@@ -161,6 +161,62 @@ async function rows(projectId: string) {
 }
 
 describe('Project file content against PostgreSQL and the local object store', () => {
+  check(
+    'folder tree copy hydrates destination paths once while preserving nested paths',
+    async () => {
+      const { copyFileItems } = await import('@/lib/workspace-files/application/copy-file-items')
+      const f = await fixture()
+      const root = await createProjectFileFolder.execute({
+        principal: f.principal,
+        input: { projectId: f.projectId, name: 'Root' },
+      })
+      await db.insert(folder).values(
+        Array.from({ length: 20 }, (_, index) => ({
+          id: generateId(),
+          projectId: f.projectId,
+          parentId: root.folder.id,
+          resourceType: 'file' as const,
+          name: `Child-${index}`,
+          userId: f.ownerId,
+        }))
+      )
+      const originalDebug = db.$client.options.debug
+      const queries: string[] = []
+      db.$client.options.debug = (_connection, query) => {
+        queries.push(query)
+      }
+      try {
+        const result = await copyFileItems.execute({
+          principal: f.principal,
+          input: {
+            source: {
+              owner: { entityType: 'project', entityId: f.projectId },
+              fileIds: [],
+              folderIds: [root.folder.id],
+            },
+            destination: {
+              owner: { entityType: 'workspace', entityId: f.workspaceId },
+              folderId: null,
+            },
+          },
+        })
+        expect(result.folders).toHaveLength(21)
+        const copiedRoot = result.folders.find((item) => item.parentId === null)
+        if (!copiedRoot) throw new Error('Copied root missing')
+        expect(result.folders.filter((item) => item.parentId === copiedRoot.id)).toHaveLength(20)
+        for (const item of result.folders.filter((item) => item.id !== copiedRoot.id))
+          expect(item.path).toBe(`${copiedRoot.path}/${item.name}`)
+        expect(
+          queries.filter((query) =>
+            query.startsWith('select "id", "name", "parent_id" from "folder"')
+          )
+        ).toHaveLength(0)
+      } finally {
+        db.$client.options.debug = originalDebug
+      }
+    }
+  )
+
   check(
     'copy selection ignores unrelated folders when the owner exceeds the selection limit',
     async () => {
 
@@ -679,11 +679,21 @@ export async function createWorkspaceFileFolder(
   return workspaceFolderRecord(folder)
 }
 
-/** Creates one folder under the caller's owner transaction and the shared hierarchy lock. */
+/** Creates one folder and hydrates its display path for single-item callers. */
 export async function createFileFolder<O extends EditableFileOwner>(
   params: CreateFileFolderParams<O>,
   tx: DbTransaction
 ): Promise<FileFolderRecord<O>> {
+  const inserted = await createFileFolderRow(params, tx)
+  const paths = buildWorkspaceFileFolderPathMap(await selectFileFolderPathRows(params.owner, tx))
+  return mapFileFolder(inserted, params.owner, paths)
+}
+
+/** Uses canonical folder validation and locking without rebuilding paths during a bulk mutation. */
+export async function createFileFolderRow<O extends EditableFileOwner>(
+  params: CreateFileFolderParams<O>,
+  tx: DbTransaction
+): Promise<typeof folderTable.$inferSelect> {
   const requestedName = normalizeWorkspaceFileItemName(params.name, 'Folder')
   await acquireFileFolderMutationLock(tx, params.owner)
   const parentId = await assertFileFolderTarget(params.owner, params.parentId, tx)
@@ -745,8 +755,7 @@ export async function createFileFolder<O extends EditableFileOwner>(
     if (getPostgresErrorCode(error) === '23505') throw new WorkspaceFileFolderConflictError(name)
     throw error
   }
-  const paths = buildWorkspaceFileFolderPathMap(await selectFileFolderPathRows(params.owner, tx))
-  return mapFileFolder(inserted, params.owner, paths)
+  return inserted
 }
 
 /**
 
@@ -63,6 +63,7 @@ const mockProvenance =
 import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
 import { downloadWorkspaceFileItems } from '@/lib/workspace-files/application/download-workspace-file-items'
 import { MAX_ZIP_DOWNLOAD_BYTES } from '@/lib/workspace-files/limits'
+import { recheckFileReadReceipt } from '@/lib/workspace-files/read-receipt'
 
 const { mockResolveVerifiedUserAccessControlContext: mockAccessContext } =
   permissionGroupsResolveMockFns
@@ -111,6 +112,7 @@ function file(id: string, name: string, folderId: string | null = null, size = 1
 describe('downloadWorkspaceFileItems', () => {
   beforeEach(() => {
     events.length = 0
+    vi.mocked(recheckFileReadReceipt).mockResolvedValue({ status: 'exact', entries: [] })
     mockLoadContext.mockImplementation(async () => {
       events.push('resolve')
       return workspace
@@ -318,6 +320,19 @@ describe('downloadWorkspaceFileItems', () => {
     ).rejects.toMatchObject({ code: 'validation' })
   })
 
+  it('refuses refreshed unsafe provenance even after initial admission succeeds', async () => {
+    vi.mocked(recheckFileReadReceipt).mockResolvedValue({ status: 'unknown' })
+    await expect(
+      observeContentDelivery(secretFreeGate, () =>
+        downloadWorkspaceFileItems.execute({
+          principal: delegatedPrincipal,
+          input: { workspaceId: 'ws-1', fileIds: ['f1'], folderIds: [] },
+        })
+      )
+    ).rejects.toMatchObject({ code: 'forbidden' })
+    expect(recheckFileReadReceipt).toHaveBeenCalled()
+  })
+
   it('rejects an unknown folder in a mixed selection', async () => {
     await expect(
       downloadWorkspaceFileItems.execute({
 
@@ -6,6 +6,7 @@ import {
   ContentRefusedError,
   capabilityGovernedPrincipalUserId,
 } from '@/lib/core/application'
+import { requireAdmittedContent } from '@/lib/core/application/content-delivery'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { assertWorkspaceCapability } from '@/lib/permission-groups/capability-assertions'
@@ -16,6 +17,7 @@ import {
   loadWorkspaceFileOperationContext,
   type WorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace'
+import { mergeWorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/file-secret-provenance'
 import { docNotReadyMessage, isDocNotReadyError } from '@/lib/uploads/utils/doc-not-ready'
 import {
   formatFileSize,
@@ -245,12 +247,20 @@ async function executeDownloadWorkspaceFileItems({
       }))
     )
   )
-  await db.transaction(
+  const provenance = await db.transaction(
     async (tx) => {
-      for (const receipt of receipts) await recheckFileReadReceipt(tx, receipt)
+      const evidence = []
+      for (const receipt of receipts) evidence.push(await recheckFileReadReceipt(tx, receipt))
+      return mergeWorkspaceFileSecretProvenance(...evidence)
     },
     { isolationLevel: 'repeatable read', accessMode: 'read only' }
   )
+  await requireAdmittedContent(principal, {
+    kind: 'workspace-file',
+    id: context.workspaceId,
+    provenance,
+    view: 'opaque',
+  })
   const included = new Set(filesToZip.map((file) => file.id))
   return {
     excludedFileIds: selectedFiles.filter((file) => !included.has(file.id)).map((file) => file.id),
 
@@ -5,7 +5,7 @@ import type { DbTransaction } from '@/lib/db/types'
 import {
   assertFileFolderTarget,
   buildWorkspaceFileFolderPathMap,
-  createFileFolder,
+  createFileFolderRow,
   listFileFolders,
 } from '@/lib/uploads/contexts/workspace/file-folder-manager'
 import {
@@ -171,12 +171,11 @@ export async function commitFileCopyInTx(
   const targetFolderId = await assertFileFolderTarget(destination.owner, destination.folderId, tx)
   const pending = new Map(snapshot.folders.map((row) => [row.id, row]))
   const mapped = new Map<string, string>()
-  const folders: CopiedFileItems['folders'] = []
   while (pending.size) {
     let progressed = false
     for (const [id, source] of pending) {
       if (source.parentId && pending.has(source.parentId)) continue
-      const created = await createFileFolder(
+      const created = await createFileFolderRow(
         {
           owner: destination.owner,
           userId,
@@ -188,7 +187,6 @@ export async function commitFileCopyInTx(
         },
         tx
       )
-      folders.push(created)
       mapped.set(id, created.id)
       pending.delete(id)
       progressed = true
@@ -216,11 +214,15 @@ export async function commitFileCopyInTx(
       })
     )
   }
-  const paths = buildWorkspaceFileFolderPathMap(
-    await listFileFolders(destination.owner, undefined, tx)
-  )
+  const destinationFolders = await listFileFolders(destination.owner, undefined, tx)
+  const paths = buildWorkspaceFileFolderPathMap(destinationFolders)
+  const folderById = new Map(destinationFolders.map((folder) => [folder.id, folder]))
   return {
     files: createdFiles.map((file) => mapFileRecord(file, destination.owner, paths)),
-    folders,
+    folders: [...mapped.values()].map((id) => {
+      const folder = folderById.get(id)
+      if (!folder) throw new Error('Copied folder is missing from the destination')
+      return folder
+    }),
   }
 }