assert.throws(
-    () => recoverAllTreePlans({
-      testHooks: {
-        afterRetainedBindingReconcile(outputs) {
-          if (successorPath) return;
-          const carried = outputs.find((output) => (
-            output.provenance === 'carried-source'
-            && output.ownerNodeId === nodeId
-            && output.sourceRelativePath === ''
-            && output.identity.kind === 'folder'
-          ));
-          assert.ok(carried);
-          successorPath = carried.path;
-          originalPath = `${carried.path}-moved`;
-          fs.renameSync(carried.path, originalPath);
-          fs.mkdirSync(carried.path);
-          fs.writeFileSync(
-            path.join(carried.path, 'replacement.txt'),
-            'replacement\n',
-          );
-        },
-        afterRetainedBindingSettle() {
-          throw new Error('simulated crash after retained folder settlement');
-        },
-      },
-    }),
-    /simulated crash after retained folder settlement/,
-  );
-
-  assert.ok(openLocalDb().prepare(`
-    SELECT 1 AS present
-    FROM workspace_tree_operation_successors
-    WHERE resource_id = ?
-    LIMIT 1
-  `).get(workspace.id));
-  recoverAllTreePlans();
-
-  assert.equal(
-    fs.readFileSync(path.join(originalPath, 'original.txt'), 'utf8'),
-    'original\n',
-  );
-  assert.equal(
-    fs.readFileSync(path.join(successorPath, 'replacement.txt'), 'utf8'),
-    'replacement\n',
-  );
-  assert.equal(nodeForPath(originalPath).node.id, nodeId);
-  assert.notEqual(nodeForPath(successorPath).node.id, nodeId);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_successors
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM workspace_tree_operation_materializations
-    WHERE resource_id = ?
-  `).get(workspace.id).count, 0);
-});
-
-function relocatedCreatedParentFixture(label) {
-  const root = path.join(
-    process.env.AMALGM_WORKSPACES_DIR,
-    label,
-  );
-  const originalParent = path.join(root, 'P');
-  const relocatedParent = path.join(root, 'Q');
-  fs.mkdirSync(root);
-  const workspace = upsertWorkspace({
-    path: root,
-    name: label,
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const beforeNodes = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-  });
-  const parentId = uuidV7();
-  const childId = uuidV7();
-  const now = new Date().toISOString();
-  const parentNode = {
-    id: parentId,
-    workspaceId: workspace.id,
-    parentId: workspace.id,
-    kind: 'folder',
-    name: 'P',
-    symlinkTarget: null,
-    trashedAt: null,
-    purgedAt: null,
-    createdAt: now,
-    updatedAt: now,
-  };
-  const childNode = {
-    id: childId,
-    workspaceId: workspace.id,
-    parentId,
-    kind: 'file',
-    name: 'child.txt',
-    symlinkTarget: null,
-    trashedAt: null,
-    purgedAt: null,
-    createdAt: now,
-    updatedAt: now,
-  };
-  const rootIdentity = treeMaterialization.identity(root, { deep: false });
-  const mutationId = `mut_${label.replaceAll('-', '_')}`;
-  const plan = {
-    contract: 'workspace-tree-operation-materialization@1',
-    resourceId: workspace.id,
-    mutationId,
-    channelId: `resource:${workspace.id}`,
-    version: 1,
-    authorityEpoch: 1,
-    rootPath: root,
-    rootIdentity,
-    controlRoots: [],
-    rollbackBindings: [],
-    operation: {
-      kind: 'tree.create',
-      workspaceId: workspace.id,
-      nodeId: parentId,
-      parentId: workspace.id,
-      nodeKind: 'folder',
-      name: 'P',
-      createdAt: now,
-    },
-    beforeNodes,
-    afterNodes: [...beforeNodes, parentNode, childNode],
-    officialAfterNodes: null,
-    actions: [
-      {
-        type: 'create',
-        nodeId: parentId,
-        target: originalParent,
-        targetParentNodeId: workspace.id,
-        targetParentIdentity: rootIdentity,
-        kind: 'folder',
-        symlinkTarget: null,
-      },
-      {
-        type: 'create',
-        nodeId: childId,
-        target: path.join(originalParent, 'child.txt'),
-        targetParentNodeId: parentId,
-        targetParentIdentity: null,
-        kind: 'file',
-        symlinkTarget: null,
-      },
-    ],
-    event: {
-      resource: `workspace-tree:${workspace.id}`,
-      op: 'update',
-      id: parentId,
-      patch: {},
-      sharedResourceId: workspace.id,
-      source: 'workspace-tree:test',
-    },
-    sourceRaceCaptured: true,
-  };
-  return {
-    childId,
-    mutationId,
-    originalParent,
-    parentId,
-    plan,
-    relocatedParent,
-    workspace,
-  };
-}
-
-function createdSiblingFilesFixture(label) {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, label);
-  const firstPath = path.join(root, 'first.txt');
-  const triggerPath = path.join(root, 'trigger.txt');
-  fs.mkdirSync(root);
-  const workspace = upsertWorkspace({
-    path: root,
-    name: label,
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const beforeNodes = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-  });
-  const firstId = uuidV7();
-  const triggerId = uuidV7();
-  const now = new Date().toISOString();
-  const node = (id, name) => ({
-    id,
-    workspaceId: workspace.id,
-    parentId: workspace.id,
-    kind: 'file',
-    name,
-    symlinkTarget: null,
-    trashedAt: null,
-    purgedAt: null,
-    createdAt: now,
-    updatedAt: now,
-  });
-  const rootIdentity = treeMaterialization.identity(root, { deep: false });
-  const mutationId = `mut_${label.replaceAll('-', '_')}`;
-  return {
-    firstId,
-    firstPath,
-    mutationId,
-    plan: {
-      contract: 'workspace-tree-operation-materialization@1',
-      resourceId: workspace.id,
-      mutationId,
-      channelId: `resource:${workspace.id}`,
-      version: 1,
-      authorityEpoch: 1,
-      rootPath: root,
-      rootIdentity,
-      controlRoots: [],
-      rollbackBindings: [],
-      operation: {
-        kind: 'tree.create',
-        workspaceId: workspace.id,
-        nodeId: firstId,
-        parentId: workspace.id,
-        nodeKind: 'file',
-        name: 'first.txt',
-        createdAt: now,
-      },
-      beforeNodes,
-      afterNodes: [
-        ...beforeNodes,
-        node(firstId, 'first.txt'),
-        node(triggerId, 'trigger.txt'),
-      ],
-      officialAfterNodes: null,
-      actions: [
-        {
-          type: 'create',
-          nodeId: firstId,
-          target: firstPath,
-          targetParentNodeId: workspace.id,
-          targetParentIdentity: rootIdentity,
-          kind: 'file',
-          symlinkTarget: null,
-        },
-        {
-          type: 'create',
-          nodeId: triggerId,
-          target: triggerPath,
-          targetParentNodeId: workspace.id,
-          targetParentIdentity: rootIdentity,
-          kind: 'file',
-          symlinkTarget: null,
-        },
-      ],
-      event: {
-        resource: `workspace-tree:${workspace.id}`,
-        op: 'update',
-        id: firstId,
-        patch: {},
-        sharedResourceId: workspace.id,
-        source: 'workspace-tree:test',
-      },
-      sourceRaceCaptured: true,
-    },
-    root,
-    triggerId,
-    triggerPath,
-    workspace,
-  };
-}
-
-function multipleRelocatedParentsFixture(label, parentCount = 2) {
-  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, label);
-  fs.mkdirSync(root);
-  const workspace = upsertWorkspace({
-    path: root,
-    name: label,
-    source: 'computer',
-  });
-  enrollWorkspace(workspace.id);
-  const beforeNodes = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-  });
-  const parentIds = Array.from({ length: parentCount }, () => uuidV7());
-  const [firstId, secondId, thirdId = null] = parentIds;
-  const childId = uuidV7();
-  const now = new Date().toISOString();
-  const node = (id, parentId, kind, name) => ({
-    id,
-    workspaceId: workspace.id,
-    parentId,
-    kind,
-    name,
-    symlinkTarget: null,
-    trashedAt: null,
-    purgedAt: null,
-    createdAt: now,
-    updatedAt: now,
-  });
-  const rootIdentity = treeMaterialization.identity(root, { deep: false });
-  const mutationId = `mut_${label.replaceAll('-', '_')}`;
-  const target = (name) => path.join(root, name);
-  return {
-    childId,
-    firstId,
-    mutationId,
-    plan: {
-      contract: 'workspace-tree-operation-materialization@1',
-      resourceId: workspace.id,
-      mutationId,
-      channelId: `resource:${workspace.id}`,
-      version: 1,
-      authorityEpoch: 1,
-      rootPath: root,
-      rootIdentity,
-      controlRoots: [],
-      rollbackBindings: [],
-      operation: {
-        kind: 'tree.create',
-        workspaceId: workspace.id,
-        nodeId: firstId,
-        parentId: workspace.id,
-        nodeKind: 'folder',
-        name: 'P1',
-        createdAt: now,
-      },
-      beforeNodes,
-      afterNodes: [
-        ...beforeNodes,
-        ...parentIds.map((id, index) => (
-          node(id, workspace.id, 'folder', `P${index + 1}`)
-        )),
-        node(childId, secondId, 'file', 'child.txt'),
-      ],
-      officialAfterNodes: null,
-      actions: [
-        ...parentIds.map((id, index) => ({
-          type: 'create',
-          nodeId: id,
-          target: target(`P${index + 1}`),
-          targetParentNodeId: workspace.id,
-          targetParentIdentity: rootIdentity,
-          kind: 'folder',
-          symlinkTarget: null,
-        })),
-        {
-          type: 'create',
-          nodeId: childId,
-          target: path.join(target('P2'), 'child.txt'),
-          targetParentNodeId: secondId,
-          targetParentIdentity: null,
-          kind: 'file',
-          symlinkTarget: null,
-        },
-      ],
-      event: {
-        resource: `workspace-tree:${workspace.id}`,
-        op: 'update',
-        id: firstId,
-        patch: {},
-        sharedResourceId: workspace.id,
-        source: 'workspace-tree:test',
-      },
-      sourceRaceCaptured: true,
-    },
-    parentIds,
-    root,
-    secondId,
-    thirdId,
-    workspace,
-  };
-}
-
-test('restart finds a receipt-owned create that moved before parent validation', () => {
-  const {
-    childId,
-    mutationId,
-    originalParent,
-    parentId,
-    plan,
-    relocatedParent,
-    workspace,
-  } = relocatedCreatedParentFixture('relocated-create-before-validation');
-  let held = treeMaterialization.insertOperation(plan);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCreatePrepared(action) {
-        if (
-          action.nodeId === childId
-          && fs.existsSync(originalParent)
-        ) {
-          fs.renameSync(originalParent, relocatedParent);
-          throw new Error('simulated crash immediately after parent relocation');
-        }
-      },
-    }),
-    /simulated crash immediately after parent relocation/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.equal(held.plan.carriedCreates, undefined);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCarriedCreateCapture() {
-        throw new Error('recovery found relocated parent receipt');
-      },
-    }),
-    /recovery found relocated parent receipt/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.equal(held.plan.carriedCreates[0].nodeId, parentId);
-  assert.equal(held.plan.carriedCreates[0].path, relocatedParent);
-
-  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
-  projectStoredTreeOperation(held, openLocalDb());
-  held = treeMaterialization.markOperationCommitted(held);
-  finishTreeOperationPlan(held, openLocalDb());
-  assert.equal(nodeForPath(relocatedParent).node.id, parentId);
-  assert.equal(
-    nodeForPath(path.join(relocatedParent, 'child.txt')).node.id,
-    childId,
-  );
-});
-
-test('restart preserves deletion of a plan-created parent before child validation', () => {
-  const {
-    childId,
-    mutationId,
-    originalParent,
-    parentId,
-    plan,
-    workspace,
-  } = relocatedCreatedParentFixture('deleted-create-before-validation');
-  let held = treeMaterialization.insertOperation(plan);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCreatePrepared(action) {
-        if (
-          action.nodeId === childId
-          && fs.existsSync(originalParent)
-        ) {
-          fs.rmSync(originalParent, { recursive: true });
-          throw new Error('simulated crash immediately after parent deletion');
-        }
-      },
-    }),
-    /simulated crash immediately after parent deletion/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.equal(held.plan.carriedCreateDeletions, undefined);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCarriedCreateDeletionCapture() {
-        throw new Error('recovery captured deleted parent receipt');
-      },
-    }),
-    /recovery captured deleted parent receipt/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.equal(held.plan.carriedCreateDeletions[0].nodeId, parentId);
-
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterCarriedSuccessorBirth(operations) {
-        assert.deepEqual(
-          operations.map((operation) => operation.kind),
-          ['tree.trash'],
-        );
-        throw new Error('simulated crash after carried trash birth');
-      },
-    }),
-    /simulated crash after carried trash birth/,
-  );
-  const afterTrashBirth = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-    includeMissing: true,
-    includePurged: true,
-  });
-  assert.ok(
-    afterTrashBirth.find((node) => node.id === parentId)?.trashedAt,
-    JSON.stringify(afterTrashBirth),
-  );
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-      AND operation_kind = 'tree.trash'
-      AND json_extract(operation_json, '$.nodeId') = ?
-  `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
-  projectStoredTreeOperation(held, openLocalDb());
-  assert.equal(fs.existsSync(originalParent), false);
-  const nodes = listWorkspaceNodes(workspace.id, {
-    includeTrashed: true,
-  });
-  assert.ok(nodes.find((node) => node.id === parentId)?.trashedAt);
-  assert.ok(nodes.find((node) => node.id === childId)?.trashedAt);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-      AND operation_kind = 'tree.trash'
-      AND json_extract(operation_json, '$.nodeId') = ?
-  `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
-  held = treeMaterialization.markOperationCommitted(held);
-  finishTreeOperationPlan(held, openLocalDb());
-});
-
-test('restart gives a replacement of a plan-created folder a fresh UUID', () => {
-  const {
-    childId,
-    mutationId,
-    originalParent,
-    parentId,
-    plan,
-    workspace,
-  } = relocatedCreatedParentFixture('replaced-create-before-validation');
-  const replacementFile = path.join(originalParent, 'local.txt');
-  let held = treeMaterialization.insertOperation(plan);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCreatePrepared(action) {
-        if (
-          action.nodeId === childId
-          && fs.existsSync(originalParent)
-        ) {
-          fs.rmSync(originalParent, { recursive: true });
-          fs.mkdirSync(originalParent);
-          fs.writeFileSync(replacementFile, 'local replacement\n');
-          throw new Error('simulated crash after created-folder replacement');
-        }
-      },
-    }),
-    /simulated crash after created-folder replacement/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCarriedCreateDeletionCapture() {
-        throw new Error('recovery classified replaced created folder');
-      },
-    }),
-    /recovery classified replaced created folder/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
-  projectStoredTreeOperation(held, openLocalDb());
-
-  const replacement = nodeForPath(originalParent).node;
-  assert.notEqual(replacement.id, parentId);
-  assert.equal(fs.readFileSync(replacementFile, 'utf8'), 'local replacement\n');
-  assert.equal(nodeForPath(replacementFile).node.parentId, replacement.id);
-  const nodes = listWorkspaceNodes(workspace.id, { includeTrashed: true });
-  assert.ok(nodes.find((node) => node.id === parentId)?.trashedAt);
-  assert.ok(nodes.find((node) => node.id === childId)?.trashedAt);
-  held = treeMaterialization.markOperationCommitted(held);
-  finishTreeOperationPlan(held, openLocalDb());
-});
-
-test('restart keeps a same-path file successor on its plan-created UUID', () => {
-  const {
-    firstId,
-    firstPath,
-    mutationId,
-    plan,
-    root,
-    triggerId,
-    triggerPath,
-    workspace,
-  } = createdSiblingFilesFixture('replaced-created-file');
-  let held = treeMaterialization.insertOperation(plan);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCreatePrepared(action) {
-        if (action.nodeId === triggerId && fs.existsSync(firstPath)) {
-          const successor = path.join(root, 'successor.tmp');
-          fs.writeFileSync(successor, 'newer local bytes\n');
-          fs.renameSync(successor, firstPath);
-          throw new Error('simulated crash after created-file replacement');
-        }
-      },
-    }),
-    /simulated crash after created-file replacement/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCarriedCreateCapture(bindings) {
-        assert.equal(bindings.find((binding) => binding.nodeId === firstId)?.path, firstPath);
-        throw new Error('recovery captured same-path file successor');
-      },
-    }),
-    /recovery captured same-path file successor/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  const latestSuccessor = path.join(root, 'latest-successor.tmp');
-  fs.writeFileSync(latestSuccessor, 'latest local bytes\n');
-  fs.renameSync(latestSuccessor, firstPath);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterCarriedCreateRefresh(bindings) {
-        assert.equal(
-          bindings.find((binding) => binding.nodeId === firstId)?.identity.ino,
-          treeMaterialization.identity(firstPath, { deep: false }).ino,
-        );
-        throw new Error('simulated crash after carried file refresh');
-      },
-    }),
-    /simulated crash after carried file refresh/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
-  projectStoredTreeOperation(held, openLocalDb());
-
-  assert.equal(nodeForPath(firstPath).node.id, firstId);
-  assert.equal(nodeForPath(triggerPath).node.id, triggerId);
-  assert.equal(fs.readFileSync(firstPath, 'utf8'), 'latest local bytes\n');
-  assert.equal(docs.openDoc(firstPath).resource, `doc:${firstId}`);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-      AND json_extract(operation_json, '$.nodeId') = ?
-      AND operation_kind IN ('tree.create', 'tree.trash')
-  `).get(`workspace-tree:${workspace.id}`, firstId).count, 0);
-  held = treeMaterialization.markOperationCommitted(held);
-  finishTreeOperationPlan(held, openLocalDb());
-});
-
-test('multiple carried successors keep durable sequence IDs across path reordering', () => {
-  const {
-    childId,
-    firstId,
-    mutationId,
-    plan,
-    root,
-    secondId,
-    workspace,
-  } = multipleRelocatedParentsFixture('multiple-carried-successors');
-  const pathFor = (name) => path.join(root, name);
-  let held = treeMaterialization.insertOperation(plan);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCreatePrepared(action) {
-        if (
-          action.nodeId === childId
-          && fs.existsSync(pathFor('P1'))
-          && fs.existsSync(pathFor('P2'))
-        ) {
-          fs.renameSync(pathFor('P1'), pathFor('Q1'));
-          fs.renameSync(pathFor('P2'), pathFor('Q2'));
-        }
-      },
-      afterOperationCarriedCreateCapture(bindings) {
-        assert.equal(bindings.length, 2);
-        throw new Error('simulated crash after two carried creates');
-      },
-    }),
-    /simulated crash after two carried creates/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterCarriedSuccessorBirth(operations) {
-        assert.deepEqual(
-          operations.map((operation) => operation.kind),
-          ['tree.rename', 'tree.rename'],
-        );
-        throw new Error('simulated crash after two successor births');
-      },
-    }),
-    /simulated crash after two successor births/,
-  );
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ? AND operation_kind = 'tree.rename'
-  `).get(`workspace-tree:${workspace.id}`).count, 2);
-
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  fs.renameSync(pathFor('Q1'), pathFor('Z'));
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterCarriedSuccessorBirth(operations) {
-        assert.deepEqual(
-          operations.map((operation) => operation.name),
-          ['Q1', 'Q2', 'Z'],
-        );
-        throw new Error('simulated crash after reordered successor birth');
-      },
-    }),
-    /simulated crash after reordered successor birth/,
-  );
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ? AND operation_kind = 'tree.rename'
-  `).get(`workspace-tree:${workspace.id}`).count, 3);
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ?
-      AND operation_kind = 'tree.rename'
-      AND json_extract(operation_json, '$.nodeId') = ?
-  `).get(`workspace-tree:${workspace.id}`, secondId).count, 1);
-
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
-  projectStoredTreeOperation(held, openLocalDb());
-  assert.equal(nodeForPath(pathFor('Z')).node.id, firstId);
-  assert.equal(nodeForPath(pathFor('Q2')).node.id, secondId);
-  assert.equal(
-    nodeForPath(path.join(pathFor('Q2'), 'child.txt')).node.id,
-    childId,
-  );
-  held = treeMaterialization.markOperationCommitted(held);
-  finishTreeOperationPlan(held, openLocalDb());
-});
-
-test('a two-node carried path swap is planned durably before its births', () => {
-  const {
-    childId,
-    firstId,
-    mutationId,
-    plan,
-    root,
-    secondId,
-    workspace,
-  } = multipleRelocatedParentsFixture('two-node-carried-swap');
-  const pathFor = (name) => path.join(root, name);
-  let held = treeMaterialization.insertOperation(plan);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCreatePrepared(action) {
-        if (
-          action.nodeId === childId
-          && fs.existsSync(pathFor('P1'))
-          && fs.existsSync(pathFor('P2'))
-        ) {
-          fs.renameSync(pathFor('P1'), pathFor('swap.tmp'));
-          fs.renameSync(pathFor('P2'), pathFor('P1'));
-          fs.renameSync(pathFor('swap.tmp'), pathFor('P2'));
-        }
-      },
-      afterOperationCarriedCreateCapture(bindings) {
-        assert.equal(bindings.length, 2);
-        throw new Error('simulated crash after swapped creates were captured');
-      },
-    }),
-    /simulated crash after swapped creates were captured/,
-  );
-
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterCarriedSuccessorPlan(operations) {
-        assert.equal(operations.length, 4);
-        assert.equal(
-          operations.filter((operation) => (
-            operation.name?.startsWith('amalgm-relocation-')
-          )).length,
-          2,
-        );
-        assert.deepEqual(
-          operations.slice(-2).map((operation) => operation.name),
-          ['P1', 'P2'],
-        );
-        throw new Error('simulated crash after durable swap plan');
-      },
-    }),
-    /simulated crash after durable swap plan/,
-  );
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ? AND operation_kind = 'tree.rename'
-  `).get(`workspace-tree:${workspace.id}`).count, 0);
-
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
-  projectStoredTreeOperation(held, openLocalDb());
-  assert.equal(nodeForPath(pathFor('P1')).node.id, secondId);
-  assert.equal(nodeForPath(pathFor('P2')).node.id, firstId);
-  assert.equal(
-    nodeForPath(path.join(pathFor('P1'), 'child.txt')).node.id,
-    childId,
-  );
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ? AND operation_kind = 'tree.rename'
-  `).get(`workspace-tree:${workspace.id}`).count, 4);
-  held = treeMaterialization.markOperationCommitted(held);
-  finishTreeOperationPlan(held, openLocalDb());
-});
-
-test('a three-node carried path cycle converges as one durable permutation', () => {
-  const {
-    childId,
-    firstId,
-    mutationId,
-    plan,
-    root,
-    secondId,
-    thirdId,
-    workspace,
-  } = multipleRelocatedParentsFixture('three-node-carried-cycle', 3);
-  const pathFor = (name) => path.join(root, name);
-  let held = treeMaterialization.insertOperation(plan);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCreatePrepared(action) {
-        if (
-          action.nodeId === childId
-          && ['P1', 'P2', 'P3'].every((name) => fs.existsSync(pathFor(name)))
-        ) {
-          fs.renameSync(pathFor('P1'), pathFor('cycle.tmp'));
-          fs.renameSync(pathFor('P3'), pathFor('P1'));
-          fs.renameSync(pathFor('P2'), pathFor('P3'));
-          fs.renameSync(pathFor('cycle.tmp'), pathFor('P2'));
-        }
-      },
-      afterOperationCarriedCreateCapture(bindings) {
-        assert.equal(bindings.length, 3);
-        throw new Error('simulated crash after cyclic creates were captured');
-      },
-    }),
-    /simulated crash after cyclic creates were captured/,
-  );
-
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterCarriedSuccessorBirth(operations) {
-        assert.equal(operations.length, 6);
-        assert.equal(
-          operations.filter((operation) => (
-            operation.name?.startsWith('amalgm-relocation-')
-          )).length,
-          3,
-        );
-        throw new Error('simulated crash after cyclic successor births');
-      },
-    }),
-    /simulated crash after cyclic successor births/,
-  );
-
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  held = crossTreeOperationWithRaceCapture(held, openLocalDb());
-  projectStoredTreeOperation(held, openLocalDb());
-  assert.equal(nodeForPath(pathFor('P1')).node.id, thirdId);
-  assert.equal(nodeForPath(pathFor('P2')).node.id, firstId);
-  assert.equal(nodeForPath(pathFor('P3')).node.id, secondId);
-  assert.equal(
-    nodeForPath(path.join(pathFor('P3'), 'child.txt')).node.id,
-    childId,
-  );
-  assert.equal(openLocalDb().prepare(`
-    SELECT COUNT(*) AS count
-    FROM mutation_journal
-    WHERE local_resource = ? AND operation_kind = 'tree.rename'
-  `).get(`workspace-tree:${workspace.id}`).count, 6);
-  held = treeMaterialization.markOperationCommitted(held);
-  finishTreeOperationPlan(held, openLocalDb());
-});
-
-test('a relocated plan-created parent preserves its rename-then-delete successor chain', () => {
-  const {
-    childId,
-    mutationId,
-    originalParent,
-    parentId,
-    plan,
-    relocatedParent,
-    workspace,
-  } = relocatedCreatedParentFixture('relocated-created-parent');
-  let held = treeMaterialization.insertOperation(plan);
-  assert.throws(
-    () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-      afterOperationCreatePrepared(action) {
-        if (
-          action.nodeId === childId
-          && fs.existsSync(originalParent)
-        ) {
-          fs.renameSync(originalParent, relocatedParent);
-        }
-      },
-      afterOperationCarriedCreateCapture() {
-        throw new Error('simulated crash after carried create capture');
-      },
-    }),
-    /simulated crash after carried create capture/,
-  );
-  held = treeMaterialization.getOperation(workspace.id, mutationId);
-  assert.equal(held.plan.carriedCreates[0].nodeId, parentId);
-  assert.equal(fs.existsSync(relocatedParent), true);
-
-  const identity = require('../workspace/identity');
-  const previousUserId = identity.userId;
-  const memberId = 'member-relocated-created-parent';
-  openLocalDb().prepare(`
-    INSERT INTO workspace_node_permissions(workspace_id, node_id, user_id, role)
-    VALUES (?, ?, ?, 'viewer')
-  `).run(workspace.id, workspace.id, memberId);
-  identity.userId = () => memberId;
-  try {
-    const assertPermissionHeld = () => assert.throws(
-      () => crossTreeOperationWithRaceCapture(held, openLocalDb()),
-      (error) => (
-        error.code === 'WORKSPACE_TREE_RETRY_PENDING'
-        && error.reason === 'forbidden'
-        && error.statusCode === 409
-      ),
-    );
-    assertPermissionHeld();
-    held = treeMaterialization.getOperation(workspace.id, mutationId);
-    assert.equal(held.plan.permissionHold.reason, 'forbidden');
-    assert.equal(held.plan.permissionHold.operations.length, 1);
-    assert.equal(held.plan.permissionHold.operations[0].kind, 'tree.rename');
-    assert.equal(nodeForPath(relocatedParent).node.id, parentId);
-    assert.equal(openLocalDb().prepare(`
-      SELECT COUNT(*) AS count
-      FROM mutation_journal
-      WHERE local_resource = ?
-        AND operation_kind = 'tree.rename'
-        AND json_extract(operation_json, '$.nodeId') = ?
-    `).get(`workspace-tree:${workspace.id}`, parentId).count, 0);
-    assertPermissionHeld();
-    assert.equal(
-      treeMaterialization.listOperations(openLocalDb(), workspace.id).length,
-      1,
-      'permission denial keeps one durable recovery owner',
-    );
-
-    openLocalDb().prepare(`
-      UPDATE workspace_node_permissions SET role = 'editor'
-      WHERE workspace_id = ? AND node_id = ? AND user_id = ?
-    `).run(workspace.id, workspace.id, memberId);
-    assert.throws(
-      () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-        afterCarriedSuccessorBirth() {
-          throw new Error('simulated crash after carried successor birth');
-        },
-      }),
-      /simulated crash after carried successor birth/,
-    );
-    assert.equal(openLocalDb().prepare(`
-      SELECT COUNT(*) AS count
-      FROM mutation_journal
-      WHERE local_resource = ?
-        AND operation_kind = 'tree.rename'
-        AND json_extract(operation_json, '$.nodeId') = ?
-    `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
-
-    held = treeMaterialization.getOperation(workspace.id, mutationId);
-    fs.rmSync(relocatedParent, { recursive: true });
-    assert.throws(
-      () => crossTreeOperationWithRaceCapture(held, openLocalDb(), {
-        afterCarriedSuccessorBirth(operations) {
-          assert.deepEqual(
-            operations.map((operation) => operation.kind),
-            ['tree.rename', 'tree.trash'],
-          );
-          throw new Error('simulated crash after carried delete successor birth');
-        },
-      }),
-      /simulated crash after carried delete successor birth/,
-    );
-    held = treeMaterialization.getOperation(workspace.id, mutationId);
-    held = crossTreeOperationWithRaceCapture(held, openLocalDb());
-    projectStoredTreeOperation(held, openLocalDb());
-
-    assert.equal(fs.existsSync(originalParent), false);
-    assert.equal(fs.existsSync(relocatedParent), false);
-    const nodes = listWorkspaceNodes(workspace.id, {
-      includeTrashed: true,
-    });
-    assert.ok(nodes.find((node) => node.id === parentId)?.trashedAt);
-    assert.ok(nodes.find((node) => node.id === childId)?.trashedAt);
-    assert.equal(openLocalDb().prepare(`
-      SELECT COUNT(*) AS count
-      FROM mutation_journal
-      WHERE local_resource = ?
-        AND operation_kind = 'tree.rename'
-        AND json_extract(operation_json, '$.nodeId') = ?
-    `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
-    assert.equal(openLocalDb().prepare(`
-      SELECT COUNT(*) AS count
-      FROM mutation_journal
-      WHERE local_resource = ?
-        AND operation_kind = 'tree.trash'
-        AND json_extract(operation_json, '$.nodeId') = ?
-    `).get(`workspace-tree:${workspace.id}`, parentId).count, 1);
-
-    held = treeMaterialization.markOperationCommitted(held);
-    finishTreeOperationPlan(held, openLocalDb());
-  } finally {
-    identity.userId = previousUserId;
-  }
-});