fix(remote-changes): recover file moves across outcome commit gaps

[Quaternion8192]

Change type

• fix — backward-compatible correction

Summary

A remote file move could commit the native rename and item revision, lose its original batch-outcome commit, then become a spurious StaleRemoteRevision conflict on unchanged replay (MirrorPulse CF-007). Persist versioned original batch/entry, policy, store/root, native object/placeholder, item-state, journal, and ancestor evidence before rename. Replay authenticates that preparation before ordinary revision checks and completes the original outcome without renaming or hydrating again, including equal-revision and case-only operations.

Use the inspected object handle for non-replacing native rename, retain directory guards through namespace/projection work, and commit path/revision plus projected evidence together. Original outcome/progress and evidence cleanup commit atomically. Uncertain objects, local work, ancestry, or storage retain a retryable entry and its evidence instead of inventing a user conflict. Pending feed observations require reconciliation and are never acknowledged as uploads by recovery.

The official SQLite provider upgrades schemas 0–6 to schema 7, preserving repository data and rejecting older runtimes. Public guidance covers policy matching, cancellation, ambiguous commits, cursor/conflict semantics, custom-store contracts, and conservative legacy behavior.

Verification

• One logical fix with implementation, regression tests, and documentation.
• Release solution build: zero warnings/errors.
• 26 native file-move regressions: zero failures/skips on local Windows ARM64. Includes ordinary/case-only moves, equal revisions, preparation/projection/outcome faults, late commit exceptions, repeated recovery faults, multi-entry prefixes, cancellation, changed/replaced evidence, and preserved local dirty/journal state. Provider reads remain zero; target guards reject duplicate native rename and enumeration verifies case.
• 41 focused official-SQLite migration, rollback/reopen, and feed-fence checks.
• 8 native SDK ABI/handle checks, including FILE_RENAME_INFO offsets and parent/object guards.
• Formatting, public API baseline, supported platform matrix, and trim/Native AOT boundaries for win-x64 and win-arm64.
• Full required Release suite: 618 passed, zero failures/skips (44 native, 204 managed, 278 integration, 76 SQLite, 16 sample-provider tests).
• No credentials, draft notes, generated outputs, dependency changes, or unrelated files are included.

Supported scope and remaining evidence

This fixes file moves submitted in the original remote batch. Directory missing-outcome recovery and historical preview.5 gaps without original proof remain outside this fix; existing conflicts are preserved for review. Before projected evidence exists, a rename that clears in-sync under TrackAll remains conservatively unresolved; PreserveForSyncEngine permits earlier-window recovery. Recovery preserves the current in-sync state and does not clear later content or journal work.

The local native evidence is ARM64 under the existing user. x64/ARM64 CI, fresh ordinary-user execution, real process termination/power loss, execution-role rotation, and adversarial write/access races are not inferred from injected in-process commit failures. Simultaneous SDK owners are outside the supported owner model. No package publication or product Adapter cursor completion is claimed.